What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2024-02-26 compared with 2023-02-24 · 206 added, 130 removed, 611 unchanged (35% of the section changed)

7 unchanged sentences

Please also see “ Special Note Regarding Forward-Looking Statements.

Risks Related to Our Business and Industry

Our quarterly operating results may vary from period to period, which could result in our failure to meet expectations with respect to operating results and cause the trading price of our stock to decline.

Our operating results, including the levels of our revenue, annualized recurring revenue (“ARR”), cash flow, deferred revenue and gross margins, have historically varied from period to period, and we expect that they will continue to do so as a result of a number of factors, many of which are outside of our control, including:

• the level of demand for our products and professional services;

• the level of demand for our products and service offerings;

• customer renewal rates and ability to attract new customers;

• the extent to which customers purchase additional products or professional services;

• the mix of our products, as well as professional services, sold during a period;

• the extent to which customers purchase additional products or service offerings;

• the mix of our products, as well as service offerings, sold during a period;

• the ability to successfully grow our sales of our cloud-based solutions, including through the shift to a consolidated platform sales approach;

2 unchanged sentences

• changes in the growth rate of the markets in which we compete;

• sales of our products and professional services due to seasonality and customer demand;

• the timing and success of new product or service introductions by us or our competitors or any other changes in the competitive landscape of our industry, including consolidation among our competitors;

• sales of our products and service offerings due to seasonality and customer demand;

• the introduction or adoption of new technologies that compete with our offerings;

• decisions by potential customers to purchase cybersecurity products or professional services from other vendors;

• decisions by potential customers to purchase cybersecurity products or service offerings from other vendors;

• the amount and timing of operating costs and capital expenditures related to the operations and expansion of our business;

• price competition;

• our ability to successfully manage and integrate any acquired businesses, including IntSights Cyber Intelligence Ltd.

(“IntSights”), and including without limitation, the amount and timing of expenses and potential future charges for impairment of goodwill from acquired companies;

• business disruptions in regions affecting our operations, stemming from actual, imminent or perceived outbreak or reemergence of contagious disease, including the COVID-19 pandemic;

• our ability to increase, retain and incentivize the channel partners that market and sell our products and professional services;

• our ability to successfully manage and integrate any acquired businesses, including without limitation, the amount and timing of expenses and potential future charges for impairment of goodwill from acquired companies;

• business disruptions in regions affecting our operations, stemming from actual, imminent or perceived outbreak or reemergence of contagious disease;

• our ability to increase, retain and incentivize the channel partners that market and sell our products and service offerings;

• our continued international expansion and associated exposure to changes in foreign currency exchange rates;

3 unchanged sentences

• the strength of regional, national and global economies;

• the impact of climate change, natural disasters or manmade problems, including terrorism or war (such as the Russia- Ukraine war);

Ta ble of Contents

• the impact of climate change, natural disasters or manmade problems, including terrorism or war (such as the Russia- Ukraine war and the Israel-Hamas conflict);

• future accounting pronouncements or changes in our accounting policies or practices.

26 unchanged sentences

You should not rely on our prior quarterly or annual periods performance as any indication of our future growth.

Ta ble of Contents

We have not been profitable historically and may not achieve or maintain profitability in the future.

We have posted a net loss in each year since inception, including net losses of $149.3 million, $124.7 million and $146.3 million in the years ended December 31, 2023, 2022 and 2021, respectively.

As of December 31, 2022, we had an accumulated deficit of $860.7 million.

While we have experienced significant revenue growth in recent periods, we may not obtain a high enough volume of sales of our products and professional services to sustain or increase our growth or achieve or maintain profitability in the future.

As of December 31, 2023, we had an accumulated deficit of $1.0 billion.

While we have experienced significant revenue growth in recent periods, we may not obtain a high enough volume of sales of our products and service offerings to sustain or increase our growth or achieve or maintain profitability in the future.

We also expect our costs to increase in future periods, which could negatively affect our future operating results if our revenue does not increase.

11 unchanged sentences

Prolonged economic uncertainties or downturns could adversely affect our business operations or financial results.

Negative conditions in the general economy in either the United States or abroad, including conditions resulting from financial and credit market fluctuations, changes in economic policy, inflation, foreign currency exchange rate fluctuations, trade uncertainty, including changes in tariffs, sanctions, international treaties, and other trade restrictions, the occurrence of a natural disaster, outbreaks of epidemics or pandemics such as COVID-19, political unrest and social strife, including acts of terrorism, armed conflicts, such as the one between Russia and Ukraine, have caused and could continue to cause a decrease in corporate spending on security offerings or information technology in general and negatively affect the rate of growth of our business.

Negative conditions in the general economy in either the United States or abroad, including conditions resulting from financial and credit market fluctuations, changes in economic policy, inflation, foreign currency exchange rate fluctuations, trade uncertainty, including changes in tariffs, sanctions, international treaties, and other trade restrictions, the occurrence of a natural disaster, outbreaks of epidemics or pandemics such as COVID-19, political unrest and social strife, including acts of terrorism, armed conflicts, such as the one between Russia and Ukraine and the Israel-Hamas conflict, have caused and could continue to cause a decrease in corporate spending on security offerings or information technology in general and negatively affect the rate of growth of our business.

Our customer base spans a variety of industries, including the business services, energy, financial services, healthcare and pharmaceuticals, technology, manufacturing, media and entertainment, online services, retail, telecommunications and travel and transportation industries.

1 unchanged sentence

As a result, our current or prospective customers in these industries may delay or cancel information technology projects or seek to lower their costs by renegotiating vendor contracts.

For example, due to economic volatility as a result of the continued impact of the ongoing COVID-19 pandemic, inflationary pressures and other global events, we have and may continue to see delays in our sales cycle, failures of customers to renew at all or to renew the anticipated scope their subscriptions with us, requests from customers for payment term deferrals as well as pricing or bundling concessions, which, if significant, could materially and adversely affect our business, results of operations and financial condition.

For example, due to economic volatility as a result of inflationary pressures and other global events, we have and may continue to see delays in our sales cycle, failures of customers to renew at all or to renew the anticipated scope their subscriptions with us, requests from customers for payment term deferrals as well as pricing or bundling concessions, which, if significant, could materially and adversely affect our business, results of operations and financial condition.

To the extent purchases of our offerings are perceived by customers and potential customers to be discretionary, our revenues may be disproportionately affected by delays or reductions in general information technology spending.

4 unchanged sentences

We cannot predict the timing, strength or duration of any economic slowdown, instability or recovery, generally or within any particular industry or geography.

Although we expect that our current cash and cash equivalent balances, including the proceeds of our convertible senior notes offering in March 2021, together with cash flows that are generated from operations and availability under our revolving credit facility, will be sufficient to meet our domestic and international working capital needs and other capital and liquidity requirements for at least the next 12 months, if the economic conditions of the general economy or industries in which we operate worsen from present levels, our business operations and financial results could be adversely affected.

Although we expect that our current cash and cash equivalent balances, including the proceeds of our offering of convertible senior notes in September 2023, together with cash flows that are generated from operations and availability under our revolving credit facility, will be sufficient to meet our domestic and international working capital needs and other capital and liquidity requirements for at least the next 12 months, if the economic conditions of the general economy or industries in which we operate worsen from present levels, our business operations and financial results could be adversely affected.

Ta ble of Contents

Macroeconomic events and conditions, such as those discussed above, may also have the effect of heightening many of the other risks described in this “Risk Factors” section, including risks associated with our guidance, our customers, our potential customers, our market opportunity, renewals and sales cycle, among others.

Actions that we are taking to restructure our business in alignment with our strategic priorities may not be as effective as anticipated.

In August of 2023, our Board approved the Restructuring Plan designed to improve operational efficiencies, reduce operating costs and better align the Company’s workforce with current business needs, top strategic priorities, and key growth opportunities.

The Restructuring Plan included the reduction of our workforce by approximately 16%.

We may encounter challenges as a result of these restructuring efforts and our reduction in force that could prevent us from recognizing the intended benefits of the Restructuring Plan or otherwise adversely affect our business, results of operations and financial condition.

As of February 26, 2024, the execution of the Restructuring Plan has been substantially completed.

As a result of the Restructuring Plan, we have incurred and may continue to incur additional costs in the short-term, including cash expenditures for employee transition, notice period and severance payments, employee benefits, and related facilitation costs as well as non-cash expenditures related to acceleration of vesting of share-based awards.

These additional cash and non-cash expenditures could have the effect of reducing our operating margins.

Our Restructuring Plan may result in other unintended consequences, including employee attrition beyond our intended reduction in force, which may also be further exacerbated by the actual or perceived declining value of our equity awards;

damage to our corporate culture and decreased employee morale among our remaining employees;

diversion of management attention;

damage to our reputation as an employer, which could make it more difficult for us to hire new employees in the future;

and the loss of institutional knowledge and expertise of departing employees.

If we experience any of these adverse consequences, our Restructuring Plan may not achieve or sustain its intended benefits, or the benefits, even if achieved, may not be adequate to meet our long-term profitability and operational expectations, which could adversely affect our business, results of operations and financial condition.

In connection with the Restructuring Plan, we permanently closed certain idle office spaces in Plano, Texas, Los Angeles, California and Toronto, Canada, which resulted in an impairment loss of $3.6 million recorded in 2023.

Refer to Note 12, Leases , and Note 19, Restructuring , in the Notes to our Consolidated Financial Statements for further details regarding the impairment of long-lived assets.

While we believe the assumptions used in determining whether there was impairment and the amount of any resulting impairment were reasonable and commensurate with the views of a market participant, changes in key assumptions in the future, including increasing the discount rate, lowering forecasts for revenue and operating margin, or lowering the long-term growth rate, could result in additional charges;

similarly, one or more changes in these assumptions in future periods due to changes in circumstances could result in future impairments in this reporting unit or other reporting units.

In addition, our Restructuring Plan could lead us to fail to meet, or cause delays in meeting, our operational and growth targets.

While positions have been eliminated, functions that they performed remain necessary to our operations, and we may be unsuccessful in effectively and efficiently distributing the duties and obligations of departed employees among our remaining employees.

The Restructuring Plan could also prevent us from pursuing new opportunities and initiatives or require us to adjust our growth strategy.

As we continue to identify areas of cost savings and operating efficiencies, we may consider implementing further measures to reduce operating costs and improve operating margins.

We may not be successful in implementing such initiatives, including as a result of factors beyond our control.

If we are unable to realize the anticipated savings and efficiencies from our Restructuring Plan and/or accomplish our business and strategic initiatives, our business, results of operations and financial condition could be materially and adversely affected.

Refer to Note 19, Restructuring , in the Notes to our Consolidated Financial Statements for further details regarding the Restructuring Plan.

Our business and growth depend substantially on customers renewing and expanding their subscriptions with us.

3 unchanged sentences

Our customers have no obligation to renew their subscriptions with us and we may not be able to accurately predict customer renewal rates.

Our customers’ renewal rates may decline or fluctuate as a result of a number of factors, including their satisfaction or dissatisfaction with our new or current product offerings, our pricing, the effects of economic conditions, including due to a global economic slowdown, inflation, foreign currency exchange rate fluctuation, the Russia-Ukraine war and the global economic uncertainty and financial market conditions caused by the COVID-19 pandemic, competitive offerings, our customers' perception of their exposure, or alterations or reductions in their spending levels.

Our customers’ renewal rates may decline or fluctuate as a result of a number of factors, including their satisfaction or dissatisfaction with our new or current product offerings, our pricing, the effects of economic conditions, including due to a global economic slowdown, inflation, foreign currency exchange rate fluctuation, the Russia-Ukraine war, the Israel-Hamas conflict and any global economic uncertainty and financial market disruptions, competitive offerings, our customers' perception of their exposure, or alterations or reductions in their spending levels.

If our customers do not renew their agreements with us or renew on terms less favorable to us, our revenues and results of operations may be adversely impacted.

Ta ble of Contents

Our future growth is also affected by our ability to sell additional offerings to our existing customers, which depends on a number of factors, including customers’ satisfaction with our products and services and general economic conditions.

1 unchanged sentence

If our new and existing product offerings and product enhancements do not achieve sufficient market acceptance, our financial results and competitive position will suffer.

Our business substantially depends on, and we expect our business to continue to substantially depend on, sales of our Insight Platform solutions.

As such, market acceptance of our Insight Platform is critical to our continued success.

Demand for Insight Platform solutions are affected by a number of factors beyond our control, including continued market acceptance of cloud-based offerings, the timing of development and release of new products by our competitors, technological change, and growth or contraction in our market and the economy in general.

If we are unable to continue to meet customer demands or to achieve more widespread market acceptance of our Insight Platform solutions, including through evolution of our sales model to a consolidated platform sales approach, our business operations, financial results and growth prospects will be materially and adversely affected.

Our business substantially depends on, and we expect our business to continue to substantially depend on, sales of our platform solutions.

As such, market acceptance of our platform solutions is critical to our continued success.

Demand for platform solutions are affected by a number of factors beyond our control, including continued market acceptance of cloud-based offerings, the timing of development and release of new products by our competitors, technological change, and growth or contraction in our market and the economy in general.

If we are unable to continue to meet customer demands or to achieve more widespread market acceptance of our platform solutions, including through evolution of our sales model to a consolidated platform sales approach, our business operations, financial results and growth prospects will be materially and adversely affected.

We spend substantial amounts of time and money to research and develop or acquire new offerings and enhanced versions of our existing offerings to incorporate additional features, improve functionality or other enhancements in order to meet our customers’ rapidly evolving demands.

2 unchanged sentences

Therefore, when we develop or acquire new or enhanced offerings, their introduction must achieve high levels of market acceptance in order to justify the amount of our investment in developing and bringing them to market.

For example, if our recent product expansions and offerings, such as our Cloud Security and Threat Intelligence offerings, do not garner widespread market adoption and implementation, or our consolidated platform sales approach is not successful, our financial results and competitive position could suffer.

For example, if our recent product expansions and offerings, such as our consolidation offerings, do not garner widespread market adoption and implementation, or our consolidated platform sales approach is not successful, our financial results and competitive position could suffer.

Further, we may make changes to our offerings that our customers do not like, find useful or agree with.

12 unchanged sentences

The adverse effect on our financial results may be particularly acute because of the significant research, development, marketing, sales and other expenses we will have incurred in connection with the new offerings or enhancements.

Ta ble of Contents

We face intense competition in our market, which could adversely affect our business, financial condition, and results of operations.

2 unchanged sentences

With the introduction of new technologies and market entrants, we expect the competitive environment to remain intense going forward.

Our primary competitors in XDR and SIEM include CrowdStrike, Exabeam, LogRhythm, Microsoft, and Splunk;

in Cloud Security include Orca Security, Palo Alto Networks, and Wiz;

in Vulnerability Risk Management include Qualys and Tenable;

in Application Security include IBM and Micro Focus;

in Threat Intelligence include Digital Shadows and Recorded Future and finally, while the competition in our professional services business is diverse, our competitors include Crowdstrike, Mandiant (Google), and SecureWorks.

The markets we operate in are highly competitive, fragmented, and subject to technology change and innovation.

We primarily compete with established and emerging security product vendors, including the large companies that incorporate security products into their products;

XDR and SIEM vendors;

cloud security vendors;

vulnerability risk management vendors;

application security vendors;

threat intelligence vendors;

and legacy security, systems management, MSSP, and other IT vendors.

Some of our actual and potential competitors have advantages over us, such as longer operating histories, significantly greater financial, technical, marketing or other resources, stronger brand and business user recognition, larger and more mature intellectual property portfolios and broader global distribution and presence.

4 unchanged sentences

With the introduction of new technologies, the evolution of our offerings and new market entrants, we expect competition to intensify in the future.

Conditions in our market could change rapidly and significantly as a result of technological advancements, including with respect to AI.

Our competitors may more successfully incorporate AI into their products, gain or leverage superior access to certain AI technologies, and achieve higher market acceptance of their AI solutions.

For further discussion of the risks related to AI, please see below under “Risks Related to Intellectual Property, Litigation and Government Regulation”.

In addition, some of our larger competitors have substantially broader product offerings and can bundle competing products and services with other software offerings.

13 unchanged sentences

In addition, in recent years, recruiting, hiring and retaining employees with expertise in the cybersecurity industry has become increasingly difficult as the demand for cybersecurity professionals has increased as a result of the recent cybersecurity attacks on global corporations and governments.

We face intense competition for these employees from numerous technology, software and other companies, especially in

certain geographic areas in which we operate, and we cannot ensure that we will be able to attract, motivate and/or retain sufficient qualified employees in the future particularly in tight labor markets.

If we are unable to attract new employees and retain our current employees, we may not be able to adequately develop and maintain new products or professional services or market our existing products or professional services at the same levels as our competitors and we may, therefore, lose customers and market share.

We face intense competition for these employees from numerous technology, software and other companies, especially in certain geographic areas in which we operate, and we cannot ensure that we will be able to attract, motivate and/or retain sufficient qualified employees in the future particularly in tight labor markets.

In addition, the change by us and other companies to offer a remote or hybrid work environment may increase the competition for such employees from employers outside of our traditional office locations.

Our workforce has evolved to a hybrid-first model following the COVID-19 pandemic, which requires regular in-office attendance but utilizes a hybrid approach.

While we intend to continue iterating our

Ta ble of Contents

approach to ensure we are balancing the needs of the business with the desires of our people, we may face difficulty in hiring and retaining our workforce as a result of this shift to have greater in-office attendance.

If we are unable to attract new employees and retain our current employees, we may not be able to adequately develop and maintain new products or service offerings or market our existing products or service offerings at the same levels as our competitors and we may, therefore, lose customers and market share.

Our failure to attract and retain personnel, especially those in sales and marketing and research and development positions for which we have historically had a high turnover rate, could have an adverse effect on our ability to execute our business objectives and, as a result, our ability to compete could decrease, our operating results could suffer and our revenue could decrease.

4 unchanged sentences

Any failure to preserve our culture could negatively affect our future success, including our ability to attract, motivate and retain personnel and effectively focus on and pursue our business strategy.

Our hybrid working model and use of service providers with remote working arrangements also subjects us to heightened operational risks.

For example, technologies in our employees’ and service providers’ homes when they are working remotely may not be as robust as in our offices and could cause the networks, information systems, applications, and other tools available to employees and service providers to be more limited or less reliable than in our offices.

Further, the security systems in place at our employees’ and service providers’ homes may be less secure than those used in our offices, and while we have implemented technical and administrative safeguards to help protect our systems as our employees and service providers work from home, we may be subject to increased cybersecurity risk, which could expose us to risks of data or financial loss, and could disrupt our business operations.

There is no guarantee that the data security and privacy safeguards we have put in place will be completely effective or that we will not encounter risks associated with employees and service providers accessing company data and systems remotely.

Our sales cycle may be unpredictable.

3 unchanged sentences

In addition, we might devote substantial time and effort to a particular unsuccessful sales effort, and as a result, we could lose other sales opportunities or incur expenses that are not offset by an increase in revenue, which could harm our business.

To date, we have derived a significant amount of our revenue from customers using our vulnerability management offerings.

If we are unable to renew or increase sales of our vulnerability management offerings, or if we are unable to increase sales of our other offerings, our business and operating results could be adversely affected.

Although we continue to introduce and acquire new products and professional services, we derive and expect to continue to derive a significant amount of our revenue from customers using certain of our vulnerability management offerings (“VM”), InsightVM, Nexpose and Metasploit.

Approximately half of our revenue was attributable to InsightVM, Nexpose and Metasploit for the year ended December 31, 2022.

As a result, our operating results could suffer due to:

• any decline in demand for our vulnerability management offerings;

• failure of our vulnerability management offerings to detect vulnerabilities in our customers’ IT environments;

• the introduction of products and technologies that serve as a replacement or substitute for, or represent an improvement over, our vulnerability management offerings;

• technological innovations or new standards that our vulnerability management offerings do not address;

• sensitivity to current or future prices offered by us or competing solutions;

• our inability to release enhanced versions of our vulnerability management offerings on a timely basis in response to the dynamic threat landscape;

• a decline in overall IT spending due to inflation, weakness or deterioration in global macroeconomic and market conditions and foreign currency exchange rate pressure.

Our inability to renew or increase sales of our vulnerability management offerings, including cloud-based subscriptions, content subscriptions, managed services and content and maintenance and support subscriptions, or a decline in prices of our vulnerability management offerings would harm our business and operating results more seriously than if we derived significant revenues from a variety of offerings.

In addition, while we have introduced several non-VM subscription products, including InsightAppSec, InsightConnect, InsightCloudSec and Threat Intelligence, these products are relatively new, and it is uncertain whether they will gain the market acceptance we expect.

Any factor adversely affecting sales of our non-VM products or professional services, including release cycles, market acceptance, competition, performance and reliability, reputation and economic and market conditions, could adversely affect our business and operating results.

A component of our growth strategy is dependent on our continued international expansion, which adds complexity to our operations.

We market and sell our products and professional services throughout the world and have personnel in many parts of the world.

We market and sell our products and service offerings throughout the world and have personnel in many parts of the world.

For the years ended December 31, 2023, 2022 and 2021, operations located outside of North America generated 22%, 21% and 19%, respectively, of our revenue.

1 unchanged sentence

We expect to conduct a significant amount of our business with organizations that are located outside the United States, particularly in Europe and Asia.

We cannot assure you that our expansion efforts into international markets will be successful in creating further demand for our products and professional services or in effectively selling our products and professional services in the international markets that we enter.

We cannot assure you that our expansion efforts into international markets will be successful in creating further demand for our products and service offerings or in effectively selling our products and service offerings in the international markets that we enter.

Our current international operations and future initiatives will involve a variety of risks, including:

6 unchanged sentences

• changes in regulatory requirements, including, but not limited to data privacy, data protection and data security regulations;

Ta ble of Contents

• difficulties and costs of staffing and managing foreign operations;

8 unchanged sentences

• costs associated with language localization of our products;

• increased exposure to climate change, natural disasters, acts of war (including the Russia-Ukraine war), terrorism, epidemics, or pandemics and other health crises, including the ongoing COVID-19 pandemic;

• increased exposure to climate change, natural disasters, acts of war (including the Russia-Ukraine war and the Israel-Hamas conflict), terrorism, epidemics, or pandemics and other health crises, including the ongoing COVID-19 pandemic;

• costs of compliance with multiple and possibly overlapping tax structures.

Our business, including the sales of our products and professional services by us and our channel partners, may be subject to foreign governmental regulations, which vary substantially from country to country and change from time to time.

Our business, including the sales of our products and service offerings by us and our channel partners, may be subject to foreign governmental regulations, which vary substantially from country to country and change from time to time.

Our failure, or the failure by our channel partners, to comply with these regulations could adversely affect our business.

5 unchanged sentences

While our business and operations have not been significantly impacted, it is not possible to predict the broader or longer-term consequences of this crisis.

Consequences of the crisis could include further sanctions, embargoes, regional instability, geopolitical shifts and adverse effects on macroeconomic conditions, security conditions, currency exchange rates and financial

There can be no assurance that the Russia-Ukraine war, including any resulting sanctions, export controls or other restrictive actions, will not have a material adverse impact on our future operations and results.

9 unchanged sentences

We are likely to recognize the costs associated with these increased investments earlier than some of the anticipated benefits and the return on these investments may be lower, or may develop more slowly, than we expect, which could adversely affect our operating results.

Ta ble of Contents

We may be unable to rapidly and efficiently adjust our cost structure in response to significant revenue declines, which could adversely affect our operating results.

7 unchanged sentences

Once our products are deployed within our customers’ networks, our customers depend on our technical and other customer support services to resolve any issues relating to the implementation and maintenance of our products.

If we do not effectively assist our customers in deploying our products, help our customers quickly resolve post-deployment issues or provide effective ongoing support, our ability to renew or sell additional products or professional services to existing customers would be adversely affected and our reputation with potential customers could be damaged.

If we do not effectively assist our customers in deploying our products, help our customers quickly resolve post-deployment issues or provide effective ongoing support, our ability to renew or sell additional products or service offerings to existing customers would be adversely affected and our reputation with potential customers could be damaged.

Further, to the extent that we are unsuccessful in hiring, training and retaining adequate technical and customer support and success personnel, our ability to provide adequate and timely support to our customers will be negatively impacted, and our customers’ satisfaction with our offerings will be adversely affected.

4 unchanged sentences

Achieving the anticipated benefits of past or future acquisitions will depend in part upon whether we can integrate acquired operations, products and technology in a timely and cost-effective manner and successfully market and sell these as new product offerings, or as new features within our existing offerings.

For example, on July 16, 2021, we acquired IntSights, a provider of contextualized external threat intelligence and proactive threat remediation which were intended to extend the cloud

security capabilities of our Insight Platform.

The integration of IntSights and any other acquisition may prove to be difficult due to the necessity of coordinating geographically separate organizations and integrating personnel with disparate business backgrounds and accustomed to different corporate cultures and business operations and internal systems.

For example, on March 14, 2023, we acquired Minerva Labs Ltd., a leading provider of anti-evasion and ransomware prevention technology.

The integration of any acquisition may prove to be difficult due to the necessity of coordinating geographically separate organizations and integrating personnel with disparate business backgrounds and accustomed to different corporate cultures and business operations and internal systems.

We may need to implement or improve controls, procedures, and policies at a business that prior to the acquisition may have lacked sufficiently effective controls, procedures and policies.

8 unchanged sentences

In developing this guidance, our management must make certain assumptions and judgments about our future performance.

Some of those key assumptions relate to the impact of macroeconomic pressures on our business and the timing and scope of economic recovery globally, which are inherently difficult to predict.

Some of those key assumptions relate to the impact of macroeconomic pressures on our business and the timing

Ta ble of Contents

and scope of economic recovery globally, which are inherently difficult to predict.

While presented with numerical specificity, this guidance is necessarily speculative in nature, and is inherently subject to significant business, economic and competitive uncertainties and contingencies, many of which are beyond our control and are based upon specific assumptions with respect to future business decisions or economic conditions, some of which may change.

9 unchanged sentences

We anticipate that we will continue to rely on these partners in order to help facilitate sales of our offerings as part of larger purchases in the United States and to grow our business internationally.

For the years ended December 31, 2022, 2021 and 2020, we derived approximately 57%, 52%, and 47%, respectively, of our revenue from sales of products and professional services through channel partners, and the percentage of revenue derived from channel partners may increase in future periods.

For the years ended December 31, 2023, 2022 and 2021, we derived approximately 62%, 57% and 52%, respectively, of our revenue from sales of products and service offerings through channel partners, and the percentage of revenue derived from channel partners may increase in future periods.

Our agreements with our channel partners are non-exclusive and do not prohibit them from working with our competitors or offering competing solutions, and some of our channel partners may have more established relationships with our competitors.

If our channel partners choose to place greater emphasis on products of their own or those offered by our competitors or do not effectively market and sell our products and professional services, our ability to grow our business and sell our products and professional services, particularly in key international markets, may be adversely affected.

In addition, our failure to recruit additional channel partners, or any reduction or delay in their sales of our products and professional services or conflicts between channel sales and our direct sales and marketing activities may harm our results of operations.

Finally, even if we are successful, our relationships with channel partners may not result in greater customer usage of our products and professional services or increased revenue.

If our channel partners choose to place greater emphasis on products of their own or those offered by our competitors or do not effectively market and sell our products and service offerings, our ability to grow our business and sell our products and service offerings, particularly in key international markets, may be adversely affected.

In addition, our failure to recruit additional channel partners, or any reduction or delay in their sales of our products and service offerings or conflicts between channel sales and our direct sales and marketing activities may harm our results of operations.

Finally, even if we are successful, our relationships with channel partners may not result in greater customer usage of our products and service offerings or increased revenue.

If we are not able to maintain and enhance our brand, our business and operating results may be adversely affected.

10 unchanged sentences

Our future performance depends on the continued services and contributions of our senior management, particularly Corey Thomas, our Chief Executive Officer, and other key employees to execute on our business plan and to identify and pursue new opportunities and product innovations.

From time to time, there may be changes in our senior management team resulting from the termination or departure of our executive officers and key employees.

From time to time, there may be changes in our senior management team resulting from

Ta ble of Contents

the termination or departure of our executive officers and key employees.

Our senior management and key employees are employed on an at-will basis, which means that they could terminate their employment with us at any time.

15 unchanged sentences

If these third parties no longer allow us to integrate with their APIs, or if we determine not to maintain these integrations, the functionality of our products may be reduced and our products may not be as marketable to certain potential customers.

Technology alliance partnerships require significant coordination between the parties

involved, particularly if a partner requires that we integrate its products with our products.

Technology alliance partnerships require significant coordination between the parties involved, particularly if a partner requires that we integrate its products with our products.

Further, we have invested and will continue to invest significant time, money and resources to establish and maintain relationships with our technology alliance partners, but we have no assurance that any particular relationship will continue for any specific period of time, result in new offerings that we can effectively commercialize or result in enhancements to our existing offerings.

5 unchanged sentences

In particular, HIPAA, and the 2009 Health Information Technology for Economic and Clinical Health Act include privacy standards that protect individual privacy by limiting the uses and disclosures of individually identifiable health information and implementing data security standards.

The foregoing and other state, federal and international legal and regulatory regimes may affect our customers’ requirements for, and demand for, our products and professional services.

The foregoing and other state, federal and international legal and regulatory regimes may affect our customers’ requirements for, and demand for, our products and service offerings.

Governments and industry organizations, such as the PCI Council, may also adopt new laws, regulations or requirements, or make changes to existing laws or regulations, that could impact the demand for, or value of, our products.

If we are unable to adapt our products to changing legal and regulatory standards or other requirements in a timely manner, or if our products fail to assist with, or expedite, our customers’ cybersecurity defense and compliance efforts, our customers may lose confidence in our products and could switch to products offered by our competitors or threaten or bring legal actions against us.

If we are unable to adapt our products to changing legal and regulatory standards or other requirements in a timely manner, or if our products fail to assist with, or expedite, our

Ta ble of Contents

customers’ cybersecurity defense and compliance efforts, our customers may lose confidence in our products and could switch to products offered by our competitors or threaten or bring legal actions against us.

In addition, if laws, regulations or standards related to data security, vulnerability management and other IT security and compliance requirements are relaxed or the penalties for non-compliance are changed in a manner that makes them less onerous, our customers may view government and industry regulatory compliance as less critical to their businesses, and our customers may be less willing to purchase our products.

4 unchanged sentences

Selling to government entities can be highly competitive, expensive and time consuming, and often requires significant upfront time and expense without any assurance that we will win a sale.

Government demand and payment for our products and professional services may also be impacted by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our offerings.

Government demand and payment for our products and service offerings may also be impacted by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our offerings.

Government entities also have heightened sensitivity surrounding the purchase of cybersecurity solutions due to the critical importance of their IT infrastructures, the nature of the information contained within those infrastructures and the fact that they are highly-visible targets for cyber attacks.

For example, the conflict in Ukraine and associated activities in Ukraine and Russia may increase the risk of cyberattacks on various types of infrastructure and operations, and the United States government has warned companies to be prepared for a significant increase in Russian cyberattacks in response to the sanctions on Russia.

Accordingly, increasing sales of our products and professional services to government entities may be more challenging than selling to commercial organizations.

Further, in the course of providing our products and professional services to government entities, our employees and those of our channel partners may be exposed to sensitive government information.

Accordingly, increasing sales of our products and service offerings to government entities may be more challenging than selling to commercial organizations.

Further, in the course of providing our products and service offerings to government entities, our employees and those of our channel partners may be exposed to sensitive government information.

Any failure by us or our channel partners to safeguard and maintain the confidentiality of such information could subject us to liability and reputational harm, which could materially and adversely affect our results of operations and financial performance.

4 unchanged sentences

dollar and we generate a majority of our revenue in U.S.

However, for the years ended December 31, 2022, 2021 and 2020 we incurred 16%, 15% and 12%, respectively, of our expenses outside of the

United States in foreign currencies, primarily the British pound sterling and euro, principally with respect to salaries and related personnel expenses associated with our sales and research and development operations.

However, for the years ended December 31, 2023, 2022 and 2021 we incurred 17%, 16% and 15%, respectively, of our expenses outside of the United States in foreign currencies, primarily the British pound sterling and euro, principally with respect to salaries and related personnel expenses associated with our sales and research and development operations.

Additionally, for the years ended December 31, 2023, 2022 and 2021, 11%, 10% and 10%, respectively, of our revenue was generated in foreign currencies.

1 unchanged sentence

The exchange rate between the U.S.

dollar and foreign currencies has fluctuated substantially in recent years and may fluctuate in the future.

dollar and foreign currencies has fluctuated substantially in recent years and may fluctuate in the future, including as a result of geopolitical factors such as the Israel-Hamas conflict, which has impacted the exchange rate between the U.S.

dollar and the Israeli New Shekel.

Furthermore, a strengthening of the U.S.

6 unchanged sentences

To safeguard these rights, we rely on a combination of patent, trademark, copyright and trade secret laws and contractual protections in the United States and other jurisdictions, all of which provide only limited protection and may not now or in the future provide us with a competitive advantage.

Ta ble of Contents

We cannot assure you that any patents will issue from any patent applications, that patents that issue from such applications will give us the protection that we seek or that any such patents will not be challenged, invalidated, or circumvented.

22 unchanged sentences

Many of these companies have the capability to dedicate substantially greater resources to enforce their intellectual property rights.

Third parties have in the past and may in the future

assert claims of infringement, misappropriation or other violations of intellectual property rights against us and we are currently involved in legal proceedings with Finjan, Inc., which has filed a complaint against us and our wholly-owned subsidiary, Rapid7 LLC, in the United States District Court, District of Delaware, alleging patent infringement.

Third parties have in the past and may in the future assert claims of infringement, misappropriation or other violations of intellectual property rights against us.

Third parties may also assert claims against our customers or channel partners, whom we typically indemnify against claims that our solutions infringe, misappropriate or otherwise violate the intellectual property rights of third parties.

8 unchanged sentences

• cease making, licensing or using solutions that are alleged to infringe or misappropriate the intellectual property of others;

Ta ble of Contents

• expend additional development resources to attempt to redesign our solutions or otherwise develop non-infringing technology, which may not be successful;

4 unchanged sentences

Any of the foregoing events could seriously harm our business, financial condition and results of operations.

We may not be successful in our initiatives that utilize AI, which could adversely affect our business, reputation,

or financial results.

There are significant risks involved in utilizing AI and no assurance can be provided that the usage of such AI will enhance our business or assist our business in being more efficient or profitable.

Known risks of AI currently include accuracy, bias, toxicity, intellectual property infringement or misappropriation, data privacy and cybersecurity, and data provenance.

In addition, AI may have errors or inadequacies that are not easily detectable.

For example, certain AI may utilize historical data in its analytics.

To the extent that such historical data is not indicative of the current or future conditions, or the AI fails to filter biases in the underlying data or collection methods, the usage of AI may lead us to make determinations on behalf of our business, recommendations to our clients, or developments to our products and services, in each case, that have an adverse effect on our business and financial results.

AI may also be subject to data herding and interconnectedness (i.e., multiple market participants utilizing the same data), which may adversely impact our business.

If the AI we utilize is incorrectly designed or utilizes training data that is overbroad, incomplete, inadequate or biased in some way, our use of AI may inadvertently reduce our efficiency or cause unintentional or unexpected outputs that are incorrect, do not match our business goals, do not comply with our policies or interfere with the performance of our products and services, business and reputation.

AI is complex and subject to a rapidly evolving regulatory landscape.

The use of AI may increase intellectual property, data privacy and cybersecurity, operational and technological risks, and our AI-related efforts may result in new or enhanced governmental or regulatory scrutiny, litigation, ethical concerns, or other complications that could adversely affect our business, reputation, or financial results or subject us to legal liability.

In particular, the technologies underlying AI and their use cases are subject to a variety of laws, including intellectual property, data privacy and cybersecurity, consumer protection and equal opportunity laws.

If we do not have sufficient rights to use the data on which AI relies, we may incur liability through the violation of such laws, third-party privacy or other rights or contracts to which we are a party.

Changes in laws, rules, directives and regulations governing the use of AI may adversely affect the ability of our business to develop and use AI.

Any of these factors could adversely affect our business, reputation, or financial results or subject us to legal liability.

Our products contain third-party open source software components, and our failure to comply with the terms of the underlying open source software licenses could restrict our ability to sell our products.

9 unchanged sentences

Disclosing our proprietary source code could allow our competitors to create similar products with lower development effort and time and ultimately, could result in a loss of sales for us.

Disclosing the source code of our proprietary software could also make it easier for cyber attackers and other third parties to discover vulnerabilities in or to defeat the protections of our products, which could result in our products failing to provide our customers with the security they expect.

Disclosing the source code of our proprietary

Ta ble of Contents

software could also make it easier for cyber attackers and other third parties to discover vulnerabilities in or to defeat the protections of our products, which could result in our products failing to provide our customers with the security they expect.

Likewise, some open source projects have known security and other vulnerabilities and architecture instabilities, or are otherwise subject to security attacks due to their wide availability, and are provided on an “as-is” basis.

19 unchanged sentences

Our ability to use net operating losses to offset future taxable income may be subject to certain limitations.

As of December 31, 2022, we had federal and state net operating loss carryforwards (“NOLs”) , o f $450.5 million and $345.4 million, respectively, available to offset future taxable income, which expire in various years beginning in 2023 if not utilized.

As of December 31, 2023, we had federal and state net operating loss carryforwards (“NOLs”), of $346.5 million and $293.5 million, respectively, available to offset future taxable income, a portion of which expires in various years beginning in 2024 if not utilized.

A lack of future taxable income would adversely affect our ability to utilize these NOLs before they expire.

Under the provisions of the Internal Revenue Code of 1986, as amended (the “Internal Revenue Code”), substantial changes in our ownership may limit the amount of pre-change NOLs that can be utilized annually in the future to offset taxable income.

Section 382 of the Internal Revenue Code imposes limitations on a company’s ability to use NOLs if a company experiences a more-than-50-percentage point ownership change over a three-year testing period.

Under the provisions of the Internal Revenue Code (the “IRC”), substantial changes in our ownership may limit the amount of pre-change NOLs that can be utilized annually in the future to offset taxable income.

IRC Section 382 imposes limitations on a company’s ability to use NOLs if a company experiences a more-than-50-percentage point ownership change over a three-year testing period.

Based upon our historical analysis, we determined that although a limitation on our historical NOLs exists, we do not expect this limitation to impair our ability to use our NOLs prior to expiration.

3 unchanged sentences

This could adversely affect our operating results, cash balances and the market price of our common stock.

We could be subject to additional tax liabilities.

We may have exposure to greater than anticipated tax liabilities.

Ta ble of Contents

We are subject to U.S.

federal, state, local and sales taxes in the United States and foreign income taxes, withholding taxes and transaction taxes in numerous foreign jurisdictions.

We generally conduct our international operations through wholly-owned

subsidiaries and report our taxable income in various jurisdictions worldwide based upon our business operations in those jurisdictions.

We generally conduct our international operations through wholly-owned subsidiaries and report our taxable income in various jurisdictions worldwide based upon our business operations in those jurisdictions.

Our intercompany relationships are and will continue to be subject to complex transfer pricing regulations administered by taxing authorities in various jurisdictions.

6 unchanged sentences

Real or perceived failures, errors or defects in our solutions could adversely affect our brand and reputation, which could have an adverse effect on our business and results of operations.

If our products or professional services fail to detect vulnerabilities in our customers’ cybersecurity infrastructure, or if our products or professional services fail to identify and respond to new and increasingly complex methods of cyber attacks, our business and reputation may suffer.

There is no guarantee that our products or professional services will detect all vulnerabilities and threats, especially in light of the rapidly changing security landscape to which we must respond, including the constantly evolving techniques used by attackers to access or sabotage data.

If our products or service offerings fail to detect vulnerabilities in our customers’ cybersecurity infrastructure, or if our products or service offerings fail to identify and respond to new and increasingly complex methods of cyber attacks, our business and reputation may suffer.

There is no guarantee that our products or service offerings will detect all vulnerabilities and threats, especially in light of the rapidly changing security landscape to which we must respond, including the constantly evolving techniques used by attackers to access or sabotage data.

2 unchanged sentences

These mandatory disclosures regarding a security breach often lead to widespread negative publicity, and any association of us with such publicity may cause our customers to lose confidence in the effectiveness of our solutions.

An actual or perceived security breach or theft of sensitive data of one of our customers, regardless of whether the breach is attributable to the failure of our products or professional services, could adversely affect the market’s perception of our offerings and subject us to legal claims.

An actual or perceived security breach or theft of sensitive data of one of our customers, regardless of whether the breach is attributable to the failure of our products or service offerings, could adversely affect the market’s perception of our offerings and subject us to legal claims.

Additionally, our products may falsely detect vulnerabilities or threats that do not actually exist.

2 unchanged sentences

However, to the extent that the information from these third parties is inaccurate or malicious, the potential for false indications of security vulnerabilities and susceptibility to attack increases.

These false positives, while typical in the industry, may impair the perceived reliability of our offerings and may therefore adversely impact market acceptance of our products and professional services and could result in negative publicity, loss of customers and sales and increased costs to remedy any problem.

These false positives, while typical in the industry, may impair the perceived reliability of our offerings and may therefore adversely impact market acceptance of our products and service offerings and could result in negative publicity, loss of customers and sales and increased costs to remedy any problem.

Further, to the extent that our community of third parties is reduced in size or participants become less active, we may lose valuable insight into the dynamic threat landscape and our ability to quickly respond to new exploits, attacks and vulnerabilities may be reduced.

4 unchanged sentences

Any errors, defects, disruptions in service or other performance problems with our products may damage our customers’ businesses and could hurt our reputation.

If our products or professional services fail to detect vulnerabilities or threats for any reason, we may incur significant costs, the attention of our key personnel could be diverted, our customers may delay or withhold payment to us or elect not to renew or other significant customer relations problems may arise.

If our products or service offerings fail to detect vulnerabilities or threats for any reason, we may incur significant costs, the attention of our key personnel could be diverted, our customers may delay or withhold payment to us or elect not to renew or other significant customer relations problems may arise.

We may also be subject to liability claims for damages related to errors or defects in our products.

A material liability claim or other occurrence that harms our reputation or decreases market acceptance of our products may harm our business and operating results.

Limitation of liability provisions in our standard terms and conditions and our other agreements may not adequately or effectively protect us from any claims related to errors or defects in our solutions, including as a result of federal, state or local laws or ordinances or unfavorable judicial decisions in the United States or other countries.

Limitation of liability provisions in our standard terms and conditions and our other agreements may not

Ta ble of Contents

adequately or effectively protect us from any claims related to errors or defects in our solutions, including as a result of federal, state or local laws or ordinances or unfavorable judicial decisions in the United States or other countries.

Our brand, reputation and ability to attract, retain and serve our customers are dependent in part upon the reliable performance of our products and network infrastructure.

24 unchanged sentences

While extortion payments may alleviate the negative impact of a ransomware attack, we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments.

Similarly, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our information technology systems (including our products) or the third-party information technology systems that support us and our services.

Such attacks may also include exploitation of vulnerabilities in third party or open source

software code that may be incorporated into our own or our customers’ or supplier’s systems, such as the vulnerability in the Java logging library known as “log4j” identified in late 2021 that affected many in our industry.

Ta ble of Contents

disruption to our information technology systems (including our products) or the third-party information technology systems that support us and our services.

Such attacks may also include exploitation of vulnerabilities in third party or open source software code that may be incorporated into our own or our customers’ or supplier’s systems.

Further, if our systems or those of our third-party service providers are breached as a result of third-party action, employee error or misconduct, attackers could learn critical information about how our products operate to help protect our customers’ IT infrastructures from cyber risk, thereby making our customers more vulnerable to cyber attacks.

22 unchanged sentences

Moreover, despite our efforts, our personnel or third parties upon whom we rely may fail to comply with such obligations.

If we (or third parties upon whom we rely) fail, or are perceived to have failed, to address and comply with data privacy and security

obligations, we could face significant consequences.

If we (or third

Ta ble of Contents

parties upon whom we rely) fail, or are perceived to have failed, to address and comply with data privacy and security obligations, we could face significant consequences.

These consequences may include but are not limited to:

15 unchanged sentences

In the United States, federal, state and local governments have enacted numerous data privacy and cybersecurity laws (including data breach notification laws, personal data privacy laws and consumer protection laws).

For example, the California Privacy Rights Act, which updated the California Consumer Privacy Act of 2018 (“CCPA”), went into effect on January 1, 2023, (“CPRA”), imposes obligations on businesses, service providers, third parties and contractors to which it applies.

These obligations include, but are not limited to, providing specific disclosures in privacy notices and affording California residents certain rights related to their personal data.

For example, at the federal level, we are subject to the rules and regulations promulgated under the authority of the Federal Trade Commission, which regulates unfair or deceptive acts or practices, including with respect to data privacy and cybersecurity.

At the state level, the California Consumer Privacy Act of 2018 (as updated by the California Privacy Rights Act, collectively, “CCPA”) imposes obligations on businesses, service providers, third parties and contractors to which it applies.

These obligations include, but are not limited to, providing specific disclosures in privacy notices and affording California residents certain rights related to their personal information.

The CCPA allows for statutory fines for non-compliance (up to $7,500 per violation).

Other states have proposed data privacy laws which may come into effect.

Other states have enacted, or propose to enact, their own comprehensive data privacy laws and, in addition, laws in all 50 U.S.

states generally require businesses to provide notice under certain circumstances to individuals whose personal information has been disclosed as a result of a data breach.

If we become subject to new data privacy or security laws, the risk of enforcement action against us could increase because we may become subject to additional obligations, and the number of individuals or entities that can initiate actions against us may increase (including individuals, via a private right of action, and state actors).

Internationally, virtually every jurisdiction in which we operate has established its own data security and cyberprivacy legal frameworks with which we, and/or our customers, must comply, including the European Union's General Data Protection Regulation, 2016/679 (“GDPR”), laws implemented by European Union (“EU”) member states and, following the withdrawal of the United Kingdom (“UK”) from the EU, the so-called ‘UK GDPR’ (“European Data Protection Laws”).

a version of the GDPR as implemented into UK law) (“UK GDPR,” and collectively, the “European Data Protection Laws”).

The UK’s decision to leave the EU and ongoing developments in the UK have created uncertainty with regard to data protection regulation in the UK.

Going forward, there may be an increasing scope for divergence in the application, interpretation and enforcement of data protection laws as between the UK and EU.

The European Data Protection Laws present significantly greater risks, compliance burdens and costs for companies with users and operations in the EU and UK.

The European Data Protection Laws present significantly greater risks, compliance burdens and costs for companies with users and operations in the European Economic Area (“EEA”) and UK.

Under the GDPR, fines of up to 20 million euros or up to 4% of the annual global turnover of the infringer, whichever is greater, could be imposed for significant non-compliance and similar levels of fines could also be imposed under the UK GDPR.

The European Data Protection Laws are broad in their application and apply when we do business with EU- and UK-based customers and when our U.S.-based customers collect and use personal data that originates from individuals resident in the EU and UK.

The European Data Protection Laws are broad in their application and apply when we do business with EU- and UK-based customers and when our U.S.-based customers collect, use and otherwise process personal data that originates from individuals residing in the EEA and UK.

They also apply to transfers of personal data between us and our EU- and UK-based subsidiaries, including employee information.

4 unchanged sentences

In addition, certain jurisdictions have enacted data localization laws and cross-border personal data transfer laws.

For example, European Data Protection Laws generally prohibit the transfer of personal data from the European Economic Area (“EEA”) and, the UK and Switzerland (collectively, “Europe”), to most other non-European countries unless the parties to the transfer have implemented specific safeguards to protect the transferred personal data.

In particular, government regulators in Europe have found that the United States does not provide an adequate level of data privacy and cybersecurity protection and although there are legal mechanisms to allow for the transfer of personal data from Europe to the United States, uncertainty remains about compliance and such mechanisms may not be available or applicable with respect to our personal data processing activities.

For example, the European Data Protection Laws impose strict rules on the transfer of personal data from the EEA, the UK and Switzerland (collectively, “Europe”), to so-called third countries, including the United States, unless the parties to the transfer have implemented specific safeguards to protect the transferred personal data.

Although there are legal mechanisms to allow for the transfer of personal data from Europe to the United States, uncertainty remains about compliance and such mechanisms may not be available or applicable with respect to our personal data processing activities.

For example, the “Standard Contractual Clauses” (“SCCs”) that are designed to be a valid mechanism by which parties can transfer personal data out of Europe to jurisdictions that are not found to provide an adequate level of protection, must be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country.

Specifically, the parties to the cross-border personal data transfer must evaluate the importing jurisdiction’s laws and implement supplemental security measures as necessary to protect the at-issue personal data.

It is likely that there will continue to be some uncertainty regarding the mechanisms by which parties transfer personal data out of Europe to jurisdictions such as the United States.

At present, there are few if any viable alternatives to the SCCs.

If we cannot implement and maintain a valid mechanism for cross-border personal data transfers, we may face increased exposure to regulatory actions, substantial fines and injunctions against processing (including prohibitions on transferring personal data out of the EU and UK).

Additionally, in July 2023, the European Commission adopted an adequacy decision concluding that the United States ensures an adequate level of protection for personal data transferred from Europe under the EU-U.S.

Data Privacy Framework (followed on October 2023 with the adoption of an adequacy decision in the UK for the UK-U.S.

Data Bridge).

However, such adequacy decisions do not foreclose, and are likely to face, future legal challenges, and it is likely that there will continue to be some uncertainty regarding the mechanisms by which parties transfer personal data out of Europe to jurisdictions such as the United States.

If we cannot implement and maintain a valid mechanism for cross-border personal data transfers, we

Ta ble of Contents

may face increased exposure to regulatory actions, substantial fines and injunctions against processing (including prohibitions on transferring personal data out of the EU and UK).

This may also reduce demand for our services from companies subject to European Data Protection Laws.

Loss of our ability to import personal data from the EU and UK may also require us to increase our data processing capabilities in the EEA at significant expense.

The costs of compliance with, and other burdens imposed by, the laws, rules, regulations and policies that are applicable to the businesses of our customers may limit the use and adoption of, and reduce the overall demand for, our software.

cybersecurity concerns, whether valid or not valid, may inhibit market adoption of our products particularly in certain industries and foreign countries.

Loss of our ability to import personal data from Europe may also require us to increase our data processing capabilities in Europe at significant expense.

Moreover, while we strive to publish and prominently display privacy policies that are accurate, comprehensive, and compliant with applicable laws, rules regulations and industry standards, we cannot ensure that our privacy policies and other statements regarding our practices will be sufficient to protect us from claims, proceedings, liability or adverse publicity relating to data privacy and security.

Although we endeavor to comply with our privacy policies, we may at times fail to do so or be alleged to have failed to do so.

If our public statements about our use, collection, disclosure and other processing of personal information, whether made through our privacy policies, information provided on our website, press statements or otherwise, are alleged to be deceptive, unfair or misrepresentative of our actual practices, we may be subject to potential government or legal investigation or action, including by the Federal Trade Commission or applicable state attorneys general.

Our compliance efforts are further complicated by the fact that data privacy and security laws, rules, regulations and standards around the world are rapidly evolving, may be subject to uncertain or inconsistent interpretations and enforcement, and may conflict among various jurisdictions.

Any failure or perceived failure by us to comply with our privacy policies, or applicable data privacy and security laws, rules, regulations, standards, certifications or contractual obligations, or any compromise of security that results in unauthorized access to, or unauthorized loss, destruction, use, modification, acquisition, disclosure, release or transfer of personal information, may result in requirements to modify or cease certain operations or practices, the expenditure of substantial costs, time and other resources, proceedings or actions against us, legal liability, governmental investigations, enforcement actions, claims, fines, judgments, awards, penalties, sanctions and costly litigation (including class actions).

Further, there are active legislative discussions regarding the implementation of laws or regulations that could restrict the manner in which security research is conducted and that could restrict or possibly bar the conduct of penetration testing and the use of exploits, which are an essential component of our Metasploit product and our business strategy more generally.

Our failure to comply with existing laws, rules or regulations, changes to existing laws or their interpretation, or the imposition of new laws, rules or regulations, could result in additional costs and may necessitate changes to our business practices and divergent operating models, which may have a material and adverse impact on our business, results of operations, and financial condition.

Any of the foregoing could harm our reputation, distract our management and technical personnel, increase our costs of doing business, adversely affect the demand for our products and services, and ultimately result in the imposition of liability, any of which could have a material adverse effect on our business, financial condition and results of operations.

Organizations may be reluctant to purchase our cloud-based offerings due to the actual or perceived vulnerability of cloud solutions.

9 unchanged sentences

• changes in our projected operating and financial results;

• changes in the prices of our products and professional services;

• changes in laws or regulations applicable to our products or professional services;

• changes in the prices of our products and service offerings;

• changes in laws or regulations applicable to our products or service offerings;

• announcements by us or our competitors of significant business developments, acquisitions or new offerings;

4 unchanged sentences

• price and volume fluctuations in the overall stock market;

Ta ble of Contents

• effects of inflation and increased interest rates;

19 unchanged sentences

In the future, we may sell additional shares of our common stock or equity-linked securities to raise capital.

In addition, a substantial number of shares of our common stock is reserved for issuance upon the exercise of stock options, settlement of other equity incentive awards and upon conversion of the 2025 Notes and 2027 Notes (the “Notes”).

The indentures for the Notes do not restrict our ability to issue additional common stock or equity-linked securities in the future.

4 unchanged sentences

We may not have sufficient cash flow from our business to pay our substantial debt when due.

In May 2020, we issued $230.0 million aggregate principal amount of 2025 Notes and in March 2021, we issued $600.0 million aggregate principal amount of 2027 Notes.

In May 2020, we issued $230.0 million aggregate principal amount of 2025 Notes, in March 2021, we issued $600.0 million aggregate principal amount of 2027 Notes and in September 2023, we issued $300.0 million aggregate principal amount of 2029 Notes.

In September 2023, concurrently with the issuance of the 2029 Notes, we used $201.0 million of the proceeds from the issuance of the 2029 Notes to repurchase and retire $184.0 million aggregate principal amount of the 2025 Notes.

In addition, we may also incur indebtedness under our revolving credit facility.

3 unchanged sentences

• require us to use a substantial portion of our cash flow from operations to make debt service payments;

Ta ble of Contents

• limit our flexibility to plan for, or react to, changes in our business and industry;

7 unchanged sentences

In addition, any required repurchase of the Notes for cash as a result of a fundamental change or voluntary redemption (in each case, pursuant to the terms of the Notes) would lower our current cash on hand such that we would not have that cash available to fund operations.

If we are unable to generate sufficient cash flow, we may be required to adopt one or more alternatives, such as

selling assets, restructuring our debt or obtaining additional equity capital on terms that may be onerous or highly dilutive.

If we are unable to generate sufficient cash flow, we may be required to adopt one or more alternatives, such as selling assets, restructuring our debt or obtaining additional equity capital on terms that may be onerous or highly dilutive.

Our ability to refinance our indebtedness will depend on the capital markets and our financial condition at such time.

9 unchanged sentences

If one or more holders elect to convert their Notes, unless we elect to satisfy our conversion obligation by delivering solely shares of our common stock (other than paying cash in lieu of delivering any fractional share), we would be required to settle a portion or all of our conversion obligation in cash, which could adversely affect our liquidity.

As disclosed in Note 10, Debt , to our consolidated financial statements, during the six months ended June 30, 2022, the 2025 Notes were convertible at the option of the holders.

During this period an immaterial principal amount of the 2025 Notes were requested for conversion and settled in cash.

As of December 31, 2022, the 2025 Notes and the 2027 Notes were not convertible at the option of the holder.

As of December 31, 2023, the 2025 Notes, the 2027 Notes and the 2029 Notes were not convertible at the option of the holder.

Whether the Notes will be convertible following the year ended December 31, 2023, will depend on the future satisfaction of a conversion condition.

1 unchanged sentence

The capped call transactions may affect the value of the Notes and our common stock.

In connection with the issuance of the 2023 Notes, the 2025 Notes and the 2027 Notes, we entered into capped call transactions with certain counterparties (the “Capped Calls”).

The Capped Calls cover, subject to customary adjustments, the number of shares of our common stock initially underlying each of the 2023 Notes, the 2025 Notes and the 2027 Notes.

In connection with the issuance of the 2023 Notes, the 2025 Notes, the 2027 Notes and the 2029 Notes, we entered into capped call transactions with certain counterparties (the “Capped Calls”).

The Capped Calls cover, subject to customary adjustments, the number of shares of our common stock initially underlying each of the 2023 Notes, the 2025 Notes, the 2027 Notes and the 2029 Notes.

The Capped Calls are expected to offset the potential dilution as a result of conversion of such Notes.

In connection with establishing their initial hedge of the capped call transactions, the counterparties or their respective affiliates entered into various derivative transactions with respect to our common stock concurrently with or shortly after the pricings of the respective Notes, including with certain investors in the applicable Notes.

The counterparties and/or or their respective affiliates may modify or unwind their hedge positions by entering into or unwinding various derivatives with respect to our common stock and/or purchasing or selling our common stock or other securities of ours in secondary market transactions prior to the maturity of the applicable Notes (and are likely to do so on each exercise date of the capped call transactions, which are scheduled to occur during the applicable observation period relating to any conversion of the 2025 Notes on or after November 1, 2024 or relating to any conversion of the 2027 Notes on or after December 15, 2026, in each case that is not in connection with a redemption).

Ta ble of Contents

scheduled to occur during the applicable observation period relating to any conversion of the 2025 Notes on or after November 1, 2024, relating to any conversion of the 2027 Notes on or after December 15, 2026 or relating to any conversion of the 2029 Notes on or after December 15, 2028, in each case that is not in connection with a redemption).

We redeemed the 2023 Notes in November 2021.

As described elsewhere in this Annual Report on Form 10-K, the 2023 Capped Calls were not redeemed with the redemption of the 2023 Notes.

As described elsewhere in this Annual Report on Form 10-K, the 2023 Capped Calls were not redeemed with the redemption of the 2023 Notes but were cash-settled via written notice provided to the counterparties on May 31, 2023;

see the section entitled “Capped Calls” under Note 11 to our consolidated financial statements and “Management's Discussion and Analysis of Financial Condition and Results of Operations” included elsewhere in this report for information regarding our cash settlement of the 2023 Capped Calls.

We cannot make any prediction as to the direction or magnitude of any potential effect that the transactions described above may have on the prices of the Notes or the shares of our common stock.

5 unchanged sentences

If an option counterparty becomes subject to insolvency proceedings, we will become an unsecured creditor in those proceedings with a claim equal to our exposure at the time under such transaction.

Our exposure will depend on many factors but, generally,

our exposure will increase if the market price or the volatility of our common stock increases.

Our exposure will depend on many factors but, generally, our exposure will increase if the market price or the volatility of our common stock increases.

In addition, upon a default or other failure to perform, or a termination of obligations, by an option counterparty, we may suffer adverse tax consequences and more dilution than we currently anticipate with respect to our common stock.

9 unchanged sentences

In certain jurisdictions, these regulatory requirements may be more stringent than those in the United States.

These laws and regulations may also impact our innovation and business drivers in developing new and emerging technologies, including those related to AI and machine learning.

Noncompliance with applicable regulations or requirements could subject us to investigations, sanctions, mandatory product recalls, enforcement actions, disgorgement of profits, fines, damages, civil and criminal penalties, injunctions or other collateral consequences.

3 unchanged sentences

Our business is subject to the risks of climate change, pandemics, earthquakes, fire, power outages, floods and other catastrophic events, and to interruption by manmade problems such as terrorism.

A significant public health crisis, epidemic or pandemic (including the ongoing COVID-19 pandemic), or climate change, or a natural disaster, such as an earthquake, fire or a flood, or a significant power outage could have a material adverse impact on our business, operating results and financial condition.

A significant public health crisis, epidemic or pandemic, or climate change, or a natural disaster, such as an earthquake, fire or a flood, or a significant power outage could have a material adverse impact on our business, operating results and financial condition.

In addition, public health crises, climate change, or natural disasters could affect our channel partners’ ability to perform services for us on a timely basis.

In the event we or our channel partners are hindered by any of the events discussed above, our ability to provide our products or professional services to customers could be delayed.

In addition, our facilities and those of our third-party data centers and hosting providers are vulnerable to damage or interruption from human error, intentional bad acts, pandemics, earthquakes, hurricanes, floods, fires, war (including the Russia-Ukraine war), terrorist attacks, power losses, hardware failures, systems failures, telecommunications failures and similar events.

The occurrence of a public health crisis, climate change, natural disaster, power failure or an act of terrorism, vandalism or other misconduct, a decision by a third party to close a facility on which we rely without adequate notice, or other unanticipated problems could result in lengthy interruptions in provision or delivery of our products, potentially leaving our customers vulnerable to cyber attacks.

In the event we or our channel partners are hindered by any of the events discussed above, our ability to provide our products or service offerings to customers could be delayed.

In addition, our facilities and those of our third-party data centers and hosting providers are vulnerable to damage or interruption from human error, intentional bad acts, pandemics, earthquakes, hurricanes, floods, fires, war (including the Russia-Ukraine war and the Israel-Hamas conflict), terrorist attacks, power losses, hardware failures, systems failures, telecommunications failures and similar events.

The occurrence of a public health crisis, climate change, natural disaster, power failure, war (including the Russia-Ukraine war and the Israel-Hamas conflict) or an act of terrorism, vandalism or other misconduct, a decision by a third party to close a facility on which we rely without adequate notice, or other unanticipated

Ta ble of Contents

problems could result in lengthy interruptions in provision or delivery of our products, potentially leaving our customers vulnerable to cyber attacks.

The occurrence of any of the foregoing events could damage our systems and hardware or could cause them to fail completely, and our insurance may not cover such events or may be insufficient to compensate us for the potentially significant losses, including the potential harm to the future growth of our business, that may result from interruptions in our service as a result of system failures.

24 unchanged sentences

If we raise additional funds through future issuances of equity or convertible debt securities, our existing stockholders could suffer significant dilution, and any new equity securities we issue could have rights, preferences and privileges superior to those of holders of our common stock.

Any debt financing that we may secure in the future could involve restrictive covenants relating to our capital raising activities and other financial and operational matters, which may make it more difficult for us to obtain additional capital and to pursue business opportunities, including potential acquisitions.

Any debt financing that we may secure in the future could involve restrictive covenants relating to our capital raising activities and other financial and operational matters, which may make it

Ta ble of Contents

more difficult for us to obtain additional capital and to pursue business opportunities, including potential acquisitions.

We may not be able to obtain additional financing on terms favorable to us, if at all.

For example, while the potential impact and duration of the COVID-19 pandemic on the global economy and our business in particular may be difficult to assess or predict, the pandemic has resulted in, and may continue to result in significant disruption of global financial markets, reducing our ability to access capital, which could in the future negatively affect our liquidity.

Market conditions and changing circumstances, some of which may be beyond our control, could impair our ability to access our existing cash, cash equivalents and investments.

We regularly maintain domestic cash deposits at FDIC insured banks which exceed the FDIC insured limits, and, as a result, there is a concentration of risk related to amounts on deposit in excess of FDIC insurance coverage.

In addition, we maintain cash deposits in foreign banks where we operate, some of which are not insured or are only partially insured by the FDIC or other similar agencies.

If banks and financial institutions with whom we have banking relationships enter receivership or become insolvent in the future, we may be unable to access, and we may lose, some or all of our existing cash, cash equivalents and investments to the extent those funds are not insured or otherwise protected by the FDIC.

Any delay in our ability to access our cash, cash equivalents and investments (or the loss of some or all of such funds) could have a material adverse effect on our operations and cause us to need to seek additional capital sooner than planned which could only be available at a higher cost or not at all.

Although we expect that current cash and cash equivalent balances and cash flows that are generated from operations will be sufficient to meet our domestic and international working capital needs and other capital and liquidity requirements for at least the next 12 months, if we are unable to obtain adequate financing or financing on terms satisfactory to us if and when we require it, our ability to continue to support our business growth and to respond to business challenges could be significantly impaired, and our business may be adversely affected.

5 unchanged sentences

• establish an advance notice procedure for stockholder proposals to be brought before an annual meeting, including proposed nominations of persons for director nominees;

• establish that directors elected prior to our 2021 annual meeting serve three-year staggered terms and subsequent to the 2023 annual meeting, each director will hold office for a term of one year;

• establish that subsequent to the 2023 annual meeting, each director will hold office for a term of one year;

• require the approval of the holders of a majority of the voting power of all of the then-outstanding shares of capital stock of the Company entitled to vote generally at an election of directors, voting together as a single class, to adopt, amend or repeal our amended and restated bylaws or amend or repeal the provisions of our amended and restated certificate of incorporation regarding the election and removal of directors and the ability of stockholders to take action by written consent or call a special meeting;

6 unchanged sentences

These and other provisions in the indentures could deter or prevent a third party from acquiring us even when the acquisition may be favorable to our stockholders.

In addition, because we are incorporated in Delaware, we are governed by the provisions of Section 203 of the Delaware General Corporation Law, which generally prohibits a Delaware corporation from engaging in any of a broad range of business combinations with any “interested” stockholder for a period of three years following the date on which the stockholder became an “interested” stockholder.

Ta ble of Contents

an “interested” stockholder.

Any of the foregoing provisions could limit the opportunity for our stockholders to receive a premium for their shares of our common stock and could also affect the price that some investors are willing to pay for our common stock.

3 unchanged sentences

The forum selection clause in our amended and restated certificate of incorporation may limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us.

Unresolved Staff Comments.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors