What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-02-19 compared with 2025-02-28 · 138 added, 130 removed, 659 unchanged (29% of the section changed)

18 unchanged sentences

• sales of our products and service offerings due to seasonality and customer demand;

• the timing and success of new product or service introductions by us or our competitors or any other changes in the competitive landscape of our industry, including consolidation among our competit ors and initiatives that use artificial intelligence (“AI”);

• the introduction or adoption of new technologies that compete with our offerings;

3 unchanged sentences

• our ability to successfully manage and integrate any acquired businesses, including without limitation, the amount and timing of expenses and potential future charges for impairment of goodwill from acquired companies;

• business disruptions in regions affecting our operations, stemming from actual, imminent or perceived outbreak or reemergence of contagious disease;

• business disruptions in regions affecting our operations, stemming from actual, imminent or perceived outbreak or reemergence of contagious diseases;

• our ability to increase, retain and incentivize the channel partners that market and sell our products and service offerings;

4 unchanged sentences

• the strength of regional, national and global economies;

• the impact of climate change, natural disasters or manmade problems, including terrorism or war (such as the Russia- Ukraine war and the ongoing conflicts in the Middle East);

• the impact of climate change, natural disasters or manmade problems, including terrorism or war;

• future accounting pronouncements or changes in our accounting policies or practices.

Each factor above or discussed elsewhere herein or the cumulative effect of some of these factors may result in fluctuations in our operating results.

This variability and unpredictability could result in our failure to meet expectations with respect to operating results, or those of securities analysts or investors, for a particular period.

This variability and unpredictability could result in our failure to meet expectations with respect to operating results, including those of securities analysts or investors, for a particular period.

If we fail to meet or exceed expectations for our operating results for these or any other reasons, the market price of our stock could fall and we could face costly lawsuits, including securities class action suits.

Our business and operations have experienced significant growth, and if we do not appropriately manage any future growth, or are unable to maintain and scale our infrastructure, systems and processes, our business and results of operations may be negatively affected.

Our business and operations have experienced significant growth in the past, and if we do not appropriately manage any future growth, or are unable to maintain and scale our infrastructure, systems and processes, our business and results of operations may be negatively affected.

Although we have experienced rapid growth in the past, we cannot provide any assurance that our business will continue to grow at the same rate or at all.

From the year ended December 31, 2021 to the year ended December 31, 2025, our revenue grew from $535.4 million to $859.8 million and our headcount grew from 2,353 to 2,613 employees.

Our future growth is dependent upon our ability to continue to meet the expanding needs of our customers and to attract new customers.

Although we have experienced rapid growth historically, we cannot provide any assurance that our business will continue to grow at the same rate or at all.

Although we have experienced rapid growth in the past, we cannot provide any assurance that our business will continue to grow at the same rate or at all.

As existing customers gain more experience with our products, they may broaden their reliance on our products, which will require that we expand our operations infrastructure.

18 unchanged sentences

You should not rely on our prior quarterly or annual periods performance as any indication of our future growth.

We have not been profitable historically and may not maintain profitability in the future.

For the year ended December 31, 2024, we have achieved net income of $25.5 million.

Prior to 2024, we had posted a net loss in each year since inception, including net losses of $152.8 million and $124.7 million in the years ended December 31, 2023 and 2022, respectively.

We may not maintain profitability in the future.

For the years ended December 31, 2025 and 2024 we achieved net income of $23.4 million and $25.5 million, respectively.

Prior to 2024, we posted a net loss in each year since inception, including a net loss of $152.8 million for the year ended December 31, 2023.

As of December 31, 2025, we had an accumulated deficit of $964.7 million.

While we have experienced significant revenue growth in recent periods and achieved profitability, we may not obtain a high enough volume of sales of our products and service offerings to sustain or increase our growth or maintain profitability in the future.

While we have experienced significant revenue growth in the past and achieved profitability, we may not obtain a high enough volume of sales of our products and service offerings to sustain or increase our growth or maintain profitability in the future.

We also expect our costs to increase in future periods, which could negatively affect our future operating results if our revenue does not increase.

9 unchanged sentences

If our revenue growth does not meet our expectations in future periods, our financial performance may be harmed, and we may not maintain profitability in the future.

Prolonged economic uncertainties or downturns could adversely affect our business.

Prolonged economic uncertainties or downturns could adversely affect our business operations or financial results.

Negative conditions in the general economy in either the United States or abroad, including conditions resulting from financial and credit market fluctuations, changes in economic policy, inflation, foreign currency exchange rate fluctuations, trade uncertainty, including changes in tariffs, sanctions, international treaties, and other trade restrictions, the occurrence of a natural disaster, outbreaks of epidemics or pandemics such as COVID-19, political unrest and social strife, including acts of terrorism, armed conflicts, such as the one between Russia and Ukraine and the ongoing conflicts in the Middle East, have caused and could continue to cause a decrease in corporate spending on security offerings or information technology in general and negatively affect the rate of growth of our business.

Our customer base spans a variety of industries, including technology services, energy, financial services, healthcare and life sciences, manufacturing, media and entertainment, retail, education, real estate, transportation, government and professional services.

A substantial downturn in any of these industries may cause companies to reduce their capital expenditures in general or by specifically reducing their spending on information technology or security offerings.

As a result, our current or prospective customers in these industries may delay or cancel information technology projects or seek to lower their costs by renegotiating vendor contracts.

For example, due to economic volatility as a result of inflationary pressures and other global events, we have and may continue to see delays in our sales cycle, failures of customers to renew at all or to renew the anticipated scope their subscriptions with us, requests from customers for payment term deferrals as well as pricing or bundling concessions, which, if significant, could materially and adversely affect our business, results of operations and financial condition.

To the extent purchases of our offerings are perceived by customers and potential customers to be discretionary, our revenues may be disproportionately affected by delays or reductions in general information technology spending.

Also, customers may choose to develop in-house software as an alternative to using our offerings.

Moreover, competitors may respond to market conditions by lowering prices and attempting to lure away our customers.

In addition, the increased pace of consolidation in certain industries may result in reduced overall spending on our offerings.

In addition, adverse economic conditions, including inflation, may also increase the costs of operating our business, including vendor, supplier and workforce expenses.

We cannot predict the timing, strength or duration of any economic slowdown, instability or recovery, generally or within any particular industry or geography.

Although we expect that our current cash and cash equivalent balances, including the proceeds of our offering of convertible senior notes in September 2023, together with cash flows that are generated from operations, will be sufficient to meet our domestic and international working capital needs and other capital and liquidity requirements for at least the next 12 months, if the economic conditions of the general economy or industries in which we operate worsen from present levels, our business operations and financial results could be adversely affected.

Macroeconomic events and conditions, such as those discussed above, may also have the effect of heightening many of the other risks described in this “Risk Factors” section, including risks associated with our guidance, our customers, our potential customers, our market opportunity, renewals and sales cycle, among others.

Actions that we are taking to restructure our business in alignment with our strategic priorities may not be as effective as anticipated.

In August of 2023, our Board approved a restructuring plan that was designed to improve operational efficiencies, reduce operating costs and better align the Company’s workforce with current business needs, top strategic priorities, and key growth opportunities (the “Restructuring Plan”).

The Restructuring Plan included the reduction of our workforce by approximately 16%.

We may encounter challenges as a result of these restructuring efforts and our reduction in force that could prevent us from recognizing the intended benefits of the Restructuring Plan or otherwise adversely affect our business, results of operations and financial condition.

As of March 31, 2024, the execution of the Restructuring Plan was completed.

As a result of the Restructuring Plan, we have incurred and may continue to incur additional costs in the short term, including cash expenditures for employee transition, notice period and severance payments, employee benefits, related facilitation costs non-cash expenditures related to acceleration of vesting of share-based awards and other significant one-time costs.

For example, in connection with the Restructuring Plan, we permanently closed certain idle office spaces in Plano, Texas, Los Angeles, California and Toronto, Canada, which resulted in an impairment loss of $3.6 million recorded in 2023.

These additional cash and non-cash expenditures could have the effect of reducing our operating margins.

Our Restructuring Plan may result in other unintended consequences, including employee attrition beyond our intended reduction in force, which may also be further exacerbated by the actual or perceived declining value of our equity awards;

damage to our corporate culture and decreased employee morale among our remaining employees;

diversion of management attention;

damage to our reputation as an employer, which could make it more difficult for us to hire new employees in the future;

and the loss of institutional knowledge and expertise of departing employees.

If we experience any of these adverse consequences, our Restructuring Plan may not achieve or sustain its intended benefits, or the benefits, even if achieved, may not be adequate to meet our long-term profitability and operational expectations, which could adversely affect our business, results of operations and financial condition.

In addition, our Restructuring Plan could lead us to fail to meet, or cause delays in meeting, our operational and growth targets.

While positions have been eliminated, functions that they performed remain necessary to our operations, and we may be unsuccessful in effectively and efficiently distributing the duties and obligations of departed employees among our remaining employees.

The Restructuring Plan could also prevent us from pursuing new opportunities and initiatives or require us to adjust our growth strategy.

As we continue to identify areas of cost savings and operating efficiencies, we may consider implementing further measures to reduce operating costs and improve operating margins.

We may not be successful in implementing such initiatives, including as a result of factors beyond our control.

If we are unable to realize the anticipated savings and efficiencies from our Restructuring Plan and/or accomplish our business and strategic initiatives, our business, results of operations and financial condition could be materially and adversely affected.

Our business and growth depend substantially on customers renewing and expanding their subscriptions with us.

3 unchanged sentences

Our customers have no obligation to renew their subscriptions with us and we may not be able to accurately predict customer renewal rates.

Our customers’ renewal rates may decline or fluctuate as a result of a number of factors, including their satisfaction or dissatisfaction with our new or current product offerings, our pricing, the effects of economic conditions, including due to a global economic slowdown, inflation, foreign currency exchange rate fluctuation, the Russia-Ukraine war, the ongoing conflicts in the Middle East and any global economic uncertainty and financial market disruptions, competitive offerings, our customers' perception of their exposure, or alterations or reductions in their spending levels.

Our customers’ renewal rates may decline or fluctuate as a result of a number of factors, including their satisfaction or dissatisfaction with our new or current product offerings, our pricing, the effects of economic conditions, including due to a global economic slowdown, inflation, foreign currency exchange rate fluctuation, and any global economic uncertainty and financial market disruptions, competitive offerings, our customers' perception of their exposure, or alterations or reductions in their spending levels.

If our customers do not renew their agreements with us or renew on terms less favorable to us, our revenues and results of operations may be adversely impacted.

3 unchanged sentences

Our business substantially depends on, and we expect our business to continue to substantially depend on, sales of our platform solutions, including our Command Platform.

As such, market acceptance of our platform solutions is critical to our continued

As such, market acceptance of our platform solutions is critical to our continued success.

Demand for our platform solutions is affected by a number of factors beyond our control, including continued market acceptance of cloud-based offerings, the timing of development and release of new products by our competitors, technological change, and growth or contraction in our market and the economy in general.

3 unchanged sentences

When we develop a new or enhanced version of an existing offering, we typically incur expenses and expend resources upfront to market, promote and sell the new offering.

Therefore, when we develop or acquire new or enhanced offerings, their introduction must achieve high levels of market acceptance in order to justify the amount of our investment in developing and bringing them to market.

Therefore, when we develop or acquire new or enhanced offerings, their introduction must achieve high levels of market

acceptance in order to justify the amount of our investment in developing and bringing them to market.

For example, if our recent product expansions and offerings, such as our consolidation offerings, do not garner widespread market adoption and implementation, or our consolidated platform sales approach is not successful, our financial results and competitive position could suffer.

4 unchanged sentences

• the failure of our consolidated platform sales approach in execution or timing or both;

• real or perceived defect, errors or failures;

• real or perceived defects, errors or failures;

• negative publicity about their performance or effectiveness;

2 unchanged sentences

• inability to scale and perform to meet customer demands;

• poor business conditions for our customers, causing them to delay IT purchases, including as a result of the COVID-19 pandemic;

• poor business conditions for our customers, causing them to delay IT purchases;

• reluctance of customers to purchase cloud-based offerings.

3 unchanged sentences

The market for SecOps solutions, including our Command Platform, is highly fragmented, intensely competitive and constantly evolving.

We compete with an array of established and emerging security software and services vendors.

With the introduction of new technologies and market entrants, we expect the competitive environment to remain intense going forward.

The markets we operate in are highly competitive, fragmented, and subject to technology change and innovation.

We primarily compete with established and emerging security product vendors, including the large companies that incorporate security products into their products;

XDR and SIEM vendors;

cloud security vendors;

vulnerability risk management vendors;

application security vendors;

threat intelligence vendors;

and legacy security, systems management, MSSP, and other IT vendors.

We primarily compete with large companies that incorporate security products into their products, security platform providers, MDR service providers, XDR and SIEM vendors, cloud security vendors, exposure management vendors, vulnerability risk management vendors, application security vendors, threat intelligence vendors and legacy security, systems management, MSSP, and other IT vendors.

Some of our actual and potential competitors have advantages over us, such as longer operating histories, significantly greater financial, technical, marketing or other resources, stronger brand and business user recognition, larger and more mature intellectual property portfolios and broader global distribution and presence.

In addition, our industry is evolving rapidly and is becoming increasingly competitive.

Larger and more established companies may focus on security operations and could directly compete with us.

2 unchanged sentences

With the introduction of new technologies, the evolution of our offerings and new market entrants, we expect competition to intensify in the future.

Conditions in our market could change rapidly and significantly as a result of technological advancements, including with respect to AI.

Our competitors may more successfully incorporate AI into their products, gain or leverage superior access to certain AI technologies, and achieve higher market acceptance of their AI solutions.

In addition, advancements in AI, automation, and related technologies may accelerate feature parity or commoditization of certain software capabilities across the industry, which could increase pricing pressure, reduce differentiation among offerings, or shorten product life cycles.

For further discussion of the risks related to AI, please see below under “Risks Related to Intellectual Property, Litigation and Government Regulation”.

1 unchanged sentence

As a result, customers may choose a bundled product offering from our competitors, even if individual products have more limited functionality than our solutions.

These competitors may also offer their products at a lower price as part of this larger sale, which could increase pricing pressure on our offerings and cause the average sales price for our offerings to decline.

These competitors may also offer their products at a lower price as part of this larger sale, which could increase pricing pressure on our offerings and cause the average sales

price for our offerings to decline.

These larger competitors are also often in a better position to withstand any significant reduction in spending by customers, and will therefore not be as susceptible to economic downturns.

Customers are increasingly seeking to consolidate security vendors and standardize on integrated security operations platforms and managed services.

As customers evaluate fewer strategic vendors, we may face increased competition for “platform” selection, longer sales cycles, greater pricing pressure and a higher risk that customers reduce or eliminate spend on our products and services in favor of competing platforms or providers.

In addition, our ability to benefit from these trends depends on our continued ability to deliver effective integration across complex customer environments and to maintain high service quality in our managed offerings.

Furthermore, our current and potential competitors may establish cooperative relationships among themselves or with third parties that may further enhance their resources and product and services offerings in the markets we address.

5 unchanged sentences

If our competitors are more successful than we are in developing new product and service offerings or in attracting and retaining customers, our business, financial condition and results of operations could be adversely affected.

Prolonged economic uncertainties or downturns could adversely affect our business.

Prolonged economic uncertainties or downturns could adversely affect our business operations or financial results.

Negative conditions in the general economy in either the United States or abroad, including conditions resulting from financial and credit market fluctuations, changes in economic policy, inflation, foreign currency exchange rate fluctuations, trade uncertainty, including changes in tariffs, sanctions, international treaties, and other trade restrictions, the occurrence of a natural disaster, outbreaks of epidemics or pandemics, political unrest and social strife, including acts of terrorism, and armed conflicts, have caused and could continue to cause a decrease in corporate spending on security offerings or information technology in general and negatively affect the rate of growth of our business.

As a result, our current or prospective customers in these industries may delay or cancel information technology projects or seek to lower their costs by renegotiating vendor contracts.

For example, due to economic volatility as a result of inflationary pressures and other global events, we have and may continue to see delays in our sales cycle, failures of customers to renew at all or to renew the anticipated scope of their subscriptions with us, requests from customers for payment term deferrals as well as pricing or bundling concessions, which, if significant, could materially and adversely affect our business, results of operations and financial condition.

Also, customers may choose to develop in-house software as an alternative to using our offerings.

Moreover, competitors may respond to market conditions by lowering prices and attempting to lure away our customers.

In addition, the increased pace of consolidation in certain industries may result in reduced overall spending on our offerings.

In addition, adverse economic conditions, including inflation, may also increase the costs of operating our business, including vendor, supplier and workforce expenses.

We cannot predict the timing, strength or duration of any economic slowdown, instability or recovery, generally or within any particular industry or geography.

Although we expect that our current cash and cash equivalent and investments balances, together with cash flows that are generated from operations and availability under our revolving credit facility, will be sufficient to meet our domestic and international working capital needs and other capital and liquidity requirements for at least the next 12 months, if the economic conditions of the general economy or industries in which we operate worsen from present levels, our business operations and financial results could be adversely affected.

If we are unable to successfully hire, train, and retain qualified personnel our business may suffer.

5 unchanged sentences

Our workforce evolved to a hybrid-first model following the COVID-19 pandemic, which requires regular in-office attendance but utilizes a hybrid approach.

While we intend to continue iterating our approach to

ensure we are balancing the needs of the business with the desires of our people, we may face difficulty in hiring and retaining our workforce as a result of this shift to have greater in-office attendance.

While we intend to continue iterating our approach to ensure we are balancing the needs of the business with the desires of our people, we may face difficulty in hiring and retaining our workforce as a result of this shift to have greater in-office attendance.

If we are unable to attract new employees and retain our current employees, we may not be able to adequately develop and maintain new products or service offerings or market our existing products or service offerings at the same levels as our competitors and we may, therefore, lose customers and market share.

5 unchanged sentences

Any failure to preserve our culture could negatively affect our future success, including our ability to attract, motivate and retain personnel and effectively focus on and pursue our business strategy.

Our hybrid working model and use of service providers with remote working arrangements also subject us to heightened operational risks.

Our hybrid working model and use of service providers with remote working arrangements also subjects us to heightened operational risks.

For example, technologies in our employees’ and service providers’ homes when they are working remotely may not be as robust as in our offices and could cause the networks, information systems, applications, and other tools available to employees and service providers to be more limited or less reliable than in our offices.

10 unchanged sentences

Our growth strategy is dependent, in part, on our continued international expansion.

For example, in April 2025, we opened a new Global Capability Center in Pune, India, to serve as an innovation hub and SOC.

We expect to conduct a significant amount of our business with organizations that are located outside the United States, particularly in Europe and Asia.

We cannot assure you that our expansion efforts into international markets will be successful in creating further demand for our products and service offerings or in effectively selling our products and service offerings in the international markets that we enter.

international markets that we enter.

Our current international operations and future initiatives will involve a variety of risks, including:

2 unchanged sentences

• trade and foreign exchange restrictions;

• economic or political instability or uncertainty in foreign markets and around the world;

• economic or political instability or uncertainty in foreign markets and around the world, including in response to tariffs and retaliatory tariffs;

• foreign currency exchange rate fluctuations;

11 unchanged sentences

• costs associated with language localization of our products;

• increased exposure to climate change, natural disasters, acts of war (including the Russia-Ukraine war and the ongoing conflicts in the Middle East), terrorism, epidemics, or pandemics and other health crises;

• increased exposure to climate change, natural disasters, acts of war, terrorism, epidemics, or pandemics and other health crises;

• costs of compliance with multiple and possibly overlapping tax structures.

5 unchanged sentences

Violations of laws or key control policies by our employees, contractors, channel partners or agents could result in delays in revenue recognition, financial reporting misstatements, fines, penalties or the prohibition of the importation or exportation of our products and could have a material adverse effect on our business and results of operations.

Further, in late February 2022, Russian military forces launched a significant military action against Ukraine.

While our business and operations have not been significantly impacted, it is not possible to predict the broader or longer-term consequences of this crisis.

Consequences of the crisis could include further sanctions, embargoes, regional instability, geopolitical shifts and adverse effects on macroeconomic conditions, security conditions, currency exchange rates and financial markets.

There can be no assurance that the Russia-Ukraine war, including any resulting sanctions, export controls or other restrictive actions, will not have a material adverse impact on our future operations and results.

If we are unable to successfully manage the challenges of international expansion and operations, our business and operating results could be adversely affected.

5 unchanged sentences

Accordingly, the effect of significant downturns in sales and market acceptance of our products and potential changes in our rate of renewals may not be fully reflected in our results of operations until future periods.

Our model also makes it difficult for us to rapidly increase our revenue through additional sales in any period, as revenue from new customers generally will be recognized over the applicable term.

also makes it difficult for us to rapidly increase our revenue through additional sales in any period, as revenue from new customers generally will be recognized over the applicable term.

We also intend to increase our investment in research and development, sales and marketing, and general and administrative functions and other areas to grow our business.

16 unchanged sentences

Achieving the anticipated benefits of past or future acquisitions will depend in part upon whether we can integrate acquired operations, products and technology in a timely and cost-effective manner and successfully market and sell these as new product offerings, or as new features within our existing offerings.

For example, on July 3, 2024, we acquired Noetic Cyber, Inc.

(“Noetic”), a provider of cyber attack surface management technology.

The integration of any acquisition may prove to be difficult due to the necessity of coordinating geographically separate organizations and integrating personnel with disparate business backgrounds and accustomed to different corporate cultures and business operations and internal systems.

4 unchanged sentences

In addition, we may only be able to conduct limited due diligence on an acquired company’s operations or may discover that the products or technology acquired were not as capable as we thought based upon the initial or limited due diligence.

Following an acquisition, we may be subject to unforeseen liabilities arising from an acquired company’s past or present operations and these liabilities may be greater than the warranty and indemnity limitations that we negotiate.

Following an acquisition, we may be subject to unforeseen liabilities arising from an acquired company’s past or present

operations and these liabilities may be greater than the warranty and indemnity limitations that we negotiate.

Any unforeseen liability that is greater than these warranty and indemnity limitations could have a negative impact on our financial condition.

3 unchanged sentences

Some of those key assumptions relate to the impact of macroeconomic pressures on our business and the timing and scope of economic recovery globally, which are inherently difficult to predict.

While presented with numerical specificity, this guidance is necessarily speculative in nature, and is inherently subject to significant business, economic and competitive

uncertainties and contingencies, many of which are beyond our control and are based upon specific assumptions with respect to future business decisions or economic conditions, some of which may change.

While presented with numerical specificity, this guidance is necessarily speculative in nature, and is inherently subject to significant business, economic and competitive uncertainties and contingencies, many of which are beyond our control and are based upon specific assumptions with respect to future business decisions or economic conditions, some of which may change.

This guidance, which inherently consists of forward-looking statements, is also qualified by, and subject to, assumptions, estimates and expectations as of the date given.

21 unchanged sentences

The promotion of our brand requires us to make substantial expenditures, and we anticipate that the expenditures will increase as our market becomes more competitive, as we expand into new markets and as more sales are generated through our channel partners.

To the extent that these activities yield increased revenues, these revenues may not offset the increased expenses we incur.

To the extent that these activities yield increased revenues, these revenues may not offset the increased expenses we

If we do not successfully maintain and enhance our brand, our business may not grow, we may have reduced pricing power relative to competitors with stronger brands, and we could lose customers and channel partners, all of which would adversely affect our business operations and financial results.

2 unchanged sentences

From time to time, there may be changes in our senior management team resulting from the termination or departure of our executive officers and key employees.

Our senior management and key employees are

employed on an at-will basis, which means that they could terminate their employment with us at any time.

Our senior management and key employees are employed on an at-will basis, which means that they could terminate their employment with us at any time.

The temporary or permanent loss of the services of our senior management, particularly Mr.

19 unchanged sentences

We generate a portion of our revenue from our vulnerability management offerings that help organizations achieve and maintain compliance with regulations and industry standards both domestically and internationally.

For example, many of our customers subscribe to our vulnerability management offerings to help them comply with the security standards developed and maintained by the Payment Card Industry Security Standards Council (the “PCI Council”), which apply to companies that process, transmit or store cardholder data.

process, transmit or store cardholder data.

In addition, our vulnerability management offerings are used by customers in the health care industry to help them comply with numerous federal and state laws and regulations related to patient privacy.

2 unchanged sentences

Governments and industry organizations, such as the PCI Council, may also adopt new laws, regulations or requirements, or make changes to existing laws or regulations, that could impact the demand for, or value of, our products.

If we are unable to adapt our products to changing legal and regulatory standards or other requirements in a timely manner, or if our products fail to assist with, or expedite, our customers’ cybersecurity defense and compliance efforts, our customers may lose confidence in our products and could switch

to products offered by our competitors or threaten or bring legal actions against us.

In addition, if laws, regulations or standards related to data security, vulnerability management and other IT security and compliance requirements are relaxed or the penalties for non-compliance are changed in a manner that makes them less onerous, our customers may view government and industry regulatory compliance as less critical to their businesses, and our customers may be less willing to purchase our products.

4 unchanged sentences

Selling to government entities can be highly competitive, expensive and time consuming, and often requires significant upfront time and expense without any assurance that we will win a sale.

In addition, certain government customers require our products and service offerings to obtain and maintain specific security certifications or authorizations, such as Federal Risk and Authorization Management Program (“FedRAMP”) authorization or similar federal, state or local government accreditations, before they may be deployed.

The process of obtaining and maintaining such certifications can be costly, time consuming and subject to evolving standards and ongoing compliance requirements, and there can be no assurance that we will obtain, maintain or timely renew any required authorization.

If we fail to do so, or if applicable requirements change, we may be unable to sell to certain government customers or may incur additional costs, which could adversely affect our public sector revenue.

Government demand and payment for our products and service offerings may also be impacted by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our offerings.

Actual or threatened government shutdowns, continuing resolution, sequestration and other fiscal or budgetary disruptions may delay procurements, contract awards, renewals and payments, reduce spending on cybersecurity initiatives and otherwise adversely affect our public sector revenue and cash flows.

Government entities also have heightened sensitivity surrounding the purchase of cybersecurity solutions due to the critical importance of their IT infrastructures, the nature of the information contained within those infrastructures and the fact that they are highly-visible targets for cyber attacks.

For example, the conflict in Ukraine and associated activities in Ukraine and Russia may increase the risk of cyberattacks on various types of infrastructure and operations, and the United States government has warned companies to be prepared for a significant increase in Russian cyberattacks in response to the sanctions on Russia.

For example, as the United States government has warned, the conflict in Ukraine has led to increasingly sophisticated cyberattacks on various types of infrastructure and operations in response to the sanctions on Russia.

Accordingly, increasing sales of our products and service offerings to government entities may be more challenging than selling to commercial organizations.

10 unchanged sentences

The exchange rate between the U.S.

dollar and foreign currencies has fluctuated substantially in recent years and may fluctuate in the future, including as a result of geopolitical factors such as the ongoing conflicts in the Middle East including Israel and the surrounding region, which has impacted the exchange rate between the U.S.

dollar and foreign currencies has fluctuated substantially in recent years and may fluctuate

in the future, including as a result of geopolitical factors such as the ongoing conflicts in the Middle East including Israel and the surrounding region, which has impacted the exchange rate between the U.S.

dollar and the Israeli New Shekel.

3 unchanged sentences

These forward contracts and other hedging strategies such as options and foreign exchange swaps related to transaction exposures that we may implement to mitigate this risk in the future may not eliminate our exposure to foreign exchange fluctuations.

Actions that we have taken to restructure our business in alignment with our strategic priorities may not be as effective as anticipated.

In August of 2023, our Board approved the Restructuring Plan designed to improve operational efficiencies, reduce operating costs and better align our workforce with strategic priorities and key growth opportunities.

The Restructuring Plan included the reduction of our workforce by approximately 16%.

We may encounter challenges as a result of these restructuring efforts that could prevent us from recognizing the intended benefits of the Restructuring Plan or otherwise adversely affect our business, results of operations and financial condition.

As of March 31, 2024, the execution of the Restructuring Plan was completed.

As a result of the Restructuring Plan, we have incurred additional costs in the short-term, including cash expenditures for employee transition, severance payments, employee benefits, and related facilitation costs as well as non-cash expenditures related to acceleration of vesting of share-based awards.

These additional cash and non-cash expenditures could reduce our operating margins.

Our Restructuring Plan may result in other unintended consequences, including employee attrition beyond our intended reduction in force;

damage to our corporate culture and decreased employee morale among our remaining employees;

diversion of management attention;

damage to our reputation as an employer;

and the loss of institutional knowledge and expertise of departing employees.

In connection with the Restructuring Plan, we permanently closed certain idle office spaces in Plano, Texas, Los Angeles, California and Toronto, Canada, which resulted in an impairment loss of $3.6 million recorded in 2023.

C hanges in key assumptions in the future, including increasing the discount rate, lowering forecasts for revenue and operating margin, or lowering the long-term growth rate, could result in additional charges;

similarly, one or more changes in these assumptions in future periods due to changes in circumstances could result in future impairments in this reporting unit.

As we continue to identify areas of cost savings and operating efficiencies, we may consider implementing further measures to reduce operating costs and improve operating margins.

We may not be successful in implementing such initiatives, including as a result of factors beyond our control.

Risks Related to Intellectual Property, Litigation and Government Regulation

3 unchanged sentences

We cannot assure you that any patents will issue from any patent applications, that patents that issue from such applications will give us the protection that we seek or that any such patents will not be challenged, invalidated, or circumvented.

that may issue in the future from our pending or future patent applications may not provide sufficiently broad protection and may not be enforceable in actions against alleged infringers.

Any patents that may issue in the future from our pending or future patent applications may not provide sufficiently broad protection and may not be enforceable in actions against alleged infringers.

We have registered the “Rapid7,” “Nexpose” and “Metasploit” names and logos in the United States and certain other countries.

37 unchanged sentences

Any of the foregoing events could seriously harm our business, financial condition and results of operations.

We may not be successful in our initiatives that utilize AI, which could adversely affect our business, reputation,

or financial results.

We may not be successful in our initiatives that utilize AI, which could adversely affect our business, reputation, or financial results.

There are significant risks involved in utilizing AI and no assurance can be provided that the usage of such AI will enhance our business or assist our business in being more efficient or profitable.

5 unchanged sentences

If the AI we utilize is incorrectly designed or utilizes training data that is overbroad, incomplete, inadequate or biased in some way, our use of AI may inadvertently reduce our efficiency or cause unintentional or unexpected outputs that are incorrect, do not match our business goals, do not comply with our policies or interfere with the performance of our products and services, business and reputation.

I n addition, employees may inadvertently input confidential, proprietary or personal information into unapproved AI tools, which could result in the loss of trade secrets, unauthorized disclosure of sensitive data, violations of privacy or confidentiality obligations, regulatory scrutiny, litigation or reputational harm.

AI is complex and subject to a rapidly evolving regulatory landscape.

15 unchanged sentences

Disclosing our proprietary source code could allow our competitors to create similar products with lower development effort and time and ultimately, could result in a loss of sales for us.

Disclosing the source code of our proprietary

software could also make it easier for cyber attackers and other third parties to discover vulnerabilities in or to defeat the protections of our products, which could result in our products failing to provide our customers with the security they expect.

Disclosing the source code of our proprietary software could also make it easier for cyber attackers and other third parties to discover vulnerabilities in or to defeat the protections of our products, which could result in our products failing to provide our customers with the security they expect.

Likewise, some open source projects have known security and other vulnerabilities and architecture instabilities, or are otherwise subject to security attacks due to their wide availability, and are provided on an “as-is” basis.

10 unchanged sentences

Changes in export or import laws and regulations, shifts in the enforcement or scope of existing laws and regulations, or changes in the countries, governments, persons, products or services targeted by such laws and regulations, could also result in decreased use of our products by, or in our decreased ability to export or sell our products to, existing or potential customers.

For example, in response to the Russia-Ukraine war, countries such as Canada, the United Kingdom, the European Union, the United States and other countries and organizations have implemented new and stricter sanctions and export controls against officials, individuals, regions, and industries in Russia, Ukraine and Belarus.

For example, in response to the conflict in Ukraine, countries and organizations such as Canada, the United Kingdom, the European Union, and the United States and other countries and organizations have implemented new and stricter sanctions and export controls against officials, individuals, regions, and industries in Russia, Ukraine and Belarus.

Each country’s potential response to such sanctions, export controls, tensions, and military actions could damage or disrupt international commerce and the global economy and could have a material adverse effect on our business and results of operations or impact our ability to continue to operate in affected regions.

6 unchanged sentences

Our ability to use net operating losses to offset future taxable income may be subject to certain limitations.

As of December 31, 2024, we had federal and state net operating loss carryforwards (“NOLs”) of $265.6 million and $306.0 million, respectively, available to offset future taxable income, a portion of which expires in various year s beginning in 2024 if not utilized.

As of December 31, 2025, we had federal and state net operating loss carryforwards (“NOLs”) of $222.6 million and $240.3 million, respectively, available to offset future taxable income, a portion of which expires in various years beginning in 2033 if not utilized.

A lack of future taxable income would adversely affect our ability to utilize these NOLs before they expire.

12 unchanged sentences

Significant judgment is required in evaluating our tax positions and our worldwide provision for taxes.

During the ordinary course of business, there are many activities and transactions for which the ultimate tax determination is uncertain and the relevant taxing authorities may disagree with our determinations as to the income and expenses attributable to specific jurisdictions.

During the ordinary course of business, there are many activities and transactions for which

the ultimate tax determination is uncertain and the relevant taxing authorities may disagree with our determinations as to the income and expenses attributable to specific jurisdictions.

In addition, our tax obligations and effective tax rates could be adversely affected by changes in the relevant tax, accounting and other laws, regulations, principles and interpretations by recognizing tax losses or lower than anticipated earnings in jurisdictions where we have lower statutory rates and higher than anticipated earnings in jurisdictions where we have higher statutory rates, by changes in foreign currency exchange rates, or by changes in the valuation of our deferred tax assets and liabilities.

1 unchanged sentence

If we are unsuccessful in sustaining our tax positions, our financial condition and results of operations would be adversely affected.

For example, during the quarter ended June 30, 2024, we received an initial assessment from the Israel Tax Authority of approximately 324 million Israeli New Shekels (approximately $88 million, based upon exchange rates as of December 31, 2024 between the Israeli New Shekel and the US Dollar) in relation to the fiscal year 2021 operations of one of our subsidiaries in Israel.

For example, during the quarter ended June 30, 2024, we received an initial assessment from the Israel Tax Authority of approximately 324 million Israeli New Shekels (approximately $102 million, based upon current exchange rates between the Israeli New Shekel and the US Dollar) in relation to the fiscal year 2021 operations of one of our subsidiaries in Israel.

If we are unsuccessful in sustaining our tax position in this matter, our financial condition and results of operations will be adversely affected.

4 unchanged sentences

There is no guarantee that our products or service offerings will detect all vulnerabilities and threats, especially in light of the rapidly changing security landscape to which we must respond, including the constantly evolving techniques used by attackers to access or sabotage data.

If we fail to update our solutions in a timely or effective manner to respond to these threats, our customers could experience security breaches.

11 unchanged sentences

We have experienced these errors or defects in the past in connection with new products, acquired products and product upgrades and we expect that these errors or defects will be found from time to time in the future in new, acquired or enhanced products after commercial release.

Defects may cause our products to be vulnerable to attacks, fail to detect vulnerabilities or threats, or temporarily interrupt customers’ networking traffic.

Defects may cause our products to be vulnerable to attacks, cause them to fail to detect vulnerabilities or threats, or temporarily interrupt customers’ networking traffic.

Any errors, defects, disruptions in service or other performance problems with our products may damage our customers’ businesses and could hurt our reputation.

If our products or service offerings fail to detect vulnerabilities or threats for any reason, we may incur significant costs, the attention of our key personnel could be diverted, our customers may delay or withhold payment to us or elect not to renew or other significant customer relations problems may

We may also be subject to liability claims for damages related to errors or defects in our products.

8 unchanged sentences

We expect this dependence on third parties to continue.

More specifically, certain of our products, in particular our cloud-based products, are hosted on cloud providers, which provides us with computing and storage capacity.

More specifically, certain of our products, in particular our cloud-based products, are hosted on cloud providers such as Amazon Web Services, which provides us with computing and storage capacity.

Interruptions in our systems or the third-party systems on which we rely, whether due to system failures, computer viruses, physical or electronic break-ins, or other factors, could affect the security or availability of our products, network infrastructure and website.

15 unchanged sentences

In particular, ransomware attacks, including by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, loss of data and income, reputational harm, and diversion of funds.

While extortion payments may alleviate the negative impact of a ransomware attack, we may be unwilling or unable to make such payments due to, for

example, applicable laws or regulations prohibiting such payments.

While extortion payments may alleviate the negative impact of a ransomware attack, we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments.

Similarly, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our information technology systems (including our products) or the third-party information technology systems that support us and our services.

Such attacks may also include exploitation of vulnerabilities in third-party or open source software code that may be incorporated into our own or our customers’ or supplier’s systems.

Such attacks may also include exploitation of vulnerabilities in third party or open source

software code that may be incorporated into our own or our customers’ or supplier’s systems.

Further, if our systems or those of our third-party service providers are breached as a result of third-party action, employee error or misconduct, attackers could learn critical information about how our products operate to help protect our customers’ IT infrastructures from cyber risk, thereby making our customers more vulnerable to cyber attacks.

Additionally, the unauthorized use or misuse of AI by our employees or others may result in the release of customer data to unauthorized parties.

While we maintain measures designed to protect the integrity, confidentiality and security of our data, our security measures could fail and those of our third-party service providers have failed and could fail, any of which could result in unauthorized access to or disclosure, modification, misuse, loss or destruction of such data or financial loss.

17 unchanged sentences

This creates some uncertainty as to the effective legal frameworks and our obligations may be subject to differing applications and interpretations, which may be inconsistent or in conflict among jurisdictions.

Preparation for and compliance with these obligations require us to devote significant resources (including, without limitation, financial and time-

related resources).

Preparation for and compliance with these obligations requires us to devote significant resources (including, without limitation, financial and time-related resources).

These obligations may necessitate changes to our business including our information technologies, systems and practices and to those of any third parties that process personal data on our behalf.

3 unchanged sentences

These consequences may include but are not limited to:

government enforcement actions (e.g., investigations, fines, penalties, audits, inspections and similar consequences);

enforcement actions (e.g., investigations, fines, penalties, audits, inspections and similar consequences);

litigation (including class-related claims);

38 unchanged sentences

Additionally, in July 2023, the European Commission adopted an adequacy decision concluding that the United States ensures an adequate level of protection for personal data transferred from Europe under the EU-U.S.

Framework (followed on October 2023 with the adoption of an adequacy decision in the UK for the UK-U.S.

Data Privacy Framework (followed on October 2023 with the adoption of an adequacy decision in the UK for the UK-U.S.

Data Bridge).

1 unchanged sentence

If we cannot implement and maintain a valid mechanism for cross-border personal data transfers, we may face increased exposure to regulatory actions, substantial fines and injunctions against processing (including prohibitions on transferring personal data out of the EU and UK).

This may also reduce demand for our services from companies subject to European Data Protection Laws.

This may also reduce demand for our services from companies subject to

European Data Protection Laws.

Loss of our ability to import personal data from Europe may also require us to increase our data processing capabilities in Europe at significant expense.

7 unchanged sentences

Organizations may be reluctant to purchase our cloud-based offerings due to the actual or perceived vulnerability of cloud solutions.

Some organizations have been reluctant to use cloud solutions for cybersecurity, such as our InsightVM, InsightIDR, InsightAppSec, InsightConnect, InsightCloudSec and Threat Intelligence, because they have concerns regarding the risks associated with the reliability or security of the technology delivery model associated with this solution.

Some organizations have been reluctant to use cloud solutions for cybersecurity, such as our vulnerability management, next-generation SIEM, application security, SOAR, cloud security and threat intelligence offerings, because they have concerns regarding the risks associated with the reliability or security of the technology delivery model associated with these solutions.

If we or other cloud service providers experience security incidents, breaches of customer data, disruptions in service delivery or other problems, the market for cloud solutions as a whole may be negatively impacted, which could harm our business.

36 unchanged sentences

In the future, we may sell additional shares of our common stock or equity-linked securities to raise capital.

In addition, a substantial number of shares of our common stock is reserved for issuance upon the exercise of stock options, settlement of other equity incentive awards and upon conversion of the 2025 Notes, 2027 Notes and 2029 Notes (the “Notes”).

The indentures for the Notes do not restrict our ability to issue additional common stock or equity-linked securities in the future.

4 unchanged sentences

We may not have sufficient cash flow from our business to pay our substantial debt when due.

In May 2020, we issued $230.0 million aggregate principal amount of 2025 Notes, in March 2021, we issued $600.0 million aggregate principal amount of 2027 Notes and in September 2023, we issued $300.0 million aggregate principal amount of 2029 Notes.

In March 2021, we issued $600.0 million aggregate principal amount of 2027 Notes and in September 2023, we issued $300.0 million aggregate principal amount of 2029 Notes.

In September 2023, concurrently with the issuance of the 2029 Notes, we used $201.0 million of the proceeds from the issuance of the 2029 Notes to repurchase and retire $184.0 million aggregate principal amount of the 2025 Notes.

In addition, we may also incur indebtedness under our revolving credit facility.

Our indebtedness may:

6 unchanged sentences

Further, the indentures governing the Notes do not restrict our ability to incur additional indebtedness, secure existing or future debt, recapitalize our existing or future debt or take a number of other actions that could intensify the risks discussed above and below.

Further, we and our subsidiaries may incur substantial additional indebtedness in the future (some of which may be secured indebtedness), subject to the restrictions contained in any future debt instruments existing at the time.

Further, we and our subsidiaries may incur substantial additional indebtedness in the future, subject to the restrictions contained in our revolving credit facility and any future debt instruments existing at the time, some of which may be secured indebtedness.

While our revolving credit facility restricts our ability to incur additional indebtedness, if our revolving credit facility is terminated, we may not be subject to such restrictions.

Our ability to pay our debt when due or to refinance our indebtedness, including the Notes, depends on our future performance, which is subject to economic, financial, competitive, and other factors beyond our control.

4 unchanged sentences

We may not be able to engage in any of these activities or engage in these activities on desirable terms, which could result in a default on our debt obligations.

In addition, our revolving credit facility contains, and any future additional indebtedness that we may incur may contain, financial and other restrictive covenants that limit our ability to operate our business, raise capital, pay dividends and/or make payments under our other indebtedness.

If we fail to comply with these covenants or to make payments under our indebtedness when due, then we would be in default under that indebtedness, which could, in turn, result in that and our other indebtedness becoming immediately payable in full.

Any such event of default under our revolving credit facility would give the lenders the right to terminate their commitments to provide additional loans under our revolving credit facility and to declare any and all borrowings outstanding, together with accrued and unpaid interest and fees, to be immediately due and payable.

In addition, the lenders under our revolving credit facility would have the right to proceed against the collateral in which we granted a security interest to them, which consists of substantially all our assets.

If the debt under our revolving credit facility were to be accelerated, we may not have sufficient cash or be able to borrow sufficient funds to refinance the debt or sell sufficient assets to repay the debt, which could immediately materially and adversely affect our cash flows, business, results of operations, financial condition and our ability to make payments under our indebtedness, including the Notes, when due.

Further, the terms of any new or additional financing may be on terms that are more restrictive or on terms that are less desirable to us.

The conditional conversion feature of the Notes, if triggered, may adversely affect our financial condition and operating results.

1 unchanged sentence

If one or more holders elect to convert their Notes, unless we elect to satisfy our conversion obligation by delivering solely shares of our common stock (other than paying cash in lieu of delivering any fractional share), we would be required to settle a portion or all of our conversion obligation in cash, which could adversely affect our liquidity.

As of December 31, 2024, the 2027 Notes and the 2029 Notes were not convertible at the option of the holders.

The 2025 Notes became convertible at the option of the holders effective November 1, 2024.

Whether the 2027 Notes or the 2029 Notes will be convertible following the year ended December 31, 2024 will depend on the future satisfaction of a conversion condition.

As of December 31, 2025, the 2027 Notes and the 2029 Notes were not convertible at the option of the holder.

Whether the Notes will be convertible following the year ended December 31, 2025, will depend on the future satisfaction of a conversion condition.

In addition, even if holders of Notes do not elect to convert their Notes, we could be required under applicable accounting rules to reclassify all or a portion of the outstanding principal of the Notes as a current rather than long-term liability, which would result in a material reduction of our net working capital.

The capped call transactions may affect the value of the Notes and our common stock.

In connection with the issuance of the 2025 Notes, the 2027 Notes and the 2029 Notes, we entered into capped call transactions with certain counterparties (the “Capped Calls”).

We entered into capped call transactions with certain counterparties in connection with the issuance of the 2025 Notes (the “2025 Capped Calls”), the 2027 Notes (the “2027 Capped Calls”), and the 2029 Notes (the “2029 Capped Calls” and, together with the 2025 Capped Calls and the 2027 Capped Calls, the “Capped Calls”).

The Capped Calls cover, subject to customary adjustments, the number of shares of our common stock initially underlying each of the 2025 Notes, the 2027 Notes and the 2029 Notes.

1 unchanged sentence

In connection with establishing their initial hedge of the capped call transactions, the counterparties or their respective affiliates entered into various derivative transactions with respect to our common stock concurrently with or shortly after the pricings of the respective Notes, including with certain investors in the applicable Notes.

The counterparties and/or or their respective affiliates may modify or unwind their hedge positions by entering into or unwinding various derivatives with respect to our common stock and/or purchasing or selling our common stock or other securities of ours in secondary market transactions prior to the maturity of the applicable Notes (and are likely to do so on each exercise date of the capped call transactions, which are scheduled to occur during the applicable observation period relating to any conversion of the 2025 Notes on or after November 1, 2024, relating to any conversion of the 2027 Notes on or after December 15, 2026 or relating to any conversion of the 2029 Notes on or after December 15, 2028, in each case that is not in connection with a redemption).

15, 2026 or relating to any conversion of the 2029 Notes on or after December 15, 2028, in each case that is not in connection with a redemption).

The 2025 Capped Calls expired in full on April 29, 2025.

We did not elect to exercise any portion of the 2025 Capped Calls prior to expiration.

We cannot make any prediction as to the direction or magnitude of any potential effect that the transactions described above may have on the prices of the Notes or the shares of our common stock.

4 unchanged sentences

Recent global economic conditions have resulted in the actual or perceived failure or financial difficulties of many financial institutions.

option counterparty becomes subject to insolvency proceedings, we will become an unsecured creditor in those proceedings with a claim equal to our exposure at the time under such transaction.

If an option counterparty becomes subject to insolvency proceedings, we will become an unsecured creditor in those proceedings with a claim equal to our exposure at the time under such transaction.

Our exposure will depend on many factors but, generally, our exposure will increase if the market price or the volatility of our common stock increases.

3 unchanged sentences

The conversion of some or all of the Notes will dilute the ownership interests of existing stockholders to the extent we deliver shares of our common stock upon conversion of any of the Notes.

As disclosed in Note 11, Debt , as of December 31, 2024, the 2027 Notes and the 2029 Notes were not convertible at the option of the holder.

As disclosed in Note 10, Debt , as of December 31, 2025 the Notes were not convertible at the option of the holder.

Any sales in the public market of the common stock issuable upon such conversion could adversely affect prevailing market prices of our common stock.

4 unchanged sentences

In certain jurisdictions, these regulatory requirements may be more stringent than those in the United States.

These laws and regulations may also impact our innovation and business drivers in developing new and emerging technologies, including those related to AI and machine learning.

These laws and regulations may also impact our innovation and business drivers in developing new and emerging technologies, including those related to AI.

Noncompliance with applicable regulations or requirements could subject us to investigations, sanctions, mandatory product recalls, enforcement actions, disgorgement of profits, fines, damages, civil and criminal penalties, injunctions or other collateral consequences.

6 unchanged sentences

In the event we or our channel partners are hindered by any of the events discussed above, our ability to provide our products or service offerings to customers could be delayed.

In addition, our facilities and those of our third-party data centers and hosting providers are vulnerable to damage or interruption from human error, intentional bad acts, pandemics, earthquakes, hurricanes, floods, fires, war (including the Russia-Ukraine war and the ongoing conflicts in the Middle East), terrorist attacks, power losses, hardware failures, systems failures, telecommunications failures and similar events.

The occurrence of a public health crisis, climate change, natural disaster, power failure, war (including the Russia-Ukraine war and the ongoing conflicts in the Middle East) or an act of terrorism, vandalism or other misconduct, a decision by a third party to close a facility on which we rely without adequate notice, or other unanticipated problems could result in lengthy interruptions in provision or delivery of our products, potentially leaving our customers vulnerable to cyber attacks.

In addition, our facilities and those of our third-party data centers and hosting providers are vulnerable to damage or interruption from human error, intentional bad acts, pandemics, earthquakes, hurricanes, floods, fires, war, terrorist attacks, power losses, hardware failures, systems failures, telecommunications failures and similar events.

The occurrence of a public health crisis, climate change, natural disaster, power failure, war or an act of terrorism, vandalism or other misconduct, a decision by a third party to close a facility on which we rely without adequate notice, or other unanticipated problems could result in lengthy interruptions in provision or delivery of our products, potentially leaving our customers vulnerable to cyber attacks.

The occurrence of any of the foregoing events could damage our systems and hardware or could cause them to fail completely, and our insurance may not cover such events or may be insufficient to compensate us for the potentially significant losses, including the potential harm to the future growth of our business, that may result from interruptions in our service as a result of system failures.

20 unchanged sentences

Changes to existing rules or the questioning of current practices may adversely affect our operating results.

If our goodwill or intangible assets become impaired, we may be required to record a significant charge to earnings.

We review our goodwill and intangible assets for impairment when events or changes in circumstances indicate the carrying value may not be recoverable, such as declines in our stock price, market capitalization, or cash flows and slower growth rates in our industry.

Goodwill is required to be tested for impairment at least annually.

If we are required to record a significant charge in our financial statements during the period in which any impairment of our goodwill or intangible assets is determined, that would negatively affect our operating results.

We may require additional capital to support business growth, and this capital might not be available on acceptable terms, if at all.

1 unchanged sentence

Accordingly, we may need to engage in equity or debt financings to secure additional funds.

If we raise additional funds through future issuances of equity or convertible debt securities, our existing stockholders could suffer significant dilution, and any new equity securities we issue could have rights, preferences and privileges superior to those of holders of our common stock.

privileges superior to those of holders of our common stock.

Any debt financing that we may secure in the future could involve restrictive covenants relating to our capital raising activities and other financial and operational matters, which may make it more difficult for us to obtain additional capital and to pursue business opportunities, including potential acquisitions.

5 unchanged sentences

Any delay in our ability to access our cash, cash equivalents and investments (or the loss of some or all of such funds) could have a material adverse effect on our operations and cause us to need to seek additional capital sooner than planned which could only be available at a higher cost or not at all.

require it, our ability to continue to support our business growth and to respond to business challenges could be significantly impaired, and our business may be adversely affected.

Although we expect that current cash and cash equivalent balances and cash flows that are generated from operations will be sufficient to meet our domestic and international working capital needs and other capital and liquidity requirements for at least the next 12 months, if we are unable to obtain adequate financing or financing on terms satisfactory to us if and when we require it, our ability to continue to support our business growth and to respond to business challenges could be significantly impaired, and our business may be adversely affected.

Our business could be negatively affected as a result of actions of activist stockholders or others.

1 unchanged sentence

Such activist stockholders frequently propose to involve themselves in the governance, strategic direction and operations of companies, including companies’ efforts regarding environmental, sustainability and governance standards.

For example, JANA Partners Management, LP, an activist investor, has reported, as of December 17, 2024 that it holds an approximate 5.8% beneficial ownership interest in our outstanding common stock.

For example, JANA Partners Management, LP, an activist investor ("JANA"), has reported, as of August 2025 that it holds an approximate 10.1% beneficial ownership interest in our outstanding common stock.

Kevin Galligan, a Partner and Director of Research at JANA, has also served as a member of our Board since April 2025.

Responding to actions from activist stockholders can be costly and time-consuming, disrupt our business and operations, and divert the attention of our board of directors, management, and employees from the pursuit of our business strategies.

10 unchanged sentences

• establish that subsequent to the 2023 annual meeting, each director will hold office for a term of one year;

• require the approval of the holders of a majority of the voting power of all of the then-outstanding shares of capital stock of the Company entitled to vote generally at an election of directors, voting together as a single class, to adopt, amend or repeal our amended and restated bylaws or amend or repeal the provisions of our amended and restated certificate of incorporation regarding the election and removal of directors and the ability of stockholders to take action by written consent or call a special meeting;

• require the approval of the holders of a majority of the voting power of all of the then-outstanding shares of capital stock of Rapid7 entitled to vote generally at an election of directors, voting together as a single class, to adopt, amend or repeal our amended and restated bylaws or amend or repeal the provisions of our amended and restated certificate of incorporation regarding the election and removal of directors and the ability of stockholders to take action by written consent or call a special meeting;

• prohibit cumulative voting in the election of directors;

2 unchanged sentences

If a fundamental change occurs prior to the maturity date of the Notes, holders of the Notes will have the right, at their option, to require us to repurchase all or a portion of their Notes.

In addition, if a “make-whole fundamental change” (as defined in the indentures) occurs prior the maturity date, we will in some cases be required to increase the conversion rate of the Notes for a holder that elects to convert its Notes in connection with such make-whole fundamental change.

In addition, if a “make-whole fundamental change” (as defined in the indentures) occurs prior to the maturity date, we will in some cases be required to increase the conversion rate of the Notes for a holder that elects to convert its Notes in connection with such make-whole fundamental change.

Furthermore, the indentures governing the Notes prohibit us from engaging in certain mergers or acquisitions unless, among other things, the surviving entity assumes our obligations under the Notes.

1 unchanged sentence

In addition, because we are incorporated in Delaware, we are governed by the provisions of Section 203 of the Delaware General Corporation Law, which generally prohibits a Delaware corporation from engaging in any of a broad range of business combinations with any “interested” stockholder for a period of three years following the date on which the stockholder became an “interested” stockholder.

Any of the foregoing provisions could limit the opportunity for our stockholders to receive a

premium for their shares of our common stock and could also affect the price that some investors are willing to pay for our common stock.

Any of the foregoing provisions could limit the opportunity for our stockholders to receive a premium for their shares of our common stock and could also affect the price that some investors are willing to pay for our common stock.

Our amended and restated certificate of incorporation designates the Court of Chancery of the State of Delaware as the exclusive forum for certain litigation that may be initiated by our stockholders, which could limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us.

3 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors