What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-03-06 compared with 2025-03-21 · 55 added, 27 removed, 717 unchanged (10% of the section changed)

ITEM 1A – RISK FACTORS

Our ability to execute our strategies is subject to certain risks.

The risks described under the heading “Risk Factors” immediately following this summary may cause us not to realize the full benefits of our competitive strengths or may cause us to be unable to successfully execute all or part of our strategies.

Our ability to execute our strategies is subject to certain risks and uncertainties, including but not limited to the risks described under the heading “Risk Factors” immediately following this summary.

These risks and uncertainties could adversely affect our business, reputation, financial condition, results of operations, cash flows and the trading price of our common stock and may cause us not to realize the full benefits of our competitive strengths or may cause us to be unable to successfully execute all or part of our strategies.

Some of the more significant challenges and risks we face include the following:

4 unchanged sentences

• risks associated with our substantial indebtedness and our obligations to repay such indebtedness;

• our failure to maintain compliance with Nasdaq’s continued listing requirements, including the $1.00 per share minimum bid price requirement, could result in our common stock’s delisting from Nasdaq, negatively impacting its market price, liquidity and our ability to access capital markets;

• the loss of, and our reliance on, third-party providers, vendors, consultants and software;

6 unchanged sentences

If we are unable to attract new customers, retain existing customers and sell additional services at comparable gross margins to customers, our revenue and results of operations could be adversely affected.

Our ability to maintain or increase our revenues and profit may be impacted by a number of factors, including our ability to attract new customers, retain existing customers and sell additional services at comparable gross margins to our customers.

In addition, as we seek to grow our customer base increasingly through outbound sales, we expect to incur higher customer acquisition costs and, to the extent we are unable to retain and sell additional services to existing customers, our revenue and results of operations may decrease.

Our ability to maintain or increase our revenues and profit may be impacted by a number of factors, including our ability to attract new customers, retain existing customers and sell additional products and services to our customers at comparable gross margins.

In addition, we have and expect to continue to incur higher customer acquisition and retention costs and, to the extent we are unable to retain and sell additional services to existing customers, our revenue and results of operations may decrease.

Growth in the demand for our services may be inhibited and we may be unable to profitably maintain or grow our customer base for a number of reasons, such as:

• our inability to provide compelling services or effectively market them to new and existing customers;

• loss of our favorable relationships with our third-party cloud service providers;

• our inability to develop and/or provide compelling services or effectively market them to new and existing customers;

• loss of favorable relationships with our third-party cloud platform providers;

• customer migration to platforms that we do not have expertise in managing;

6 unchanged sentences

• our inability to strengthen awareness of our brand;

• past or future cybersecurity-related incidents;

• past or future cybersecurity-related incidents targeting us, our customers or our critical suppliers;

• reliability, quality or compatibility problems with our services.

Moreover, we may face difficulty retaining existing customers over the long term.

Moreover, we have faced and expect to continue to face difficulty retaining certain existing customers over the long term.

Certain customer contracts, particularly within our Private Cloud segment, frequently have initial terms (typically from 12 to 36 months) and, unless terminated, may be renewed or automatically extended for shorter, rolling periods after the initial term.

Our customers have no obligation to renew their services after their initial contract periods expire and any termination fees associated with an early termination may not be sufficient to recover our costs associated with such contracts.

New and evolving laws and regulations, including the E.U.

Data Act and similar legislation, may limit our ability to negotiate, structure, or enforce long-term contractual arrangements with customers, which could result in increased compliance costs, contract renegotiations, reduced revenue visibility, or adverse impacts on our business, results of operations, and financial condition.

In addition, most of our services within our Public Cloud segment and legacy OpenStack business are based on a consumption model and can be canceled at any time without penalty.

13 unchanged sentences

This requires us to anticipate and respond to customer demands and preferences, address business model shifts, optimize our go-to-market execution by improving our cost structure, align sales coverage with strategic goals, improve channel execution and strengthen our services and capabilities in our areas of strategic focus.

Any failure to successfully execute our strategies, including any failure to invest in strategic growth areas, could adversely affect our business, financial condition and results of operations.

As an example, we have made and expect to continue to make investments in new technologies, including AI and GenAI.

The adoption and use of new technologies that are still in their early stages involve significant risks and uncertainties.

In addition, investments in technology systems, capabilities, talent and resources may not deliver the benefits or perform as expected, may be replaced or become obsolete more quickly than expected or may reduce or replace some of our current services and offerings.

Any failure to successfully execute our strategies, including any failure to invest in strategic growth areas or for those strategic growth areas to fail to perform as anticipated, could adversely affect our business, financial condition and results of operations.

Our strategies require significant investments that may adversely affect our near-term revenue growth and results of operations.

We expect the implementation of our strategies to require significant investments, and the investments we must make could result in lower gross margins and raise our operating expenses and capital expenditures.

We expect the implementation of our strategies to require significant investments (including investments in AI and GenAI), and the investments we must make could result in lower gross margins and raise our operating expenses and capital expenditures.

The risks and challenges we face in connection with our strategies include upgrading and integrating our service offerings, expanding our professional services capability, expanding into new geographies, growing in geographies where we currently have an existing presence and ensuring that the performance, features and reliability of our service offerings and our customer service remain competitive in a rapidly changing technological environment.

64 unchanged sentences

By way of example, we have non-exclusive managed service provider relationships with AWS, Microsoft and Google and have entered into agreements with colocation service providers to provide us with colocation space.

Our business is highly dependent on our ability to maintain favorable relationships with our third-party cloud infrastructure providers and the ability of those third-party cloud infrastructure providers to provide the services and features that our customers desire.

We have non-exclusive managed service provider relationships with AWS, Microsoft and Google.

Some of our customers first select their cloud infrastructure platform provider and then engage us to provide the managed services for the selected platform and, more often than not, we resell the cloud infrastructure to the customer (although some customers may elect to purchase the cloud infrastructure directly from the providers).

Our agreements with AWS, Microsoft and Google may be terminated at will by the counterparty.

Our business is highly dependent on our ability to maintain favorable relationships with third-party cloud platform providers and the ability of those providers to provide the services and features that our customers desire.

We have non-exclusive managed service provider relationships with AWS, Microsoft, Google, and VMware by Broadcom, among others.

Some of our customers first select their cloud platform and then engage us to provide the managed services and support for the selected environment.

In most cases, we also resell the cloud infrastructure from AWS, Microsoft, and Google, or VMware licenses, to the customer (although some customers may elect to purchase the cloud infrastructure or licenses directly from the providers).

Our agreements with AWS, Microsoft, Google, and VMware by Broadcom may generally be modified or terminated at will or with limited notice by the counterparty.

If we are unable to maintain these relationships on favorable terms, or at all, we may not be able to retain our current customers or attract new customers, which could have a material and adverse effect on our business, financial condition and results of operations.

Further, if our cloud infrastructure providers are unable to provide the types of services and features that meet customer needs, our customers may migrate to alternative cloud infrastructure providers that we may not have the ability to resell and/or support or may not be able to support on a competitive cost structure, which could have a material and adverse effect on our business, financial condition and results of operations.

We rely on our relationships with third-party cloud infrastructure providers to help drive revenue to our business.

Further, if the platform providers are unable to provide the types of services and features that meet customer needs, our customers may migrate to alternative platform providers that we may not have the ability to resell and/or support or may not be able to support on a competitive cost structure, which could have a material and adverse effect on our business, financial condition and results of operations.

Our ability to resell licenses, cloud infrastructure, and deliver managed services for these platforms depends on maintaining our applicable partner statuses and related technical certifications.

We rely heavily on our relationships with third-party platform providers to help drive revenue to our business.

Most of these providers offer services that are complementary to our services;

1 unchanged sentence

These providers may decide in the future to terminate their agreements with us and/or to market and sell a competitor’s or their own services rather than ours, which could cause our revenue to decline.

Also, we derive tangible and intangible benefits from our association with some of these providers, particularly high-profile providers that reach a large number of companies through the Internet.

If a substantial number of these providers terminate their relationship with us, our business, financial condition and results of operations could be adversely affected.

Also, we derive incentives and other tangible and intangible benefits from our association with some of these providers, particularly high-profile providers that reach a large number of companies through the Internet.

If any provider terminates all or a significant portion of its relationship with us, chooses to pursue relationships with all or a portion of our customers directly, or limits or eliminates our participation in preferred partner programs or similar, our business, financial condition and results of operations would be adversely affected.

Our referral and reseller partners provide revenue to our business, and we benefit from our association with them.

23 unchanged sentences

The services we offer also involve the transmission of large amounts of sensitive and proprietary information over public communications networks, as well as the processing and storage of confidential customer information, which may include information subject to stringent domestic and foreign data protection laws, including those governing personally identifiable information, protected health information or other types of sensitive data.

Many of our customers use our products and services in heavily regulated industries, including banking, financial services, insurance, healthcare, critical infrastructure and government sectors, among others.

We also process, store and transmit our own data as part of our business and operations, which may include personally identifiable, confidential or proprietary information.

Cyber-attacks have become more prevalent in our industry, and the techniques used to sabotage or obtain unauthorized access to systems are constantly expanding and evolving.

Cyber-attacks have become more prevalent in our industry, and the techniques used to sabotage or obtain unauthorized access to systems are constantly expanding and evolving, including with the availability of AI and GenAI tools and technologies.

Malicious actors are increasingly sophisticated in their methods, tactics, techniques and procedures, seeking to steal money, gain unauthorized access to, destroy or manipulate data, and disrupt operations, and some of their attacks may not be recognized or discovered until launched or after initial entry into the environment, such as novel or zero-day attacks that are launched before patches are available and defenses can be readied.

Malicious actors are also increasingly developing methods to avoid prevention, detection and alerting capabilities, including employing counter-forensic tactics, making response activities more difficult.

Like many companies, we have experienced these attacks, including a ransomware incident that caused service disruptions for our Hosted Exchange customers, as previously disclosed in December 2022.

In certain cases, our customers choose to host technologies within our infrastructure which are not capable of being updated to protect against cyber-attacks, are not timely updated due to operational constraints or other business decisions, or reach end-of-life status where security patches are no longer available from the vendor.

Like many companies, we have experienced these attacks, including a ransomware incident that caused service disruptions for our Hosted Exchange customers, as previously disclosed in December 2022 and another incident where a malicious actor publicly claimed to have accessed our systems, which claim was repudiated through internal investigations and forensic analysis.

Our dependence upon third-parties for delivery of services introduces additional risks, such as those associated with the ScienceLogic breach which exposed some customer information to unauthorized individuals (but which did not result in a material impact to our customers’ operations).

When these cyber-attacks occur, we respond to these incidents pursuant to our cybersecurity policies and procedures and in accordance with the law.

Our cybersecurity policies and procedures are designed to protect against and mitigate harm from unauthorized access, infrastructure attacks, malicious file attacks, ransomware, data theft, bugs, worms, malicious software programs, remnant data exposure, computer viruses, denial-of-service attacks, accidents, employee error or malfeasance, intentional misconduct by computer “hackers,” state-sponsored cyber-attacks and attempts by outside parties to fraudulently induce our employees or customers to disclose or grant access to our data or our customers’ data.

Our current cybersecurity framework is governed and overseen by the Chief Security Officer (“CSO”).

Our current cybersecurity framework is governed and overseen by a team of cybersecurity professionals led by our Chief Information Security Officer, working together with our executive leadership team and other cross-functional leaders.

The Audit Committee of our Board receives regular cybersecurity updates.

2 unchanged sentences

Nevertheless, our security measures have in the past and may continue to be circumvented or fail to defeat or mitigate cybersecurity attacks.

Additionally, other disruptions can occur, such as infrastructure gaps, hardware and software vulnerabilities, inadequate or missing security controls, exposed or unprotected customer data and the accidental or intentional disclosure of source code or other confidential information by former or current employees.

Additionally, other disruptions can occur, such as infrastructure gaps, hardware and software vulnerabilities, inadequate or missing security controls, exposed or unprotected customer data and the accidental or intentional disclosure confidential information by former or current employees.

In some cases, some legacy or end-of-life technology equipment may be utilized which is not capable of being updated to protect against certain attacks and deploy compensating controls to manage cybersecurity risks as appropriate.

Any such incidents could (i) interfere with the delivery of services to our customers, (ii) impede our customers’ ability to do business, (iii) compromise the security of infrastructure, systems and data, (iv) lead to the dissemination to third parties of proprietary information or sensitive, personal, or confidential data about us, our employees or our customers, including personally identifiable information of individuals involved with our customers and their end users and (v) impact our ability to do business in the ordinary course.

5 unchanged sentences

When customers use our services, they rely on the security of our infrastructure, including hardware and other elements provided by third parties, to ensure the reliability of our services and the protection of their data.

In most cases, the security of customers’ technology and data relies on a shared responsibility model in which we must coordinate appropriate cybersecurity controls with the customer.

We also offer professional services to our customers where we consult on data center solutions and assist with implementations.

6 unchanged sentences

Similar security risks exist with respect to our business partners and the third-party vendors that we rely on for aspects of our IT support services and administrative functions, including the systems owned, operated or controlled by other unaffiliated operators to the extent we rely on such other systems to deliver services to our customers.

Our cybersecurity policies and procedures are designed to vet third-party providers and provide for adequate oversight and cooperation regarding cybersecurity incidents with respect to our third-party vendors, but our ability to monitor our third-party service providers’ data security is limited.

As a result, we are subject to the risk that cyber-attacks on, or other security incidents affecting, our business partners and third-party vendors may adversely affect our business even if an attack or breach does not directly impact our systems.

1 unchanged sentence

In addition, our customers require and expect that we maintain industry-related compliance certifications, such as International Organization for Standardization ("ISO") 27001, Service Organization Controls ("SOC 1, 2, 3") and Payment Card Industry ("PCI"), Federal Information Security Management Act ("FISMA"), Federal Risk and Authorization Management Program ("FedRAMP") and Health Information Trust Alliance (“HITRUST”) in the U.S., Information Security Registered Assessors Program ("IRAP") in Australia and Public Services Network ("PSN") in the U.K.

There are significant costs associated with maintaining existing and implementing any newly-adopted industry-related compliance certifications, including costs associated with retroactively building security controls into services which may involve re-engineering technology, processes and staffing.

These certifications and attestations apply to specified systems, services or processes and do not eliminate cybersecurity risk.

In addition, they are point-in-time references and do not guarantee future performance.There are significant costs associated with maintaining existing and implementing any newly-adopted industry-related compliance certifications, including costs associated with enhancing or implementing additional security controls into services which may involve re-engineering technology, processes and staffing.

The inability to maintain applicable compliance certifications could result in monetary fines, disruptive participation in forensic audits due to a breach, security-related control failures, customer contract breaches, customer churn and brand and reputational harm.

In some cases, customers may host regulated computing workloads which could fall under infrastructure protection mandates that have not been communicated to us.

We work together with our customers in good faith to identify those situations and ensure appropriate regulatory compliance programs and controls are in place where appropriate.

See Item 1C - “Cybersecurity” for additional information.

395 unchanged sentences

We are a highly leveraged company.

As of December 31, 2024, we had $2,449.4 million face value of outstanding indebtedness, in addition to $375.0 m illion of undrawn commitments under the New Revolving Credit Facility and $23.5 million of letters of credit issued thereunder.

As of December 31, 2025, we had $2,429.2 million face value of outstanding indebtedness.

Our outstanding indebtedness as of December 31, 2025 included $270.2 million of borrowings under the FLFO Term Loan Facility, $1,610.0 million of borrowings under the FLSO Term Loan Facility, $61.1 million of borrowings under the Term Loan Facility, $318.6 million of 3.50% FLSO Senior Secured Notes, $125.4 million of 5.375% Senior Notes, and $43.9 million of 3.50% Senior Secured Notes.

In addition, as of December 31, 2025, the New Revolving Credit Facility had total commitments of $375.0 m illion, $60.0 million of outstanding borrowings, and $23.5 million of letters of credit issued thereunder.

For the years ended December 31, 2024 and 2025, w e made total debt service payments, consisting of required principal and interest payments, of approximately $162.1 million and $150.1 million, respectively, which represented 406.2% and 99.2%, respectively, of our cash flow from operations (or 88.9% and 53.4%, respectively, of our cash flow from operations calculated prior to any deductions for cash interest payments).

20 unchanged sentences

To the extent that we incur additional indebtedness or such other obligations, the risk associated with our substantial indebtedness as described above under the risk factor “ Our substantial indebtedness could materially and adversely affect our ability to raise additional capital to fund our operations, limit our ability to react to changes in the economy or our industry and prevent us from making debt service payments ,” including our potential inability to service our debt, will increase.

As of December 31, 2024, we had $375.0 million available for additional borrowing under the New Revolving Credit Facility portion of our New Senior Facilities (with $23.5 million of letters of credit issued thereunder), all of which would be secured.

As of December 31, 2025, we had $291.5 million available for additional borrowing under the New Revolving Credit Facility portion of our New Senior Facilities (including $23.5 million of letters of credit issued thereunder), all of which would be secured.

We may not be able to generate sufficient cash to service all of our indebtedness and to fund our working capital and capital expenditures and may be forced to take other actions to satisfy our obligations under our indebtedness that may not be successful.

62 unchanged sentences

Risks Related to Ownership of Our Common Stock

Our common stock has previously traded below Nasdaq’s $1.00 minimum bid price requirement.

If we fail to maintain compliance with Nasdaq’s continued listing requirements, our common stock could be delisted, which could adversely affect the liquidity and market price of our common stock.

Our common stock is currently listed on the Nasdaq Global Select Market, which imposes certain continued listing requirements, including a minimum bid price requirement of $1.00 per share, requirements relating to minimum market value of securities, stockholders’ equity, and corporate governance standards.

If we fail to maintain compliance with Nasdaq’s continued listing requirements, Nasdaq may initiate procedures to delist our common stock.

A delisting of our common stock could materially and adversely affect our business and investors by, among other things, reducing the liquidity and market price of our common stock, limiting our ability to raise additional capital and access the public equity markets, reducing analyst coverage, impairing our ability to use equity-based compensation to attract and retain employees, increasing volatility in the trading price of our common stock, and generating negative publicity.

The market price of our common stock has experienced significant volatility and has previously traded below $1.00 per share.

Although the closing bid price of our common stock was above $1.00 per share as of the date of this filing, there can be no assurance that it will remain at or above that level.

If our stock price were to decline and remain below $1.00 per share for 30 consecutive business days, we would not be in compliance with Nasdaq’s minimum bid price requirement and could become subject to Nasdaq’s deficiency procedures.

If we are unable to regain compliance during any applicable cure period, we could face potential delisting.

Our stock price may fluctuate significantly.

The market price of our common stock could vary significantly as a result of a number of factors, some of which are beyond our control.

The following factors could affect our stock price:

The following is a non-exhaustive list of additional factors that could affect our stock price:

• our operating and financial performance and prospects;

8 unchanged sentences

• sales of our common stock by us or our stockholders, or the perception that such sales may occur;

• our failure to maintain compliance with Nasdaq’s continued listing requirements, including but not limited to the $1.00 minimum bid price requirement;

• changes in accounting principles, policies, guidance, interpretations or standards;

11 unchanged sentences

As of December 31, 2025 , we had 248.4 million shares of common stock issued and approximately 15.7 million shares of common stock underlying outstanding options and restricted stock under the 2017 Incentive Plan and the 2020 Incentive Plan, and we have reserved an additional 38.5 million shares of common stock for issuance under the 2020 Incentive Plan and 7.8 million shares of common stock for issuance under the ESPP and we may be required to issue additional shares of common stock to an affiliate of ABRY under the merger agreement related to the acquisition of Datapipe.

Also, during the year ended December 31, 2025, we registered 10.0 million shares of common stock for 4.0 million and 6.0 million RSUs and stock options, respectively, granted to our new chief executive officer outside of the 2020 Incentive Plan.

In addition, certain of our existing stockholders, including Apollo and ABRY, have certain rights to require us to register the sale of common stock held by them including in connection with underwritten offerings.

41 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors