What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2023-08-09 compared with 2023-05-10 · 72 added, 45 removed, 730 unchanged (14% of the section changed)

11 unchanged sentences

• Prolonged economic uncertainties or downturns could adversely affect our business.

• Actions that we are taking to restructure our business in alignment with our strategic priorities may not be as effective as anticipated.

• Real or perceived failures, errors or defects in our solutions could adversely affect our brand and reputation, which could have an adverse effect on our business and results of operations.

74 unchanged sentences

We have posted a net loss in each year since inception, including net losses of $124.7 million, $146.3 million and $98.8 million in the years ended December 31, 2022, 2021 and 2020, respectively.

As of March 31, 2023, we had an accumulated deficit of $886.7 million.

As of June 30, 2023, we had an accumulated deficit of $953.4 million.

While we have experienced significant revenue growth in recent periods, we may not obtain a high enough volume of sales of our products and professional services to sustain or increase our growth or achieve or maintain profitability in the future.

17 unchanged sentences

For example, due to economic volatility as a result of the continued impact of the ongoing COVID-19 pandemic, inflationary pressures and other global events, we have and may continue to see delays in our sales cycle, failures of customers to renew at all or to renew the anticipated scope their subscriptions with us, requests from customers for payment term deferrals as well as pricing or bundling concessions, which, if significant, could materially and adversely affect our business, results of operations and financial condition.

To the extent purchases of our offerings are perceived by customers and potential customers to be discretionary, our revenues may be disproportionately affected by delays or reductions in general information technology spending.

To the extent purchases of our offerings are perceived by customers and potential customers to be discretionary, our revenues may be disproportionately affected by delays

or reductions in general information technology spending.

Also, customers may choose to develop in-house software as an alternative to using our offerings.

Moreover, competitors may respond to market conditions by lowering prices and attempting

to lure away our customers.

Moreover, competitors may respond to market conditions by lowering prices and attempting to lure away our customers.

In addition, the increased pace of consolidation in certain industries may result in reduced overall spending on our offerings.

3 unchanged sentences

Macroeconomic events and conditions, such as those discussed above, may also have the effect of heightening many of the other risks described in this “Risk Factors” section, including risks associated with our guidance, our customers, our potential customers, our market opportunity, renewals and sales cycle, among others.

Actions that we are taking to restructure our business in alignment with our strategic priorities may not be as effective as anticipated.

In August of 2023, our Board approved a plan designed to improve operational efficiencies, reduce operating costs and better align the Company’s workforce with current business needs, top strategic priorities, and key growth opportunities (the “Restructuring Plan”).

The Restructuring Plan includes the reduction of our workforce by approximately 18%.

We may encounter challenges in the execution of these restructuring efforts and our reduction in force that could prevent us from recognizing the intended benefits of the Restructuring Plan or otherwise adversely affect our business, results of operations and financial condition.

As a result of the Restructuring Plan, we have incurred and may continue to incur additional costs in the short-term, including cash expenditures for employee transition, notice period and severance payments, employee benefits, and related facilitation costs as well as non-cash expenditures related to acceleration of vesting of share-based awards.

These additional cash and non-cash expenditures could have the effect of reducing our operating margins.

Our Restructuring Plan may result in other unintended consequences, including employee attrition beyond our intended reduction in force, which may also be further exacerbated by the actual or perceived declining value of our equity awards;

damage to our corporate culture and decreased employee morale among our remaining employees, including as a result of reduced employee perks;

diversion of management attention;

damage to our reputation as an employer, which could make it more difficult for us to hire new employees in the future;

and the loss of institutional knowledge and expertise of departing employees.

If we experience any of these adverse consequences, our Restructuring Plan may not achieve or sustain its intended benefits, or the benefits, even if achieved, may not be adequate to meet our long-term profitability and operational expectations, which could adversely affect our business, results of operations and financial condition.

In connection with the Restructuring Plan, we plan to permanently close certain office locations.

This will result in an impairment loss of approximately $4 million that will be recorded during 2023 as the exit activities are finalized in each location.

While we believe the assumptions used in determining whether there was impairment and the amount of any resulting impairment were reasonable and commensurate with the views of a market participant, changes in key assumptions in the future, including increasing the discount rate, lowering forecasts for revenue and operating margin, or lowering the long-term growth rate, could result in additional charges;

similarly, one or more changes in these assumptions in future periods due to changes in circumstances could result in future impairments in this reporting unit or other reporting units.

In addition, our Restructuring Plan could lead us to fail to meet, or cause delays in meeting, our operational and growth targets.

While positions have been eliminated, functions that they performed remain necessary to our operations, and we may be unsuccessful in effectively and efficiently distributing the duties and obligations of departed employees among our remaining employees.

The Restructuring Plan could also prevent us from pursuing new opportunities and initiatives or require us to adjust our growth strategy.

As we continue to identify areas of cost savings and operating efficiencies, we may consider implementing further measures to reduce operating costs and improve operating margins.

We may not be successful in implementing such initiatives, including as a result of factors beyond our control.

If we are unable to realize the anticipated savings and efficiencies from our Restructuring Plan and/or accomplish our business and strategic initiatives, our business, results of operations and financial condition could be materially and adversely affected.

Our business and growth depend substantially on customers renewing and expanding their subscriptions with us.

61 unchanged sentences

In addition, in recent years, recruiting, hiring and retaining employees with expertise in the cybersecurity industry has become increasingly difficult as the demand for cybersecurity professionals has increased as a result of the recent cybersecurity attacks on global corporations and governments.

We face intense competition for these employees from numerous technology, software and other companies, especially in certain geographic areas in which we operate, and we cannot ensure that we will be able to attract, motivate and/or retain sufficient qualified employees in the future particularly in tight labor markets.

sufficient qualified employees in the future particularly in tight labor markets.

If we are unable to attract new employees and retain our current employees, we may not be able to adequately develop and maintain new products or professional services or market our existing products or professional services at the same levels as our competitors and we may, therefore, lose customers and market share.

27 unchanged sentences

We market and sell our products and professional services throughout the world and have personnel in many parts of the world.

For each of the three months ended March 31, 2023 and 2022, operations located outside of North America generated 21% of our revenue.

For the six months ended June 30, 2023 and 2022, operations located outside of North America generated 21% and 18%, respectively, of our revenue.

Our growth strategy is dependent, in part, on our continued international expansion.

22 unchanged sentences

Our business, including the sales of our products and professional services by us and our channel partners, may be subject to foreign governmental regulations, which vary substantially from country to country and change from time to time.

or the failure by our channel partners, to comply with these regulations could adversely affect our business.

Our failure, or the failure by our channel partners, to comply with these regulations could adversely affect our business.

Further, in many foreign countries it is common for others to engage in business practices that are prohibited by our internal policies and procedures or U.S.

4 unchanged sentences

While our business and operations have not been significantly impacted, it is not possible to predict the broader or longer-term consequences of this crisis.

Consequences of the crisis could include further sanctions, embargoes, regional instability, geopolitical shifts and adverse effects on macroeconomic conditions, security conditions, currency exchange rates and financial markets.

There can be no assurance that the Russia-Ukraine war, including any resulting sanctions, export controls or other restrictive actions, will not have a material adverse impact on our future operations and results.

26 unchanged sentences

For example, on March 14, 2023, we acquired Minerva Labs Ltd., a leading provider of anti-evasion and ransomware prevention technology.

The integration of Minerva and any other acquisition may prove to be difficult due to the necessity of coordinating geographically separate organizations and integrating personnel with disparate business backgrounds and accustomed to different corporate cultures and business operations and internal systems.

The integration of Minerva and any other

acquisition may prove to be difficult due to the necessity of coordinating geographically separate organizations and integrating personnel with disparate business backgrounds and accustomed to different corporate cultures and business operations and internal systems.

We may need to implement or improve controls, procedures, and policies at a business that prior to the acquisition may have lacked sufficiently effective controls, procedures and policies.

20 unchanged sentences

We anticipate that we will continue to rely on these partners in order to help facilitate sales of our offerings as part of larger purchases in the United States and to grow our business internationally.

For the years ended December 31, 2022, 2021 and 2020, we derived approximately 57%, 52%, and 47%, respectively, of our revenue from sales of products and professional services through channel partners, and the percentage of

revenue derived from channel partners may increase in future periods.

Our agreements with our channel partners are non-exclusive and do not prohibit them from working with our competitors or offering competing solutions, and some of our channel partners may have more established relationships with our competitors.

32 unchanged sentences

If these third parties no longer allow us to integrate with their APIs, or if we determine not to maintain these integrations, the functionality of our products may be reduced and our products may not be as marketable to certain potential customers.

Technology alliance partnerships require significant coordination between the parties involved, particularly if a partner requires that we integrate its products with our products.

Technology alliance partnerships require significant coordination between the parties

involved, particularly if a partner requires that we integrate its products with our products.

Further, we have invested and will continue to invest significant time, money and resources to establish and maintain relationships with our technology alliance partners, but we have no assurance that any particular relationship will continue for any specific period of time, result in new offerings that we can effectively commercialize or result in enhancements to our existing offerings.

25 unchanged sentences

dollar and we generate a majority of our revenue in U.S.

However, three months ended March 31, 2023 and 2022 we incurred 17% and 19%, respectively, of our expenses outside of the United States in foreign currencies, primarily the British pound sterling and euro, principally with respect to salaries and related personnel expenses associated with our sales and research and development operations.

Additionally, for three months ended March 31, 2023 and 2022, 11% and 10%, respectively, of our revenue was generated in foreign currencies.

However, for the six months ended June 30, 2023 and 2022 we incurred 17% and 18%, respectively, of our expenses outside of the United States in

foreign currencies, primarily the British pound sterling and euro, principally with respect to salaries and related personnel expenses associated with our sales and research and development operations.

Additionally, for the six months ended June 30, 2023 and 2022, 11% and 10%, respectively, of our revenue was generated in foreign currencies.

Accordingly, changes in exchange rates may have an adverse effect on our business, operating results and financial condition.

25 unchanged sentences

From time to time, legal action by us may be necessary to enforce our patents and other intellectual property rights, to protect our trade secrets, to determine the validity and scope of the intellectual property rights of others or to defend against claims of infringement or invalidity.

Such litigation could result in substantial costs and diversion of resources and could result in

impairment or loss of portions of our intellectual property.

Such litigation could result in substantial costs and diversion of resources and could result in impairment or loss of portions of our intellectual property.

Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims and countersuits attacking the validity and enforceability of our intellectual property rights.

5 unchanged sentences

Many of these companies have the capability to dedicate substantially greater resources to enforce their intellectual property rights.

Third parties have in the past and may in the future assert claims of infringement, misappropriation or other violations of intellectual property rights against us and we are currently involved in legal proceedings with Finjan, Inc., which has filed a complaint against us and our wholly-owned subsidiary, Rapid7 LLC, in the United States District Court, District of Delaware, alleging patent infringement.

Third parties have in the past and may in the future

assert claims of infringement, misappropriation or other violations of intellectual property rights against us.

Third parties may also assert claims against our customers or channel partners, whom we typically indemnify against claims that our solutions infringe, misappropriate or otherwise violate the intellectual property rights of third parties.

26 unchanged sentences

Disclosing the source code of our proprietary software could also make it easier for cyber attackers and other third parties to discover vulnerabilities in or to defeat the protections of our products, which could result in our products failing to provide our customers with the security they expect.

Likewise, some open source projects have known security and other vulnerabilities and architecture instabilities, or are otherwise subject to security attacks due to their wide availability, and are provided on an “as-is” basis.

Likewise, some open source projects have known security and other vulnerabilities and architecture instabilities, or are

otherwise subject to security attacks due to their wide availability, and are provided on an “as-is” basis.

Any of these events could have a material adverse effect on our business, operating results and financial condition.

30 unchanged sentences

federal, state, local and sales taxes in the United States and foreign income taxes, withholding taxes and transaction taxes in numerous foreign jurisdictions.

We generally conduct our international operations through wholly-owned subsidiaries and report our taxable income in various jurisdictions worldwide based upon our business operations in those jurisdictions.

We generally conduct our international operations through wholly-owned subsidiaries and report our taxable income in various jurisdictions worldwide based upon our business operations in those

jurisdictions.

Our intercompany relationships are and will continue to be subject to complex transfer pricing regulations administered by taxing authorities in various jurisdictions.

21 unchanged sentences

Errors or defects may be more likely when a product is first introduced or as new versions are released, or when we introduce an acquired company's products.

We have experienced these errors or defects in the past in connection with new products, acquired products and product upgrades and we expect that these

errors or defects will be found from time to time in the future in new, acquired or enhanced products after commercial release.

We have experienced these errors or defects in the past in connection with new products, acquired products and product upgrades and we expect that these errors or defects will be found from time to time in the future in new, acquired or enhanced products after commercial release.

Defects may cause our products to be vulnerable to attacks, cause them to fail to detect vulnerabilities or threats, or temporarily interrupt customers’ networking traffic.

31 unchanged sentences

Similarly, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our information technology systems (including our products) or the third-party information technology systems that support us and our services.

Such attacks may also include exploitation of vulnerabilities in third party or open source software code that may be incorporated into our own or our customers’ or supplier’s systems, such as the vulnerability in the Java logging library known as “log4j” identified in late 2021 that affected many in our industry.

Such attacks may also include exploitation of vulnerabilities in third party or open source

software code that may be incorporated into our own or our customers’ or supplier’s systems, such as the vulnerability in the Java logging library known as “log4j” identified in late 2021 that affected many in our industry.

Further, if our systems or those of our third-party service providers are breached as a result of third-party action, employee error or misconduct, attackers could learn critical information about how our products operate to help protect our customers’ IT infrastructures from cyber risk, thereby making our customers more vulnerable to cyber attacks.

15 unchanged sentences

Because our products collect and store user and related information, domestic and international privacy and cybersecurity concerns, and other laws and regulations, could have a material adverse effect on our business.

of issues including data privacy and cybersecurity, and restrictions or technological requirements regarding the collection, use, storage, protection, retention or transfer of data.

We, and our customers, are subject to a number of stringent and changing obligations in domestic and international laws, regulations, guidance, industry standards, external and internal policies and contracts and other obligations that address a range of issues including data privacy and cybersecurity, and restrictions or technological requirements regarding the collection, use, storage, protection, retention or transfer of data.

The regulatory framework for online services, data privacy and cybersecurity issues worldwide can vary substantially from jurisdiction to jurisdiction, is rapidly evolving and is likely to remain uncertain for the foreseeable future.

4 unchanged sentences

Moreover, despite our efforts, our personnel or third parties upon whom we rely may fail to comply with such obligations.

If we (or third parties upon whom we rely) fail, or are perceived to have failed, to address and comply with data privacy and security obligations, we could face significant consequences.

If we (or third parties upon whom we rely) fail, or are perceived to have failed, to address and comply with data privacy and security

obligations, we could face significant consequences.

These consequences may include but are not limited to:

35 unchanged sentences

For example, the “Standard Contractual Clauses” (“SCCs”) that are designed to be a valid mechanism by which parties can transfer personal data out of Europe to jurisdictions that are not found to provide an adequate level of protection, must be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country.

Specifically,

the parties to the cross-border personal data transfer must evaluate the importing jurisdiction’s laws and implement supplemental security measures as necessary to protect the at-issue personal data.

Specifically, the parties to the cross-border personal data transfer must evaluate the importing jurisdiction’s laws and implement supplemental security measures as necessary to protect the at-issue personal data.

It is likely that there will continue to be some uncertainty regarding the mechanisms by which parties transfer personal data out of Europe to jurisdictions such as the United States.

4 unchanged sentences

The costs of compliance with, and other burdens imposed by, the laws, rules, regulations and policies that are applicable to the businesses of our customers may limit the use and adoption of, and reduce the overall demand for, our software.

Privacy or cybersecurity concerns, whether valid or not valid, may inhibit market adoption of our products particularly in certain industries and foreign countries.

cybersecurity concerns, whether valid or not valid, may inhibit market adoption of our products particularly in certain industries and foreign countries.

Further, there are active legislative discussions regarding the implementation of laws or regulations that could restrict the manner in which security research is conducted and that could restrict or possibly bar the conduct of penetration testing and the use of exploits, which are an essential component of our Metasploit product and our business strategy more generally.

6 unchanged sentences

The market price of our common stock may be highly volatile and may fluctuate substantially as a result of a variety of factors, some of which are related in complex ways.

Since shares of our common stock were sold in our initial public offering (“IPO”), in July 2015 at a price of $16.00 per share, our stock price has ranged from an intraday low of $9.05 to an intraday high of $145.00 through April 30, 2023.

Factors that may affect the market price of our common stock include:

48 unchanged sentences

Further, the indentures governing the Notes do not restrict our ability to incur additional indebtedness, secure existing or future debt, recapitalize our existing or future debt or take a number of other actions that could intensify the risks discussed above and below.

Further, we and our subsidiaries may incur substantial additional indebtedness in the future, subject to the restrictions contained in our revolving credit facility and any future debt instruments existing at the time, some of which may be secured

indebtedness.

While our revolving credit facility restricts our ability to incur additional indebtedness, if our revolving credit facility is terminated, we may not be subject to such restriction under the terms of such indebtedness.

2 unchanged sentences

In addition, any required repurchase of the Notes for cash as a result of a fundamental change or voluntary redemption (in each case, pursuant to the terms of the Notes) would lower our current cash on hand such that we would not have that cash available to fund operations.

If we are unable to generate sufficient cash flow, we may be required to adopt one or more alternatives, such as selling assets, restructuring our debt or obtaining additional equity capital on terms that may be onerous or highly dilutive.

If we are unable to generate sufficient cash flow, we may be required to adopt one or more alternatives, such as

selling assets, restructuring our debt or obtaining additional equity capital on terms that may be onerous or highly dilutive.

Our ability to refinance our indebtedness will depend on the capital markets and our financial condition at such time.

11 unchanged sentences

During this period an immaterial principal amount of the 2025 Notes were requested for conversion and settled in cash.

As of March 31, 2023, the 2025 Notes and the 2027 Notes were not convertible at the option of the holder.

Whether the Notes will be convertible following the fiscal quarter ending March 31, 2023, will depend on the future satisfaction of a conversion condition.

As of June 30, 2023, the 2025 Notes and the 2027 Notes were not convertible at the option of the holder.

Whether the Notes will be convertible following the fiscal quarter ending June 30, 2023, will depend on the future satisfaction of a conversion condition.

In addition, even if holders of Notes do not elect to convert their Notes, we could be required under applicable accounting rules to reclassify all or a portion of the outstanding principal of the Notes as a current rather than long-term liability, which would result in a material reduction of our net working capital.

6 unchanged sentences

We redeemed the 2023 Notes in November 2021.

As described elsewhere in this Quarterly Report on Form 10-Q, the 2023 Capped Calls were not redeemed with the redemption of the 2023 Notes.

As described elsewhere in this Quarterly Report on Form 10-Q, the 2023 Capped Calls were not redeemed with the redemption of the 2023 Notes but were cash-settled via written notice provided to the counterparties on May 31, 2023;

see the section entitled “Capped Calls” under Note 10 to our consolidated financial statements and “Management's Discussion and Analysis of Financial Condition and Results of Operations” included elsewhere in this report for information regarding our cash settlement of the 2023 Capped Calls.

We cannot make any prediction as to the direction or magnitude of any potential effect that the transactions described above may have on the prices of the Notes or the shares of our common stock.

4 unchanged sentences

Recent global economic conditions have resulted in the actual or perceived failure or financial difficulties of many financial institutions.

If an option counterparty becomes subject to insolvency proceedings, we will become an unsecured creditor in those proceedings with a claim equal to our exposure at the time under such transaction.

option counterparty becomes subject to insolvency proceedings, we will become an unsecured creditor in those proceedings with a claim equal to our exposure at the time under such transaction.

Our exposure will depend on many factors but, generally, our exposure will increase if the market price or the volatility of our common stock increases.

3 unchanged sentences

The conversion of some or all of the Notes will dilute the ownership interests of existing stockholders to the extent we deliver shares of our common stock upon conversion of any of the Notes.

As disclosed in Note 10, Debt , as of March 31, 2023 the Notes were not convertible at the option of the holder.

As disclosed in Note 10, Debt , as of June 30, 2023 the Notes were not convertible at the option of the holder.

Any sales in the public market of the common stock issuable upon such conversion could adversely affect prevailing market prices of our common stock.

18 unchanged sentences

Climate-related events, including the increasing frequency of extreme weather events and their impact on critical infrastructure in the United States and elsewhere, have the potential to disrupt our business, our third-party suppliers, and/or the business of our customers, and may cause us to experience higher attrition, losses and additional costs to maintain and resume operations.

Transitional climate change risks that result from a shift to a low-carbon economy may subject us to increased regulations, reporting requirements, standards, or expectations regarding

the environmental impacts of our business and untimely or inaccurate disclosure could adversely affect our reputation, business or financial performance.

Transitional climate change risks that result from a shift to a low-carbon economy may subject us to increased regulations, reporting requirements, standards, or expectations regarding the environmental impacts of our business and untimely or inaccurate disclosure could adversely affect our reputation, business or financial performance.

All of the aforementioned risks may be exacerbated if our disaster recovery plans or the disaster recovery plans established for our third-party data centers and hosting providers prove to be inadequate.

25 unchanged sentences

For example, on March 10, 2023, Silicon Valley Bank (“SVB”), was placed into receivership with the Federal Deposit Insurance Corporation (“FDIC”) which resulted in all funds held at SVB being temporarily inaccessible by SVB’s customers.

Any delay in our ability to access our cash, cash equivalents and investments (or the loss of some or all of such funds) could

have a material adverse effect on our operations and cause us to need to seek additional capital sooner than planned and at a higher cost.

Although we expect that current cash and cash equivalent balances and cash flows that are generated from operations will be sufficient to meet our domestic and international working capital needs and other capital and liquidity requirements for at least the next 12 months, if we are unable to obtain adequate financing or financing on terms satisfactory to us if and when we require it, our ability to continue to support our business growth and to respond to business challenges could be significantly impaired, and our business may be adversely affected.

Any delay in our ability to access our cash, cash equivalents and investments (or the loss of some or all of such funds) could have a material adverse effect on our operations and cause us to need to seek additional capital sooner than planned and at a higher cost.

require it, our ability to continue to support our business growth and to respond to business challenges could be significantly impaired, and our business may be adversely affected.

Anti-takeover provisions in our charter documents, our indenture and under Delaware law could make acquiring us more difficult, limit attempts by our stockholders to replace or remove our current management and limit the market price of our common stock.

16 unchanged sentences

Our amended and restated certificate of incorporation designates the Court of Chancery of the State of Delaware as the exclusive forum for certain litigation that may be initiated by our stockholders, which could limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us.

officers or other employees to us or our stockholders, (3) any action asserting a claim arising pursuant to any provision of the Delaware General Corporation Law, our amended and restated certificate of incorporation or our amended and restated bylaws or (4) any action asserting a claim governed by the internal affairs doctrine.

Our amended and restated certificate of incorporation further provides that any person or entity purchasing or otherwise acquiring any interest in shares of our common stock is deemed to have notice of and consented to the foregoing provision.

Pursuant to our amended and restated certificate of incorporation, unless we consent in writing to the selection of an alternative forum, the Court of Chancery of the State of Delaware is the sole and exclusive forum for (1) any derivative action or proceeding brought on our behalf, (2) any action asserting a claim of breach of a fiduciary duty owed by any of our directors, officers or other employees to us or our stockholders, (3) any action asserting a claim arising pursuant to any provision of the Delaware General Corporation Law, our amended and restated certificate of incorporation or our amended and restated bylaws or (4) any action asserting a claim governed by the internal affairs doctrine.

Our amended and restated certificate of incorporation further provides that any person or entity purchasing or otherwise acquiring any interest in shares of our common

stock is deemed to have notice of and consented to the foregoing provision.

The forum selection clause in our amended and restated certificate of incorporation may limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us.

8 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors