What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-03-26 compared with 2024-03-27 · 357 added, 328 removed, 665 unchanged (51% of the section changed)

8 unchanged sentences

Risks Related to Our Business and Industry

• We have a limited operating history, which makes it difficult to evaluate our current business and future prospects and increases the risks associated with your investment.

• We have a limited operating history at our current scale, which makes it difficult to forecast our future results of operations.

• We have a history of losses, anticipate increases in our operating expenses in the future, and may not achieve or sustain profitability.

3 unchanged sentences

• Adverse global macroeconomic conditions or reduced information technology spending could adversely affect our business, operating results, and financial condition.

• A network or data security incident against us, whether actual, alleged, or perceived, would harm our reputation, create liability, and regulatory exposure, and adversely affect our business, operating results, and financial condition.

• A security incident against us or our third-party vendors and service providers, whether actual, alleged, or perceived, would harm our reputation, create liability, and regulatory exposure, and adversely affect our business, operating results, and financial condition.

• Defects, errors, or vulnerabilities in our platform, the failure of our platform to block malware or prevent a security breach, misuse of our platform, or risks of product liability claims would harm our reputation and adversely affect our business, operating results, and financial condition.

• Existing and future acquisitions, strategic investments, partnerships, or alliances could be difficult to identify and integrate, divert the attention of key management personnel, disrupt our business, dilute stockholder value and adversely affect our business, operating results, and financial condition.

• If we are unable to retain our customers, renew and expand our relationships with them, and add new customers, we may not be able to sustain revenue growth, and we may not achieve or maintain profitability in the future.

• If we are unable to retain our customers, renew and expand our relationships with them, and add new customers, or our partners are unable to execute on their purchasing commitments, we may not be able to sustain revenue growth, and we may not achieve or maintain profitability in the future.

• If our platform is not effectively interoperated within our customers’ IT infrastructure, deployments could be delayed or canceled, which would adversely affect our business, operating results, and financial condition.

3 unchanged sentences

Risks Related to Regulatory Matters

• If we fail to adequately protect personal information or other information we collect, process, share, or maintain under applicable laws, our business, operating results, and financial condition could be adversely affected.

• We are subject to laws and regulations affecting our business, including those related to the privacy and data protection of the personal data or other information we collect, process or share.

Our actual or perceived failure to comply with such laws or regulations could harm our business.

• Complying with laws and regulations related to privacy and data protection could result in additional costs and liabilities to us, especially as new laws or regulations are enacted, change or are subject to various interpretations.

Risks Related to Our People

7 unchanged sentences

Risks Related to Our Business and Industry

We have a limited operating history, which makes it difficult to evaluate our current business and future prospects and increases the risks associated with your investment.

We were founded in January 2013 and released our first endpoint security solution in February 2015.

Our limited operating history and financial data may make it difficult to evaluate our current business, future prospects and other trends.

We have encountered, and will continue to encounter, risks and uncertainties frequently experienced by growing companies in rapidly changing industries and sectors, such as the risks and uncertainties described herein.

Any predictions about our future revenue and expenses may not be as accurate as they would be if we had a longer operating history or operated in a more predictable or established market.

We have a limited operating history at our current scale, which makes it difficult to forecast our future results of operations.

As a result of our limited operating history at our current scale and the introduction of new products in recent years, our ability to accurately forecast our future results of operations is limited and is subject to a number of risks and uncertainties, including those described herein.

Any predictions about our future revenue and expenses may not be as accurate as they would be if we had a longer operating history at our current scale or operated in a more predictable or established market.

If our assumptions regarding these risks and uncertainties are incorrect or change due to fluctuations in our markets or otherwise, or if we do not address these risks successfully, our operating and financial results could differ materially from our expectations and our business and operating results would be adversely affected.

We cannot assure you that we will be successful in addressing these and other challenges we may face in the future.

The risks associated with having a limited operating history may be exacerbated by current global macroeconomic conditions.

We cannot assure you that we will be successful in addressing these and other challenges we

may face in the future.

The risks associated with having a limited operating history may be exacerbated by current macroeconomic conditions.

We have a history of losses, anticipate increases in our operating expenses in the future, and may not achieve or sustain profitability.

4 unchanged sentences

While we have historically experienced significant growth in revenue, we cannot predict when or whether we will reach or maintain profitability.

We also expect our operating expenses to increase in the future as we continue to invest for our future growth, including expanding our research and development function to drive further development of our platform, expanding our sales and marketing activities, developing the functionality to expand into adjacent markets, and reaching customers in new geographic locations, which will negatively affect our operating results if our total revenue does not increase.

In addition to the anticipated costs to grow our business, we have incurred and expect to continue to incur significant additional legal, accounting, and other expenses as a public company, particularly now that we are no longer an emerging growth company.

Our revenue growth is expected to slow as we grow and our revenue may decline for a number of other reasons, including reduced demand for our platform, increased competition, a decrease in the growth or reduction in size of our overall market, or if we cannot capitalize on growth opportunities, including acquisitions, new products, services, and feature releases.

While we consistently evaluate opportunities to reduce our operating costs and optimize efficiencies, including, for example, our restructuring plan in June 2023, we cannot guarantee that these efforts will be successful or that we will not re-accelerate operating expenditures in the future in order to capitalize on growth opportunities.

We also expect our operating expenses to increase in the future as we continue to invest in our future growth, including expanding our research and development function to drive further development of our platform, expanding our sales and marketing activities, developing the functionality to expand into adjacent markets, and reaching customers in new geographic locations, which could negatively affect our operating results if our total revenue does not increase.

In addition to the anticipated costs to grow our business, we have incurred and expect to continue to incur significant legal, accounting, and other expenses as a public company.

Our revenue growth is expected to slow as we scale and our revenue may decline for a number of other reasons, including reduced demand for our platform, increased competition, a decrease in the growth or reduction in the size of our overall market, or if we cannot capitalize on growth opportunities, including acquisitions, new products, services, and feature releases.

While we consistently evaluate opportunities to reduce our operating costs and optimize efficiencies, we cannot guarantee that these efforts will be successful or that we will not re-accelerate operating expenditures in the future in order to capitalize on growth opportunities.

If we fail to increase our revenue to offset increases in our operating expenses, or manage our costs as we invest in our business, we may not achieve or sustain profitability.

7 unchanged sentences

• our ability to attract, train, retain, and motivate talented employees;

• our ability to successfully incorporate new technologies into our platform, including AI;

• the budgeting cycles, seasonal buying patterns, and purchasing practices of our customers, including any slowdown in technology spending due to US and general global macroeconomic conditions;

• general global macroeconomic and political conditions, both domestically and in our foreign markets that could impact some or all regions where we operate, including global economic slowdowns, actual or perceived global banking and finance related issues, increased risk of inflation, potential uncertainty with respect to the federal debt ceiling and budget and potential government shutdowns related thereto, interest rate volatility, supply chain disruptions, labor shortages, and potential global recession;

• the impact of natural or man-made global events on our business, including wars and other armed conflict, such as the conflicts in the Middle East, Ukraine and the tensions between China and Taiwan;

• our ability to successfully incorporate new technologies into our platform, including generative AI;

• the budgeting cycles, seasonal buying patterns, and purchasing practices of our customers, including any slowdown in technology spending due to U.S.

and general global macroeconomic conditions;

• general global macroeconomic and political conditions, both domestically and in our foreign markets that could impact some or all regions where we operate, including the changes in U.S.

federal spending, changes in tariffs and trade restrictions, global economic slowdowns, actual or perceived global banking and finance related issues, increased risk of inflation, interest rate volatility, supply chain disruptions, labor shortages, and potential global recession;

• the impact of natural or man-made global events on our business, including regional geopolitical conflicts around the world;

• changes in customer, distributor or reseller requirements or market needs;

12 unchanged sentences

• timing of revenue recognition and revenue deferrals;

• insolvency or credit difficulties confronting our customers, which could increase due to US and global macroeconomic issues, including actual or perceived global banking and finance related issues, inflation, interest rate volatility, and market downturns, which would adversely affect their ability to purchase or pay for our platform, products, and services in a timely manner or at all;

• insolvency or credit difficulties confronting our customers, which could increase due to U.S.

and global macroeconomic issues, including actual or perceived global banking and finance related issues, inflation, interest rate volatility, and market downturns, which would adversely affect their ability to purchase or pay for our platform, products, and services in a timely manner or at all;

• the cost and potential outcomes of litigation or other proceedings, which could have a material adverse effect on our business;

5 unchanged sentences

Our larger competitors have substantially broader and more diverse product and service offerings and more mature distribution

and go-to-market strategies, which allows them to leverage their existing customer and distributor relationships to gain business in a manner that discourages potential customers from purchasing our platform.

and go-to-market strategies, which allow them to leverage their existing customer and distributor relationships to gain business in a manner that discourages potential customers from purchasing our platform.

Conditions in our market could change rapidly and significantly as a result of technological advancements, including but not limited to increased advancements and proliferation in the use of open artificial intelligence applications, partnering or acquisitions by our competitors or continuing market consolidation.

10 unchanged sentences

Our quarterly financial results may fluctuate as a result of a number of factors, many of which are outside of our control and may be difficult to predict, including, without limitation:

• the impact of natural or man-made global events on our business, including wars and other armed conflict, such as the conflicts in the Middle East, Ukraine and tensions between China and Taiwan;

• general global macroeconomic and political conditions, both domestically and in our foreign markets that could impact some or all regions where we operate, including the changes in U.S.

• the impact of natural or man-made global events on our business, including regional geopolitical conflicts around the world;

• our ability to attract new and retain existing customers or sell additional features to existing customers;

• the budgeting cycles, seasonal buying patterns, and purchasing practices of customers;

including decisions by organizations to purchase security solutions from larger, more established security vendors or from their primary IT equipment vendors and insolvency or credit difficulties confronting our customers, affecting their ability to purchase or pay for our solution

• the timing and length of our sales cycles;

1 unchanged sentence

• changes in the growth rate of the cybersecurity market generally and market for endpoint security;

• the timing and success of new product and service introductions by us, including PinnacleOne, our strategic risk analysis and advisory group, and Singularity Data Lake, our live enterprise data platform for data queries, analytics, insights, and retention, or our competitors or any other competitive developments, including consolidation among our customers or competitors;

• the timing and success of new product and service introductions by us, or any other competitive developments, including consolidation among our customers or competitors and changes in our pricing policies or those of our competitors;

• the level of awareness of cybersecurity threats, particularly advanced cyberattacks, and the market adoption of our platform;

• our ability to successfully expand our business domestically and internationally;

• decisions by organizations to purchase security solutions from larger, more established security vendors or from their primary IT equipment vendors;

• changes in our pricing policies or those of our competitors;

• our ability to successfully expand our business domestically and internationally, including the impact of the amount and timing of operating costs and capital expenditures related to the expansion of our business;

• any disruption in our relationship with ISVs, channel partners, MSPs, MSSPs, MDRs, OEMs, and IR firms;

• insolvency or credit difficulties confronting our customers, affecting their ability to purchase or pay for our solution;

• significant security breaches of, technical difficulties with, or interruptions to, the use of our platform or other cybersecurity incidents;

2 unchanged sentences

• negative media coverage or publicity;

• the amount and timing of operating costs and capital expenditures related to the expansion of our business;

• increases or decreases in our expenses caused by fluctuations in foreign currency exchange rates.

7 unchanged sentences

In addition, the purchase of our platform is often discretionary and may involve a significant commitment of capital and other resources.

Weak global and regional economic conditions, including US and global macro-economic issues, actual or perceived global banking and finance related issues, labor shortages, supply chain disruptions, rising interest rates and inflation, spending environments, geopolitical instability, warfare and uncertainty, weak economic conditions in certain regions or a reduction in information technology spending regardless of macro-economic conditions, including the effects of the conflicts in the Middle East, Ukraine, and tensions between China and Taiwan and judicial reform in Israel, could adversely affect our business, operating results, and financial condition, including resulting in longer sales cycles, a negative impact on our ability to attract and retain new customers or expand our platform or sell additional products and services to our existing customers, lower prices for our platform, higher default rates among our channel partners, reduced sales to new or existing customers and slower or declining growth.

For example, as a result of current uncertainty in macroeconomic conditions and related higher cost consciousness around IT budgets, we have recently experienced certain impacts on our business, including a decline in usage and consumption patterns from certain customers, especially larger enterprise customers, longer sales cycles, and deal downsizing by new customers and of renewals by existing

customers, especially larger enterprises.

Weak global and regional economic conditions, including the changes in U.S.

federal spending, changes in tariffs and trade restrictions, U.S.

and global macroeconomic issues, actual or perceived global banking and finance related issues, labor shortages, supply chain disruptions, fluctuating interest rates and inflation, spending environments, geopolitical instability, warfare and uncertainty, weak economic conditions in certain regions or a reduction in information technology spending regardless of macroeconomic conditions, including the effects of the conflicts in the Middle East and Ukraine, and tensions between China and Taiwan, could adversely affect our business, operating results, and financial condition, including resulting in longer sales cycles, a negative impact on our ability to attract and retain new customers or expand our platform or sell additional products and services to our existing customers, lower prices for our platform, higher default rates among our channel partners, reduced sales to new or existing customers and slower or declining growth.

For example, as a result of current uncertainty in macroeconomic conditions and related higher cost consciousness around IT budgets, we have experienced certain impacts on our business, including a decline in usage and consumption patterns from certain customers, especially larger enterprise customers, longer sales cycles, and deal downsizing by new customers and of renewals by existing customers, especially larger enterprises.

We expect the global macroeconomic conditions impacting demand to persist in the near term.

Deterioration in economic conditions in any of the countries in which we do business could also cause slower or impaired collections on accounts receivable, which may adversely impact our liquidity and financial condition.

Moreover, the US capital markets have experienced and continue to experience extreme volatility and disruption.

Inflation rates in the US significantly increased in 2021 and 2022, resulting in federal action to increase interest rates, adversely affecting capital markets activity.

Further deterioration of the macroeconomic environment and regulatory action may adversely affect our business, operating results, and financial condition.

We are investing in expanding our platform, including our cloud security products, and it is difficult to predict adoption and demand.

We are meaningfully investing in our platform, including growing our cloud security product.

For example, in November 2023, through the acquisition of KSG, we launched PinnacleOne, a strategic advisory group also operating as a think tank for hire, focused on helping companies and their executives holistically understand the evolving risks of operating in the modern global business landscape through personalized access to experts’ intelligence, insight, and transformative risk management strategies.

Further, in February 2024, we acquired PingSafe, a cloud security platform, which we expect will enable us to couple PingSafe’s CNAPP with our cloud workload security and cloud data security capabilities.

For example, in February 2024, we acquired PingSafe, a cloud security platform, which we expect will enable us to couple PingSafe’s CNAPP with our cloud workload security and cloud data security capabilities and Stride, a workflow automation tool that will enable us to further our autonomous platform vision.

It is difficult to predict customer adoption and demand for our platform, the size and growth rate of this market, the entry of competitive products and services or the success of existing competitive products and services.

6 unchanged sentences

We may not be successful in our artificial intelligence initiatives, which could adversely affect our business, reputation, or financial results.

We have recently begun incorporating generative AI into our offerings, including our Purple AI solution dedicated to threat-hunting, analysis and response.

We incorporate generative AI into many of our offerings, including Purple AI which streamlines threat hunting across various types of data and synthesizes threat intelligence and insights in natural language.

As with many innovations, generative AI presents risks, challenges, and unintended consequences that could impact our successful ability to incorporate the use of generative AI in our business.

1 unchanged sentence

Further, data practices by us or others that result in controversy could also impair the acceptance of AI solutions.

This is turn could undermine confidence in the decisions, predictions, analyses or other content that our AI-initiatives produce.

This in turn could undermine confidence in the decisions, predictions, analyses or other content that our AI initiatives produce.

Our generative AI solutions are reliant on third-party foundation models that may change their availability or commercial model in a manner that negatively affects our offering.

Furthermore, the integration of third-party AI models with our products and services relies on certain safeguards implemented by the third-party developers of the underlying AI models, including those related to the accuracy, bias, and other variables of the data and their safeguards may be insufficient.

In addition, our competitors or other third parties may incorporate generative AI solutions into their products more successfully than us, and their solutions may achieve higher market acceptance than ours, which may result in us failing to recoup our investments in developing generative AI-powered offerings.

We have made and expect to continue to make significant investments in our AI technology, including in our Purple AI solution.

We have made and expect to continue to make significant investments in our AI technology, including in Purple AI.

Our ability to employ AI, or the ability of our competitors to do so more successfully, may negatively impact our gross margins, impair our ability to compete effectively, result in reputational harm and have an adverse impact on our operating results.

Further, we have, and may in the future, implement AI-based tools and solutions, including third-party software solutions, in order to, among other things, drive efficiencies in our business, IT systems and other internal processes and improve customer support.

If these tools and solutions do not achieve their expected benefits or if such tools and solutions have defects, bugs, errors, or vulnerabilities, our business may be adversely impacted.

Moreover, AI may give rise to litigation risk, including potential intellectual property, privacy, or cybersecurity liability.

Because AI is an emerging technology, there is not a mature body of case law construing the appropriateness of certain of its uses of data - whether through the employment of large language models or other models leveraging data found on the Internet - and the evolution of this law may limit our ability to exploit artificial intelligence tools, or expose us to litigation.

Further, AI presents emerging ethical issues and if our use of AI algorithms draws controversy due to their perceived or actual impact on society, we may experience brand or reputational harm, competitive harm or legal liability.

Because AI is an emerging technology, there is not a mature body of case law construing the appropriateness of certain of its uses of data whether through the employment of large language models or other models leveraging data found on the Internet and the evolution of this law may limit our ability to exploit AI tools, or expose us to litigation.

In addition, given the complex nature of AI technology, we face an evolving regulatory landscape.

For example, in October 2023, President Biden issued an Executive Order that establishes new standards for, among other things, AI safety, security, and privacy.

federal government, various state legislatures and other government entities worldwide have implemented and are in the process of implementing specific laws, regulations, policies and obligations relating to the use of AI, and we will need to continue to monitor these developments to ensure our products that we sell to government entities remain compliant with such applicable regulations.

Furthermore, the current administration’s approach to investment in and regulation of AI is expected to deviate from that of the previous administration and we will need to adapt to any resulting changes, including new or revised executive orders and initiatives.

Moreover, we are subject to significant competition from other companies, some of which have longer operating histories and significantly greater financial, technical, marketing, distribution, professional services, or other resources than us.

1 unchanged sentence

Any of the foregoing could adversely affect our business, reputation, or financial results.

A network or data security incident against us, whether actual, alleged, or perceived, would harm our reputation, create liability and regulatory exposure, and adversely impact our business, operating results, and financial condition.

A security incident against us, or our third-party vendors and service providers, whether actual, alleged, or perceived, would harm our reputation, create liability and regulatory exposure, and adversely impact our business, operating results, and financial condition.

Companies are subject to an increasing number and wide variety of attacks on their networks on an ongoing basis.

Traditional computer “hackers,” malicious code (such as viruses and worms), phishing attempts, ransomware, account takeover, business email compromise, employee fraud, theft or misuse, denial of service attacks, and sophisticated nation-state and nation-state supported actors engage in intrusions and attacks that create risks for our internal networks and cloud deployed products and the information they store and process.

Traditional computer “hackers,” malicious code (such as viruses and worms), phishing attempts, ransomware, account takeover, business email compromise, employee fraud, theft or misuse, denial of service attacks, and sophisticated nation-state and nation-state supported actors engage in intrusions and attacks that create risks for our internal networks, cloud deployed products and the information they store and process.

Cybersecurity companies face particularly intense attack efforts, and we have faced, and will continue to face, cyber threats and attacks from a variety of sources.

The research that we conduct and report may make us, or our customers, a further target for attacks of all kinds.

State-supported and geopolitical-related cyberattacks may rise in connection with regional geopolitical conflicts such as the conflicts in the Middle East, Ukraine and tensions between China and Taiwan.

We provide security services to many highly targeted entities, such as U.S.

government agencies, defense contractors, and non-U.S.

Our work protecting these entities increases the likelihood that we may be targeted by nation-state actors, including those from countries with a history of conducting cyber operations against such organizations.

State-supported and geopolitical-related cyberattacks may rise in connection with regional geopolitical conflicts such as the conflicts in the Middle East and Ukraine, and tensions between China and Taiwan.

In addition, our cybersecurity product is likely considered a valuable target for lateral attacks because of its highly privileged access.

Moreover, the ongoing war in Ukraine and associated activities in Ukraine and Russia have increased the risk of cyberattacks on various types of infrastructure and operations, and the US government has warned companies to be prepared for a significant increase in Russian cyberattacks in response to the sanctions on Russia.

There may also be increased risks of cybersecurity attacks as a result of the unfolding events in the Middle East.

Additionally, bad actors are beginning to utilize AI-based tools to execute attacks, creating unprecedented cybersecurity challenges.

Although we have implemented security measures to prevent such attacks, our networks and systems may be breached due to the actions of outside parties, human or employee error, insufficient cybersecurity controls, malfeasance, a combination of these, or otherwise, and as a result, an unauthorized party may obtain access to our and/or our customers’ systems, networks, or data.

We may face difficulties or delays in identifying or otherwise responding to any attacks or actual or potential security breaches or threats.

Although we have implemented security measures designed to prevent such attacks, our networks and systems, and those of our third-party vendors and service providers may be breached due to the actions of outside parties, human error, insufficient cybersecurity controls, malfeasance, a combination of these, or otherwise, and as a result, an unauthorized party may obtain access to our and/or our customers’ systems, networks, or data.

We and our third-party vendors and service providers may face difficulties or delays in identifying or otherwise responding to any attacks or actual or potential security breaches or threats.

These risks are exacerbated by developments in generative AI.

A breach in our data security or an attack against our platform could impact our networks or the networks and data of our customers that are secured by our platform, creating system disruptions or slowdowns and providing access to malicious parties to information stored on our networks or the networks of our customers, resulting in data being publicly disclosed, misused, altered, lost, or stolen, which could subject us to liability and adversely affect our financial condition.

If compromised, our own systems could be used to facilitate or magnify an attack.

Further, the increase in remote work by companies and individuals in recent years has generally increased the attack surface available to bad actors for exploitation, and as such, the risk of a cybersecurity incident potentially occurring has increased.

We have accordingly increased our investments in protective measures and risk mitigation strategies, but we cannot guarantee that our efforts, or the efforts of those upon whom we rely and partner with, will be successful in preventing any such information security incidents.

Protecting our own assets has become more expensive from a dollar investment and time perspective and these costs may increase as the threat landscape increases, including as a result of use by bad actors of AI.

Any actual, alleged, or perceived security breach in our systems or networks, or any other actual, alleged or perceived data security incident we suffer, could result in damage to our reputation, negative publicity, loss of customers and sales, loss of competitive advantages over our competitors, increased costs to remedy any problems and otherwise respond to any incident, regulatory investigations and enforcement actions, fines and penalties, costly litigation, and other liability.

We would also be exposed to a risk of loss or litigation and potential liability under laws, regulations, and contracts that protect the privacy and security of personal information.

For example, the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act (CPRA), imposes a private right of action for security breaches that could lead to some form of remedy including regulatory scrutiny, fines, private right of action settlements, and other consequences.

Where a security incident involves a breach of security leading to the accidental or unlawful destruction, loss, alternation, unauthorized disclosure of, or access to, personal data from the European Economic Area (EEA) or the UK in respect of which we are a controller or processor under the General Data Protection Regulation (GDPR), and the UK General Data Protection Regulation and UK Data Protection Act 2018 (UK GDPR), this could result in fines of up to €20 million or 4% of annual global turnover, whichever is greater, under the GDPR or up to £17.5 million or 4% of annual global turnover, whichever is greater, in the case of the UK GDPR.

A breach in our or in our third-party vendors and service providers’ data security or an attack against our platform or our third-party vendors’ or service providers’ platform could impact our networks or the networks and data of our customers that are secured by our platform, creating system disruptions or slowdowns and providing access to malicious parties to information stored on our networks or the networks of our customers, resulting in data being publicly disclosed, misused, altered, lost, or stolen, which could subject us to liability and adversely affect our financial condition.

If compromised, our own systems or the systems of our third-party vendors and service providers could be used to facilitate or magnify an attack.

Further, the trend towards remote and hybrid work by

companies and individuals in has generally increased the attack surface available to bad actors for exploitation, and as such, the risk of a cybersecurity incident potentially occurring has increased.

We have accordingly increased our investments in protective measures and risk mitigation strategies, but we cannot guarantee that our efforts, or the efforts of our third-party vendors and service providers or efforts of others upon whom we rely and partner with, will be successful in preventing any such information security incidents.

Any actual, alleged, or perceived security breach in our systems or networks or those of our third-party vendors and service providers, or any other actual, alleged or perceived data security incident we suffer, could result in damage to our reputation, negative publicity, loss of customers and sales, loss of competitive advantages over our competitors, increased costs to remedy any problems and otherwise respond to any incident, regulatory investigations and enforcement actions, fines and penalties, costly litigation, and other liability.

We would also be exposed to a risk of loss or litigation and potential liability under laws, regulations, and contracts that protect the privacy and security of personal data.

For example, the California Consumer Privacy Act of 2018, as amended (CCPA), imposes a private right of action for security breaches of personal data that could lead to some form of remedy including regulatory scrutiny, fines, private right of action settlements, and other consequences.

Where a security incident involves a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data from the European Economic Area (EEA) or the U.K.

in respect of which we are a controller or processor under the E.U.

General Data Protection Regulation (collectively, the GDPR), this could result in fines of up to €20 million (£17.5 million) or 4% of annual global turnover, whichever is greater.

We may also be required to provide notice of such breaches to regulators and/or individuals which may result in us incurring additional costs, penalties, fines or litigation.

Further, on July 26, 2023, the SEC adopted cybersecurity disclosure rules for public companies that require disclosure regarding cybersecurity risk management (including the board’s role in overseeing cybersecurity risks, management’s role and expertise in assessing and managing cybersecurity risks and processes for assessing, identifying and managing cybersecurity risks) in annual reports on Form 10-K.

These cybersecurity disclosure rules also require the disclosure of material cybersecurity incidents by Form 8-K, within four business days of determining an incident is material.

Any public disclosure relating to a material cybersecurity incident, whether as a result of the new SEC rules or otherwise, harm our reputation, result in litigation and adversely impact our business, operating results, and financial condition.

In addition, certain of our customer agreements may require us to promptly report security breaches involving their data on our systems or those of subcontractors processing such data on our behalf.

In addition, our customer agreements may require us to promptly report security breaches to our customers involving their data on our systems or those of third-party vendors or subcontractors processing such data on our behalf.

This mandatory disclosure could be costly, result in litigation, harm our reputation, erode customer trust, and require significant resources to mitigate issues stemming from actual or perceived security breaches.

In addition, we may incur significant financial and operational costs to investigate, remediate, eliminate and put in place additional tools and devices designed to prevent actual or perceived security breaches and other security incidents, as well as costs to comply with any notification obligations resulting from any security incidents.

Further, some of our customers may also be subject to the E.U.

Digital Operational Resilience Act (DORA), which requires them to impose contractual provisions on us, including certain mandatory third-party risk management provisions.

If we fail to materially comply with these contractual requirements, we may be subject to litigation, investigations, audits or other adverse consequences.

We may also incur significant financial and operational costs to investigate, remediate, eliminate and put in place additional tools and devices designed to prevent actual or perceived security breaches and other security incidents, as well as costs to comply with any notification obligations resulting from any security incidents.

Any of these negative outcomes could adversely affect the market perception of our platform and customer and investor confidence in our company, and would adversely affect our business, operating results, and financial condition.

Defects, errors, or vulnerabilities in our platform, the failure of our platform to block malware or prevent a security breach, misuse of our platform, or risks of product liability claims would harm our reputation and adversely impact our business, operating results, and financial condition.

Our platform and product features are multi-faceted and may be deployed with material defects, software “bugs” or errors that are not detected until after their commercial release and deployment to our customers.

From time to time, certain of our customers have reported defects in our platform related to performance, scalability, and compatibility.

Our platform and product features also provide our customers with the ability to customize a multitude of settings, and it is possible that a customer could misconfigure our platform or otherwise fail to configure our products in an optimal manner.

Such defects and misconfigurations of our platform could cause our platform to operate at suboptimal efficacy, cause it to fail to secure customers’ computing environments and detect and block threats, or temporarily interrupt our customers’ computing environments.

We also make frequent updates to our platform, which may fail, resulting in temporary vulnerability that increases the likelihood of a material defect.

Our platform and product features are multi-faceted, rely on third-party software and infrastructure, and may be deployed with material defects, vulnerabilities, software “bugs” or errors that are not detected until after their commercial release and deployment to our customers.

Vulnerabilities may be exploited by malicious actors and material defects may prevent our software from operating correctly or detecting malicious software.

From time to time, certain of our customers and external researchers have reported defects in our platform related to performance, scalability, and compatibility.

In addition, customers may request a software bill of materials where we disclose an inventory of software used by the customer along with potential defects and vulnerabilities.

Our platform and product features also provide our customers with the ability to customize a multitude of settings, and administer devices on the applicable computing environment, and it is possible that a customer, partner or internal services team member could misconfigure or misuse our platform or otherwise fail to configure our products in an optimal manner.

interrupt our customers’ computing environments.

We also make frequent updates to our platform, which may fail or be deployed incorrectly resulting in temporary vulnerability, or a material defect or downtime in our customer environments.

In addition, because the techniques used by computer hackers to access or sabotage target computing environments change frequently and generally are not recognized until launched against a target, there is a risk that an advanced attack could emerge that our platform is unable to detect or prevent.

Furthermore, as a well-known provider of security solutions, our networks, platform, products, including cloud-based technology, and customers could be targeted by attacks specifically designed to disrupt our business, harm our reputation or use our technology to gain unauthorized access.

In addition, regional geopolitical conflicts such as the conflicts in the Middle East, Ukraine and tensions between China and Taiwan, may result in increased cyberattacks against our customers, resulting in an increased risk of a security breach of our customers’ systems.

Furthermore, as a well-known provider of security solutions and because security solutions are highly privileged in customers environments, our networks, platform, products, including cloud-based technology, and customers could be targeted by attacks specifically designed to disrupt our business, harm our reputation or use our technology to gain unauthorized access.

In addition, regional geopolitical conflicts around the world, may result in increased cyberattacks against our customers, resulting in an increased risk of a security breach of our customers’ systems.

In addition, defects or errors in our platform could result in a failure to effectively update customers’ cloud-based products.

1 unchanged sentence

Any of these situations could result in negative publicity to us, damage our reputation, and increase expenses and customer relations issues, which would adversely affect our business, financial condition, and operating results.

Advances in computer capabilities, discoveries of new weaknesses and other developments with software generally used by the Internet community may increase the risk we will suffer a security breach.

Advances in computer capabilities, discoveries of new weaknesses and other developments with software generally used online may increase the risk we will suffer a security breach.

Furthermore, our platform may fail to detect or prevent malware, ransomware, viruses, worms or similar threats for any number of reasons, including our failure to enhance and expand our platform to reflect industry trends, new technologies and new operating environments, the complexity of the environment of our clients and the sophistication of malware, viruses and other threats.

Our platform may fail to detect or prevent threats in any particular test for a number of reasons.

We or our service providers may also suffer security breaches or unauthorized access to personal information, financial account information, and other confidential information due to employee error, rogue employee activity, unauthorized access by third parties acting with malicious intent or who commit an inadvertent mistake or social engineering.

If we experience, or our service providers experience, any breaches of security measures or sabotage or otherwise suffer unauthorized use or disclosure of, or access to, personal information, financial account information or other confidential information, we might be required to expend significant capital and resources to address these problems.

Our platform may fail to interoperate or conflict with customer environments causing customer downtime.

We or our service providers may also suffer security breaches or unauthorized access to personal data, financial account information, and other confidential information due to employee error, rogue employee activity, unauthorized access by third parties acting with malicious intent or who commit an inadvertent mistake or social engineering.

If we experience, or our service providers experience, any breaches of security measures or sabotage or otherwise suffer unauthorized use or disclosure of, or access to, personal data, financial account information or other confidential information, we might be required to expend significant capital and resources to address these problems.

We may not be able to remedy any problems caused by hackers or other similar actors in a timely manner, or at all.

6 unchanged sentences

• an increase in resources devoted to customer service and support, which could adversely affect our gross margin;

• negative impact on our customers’ operations;

• harm to our reputation or brand; and

2 unchanged sentences

Moreover, if a high-profile cybersecurity incident occurs with respect to another SaaS provider, customers may lose trust in the security of the SaaS business model generally, which could adversely affect our ability to retain existing customers or attract new ones.

Further, if another cybersecurity vendor were to experience a defect, error, or vulnerability, fail to detect a cybersecurity incident, or to cause interruptions in the networks of their customers, customers may lose trust in cybersecurity companies generally, including our platform, which could adversely affect our business, including our ability to retain existing customers or attract new ones.

In the last few years there have been many successful advanced cybersecurity incidents that have damaged several prominent companies despite strong information security measures.

We expect that the risks associated with cybersecurity incidents and the costs of preventing such attacks will continue to increase in the future.

In addition, we cannot assure you that any limitation of liability provisions in our customer agreements, contracts with third-party vendors and service providers, or other contracts would be enforceable or adequate or would otherwise protect us from any liabilities or damages with respect to any particular claim relating to a security breach or other security-related matter or as a result of federal, state, or local laws or ordinances, or unfavorable judicial decisions in the US, or other countries.

In addition, we cannot assure that any limitation of liability provisions in our customer agreements, contracts with third-party vendors and service providers, or other contracts would be enforceable or adequate or would otherwise protect us from any liabilities or damages with respect to any particular claim relating to a security breach or other security-related matter or as a result of federal, state, or local laws or ordinances, or unfavorable judicial decisions in the U.S., or other countries.

We maintain insurance to protect against certain claims associated with the use of our platform, but our insurance coverage may not adequately cover any claim asserted against us.

4 unchanged sentences

As part of our business strategy, we have in the past and expect to continue to make investments in and/or acquire complementary companies, services, products, technologies, or talent.

For example, in February 2021 we acquired Scalyr, a data analytics company, in May 2022 we acquired Attivo, a leading identity security and lateral movement protection company, in November 2023 we acquired KSG, a strategic advisory group, and in February 2024 we acquired both PingSafe, a cloud security platform, and Stride, a security automation company.

For example, in February 2024 we acquired both PingSafe, a cloud security platform, and Stride, a security automation company.

We have also invested in certain privately held companies through our S Ventures fund, and we may not realize a return on these investments.

28 unchanged sentences

Our failure to address these risks or other problems encountered in connection with acquisitions and investments could cause us to fail to realize the anticipated benefits of these acquisitions or investments, cause us to incur unanticipated liabilities, and harm our business generally.

If we are unable to retain our customers, renew and expand our relationships with them, and add new customers, we may not be able to sustain revenue growth, and we may not achieve or maintain profitability in the future.

If we are unable to retain our customers, renew and expand our relationships with them, and add new customers, or our partners are unable to execute on their purchasing commitments, we may not be able to sustain revenue growth, and we may not achieve or maintain profitability in the future.

Historically, we have experienced rapid growth in the adoption of our platform, customer base, and revenue.

5 unchanged sentences

• improve the capabilities of our platform through research and development;

• successfully execute on partner purchasing commitments;

• continue to successfully expand our business domestically and internationally;

• successfully compete with other companies in the endpoint security industry.

• successfully compete with other companies in the cybersecurity industry.

Our customers have no obligation to renew their subscription for our platform after the expiration of their contractual subscription period, which is generally one to three years, and in the normal course of business, some customers have elected not to renew.

In addition, our customers may renew for shorter contract subscription lengths or cease using certain features.

Our customer retention and expansion may decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with our services, our pricing, customer security and networking issues and requirements, our customers’ spending levels, decreases in the number of endpoints to which our customers deploy our solution, mergers and acquisitions involving our customers, industry developments, competition, general economic conditions, or the perceived decline in the incidence of cyberattacks.

Our customer retention and expansion may decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with our services, our pricing, customer security and networking issues and requirements, our customers’ spending levels, our channel partner strategy and pricing, decreases in the number of endpoints to which our customers deploy our solution, mergers and acquisitions involving our customers, industry developments, competition, general economic conditions, or the perceived decline in the incidence of cyberattacks.

If our efforts to maintain and expand our relationships with our existing customers are not successful, our business, operating results, and financial condition will materially suffer.

34 unchanged sentences

We face significant challenges in ensuring that our platform effectively identifies and responds to these advanced and evolving attacks, including as a result of the evolving AI landscape.

As a result of the continued rapid innovations in the technology industry, including the rapid growth of smartphones, tablets and other devices, enterprise employees using personal devices for work, the rapidly evolving Internet of Things and AI, we expect the networks of our customers to continue to change rapidly and become more complex.

As a result of the continued rapid innovations in the technology industry, including the rapid growth of smartphones, tablets and other devices, enterprise employees using personal devices for work, the rapidly evolving IoT and AI, we expect the networks of our customers to continue to change rapidly and become more complex.

There can be no assurance that we will be successful in developing and marketing, on a timely basis, enhancements to our platform that adequately address the changing needs of our customers.

13 unchanged sentences

To the extent potential customers, industry analysts or research firms believe that the occurrence of a failure to detect or prevent any particular threat is a flaw or indicates that our solutions or services do not provide significant value, we may lose customers, and our reputation, financial condition and business would be harmed.

Moreover, the performance of our channel partners and alliance partners may affect our brand and reputation if customers do not have a positive experience with these partners.

In addition, we have in the past worked, and continue to work, with high profile customers as well as assist in analyzing and remediating high profile cyberattacks.

Moreover, the performance of our channel partners and alliance partners may affect our brand and reputation, as it could negatively impact our reputation if customers do not have a positive experience with these partners.

In addition, we have in the past worked, and continue to work, with high profile customers and have assisted in analyzing and remediating high profile cyberattacks.

Our work with such customers has exposed us to publicity and media coverage.

Negative publicity about us, including about our management, the efficacy and reliability of our platform, our products offerings, our professional services, and the customers we work with, even if inaccurate, could adversely affect our reputation and brand.

Negative publicity about us, including about our management, the efficacy and reliability of our platform, our product offerings, our professional services, and the customers we work with, even if inaccurate, could adversely affect our reputation and brand.

If we are unable to maintain successful relationships with our channel partners and alliance partners, or if our channel partners or alliance partners fail to perform, our ability to market, sell and distribute our platform will be limited, and our business, operating results, and financial condition will be harmed.

Substantially all of our sales are fulfilled through our channel partners, including resellers, distributors, MSPs, MSSPs, MDRs, OEMs, and IR firms, and we expect that we will continue to generate a significant portion of our revenue from channel partners for the foreseeable future.

Our agreements with our channel partners are non-exclusive, do not last for set terms, and may be terminated by either party at any time.

Further, channel partners fulfill our sales on a purchase order basis and do not impose minimum purchase requirements or related terms on sales.

Our agreements with our channel partners generally are non-exclusive, do not last for set terms, and may be terminated by either party at any time.

Further, the majority of channel partners fulfill our sales on a purchase order basis and do not impose minimum purchase requirements or related terms on sales.

We also have several large MSSP, OEM and reseller partnerships with multi-year purchasing commitments.

Additionally, we have entered, and intend to continue to enter, into alliance partnerships with third parties to support our future growth plans.

The loss of a substantial number of our channel partners or alliance partners, or the failure to recruit additional partners, would adversely affect our business, operating results, and financial condition.

The loss of a substantial number of our channel partners or alliance partners, the failure to recruit additional partners, or failure of partners to meet their purchasing commitments would adversely affect our business, operating results, key financial metrics and financial condition.

To the extent our partners are unsuccessful in selling our platform, or if we are unable to enter into arrangements with and retain a sufficient number of high-quality partners in each of the regions in which we sell or plan to sell our platform, we are unable to keep them motivated to sell our platform, or our partners shift focus to other vendors and/or our competitors, our ability to sell our platform and operating results will be harmed.

To the extent our partners fail to meet their purchasing commitments, they may fail to pay us or attempt to renegotiate our agreements and we risk churn in forecast metrics.

The termination of our relationship with any significant partner may adversely affect our sales and operating results.

12 unchanged sentences

We have made significant investments to address the government sector, but we cannot assure you that these investments will be successful, or that we will be able to maintain or grow our revenue from the government sector.

Although we anticipate that they may increase in the future, sales to governmental organizations have not accounted for, and may never account for, a significant portion of our revenue.

Sales to governmental organizations are subject to a number of challenges and risks that may adversely affect our business and operating results, including the following risks:

• selling to governmental agencies can be highly competitive, expensive, and time consuming, often requiring significant upfront time and expense without any assurance that such efforts will generate a sale;

• government certification, software supply chain or source code transparency requirements applicable to us or our platform may change and, in doing so, restrict our ability to sell into the governmental sector until we have attained the revised certification or meet other new requirements.

For example, although we are

currently FedRAMP authorized, such authorization is costly to maintain and subject to rigorous compliance and if we lose our authorization, it will restrict our ability to sell to government customers;

• government demand and payment for our platform may be impacted by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our platform, including as a result of sudden, unforeseen and disruptive events such as government shutdowns, governmental defaults on indebtedness, war, regional geopolitical conflicts around the world, incidents of terrorism, natural disasters, and public health concerns or epidemics;

Although we anticipate that they may increase in the future, sales to government organizations have not accounted for, and may never account for, a significant portion of our revenue.

Sales to government organizations are subject to a number of challenges and risks that may adversely affect our business and operating results, including the following risks:

• selling to government agencies can be highly competitive, expensive, and time consuming, often requiring significant upfront time and expense without any assurance that such efforts will generate a sale;

• government certification, software supply chain or source code transparency requirements applicable to us or our platform may change and, in doing so, restrict our ability to sell into the government sector until we have attained the revised certification or meet other new requirements.

For example, although we are currently FedRAMP authorized, such authorization is costly to maintain and subject to rigorous compliance and if we lose our authorization, it will restrict our ability to sell to government customers;

• government demand and payment for our platform may be impacted by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our platform, including as a result of sudden, unforeseen and disruptive events such as government shutdowns, government defaults on indebtedness, war, regional geopolitical conflicts around the world, incidents of terrorism, natural disasters, and public health concerns or epidemics;

• governments routinely investigate and audit government contractors’ administrative processes, and any unfavorable audit could result in the government refusing to continue buying our platform, which would adversely impact our revenue and operating results, or institute fines or civil or criminal liability if an investigation, audit, or other review, were to uncover improper or illegal activities;

• governments may require certain products to be manufactured, produced, hosted or accessed solely in their country or in other relatively high-cost locations, and we may not produce or host all products in locations that meet these requirements, affecting our ability to sell these products to governmental agencies;

• refusal to grant certain certifications or clearance by one government agency, or decision by one government agency that our products do not meet certain standards, may cause reputational harm and cause concern with other government agencies.

The occurrence of any of the foregoing could cause governmental organizations to delay or refrain from purchasing our solutions in the future or otherwise adversely affect our business and operating results.

Our long-term success depends, in part, on our ability to expand the sale of our platform to customers located outside of the US and our current, and any further, expansion of our international operations exposes us to risks that could have a material adverse effect on our business, operating results, and financial condition.

We are generating a growing portion of our revenue outside of the US, and conduct our business activities in various foreign countries, including some emerging markets where we have limited experience, where the challenges of conducting our business can be significantly different from those we have faced in more developed markets and where business practices may create internal control risks including:

The occurrence of any of the foregoing could cause government organizations to delay or refrain from purchasing our solutions in the future or otherwise adversely affect our business and operating results.

Furthermore, on January 20, 2025, President Donald Trump announced an executive order establishing the Department of Government Efficiency in an effort to maximize government efficiency and productivity.

Pressures on and uncertainty surrounding the U.S.

federal government’s budget and potential changes in budgetary priorities, could adversely affect the funding for and purchases of our platform by government organizations.

Our long-term success depends, in part, on our ability to expand the sale of our platform to customers located outside of the U.S.

and our current, and any further, expansion of our international operations exposes us to risks that could have a material adverse effect on our business, operating results, and financial condition.

We are generating a growing portion of our revenue outside of the U.S., and conduct our business activities in various foreign countries, including some emerging markets where we have limited experience, where the challenges of conducting our business can be significantly different from those we have faced in more developed markets and where business practices may create internal control risks including:

• fluctuations in foreign currency exchange rates, which could add volatility to our operating results;

1 unchanged sentence

• tariffs, export and import restrictions, restrictions on foreign investments, sanctions, and other trade barriers or protection measures;

• exposure to numerous, increasing, stringent (particularly in the EU), and potentially inconsistent laws and regulations relating to privacy, data protection, and information security;

• exposure to numerous, increasing, stringent (particularly in the E.U.), and potentially inconsistent laws and regulations relating to privacy, data protection, information security and AI;

• costs of localizing products and services (including, but not limited to data localization requirements);

2 unchanged sentences

• challenges inherent in efficiently managing an increased number of employees over large geographic distances, including the need to implement appropriate systems, policies, benefits, and compliance programs;

• difficulties in maintaining our corporate culture with a dispersed and distant workforce;

• difficulties in maintaining our corporate culture with a dispersed and distant workforce due to the trend towards hybrid working;

• treatment of revenue from international sources, evolving domestic and international tax environments, and other potential tax issues, including with respect to our corporate operating structure and intercompany arrangements;

1 unchanged sentence

• economic weakness or currency-related crises;

• compliance with multiple, conflicting, ambiguous or evolving governmental laws and regulations, including employment, tax, data privacy, anti-corruption, import/export, antitrust, data transfer, storage and protection, and industry-specific laws and regulations, including rules related to compliance by our third-party resellers and our ability to identify and respond timely to compliance issues when they occur and regulations applicable to us and our third party data providers from whom we purchase and resell syndicated data;

• compliance with multiple, conflicting, ambiguous or evolving government laws and regulations, including employment, tax, data privacy, anti-corruption, import/export, antitrust, data transfer, storage and protection, and industry-specific laws and regulations, including rules related to compliance by our third-party resellers and our ability to identify and respond timely to compliance issues when they occur and regulations applicable to us and our third party data providers from whom we purchase and resell syndicated data;

• vetting and monitoring our third-party channel partners in new and evolving markets to confirm they maintain standards consistent with our brand and reputation;

3 unchanged sentences

• dependence on certain third parties, including channel partners with whom we do not have extensive experience;

• natural disasters, acts of war, terrorism, or pandemics, including the armed conflicts in the Middle East, Ukraine and tensions between China and Taiwan;

• natural disasters, acts of war, terrorism, or pandemics, including regional geopolitical conflicts around the world;

• actual or perceived instability in the global banking system;

• changes in tariffs and trade restrictions;

• cybersecurity incidents;

4 unchanged sentences

Such restructurings increase our operating costs, and if ineffectual, could increase our income tax liabilities and our global effective tax rate.

We have experienced rapid growth in recent periods, and if we do not effectively manage our future growth, our business, operating results, and financial condition may be adversely affected.

We have experienced rapid growth, and if we do not effectively manage our future growth, our business, operating results, and financial condition may be adversely affected.

We have experienced rapid growth in recent periods, and we expect to continue to invest broadly across our organization to support our growth.

5 unchanged sentences

To manage any future growth effectively, we must continue to improve and expand our information technology and financial infrastructure, our operating and administrative systems and controls, and our ability to manage headcount, capital, and processes in an efficient manner.

As a result of recent macroeconomic conditions, in June 2023, we approved a restructuring plan designed to improve operational efficiencies and operating costs and better align our workforce and operations with current business needs, priorities, and near-term growth expectations.

If we continue to experience rapid growth, we may not be able to successfully implement or scale improvements to our systems, processes, and controls in an efficient or timely manner.

17 unchanged sentences

Further, competition continues to increase in the market segments in which we participate, and we expect competition to further increase in the future, thereby leading to increased pricing pressures.

Larger competitors with more diverse product and service offerings may reduce the price of products or services that compete with ours or may bundle them with other products and services.

Larger competitors with more diverse products and service offerings may reduce the price of products or services that compete with ours or may bundle them with other

products and services.

This could lead customers to demand greater price concessions or additional functionality at the same price levels.

14 unchanged sentences

Our business, operating results, and financial condition would be adversely affected if we suffer performance issues or downtime that exceeds the service level commitments under our agreements with our customers.

Our business is subject to the risks of warranty claims, product returns and product defects from real or perceived defects in our solutions or their misuse by our customers or third parties and indemnity provisions in various agreements potentially expose us to substantial liability for intellectual property infringement and other losses.

Our business is subject to the risks of liability, indemnity and warranty claims, from real or perceived defects in our solutions or their misuse by our customers or third parties and indemnity provisions in various agreements potentially expose us to substantial liability for intellectual property infringement and other losses.

We may be subject to liability claims for damages related to errors or defects in our solutions.

A material liability claim or other occurrence that harms our reputation or decreases market acceptance of our platform will harm our business and operating results.

Although we generally have limitation of liability provisions in our terms and conditions of sale, they may not fully or effectively protect us from claims as a result of federal, state or local laws or ordinances, or unfavorable judicial decisions in the US or other countries.

The sale and support of our platform also entails the risk of product liability claims.

or other countries.

The sales and support of our platform also entails the risk of liability claims.

We employ measures in the form of policy and technical controls to limit unauthorized access to our platform by our employees, customers and third-parties, however, these measures may not fully or effectively protect our platform from unauthorized access.

Additionally, we typically provide indemnification to customers, partners or other third parties we do business with for certain losses suffered or expenses incurred as a result of third-party claims arising from our infringement of a third party’s intellectual property.

Additionally, we typically provide indemnification to customers and partners we do business with for certain losses suffered or expenses incurred as a result of third-party claims arising from our infringement of a third party’s intellectual property.

We also provide unlimited liability for certain breaches of confidentiality, as defined in our master subscription agreement.

We also provide limited liability in the event of certain breaches of our master subscription agreement.

Certain of these contractual provisions survive termination or expiration of the applicable agreement.

Certain of these contractual provisions survive the termination or expiration of the applicable agreement.

However, as we continue to grow, indemnification claims against us for the obligations listed may increase.

When our customers or other third parties we do business with make intellectual property rights or other indemnification claims against us, we incur significant legal expenses and may have to pay damages, license fees and/or stop using technology found to be in violation of the third party’s rights.

When our customers or other third parties whom we do business with make intellectual property rights or other indemnification claims against us, we incur significant legal expenses and may have to pay damages, license fees

and/or stop using technology found to be in violation of the third party’s rights.

We may also have to seek a license for the technology.

Such licenses may not be available on reasonable terms, if at all, and may significantly increase our operating expenses or may require us to restrict our business activities and limit our ability to deliver certain solutions or features.

We may also be required to develop alternative non-infringing technology, which could require

significant effort and expense and/or cause us to alter our platform, which could harm our business.

We may also be required to develop alternative non-infringing technology, which could require significant effort and expense and/or cause us to alter our platform, which could harm our business.

Large indemnity obligations, whether for intellectual property or in certain limited circumstances, other claims, would harm our business, operating results and financial condition.

4 unchanged sentences

Any failure or refusal of our insurance providers to provide the expected insurance benefits to us after we have remediated warranty claims would cause us to incur significant expense or cause us to cease offering warranties which could damage our reputation, cause us to lose customers, expose us to liability claims by our customers, negatively impact our sales and marketing efforts, and have an adverse effect on our business, operating results, and financial condition.

Further, although the terms of the warranty do not allow those customers to use warranty claim payments to fund payments to persons on the US Treasury Department’s Office of Foreign Assets Control (OFAC), list of Specially Designated Nationals and Blocked Persons or who are otherwise subject to US sanctions, we cannot assure you that all of our customers will comply with our warranty terms or refrain from taking actions, in violation of our warranty and applicable law.

Further, although the terms of the warranty do not allow those customers to use warranty claim payments to fund payments to persons on the U.S.

Treasury Department’s Office of Foreign Assets Control (OFAC), list of Specially Designated Nationals and Blocked Persons or who are otherwise subject to U.S.

sanctions, we cannot assure you that all of our customers will comply with our warranty terms or refrain from taking actions, in violation of our warranty and applicable law.

Key business metrics and other estimates are subject to inherent challenges in measurement and to change as our business evolves, and our business, operating results, and financial condition could be adversely affected by real or perceived inaccuracies in those metrics or any changes in metrics we disclose.

We regularly review key business metrics, including our ARR, number of customers with ARR of $100,000, NRR, and other measures to evaluate growth trends, measure our performance, and make strategic decisions.

These key metrics are calculated using internal company data and have not been validated by an independent third party.

We regularly review key business metrics, including our annualized recurring revenue (ARR), number of customers with ARR of $100,000, and other measures to evaluate growth trends, measure our performance, and make strategic decisions.

These metrics are calculated using internal company data and have not been validated by an independent third party.

While these numbers are based on what we believe to be reasonable estimates for the applicable period of measurement at the time of reporting, there are inherent challenges in such measurements.

If we fail to maintain effective processes and systems, our key metrics calculations may be inaccurate, and we may not be able to identify those inaccuracies.

If we fail to maintain effective processes and systems, our metrics calculations may be inaccurate, and we may not be able to identify those inaccuracies.

We regularly review our processes for calculating these metrics, and from time to time we make adjustments to improve their accuracy.

Moreover, we may periodically change the definition or methodology underlying our key metrics.

Moreover, we may periodically change the definition or methodology underlying our metrics.

For example, as a result of a decline in usage and consumption in the quarter ended April 30, 2023, we decided to change our methodology of calculating ARR for consumption and usage-based agreements to reflect committed contract values as opposed to based on consumption and usage.

5 unchanged sentences

Our future success is dependent, in part, on our ability to hire, integrate, train, manage, retain, and motivate the members of our management team and other key employees throughout our organization.

The loss of key personnel, including key members of our management team or members of our board of directors, as well as certain of our key marketing, sales, finance, support, product development, people team, or technology personnel, could disrupt our operations and have an adverse effect on our ability to grow our business.

In particular, we are highly dependent on the services of Tomer Weingarten, our co-founder, Chairman of the Board of Directors, President, and Chief

Executive Officer, who is critical to the development of our technology, platform, future vision, and strategic direction.

The loss of key personnel,

including key members of our management team or members of our board of directors, as well as certain of our key marketing, sales, finance, support, product development, people team, or technology personnel, could disrupt our operations and have an adverse effect on our ability to grow our business.

In particular, we are highly dependent on the services of Tomer Weingarten, our co-founder, Chairman of the Board of Directors, President, and Chief Executive Officer, who is critical to the development of our technology, platform, future vision, and strategic direction.

From time to time, there have been and may in the future be changes in our management team.

While we seek to manage any such transitions carefully, such changes may result in a loss of institutional knowledge, cause disruptions to our business and negatively affect our business.

Further, we maintain an office in Tel Aviv, Israel and had approximately 13% of our personnel in Israel as of January 31, 2024.

We are closely monitoring the unfolding events of the armed conflict in Israel which began in October 2023.

While this conflict is still evolving, to date, the conflict has not had an adverse impact on our workforce and we have implemented continuity measures to address the safety of our employees and continue our operations in the event of reduced employee availability in the conflict region.

However, if our continuity measures fail or the conflict continues to worsen or intensify, any business interruptions or spillover effects could adversely affect our business and operations.

Competition for highly skilled personnel is intense, especially in the San Francisco Bay Area, where we have a substantial presence and need for highly skilled personnel, and we may not be successful in hiring or retaining qualified personnel to fulfill our current or future needs.

2 unchanged sentences

We have, from time to time, experienced, and we expect to continue to experience, difficulty in hiring and retaining highly skilled employees with appropriate qualifications.

For example, in recent years, recruiting, hiring and retaining employees with expertise in the cybersecurity industry has become increasingly difficult as the demand for cybersecurity professionals has increased as a result of recent cybersecurity attacks on global corporations and governments.

For example, in recent years, recruiting, hiring and retaining employees with expertise in the cybersecurity industry has become increasingly difficult as the demand for cybersecurity professionals has increased as a result of the recent cybersecurity attacks on global corporations and governments.

We may be required to provide more training to our personnel than we currently anticipate.

1 unchanged sentence

Should our competitors recruit our employees, our level of expertise and ability to execute our business plan would be negatively impacted.

In June 2023, we approved a restructuring plan, which impacted approximately 5% of our workforce.

This reduction may adversely impact our ability to achieve our future operational targets.

In the future, we may be unable to hire qualified employees and may be unable to successfully train those employees that we are able to hire, and as a result, employees may not become fully productive on the timelines that we have projected or at all.

Further, the reduction could yield unanticipated consequences or disruptions in our day-to-day operations, such as attrition beyond planned staff reductions.

Additionally, restrictive immigration policies or legal or regulatory developments relating to immigration may also negatively affect our efforts to attract and hire new personnel as well as retain our existing personnel.

Changes in US immigration and work authorization laws and regulations can be significantly affected by political forces and levels of economic activity.

Changes in U.S.

immigration and work authorization laws and regulations can be significantly affected by political forces and levels of economic activity.

Our business may be adversely affected if legislative or administrative changes to immigration or visa laws and regulations impair our hiring processes.

1 unchanged sentence

Our competitors also may be successful in recruiting and hiring members of our management team, sales team or other key employees, and it may be difficult for us to find suitable replacements on a timely basis, on competitive terms, or at all.

We have in the past, and may in the future, be subject to allegations that employees we hire have been improperly solicited, or that they have divulged proprietary or other confidential information or that their former employers own such employees’ inventions or other work product, or that they have been hired in violation of non-compete provisions or non-solicitation provisions.

In addition, job candidates and existing employees often consider the value of the equity awards and other compensation they receive in connection with their employment.

23 unchanged sentences

If we do not continue to develop our corporate culture as we grow and evolve, it could harm our ability to foster the innovation, inclusion, creativity, and teamwork that we believe is important to support our growth.

As we implement more complex organizational structures, we may find it increasingly difficult to maintain the beneficial aspects of

our corporate culture, which could negatively impact our future success.

As we implement more complex organizational structures, we may find it increasingly difficult to maintain the beneficial aspects of our corporate culture, which could negatively impact our future success.

We are also taking steps to develop a more inclusive and diverse workforce, however, there is no guarantee that we will be able to do so.

1 unchanged sentence

Our proprietary rights may be difficult to enforce, which could enable others to copy or use aspects of our platform without compensating us.

We rely primarily on patent, trademark, copyright and trade secrets laws, and confidentiality agreements and contractual provisions to protect our technology.

We rely primarily on patent, trademark, copyright and trade secrets laws, as well as confidentiality agreements and contractual provisions to protect our technology.

Valid patents may not issue from our pending applications, and the claims eventually allowed on any patents may not be sufficiently broad to protect our technology or platform.

Any issued patents may be challenged, invalidated or circumvented, and any rights granted under these patents may not actually provide adequate defensive protection or competitive advantages to us.

Patent applications in the US are typically not published until at least 18 months after filing, or, in some cases, not at all, and publications of discoveries in industry-related literature lag behind actual discoveries.

Patent applications in the U.S.

are typically not published until at least 18 months after filing, or, in some cases, not at all, and publications of discoveries in industry-related literature lag behind actual discoveries.

We cannot be certain that we were the first to make the inventions claimed in our pending patent applications or that we were the first to file for patent protection.

Additionally, the process of obtaining patent protection is expensive and time-consuming, and we may not be able to prosecute all necessary or desirable patent applications at a reasonable cost or in a timely manner.

In addition, recent changes to the patent laws in the US may bring into question the validity of certain software patents and may make it more difficult and costly to prosecute patent applications.

In addition, recent changes to the patent laws in the U.S.

may bring into question the validity of certain software patents and may make it more difficult and costly to prosecute patent applications.

Such changes may lead to uncertainties or increased costs and risks surrounding the prosecution, validity, ownership, enforcement, and defense of our issued patents and patent applications and other intellectual property, the outcome of third-party claims of infringement, misappropriation, or other violation of intellectual property brought against us and the actual or enhanced damages (including treble damages) that may be awarded in connection with any such current or future claims, and could have a material adverse effect on our business, operating results, and financial condition.

Despite our efforts to protect our proprietary rights, unauthorized parties may attempt to copy aspects of our platform or obtain and use information that we regard as proprietary.

We generally enter into confidentiality or license agreements with our employees, consultants, vendors, and customers, and generally limit access to and distribution of our proprietary information.

We generally enter into confidentiality or license agreements with our employees, consultants, vendors, channel partners, and customers, and generally limit access to and distribution of our proprietary information.

However, such agreements may not be enforceable in full or in part in all jurisdictions and any breach could negatively affect our business and our remedy for such breach may be limited.

3 unchanged sentences

Policing unauthorized use of our technology or platform is difficult.

In addition, the laws of some foreign countries do not protect our proprietary rights to the same extent as the laws of the US, and many foreign countries do not enforce these laws as diligently as government agencies and private parties in the US.

In addition, the laws of some foreign countries do not protect our proprietary rights to the same extent as the laws of the U.S., and many foreign countries do not enforce these laws as diligently as government agencies and private parties in the U.S.

For example, many foreign countries limit the enforceability of patents against certain third parties, including government agencies or government contractors.

5 unchanged sentences

Moreover, the availability of copyright protection and other legal protections for intellectual property generated by certain technologies, such as generative AI, is uncertain.

The use of generative AI and other forms of AI may expose us to risks because the intellectual property ownership and license rights, including copyright, of generative and other AI output, has not been fully interpreted by US courts or been fully addressed by US federal or state regulation, as well as in foreign jurisdictions.

courts or been fully addressed by U.S.

federal or state regulation, as well as in foreign jurisdictions.

Such litigation could result in substantial costs and diversion of resources and could negatively affect our business, operating results and financial condition.

If we are unable to protect our proprietary rights (including aspects of our software and platform protected other than by patent rights), we will find ourselves at a competitive disadvantage to others who need not incur the additional expense, time and effort required to create our platform and other innovative products that have enabled us to be successful to date.

other innovative products that have enabled us to be successful to date.

Moreover, we may need to expend additional resources to defend our intellectual property rights in foreign countries, and our inability to do so could impair our business or adversely affect our international expansion.

21 unchanged sentences

Alternatively, we could be required to develop alternative non-infringing technology, which could require significant time, effort, and expense, and may affect the performance or features of our platform.

If we cannot license or develop alternative non-infringing substitutes for any infringing technology used in any aspect of our business, we would be forced to limit or stop sales of our

platform and may be unable to compete effectively.

If we cannot license or develop alternative non-infringing substitutes for any infringing technology used in any aspect of our business, we would be forced to limit or stop sales of our platform and may be unable to compete effectively.

Any of these results would adversely affect our business, operating results, and financial condition.

15 unchanged sentences

Some open source licenses contain requirements that we make available as source code for modifications or derivative works we create based upon our use and distribution of the open source software.

If we combine and distribute our proprietary software with open source software in a certain manner, we could, under certain open source licenses, be required to release combined the source code of our proprietary software to the public, including authorizing further modification and redistribution, or otherwise be limited in the licensing of our services, each of which could provide an advantage to our competitors or other entrants to the market, create security vulnerabilities in our solution, require us to re-engineer all or a portion of our platform, and reduce or eliminate the value of our services.

If we combine and distribute our proprietary software with open source software in a certain manner, we could, under certain open source licenses, be required to release the source code of our proprietary software to the public, including authorizing further modification and redistribution, or otherwise be limited in the licensing of our services, each of which could provide an advantage to our competitors or other entrants to the market, create security vulnerabilities in our solution, require us to re-engineer all or a portion of our platform, and reduce or eliminate the value of our services.

This would allow our competitors to create similar products with lower development effort and time and ultimately could result in a loss of sales for us.

The terms of many open source licenses have not been interpreted by US courts, and there is a risk that these licenses could be construed in ways that could impose unanticipated conditions or restrictions on our ability to commercialize products and subscriptions incorporating such software.

The terms of many open source licenses have not been interpreted by U.S.

courts, and there is a risk that these licenses could be construed in ways that could impose unanticipated conditions or restrictions on our ability to commercialize products and subscriptions incorporating such software.

Moreover, we cannot assure you that our processes for controlling our use of open source software in our products and subscriptions will be effective.

From time to time, we may face claims from third parties asserting ownership of, or demanding release of, the open source software or derivative works that we developed using such software (which could include our proprietary source

code), or otherwise seeking to enforce the terms of the applicable open source license.

These claims, regardless of validity, could result in time consuming and costly litigation, divert management’s time and attention away from developing the business, expose us to customer indemnity claims, or force us to disclose source code.

Litigation could be costly for us to defend, result in paying damages, entering into unfavorable licenses, have a negative effect on our operating results and financial condition, or cause delays by requiring us to devote additional research and development resources to change our solution.

could be costly for us to defend, result in paying damages, entering into unfavorable licenses, have a negative effect on our operating results and financial condition, or cause delays by requiring us to devote additional research and development resources to change our solution.

Risks Related to Legal and Regulatory Matters

We are subject to laws and regulations, including governmental export and import controls, sanctions and anti-corruption laws, that could impair our ability to compete in our markets and subject us to liability if we are not in full compliance with applicable laws.

We are subject to laws and regulations, including governmental export and import controls, that could subject us to liability or impair our ability to compete in our markets.

Our platform and related technology are subject to US export controls, including the US Department of Commerce’s Export Administration Regulations (also known as “EAR”), and we and our employees, representatives, contractors, agents, intermediaries, and other third parties are also subject to various economic and trade sanctions regulations administered by OFAC and other US government agencies.

We incorporate standard encryption algorithms into our platform, which, along with the underlying technology, may be exported outside of the US only with the required export authorizations, including by license, license exception or other appropriate government authorizations, which may require the filing of an encryption registration and classification request.

We also offer certain customers a ransomware warranty in addition to their subscriptions, providing coverage in the form of a limited monetary payment if they are affected by a ransomware attack (as specified in our ransomware warranty agreement), and though the terms of the warranty do not allow those customers to use warranty claim payments to fund payments to persons on OFAC’s list of Specially Designated Nationals and Blocked Persons or who are otherwise prohibited to receive such payments under US sanctions, we cannot assure you that all of our customers will comply with our warranty terms or refrain from taking actions in violation of our warranty and applicable law.

Furthermore, US export control laws and economic sanctions prohibit the export and re-export of certain hardware and software and the provision of certain cloud-based solutions to certain countries, governments and persons targeted by US sanctions and for certain end-uses.

As an example, following Russia’s invasion of Ukraine, the US and other countries imposed economic sanctions and severe export control restrictions against Russia and Belarus.

The US and its allies could expand and strengthen these sanctions and export restrictions and take other actions should the conflict further escalate.

These restrictions would further impact our ability to do business in certain parts of the world and to do business with certain persons and entities, including selling our services and using local developers.

We are subject to laws and regulations, including government export and import controls, sanctions and anti-corruption laws, that could impair our ability to compete in our markets and subject us to liability if we are not in full compliance with applicable laws.

We are subject to laws and regulations, including government export and import controls, that could subject us to liability or impair our ability to compete in our markets.

Our platform and related technology are subject to U.S.

export controls, including the U.S.

Department of Commerce’s Export Administration Regulations (EAR).

We, along with our employees, representatives, contractors, agents, intermediaries, and other third parties are also subject to various economic and trade sanctions regulations administered by OFAC and other U.S.

government agencies.

We incorporate standard encryption algorithms into our platform, which, along with the underlying technology, may be exported or reexported to foreign countries only with the required export authorizations, including by license, license exception or other appropriate government authorizations, which may require the filing of an encryption registration and classification request and other reports submitted on a periodic basis.

sanctions, we cannot assure you that all of our customers will comply with our warranty terms or refrain from taking actions in violation of our warranty and applicable law.

Furthermore, U.S.

export control laws and economic sanctions prohibit the export and re-export of certain hardware and software and the provision of certain cloud-based solutions to certain countries, governments and persons targeted by U.S.

sanctions and for certain end-uses.

For example, following Russia’s invasion of Ukraine, the U.S.

and other countries have continued to impose economic sanctions and severe export control restrictions against Russia and Belarus.

Should the conflict escalate, sanctions and export restrictions will likely expand and strengthen, potentially impacting our ability to conduct business in certain regions and with specific individuals and entities in those regions.

Further, regulators in the U.S.

and elsewhere have signaled an increased emphasis on sanctions and export control enforcement, including several recent high-profile enforcement actions and increased pressure for companies to self-disclose potential violations.

While we have implemented certain procedures to facilitate compliance with applicable laws and regulations in connection with the collection and distribution of this information, we cannot assure you that these procedures have been fully effective or that we, or third parties who we do not control, have complied with all laws or regulations in this regard.

Failure by our employees, representatives, contractors, channel partners, agents, intermediaries, or other third parties to comply with applicable laws and regulations in the collection and distribution of this information also could have negative consequences to us, including reputational harm, government investigations, loss of export privileges, monetary fines, and other penalties.

We also collect information about cyber threats from open sources, intermediaries and third parties that we make available to our customers in our threat industry publications.

Further, regulators in the US and elsewhere have signaled an increased emphasis on sanctions and export control enforcement, including several recent high-profile enforcement actions and increased pressure for companies to self-disclose potential violations.

While we have implemented certain procedures to facilitate compliance with applicable laws and regulations in connection with the collection and distribution of this information, we cannot assure you that these procedures have been effective or that we, or third parties who we do not control, have complied with all laws or regulations in this regard.

Although we take precautions to prevent our information collection practices and services from being provided in violation of such laws, our information collection practices and services may have been in the past, and could in the future be, provided in violation of such laws.

4 unchanged sentences

Additionally, export restrictions imposed on Russia and Belarus specifically limit the export of encryption hardware, software and related source code and technology to these locations which could limit our ability to provide our software and services to these countries.

Changes in our platform, and changes in or promulgation of new export and import regulations may create delays in the introduction of our platform into international markets, prevent our customers with international operations from deploying our platform globally or, in some cases, prevent the export or import of our platform to certain countries, governments or persons altogether.

Changes in our platform, and changes in or promulgation of new export and import regulations may create delays in the introduction of our platform into certain international markets, prevent our customers with international operations from deploying our platform globally or, in some cases, prevent the export or import of our platform to certain countries, governments or persons altogether.

Any change in export or import regulations, economic sanctions or related legislation, shift in the enforcement or scope of existing regulations, or change in the countries, governments, persons or technologies targeted by such regulations, could result in decreased use of our platform by, or in our decreased ability to export or sell our platform to, existing or potential customers with international operations.

Any decreased use of our platform or limitation on our ability to export or sell our platform would adversely affect our business, operating results, and financial condition.

We are also subject to the United States Foreign Corrupt Practices Act of 1977 (FCPA), as amended, the United Kingdom Bribery Act 2010 (the Bribery Act), and other anti-corruption, sanctions, anti-bribery, anti-money laundering and similar laws in the US and other countries in which we conduct activities.

and other countries in which we conduct activities.

Anti-corruption and anti-bribery laws, which have been enforced aggressively and are interpreted broadly, prohibit companies and their employees, agents, intermediaries and other third parties from promising, authorizing, making or offering improper payments or other benefits to government officials and others in the public, and in certain cases, private sector.

We leverage third parties, including intermediaries, agents and channel partners, to conduct our business in the US and abroad, to sell subscriptions to our platform and to collect information about cyber threats.

We leverage third parties, including intermediaries, agents and channel partners, to conduct our business in the U.S.

and abroad, to sell subscriptions to our platform and to collect information about cyber threats.

We and these third parties may have direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities and we may be held liable for the corrupt or other illegal activities of these third-party business partners and intermediaries, our employees, representatives, contractors, channel partners, agents, intermediaries and other third parties, even if we do not explicitly authorize such activities.

1 unchanged sentence

As we increase our international sales and business, including our business with government organizations, our risks under these laws may increase.

Noncompliance with these laws could subject us to investigations, severe criminal or civil sanctions, settlements, prosecution, loss of export privileges, suspension or debarment from US government contracts, other enforcement actions, disgorgement of profits, significant fines, damages, other civil and criminal penalties or injunctions, whistleblower complaints, adverse media coverage and other consequences.

Noncompliance with these laws could subject us to investigations, severe criminal or civil sanctions, settlements, prosecution, loss of export privileges, suspension or debarment from U.S.

government contracts, other enforcement actions, disgorgement of profits, significant fines, damages, other civil and criminal penalties or injunctions, whistleblower complaints, adverse media coverage and other consequences.

Any investigations, actions or sanctions could harm our reputation, business, operating results, and financial condition.

1 unchanged sentence

Our AI-related initiatives may result in new or enhanced governmental or regulatory scrutiny, including regarding the use of AI in our products and the marketing of products using AI, litigation, customer reporting or documentation requirements, ethical or social concerns, or other complications and may also introduce risks related to accuracy, bias, toxicity, privacy, and security and data provenance.

For example, the European Commission’s proposed Artificial Intelligence Act could also impose new obligations or limitations affecting our business, if and when it enters into force.

If we fail to adequately protect personal information or other information we collect, process, share or maintain under applicable laws, our business, operating results, and financial condition could be adversely affected.

We receive, store, and process personal information from our employees, customers, the employees of our customers, and our end users.

This personal information is hosted by our third-party service providers.

A wide variety of state, national, and international laws, as well as regulations and industry standards apply to the collection, use, retention, protection, disclosure, transfer and other processing of personal information and other information, the scope of which are changing, subject to differing interpretations, and may be inconsistent across countries or conflict with other rules.

Data protection and privacy-related laws and regulations are evolving and may result in

increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions.

Failure to comply with laws, regulations and industry standards regarding personal information or other information could adversely affect our business, operating results, and financial condition.

For example, in Europe, the E.U.

AI Act has started becoming applicable in 2025.

AI Act aims to introduce a common and regulatory framework for AI through regulating AI providers and entities making use of AI tools in a professional capacity and may require the implementation of additional quality assurance controls and measures to be reviewed and approved by regulatory submissions of our offerings.

Additionally, in the United States, the Framework for Artificial Intelligence Diffusion rule entered into effect on January 13, 2025.

The rule amends the EAR to control certain advanced closed-weight dual-use AI models and creates a global license requirement.

The rule may require the implementation of additional procedures to facilitate compliance with applicable laws and regulations.

We are subject to laws and regulations affecting our business, including those related to the privacy and data protection of the personal data or other information we collect, process or share.

Our actual or perceived failure to comply with such laws or regulations could harm our business.

We receive, store, and process some personal data from our employees, customers, the employees of our customers, and our end users.

This personal data is hosted by our third-party vendors and service providers.

A wide variety of state, national, and international laws, as well as regulations and industry standards apply to the collection, use, retention, protection, disclosure, transfer and other processing of personal data and other confidential or sensitive information, the scope of which are changing, subject to differing interpretations, and may be inconsistent across countries or conflict with other rules.

Data protection and privacy-related laws and regulations are evolving and may result in increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions.

Complying with these various laws and regulations could cause us to incur substantial costs or require us to change our business practices, systems, and compliance procedures in a manner adverse to our business.

In the US, there are numerous federal and state consumer, privacy, and data security laws and regulations governing the collection, use, disclosure, and protection of personal information, including security breach notification laws and consumer protection laws.

Failure to comply with laws, regulations and industry standards regarding personal data or other information could adversely affect our business, operating results, and financial condition.

In the U.S., there are numerous federal and state consumer, privacy, and data security laws and regulations governing the collection, use, disclosure, and protection of personal data, including security breach notification laws and consumer protection laws.

Each of these laws is subject to varying interpretations and constantly evolving.

Notably, but not necessarily limited to, we may be subject to:

• Controlling the Assault of Non-Solicited Pornography And Marketing Act (also known as the “CAN-SPAM Act”) and similar state consumer protection laws regarding the use of telephones and text messaging for marketing purposes.

• Section 5(a) of the Federal Trade Commission (FTC) Act for violating consumers’ privacy rights or failing to take appropriate steps to keep consumers’ personal information secure, resulting in a finding of an unfair act or practice.

• The CCPA, effective since January 1, 2020, which created new data privacy obligations for covered businesses and provided new privacy rights to California residents, including the right to opt out of certain disclosures of their information and receive detailed information about how their personal information is used.

The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation.

A ballot initiative called the California Privacy Rights Act (CPRA) went into force July 1, 2023, and significantly modifies the CCPA, including by expanding consumers’ rights with respect to certain sensitive personal data.

The CPRA also creates a new state agency, known as the California Privacy Protection Agency, which is vested with the authority to implement and enforce the CCPA and the CPRA.

Potential uncertainty surrounding the CCPA and CPRA may increase our compliance costs and potential liability, particularly in the event of a data breach, and could have a material adverse effect on our business.

• Other states have enacted consumer privacy laws comparable to the CCPA that came into effect in 2023:

Virginia enacted the Virginia Consumer Data Protection Act which became effective January 1, 2023;

Colorado and Connecticut enacted the Colorado Privacy Act and the Connecticut Personal Data Privacy and Online Monitoring Act, which both became effective July 1, 2023;

Utah enacted the Utah Consumer Privacy Act, which became effective December 31, 2023.

In addition, as of December 31, 2023, eight other states (Delaware, Indiana, Iowa, Florida, Montana, Oregon, Tennessee and Texas) enacted privacy legislation which will become effective between July 1, 2024 and January 1, 2026.

Numerous other states also have pending consumer privacy legislation under review, which if enacted, would add additional costs and expense of resources to maintain compliance.

In certain circumstances, we may also be subject to the GDPR (established in 2018 and implemented by countries in the EEA) and the UK GDPR, which respectively govern the collection, use, disclosure, transfer or other processing of personal data of natural persons, and it applies extra-territorially and imposes onerous requirements on controllers and processors of personal data, including, for example:

(i) accountability and transparency requirements, and enhanced requirements for obtaining valid consent;

(ii) obligations to consider data protection as any new products or services are developed and to limit the amount of personal data processed;

(iii) obligations to comply with data protection rights of data subjects;

and (iv) reporting of personal data breaches to the supervisory authority without undue delay (and no later than 72 hours).

Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements and potential fines for noncompliance of up to €20 million or 4% of the annual global turnover of the noncompliant company, whichever is greater.

Additionally, following the withdrawal by the UK from the EU and the EEA, companies must comply with both the GDPR and the UK GDPR as incorporated into UK national law, the latter regime having the ability to separately fine up to the

greater of £17.5 million or 4% of global annual turnover.

In addition to the foregoing, a breach of the GDPR or UK GDPR could result in regulatory investigations, reputational damage, orders to cease or change our processing of our data, enforcement notices, and/or assessment notices (for a compulsory audit).

Notably we may be subject to:

• The CCPA, which took effect in 2020, created new data privacy obligations for covered businesses and provided new privacy rights to California residents, including the right to opt out of certain disclosures of their personal information and receive detailed information about how their personal information.

• Following California’s lead, over a third of other U.S.

states have enacted privacy laws in recent years.

In addition, various comprehensive federal privacy bills have been proposed in Congress from time to time.

As a result of our presence in the E.U.

and the U.K., we are also subject to the GDPR, which governs the collection, use, disclosure, transfer or other processing of personal data of natural persons in the EEA and U.K., and it applies extra-territorially and imposes onerous requirements on controllers and processors of personal data.

A breach of the GDPR could result in fines, penalties, regulatory investigations, reputational damage, orders to cease or change our processing of our data, enforcement notices, and/or assessment notices for a compulsory audit.

Such penalties include potential fines for noncompliance of up to €20 million (£17.5 million in the U.K.) or 4% of a company’s global turnover, whichever is greater.

In addition to the foregoing, a breach of the GDPR could result in regulatory investigations, reputational damage, orders to cease or change our processing of our data, enforcement notices, and/or assessment notices (for a compulsory audit).

Such penalties include potential fines for noncompliance of up to €20 million (£17.5 million in the U.K.) or 4% of global turnover, whichever is greater.

We may also face civil claims including representative actions and other class action type litigation (where individuals have suffered harm), potentially amounting to significant compensation or damages liabilities, as well as associated costs, diversion of internal resources, and reputational harm.

The GDPR and UK GDPR requires, among other things, that personal data only be transferred outside of the EEA, or the UK, respectively to jurisdictions that have been deemed adequate (also known as “Third Countries,”) by the European Commission or by the UK data protection regulator, respectively.

Accordingly, personal data may not be transferred to those jurisdictions that have not been deemed adequate, unless steps are taken to legitimize those data transfers.

The GDPR prohibits, among other things, personal data from being transferred outside of the EEA or the U.K.

to any jurisdictions (Third Countries, including the U.S.) that have not been deemed adequate by regulators in the E.U.

or U.K., unless steps are taken to legitimize those data transfers.

Switzerland follows similar legal practices.

We rely on the use of Standard Contractual Clauses (SCCs), a standard form of contract approved by the European Commission, as an adequate personal data transfer mechanism for the transfer of personal data to Third Countries;

however, the SCCs may not be alone sufficient to protect data transferred to the US or other Third Countries under certain circumstances without making a case-by-case basis assessment of the legal regime applicable in the destination country according to the CJEU.

On June 28, 2021, the European Commission issued an adequacy decision for personal data transfers from the EEA to the UK, with a sunset clause of four years, meaning that the European Commission will review and renew only if the European Commission considers that the UK continues to ensure an adequate level of data protection.

Notably, the European Commission reserved a right to intervene at any time during the four-year adequacy period if the UK deviates from the level of protection then in place.

If this adequacy decision is reversed by the European Commission, we would have to implement protection measures such as the SCCs for personal data transfers between the EU and the UK or find alternative solutions for the compliant transfer of personal data from the EU into the UK In March 2022, the UK Information Commissioner’s Office adopted an International Data Transfer Agreement (IDTA) for transfers of personal data out of the UK to so-called third countries, as well as an international data transfer addendum (UK SCC Addendum) that can be used with the SCCs for the same purpose.

To add to this complexity, effective on July 10, 2023, the European Commission adopted the new EU-US Data Privacy Framework (DPF) which allows for transfers of personal data from the EU to certified companies in the US without the need for additional privacy safeguards as an alternative to the SCCs.

In October 2023, a UK extension to the DPF (the UK – US Data Bridge) was adopted enabling the transfer of personal data between the UK and US entities without the need for an IDTA or UK SCC Addendum.

However, the DPF and the UK – US Data Bridge could be subject to further legal challenge which could cause the legal requirements for personal data transfers from the EU and the UK to the US to become uncertain once again.

Some countries (including some outside the EEA) also are considering or have passed legislation requiring local storage and processing of data, or similar requirements, which could increase the cost and complexity of delivering our products and services if we were to operate in those countries.

If we are required to implement additional measures to transfer data from the EEA, this could increase our compliance costs, and could adversely affect our business, financial condition and results of operations.

The myriad of international and US privacy and data breach laws are not consistent, and compliance in the event of a widespread data breach is difficult and may be costly.

In many jurisdictions, enforcement actions and consequences for noncompliance are also rising.

In addition to government regulation, privacy advocates and industry groups may propose new and different self-regulatory standards that either legally or contractually apply to us.

As supervisory authorities continue to issue further guidance on personal information transfers (including regarding data export and circumstances in which we cannot use the SCCs), we could suffer additional costs, complaints, or regulatory investigations or fines.

If we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, adversely affecting our financial results, and possibly making it necessary to establish localized storage systems in the EEA, Switzerland, and the UK to maintain personal data originating from those jurisdictions that adds expenses and may create distractions from our other business pursuits.

Loss, retention or misuse of certain information and alleged violations of laws and regulations relating to privacy and data security, and any relevant claims, may expose

us to potential liability and may require us to expend significant resources on data security and in responding to and defending such allegations and claims.

We are also subject to evolving EU and UK privacy laws on cookies and electronic marketing.

In the EU and the UK, informed opt-in consent is required for the placement of a cookie or similar technologies on a user’s device and for direct electronic marketing.

The GDPR also imposes conditions on obtaining valid consent, such as a prohibition on pre-checked consents and a requirement to ensure separate consents are sought for each type of cookie or similar technology.

While we anticipate the development of the ePrivacy Regulation to govern cookies and e-marketing, recent European court decisions and regulators’ guidance are driving increased attention to cookies and tracking technologies.

If regulators start to enforce the strict approach in recent guidance, this could lead to substantial costs, require significant systems changes, limit the effectiveness of our marketing activities, divert the attention of our technology personnel, adversely affect our margins, increase costs and subject us to additional liabilities.

Regulation of cookies and similar technologies, and any decline of cookies or similar online tracking technologies as a means to identify and potentially target users, may lead to broader restrictions and impairments on our marketing and personalization activities and may negatively impact our efforts to understand users.

Similar concerns may happen under the new CPRA regime in California and other current and soon-to-be enacted US state privacy laws.

Additionally, by expanding into the EU and UK, we may also trigger Article 3(2) of the GDPR/UK GDPR directly as we may be considered to be monitoring data subjects.

To the extent we process personal data on behalf of our customers for the provision of services, we have, and may in the future, also be required to enter into data processing agreements which comply with Article 28 of the GDPR/UK GDPR.

We depend on a number of third parties in relation to the operation of our business, a number of which process personal data on our behalf or as our sub-processor.

We currently rely on the use of Standard Contractual Clauses (SCCs) and our certification under the E.U.-U.S.

Data Privacy Framework (DPF), the U.S.-U.K.

DPF and the Swiss U.S.

DPF for the transfer of personal data from the E.U.

to Third Countries.

However these transfer mechanisms could be subject to further legal challenge which could cause the legal requirements for personal data transfers from these countries to the U.S.

to become uncertain once again.

If we are otherwise unable to transfer personal data between and among countries and regions

in which we operate, it could affect the manner in which we provide our services, adversely affecting our financial results, and possibly making it necessary to establish systems in the EEA, Switzerland, the U.K.

and other jurisdiction to maintain personal data originating from those jurisdictions that adds expenses and may create distractions from our other business pursuits.

As supervisory authorities continue to issue further guidance on personal data transfers, we could suffer additional costs, complaints, or regulatory investigations or fines.

Loss, retention or misuse of certain information and alleged violations of laws and regulations relating to privacy and data security, and any relevant claims, may expose us to potential liability and may require us to expend significant resources on data security and in responding to and defending such allegations and claims.

Moreover, we are also subject to evolving E.U.

privacy laws on cookies and electronic marketing.

Similar concerns around the regulation of cookies and similar technologies may happen under the CCPA regime in California and other current and soon-to-be enacted U.S.

state privacy laws.

Further, we depend on a number of third parties in relation to the operation of our business, many of which process personal data on our behalf or as our sub-processor.

To the extent required by applicable law, we attempt to mitigate the associated risks of using third parties by performing security assessments and detailed due diligence, entering into contractual arrangements to ensure that providers only process personal data according to our instructions or comparable instructions to the instructions of our customer (as applicable), and that they have sufficient technical and organizational security measures in place.

There is no assurance that these contractual measures and our own privacy and security-related safeguards will protect us from the risks associated with the third-party processing, storage and transmission of such information.

Any violation of privacy, data protection, data or cybersecurity laws by our third-party processors could have a material adverse effect on our business and result in the fines and penalties under the GDPR and the UK GDPR outlined above.

In recent years, some regulators have proposed or introduced cybersecurity licensing requirements or certification regimes for specific sectors, such as critical infrastructure.

These may impose new requirements on us or our current or prospective customer including, but not limited to, data processing locations, breach notification, and security standards.

Such requirements may cause us to incur significant organizational costs and increase barriers of entry into new markets.

New worldwide data protection laws, including in the US and European jurisdictions described above, may lead to changing definitions of personal information and other sensitive information which may also limit or inhibit our ability to operate or expand our business, including limiting strategic partnerships that may involve the sharing of data.

Notably some foreign jurisdictions require that certain types of data be retained on servers within these respective jurisdictions.

Our failure to comply with applicable laws, directives, and regulations may result in enforcement action against us, including fines, and damage to our reputation, any of which may have an adverse effect on our business and operating results.

Any failure or perceived failure by us, even if unfounded, to comply with applicable privacy and data security laws and regulations, our privacy policies, or our privacy-related obligations to customers, users or other third parties, or any compromise of security that results in the unauthorized release or transfer of personal information or other customer data, may result in governmental enforcement actions, fines, penalties, litigation, or public statements against us by consumer advocacy groups or others and could cause our users to lose trust in us, which would have an adverse effect on our reputation and business.

For example, in 2017, we reached a consent agreement with the FTC, to resolve an investigation relating to certain disclosures in our privacy policy.

Any failure or perceived failure by us, even if unfounded, to comply with applicable privacy and data security laws and regulations, our privacy policies, or our privacy-related obligations to customers, users or other third parties, or any compromise of security that results in the unauthorized release or transfer of personal data or other customer data, may result in government enforcement actions, fines, penalties, litigation, or public statements against us by consumer advocacy groups or others and could cause our users to lose trust in us, which would have an adverse effect on our reputation and business.

For example, in 2017, we reached a consent agreement with the Federal Trade Commission (FTC), to resolve an investigation relating to certain disclosures in our privacy policy.

The consent agreement requires us, among other things, to provide information to the FTC about our compliance with the FTC order and about representations made in our marketing materials.

We may be subject to future investigations and legal proceedings

by the FTC or other regulators.

We may be subject to future investigations and legal proceedings by the FTC or other regulators.

As such, it is possible that a regulatory inquiry might result in changes to our policies or business practices.

1 unchanged sentence

In addition, it is possible that future orders issued by, or enforcement actions initiated by, regulatory authorities could cause us to incur substantial costs or require us to change our business practices in a manner materially adverse to our business.

Complying with laws and regulations related to privacy and data protection could result in additional costs and liabilities to us.

We are subject to various state, national, and international laws, regulations, and industry standards that apply to the collection, use, retention, protection, disclosure, transfer and other processing of personal data and other information, which often change in scope, are subject to differing interpretations, and may be inconsistent across countries or conflict with other rules.

The myriad of international and U.S.

privacy and data breach laws are not consistent, and compliance in the event of a widespread data breach is difficult and may be costly.

In many jurisdictions, enforcement actions and consequences for noncompliance are also rising.

In addition to government regulation, privacy advocates and industry groups may propose new and different self-regulatory standards that either legally or contractually apply to us.

Further, some countries (including some outside the EEA) also considering or have passed legislation requiring local storage and processing of data, or similar requirements, which could increase the cost and complexity of delivering our products and services if we were to operate in those countries.

In recent years, some regulators have proposed or introduced cybersecurity licensing requirements or certification regimes for specific sectors, such as critical infrastructure.

These may impose new requirements on us or our current or prospective customers including, but not limited to, data processing locations, breach notification, and security standards.

For instance, under DORA, which came into force in January 2025, our E.U.

financial entity clients for whom we are a third-party provider of critical information and communication technology (ICT) services will require us to contract with and manage our relationships with them (and, where applicable, our relationships with critical third-party technology vendors in our own supply chain) in accordance with the requirements of DORA.

Such requirements may cause us to incur significant organizational costs and increase barriers of entry into new markets.

Any significant change to applicable laws, regulations or industry practices regarding the use or disclosure of our customers’ data, or regarding the manner in which the express or implied consent of customers for the use and disclosure of such data is obtained – or in how these applicable laws, regulations or industry practices are interpreted and enforced by state, federal and international privacy regulators – could require us to modify our services and features, possibly in a material manner, may subject us to regulatory enforcement actions and fines, and may limit our ability to develop new products, services and features that make use of the data that our customers voluntarily share with us.

Any security breach or incident, including those resulting from a cybersecurity attack, phishing attack, unauthorized access, unauthorized usage, virus, malware, ransomware, denial of service, credential stuffing attack, supply chain attack, hacking or similar breach involving our networks and systems, or those of third parties upon which we rely, could result in the loss of customer data, including personal information, disruption to our operations, significant remediation costs, lost revenue, increased insurance premiums, damage to our reputation, litigation, regulatory investigations, or other liabilities.

These attacks may come from individual hackers, criminal groups, and state-sponsored organizations, and security breaches and incidents may arise from other sources, such as employee or contractor error or malfeasance.

Cyber threats are evolving and becoming increasingly sophisticated and complex, increasing the difficulty of detecting and successfully defending against them.

As a cybersecurity company, we have been and may continue to be specifically targeted by malicious actors for attacks intended to circumvent our security capabilities as an entry point into customers’ endpoints, networks, or systems.

Our industry is experiencing an increase in phishing attacks and unauthorized scans of systems searching for vulnerabilities or misconfigurations to exploit.

If our security measures are breached or otherwise compromised as a result of third-party action, employee or contractor error, defect, vulnerability or bug in our products or products of third parties upon which we rely, malfeasance or otherwise, including any such breach or compromise resulting in someone obtaining unauthorized access to our confidential information, including personal information or the personal information of our customers or others, or if any of these are perceived or reported to occur, we may suffer the loss, compromise, corruption, unavailability, or destruction of our or others’ confidential information and personal information, we may face a loss in intellectual property protection, our reputation may be damaged, our business may suffer and we could be subject to claims, demands, regulatory investigations and other proceedings, indemnity obligations, and otherwise incur significant liability.

Even the perception of inadequate security may damage our reputation and negatively impact our ability to win new customers and retain existing customers.

Further, we could be required to expend significant capital and other resources to address any security incident or breach, and we may face difficulties or delays in identifying and responding to any security breach or incident.

Techniques used to sabotage or obtain unauthorized access to systems or networks are constantly evolving and, in some instances, are not identified until launched against a target.

We and our third-party vendors and service providers may be unable to anticipate these techniques, react in a timely manner, or implement adequate preventative measures.

Due to political uncertainty and military actions associated with the conflicts in Ukraine, the Middle East and tensions between China and Taiwan, we and our third-party vendors and service providers are vulnerable to a heightened risk of cybersecurity attacks, phishing attacks, viruses, malware, ransomware, hacking or similar breaches from nation-state and affiliated actors, including attacks that could materially disrupt our and our third-party vendors’ and service providers’ systems and operations, supply chain, and ability to produce, sell and distribute our products and services as well as retaliatory cybersecurity attacks from Russian and Russian-affiliated actors against companies with a US presence.

In addition, laws, regulations, government guidance, and industry standards and practices in the US and elsewhere are rapidly evolving to combat these threats.

We may face increased compliance burdens regarding such requirements with regulators and customers regarding our products and services and also incur additional costs for oversight and monitoring of our own supply chain.

We and our customers may also experience increased costs associated with security measures and increased risk of suffering cyberattacks,

including ransomware attacks.

Should we or the third-party vendors and service providers upon which we rely experience such attacks, including from ransomware or other security breaches or incidents, our operations may also be hindered or interrupted due to system disruptions or otherwise, with foreseeable secondary contractual, regulatory, financial and reputational harms that may arise from such an incident.

Further, we cannot assure that any limitations of liability provisions in our customer agreements, contracts with third-party vendors and service providers or other contracts would be enforceable or adequate or would otherwise protect us from any liabilities or damages with respect to any particular claim relating to a security breach or other security incident.

We also cannot be sure that our existing insurance coverage will continue to be available on acceptable terms or will be available in sufficient amounts to cover claims related to a security incident or breach, or that the insurer will not deny coverage as to any future claim.

The successful assertion of claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or coinsurance requirements, could have a material adverse effect on our business, including our financial condition, operating results, and reputation.

Moreover, while we strive to publish and prominently display privacy policies that are accurate, comprehensive, and compliant with applicable laws, rules regulations and industry standards, we cannot ensure that our privacy policies and other statements regarding our practices will be sufficient to protect us from claims, proceedings, liability or adverse publicity relating to data privacy and security.

If our public statements about our use, collection, disclosure and other processing of personal information, whether made through our privacy policies, information provided on our website, press statements or otherwise, are alleged to be deceptive, unfair or misrepresentative of our actual practices, we may be subject to potential government or legal investigation or action, including by the FTC or applicable state attorneys general.

If our public statements about our use, collection, disclosure and other processing of personal data, whether made through our privacy policies, information provided on our website, press statements or otherwise, are alleged to be deceptive, unfair or misrepresentative of our actual practices, we may be subject to potential government or legal investigation or action, including by the FTC or applicable state attorneys general.

Our compliance efforts are further complicated by the fact that data privacy and security laws, rules, regulations and standards around the world are rapidly evolving, may be subject to uncertain or inconsistent interpretations and enforcement, and may conflict among various jurisdictions.

Any failure or perceived failure by us to comply with our privacy policies, or applicable data privacy and security laws, rules, regulations, standards, certifications or contractual obligations, or any compromise of security that results in unauthorized access to, or unauthorized loss, destruction, use, modification, acquisition, disclosure, release or transfer of personal information, may result in requirements to modify or cease certain operations or practices, the expenditure of substantial costs, time and other resources, proceedings or actions against us, legal liability, governmental investigations, enforcement actions, claims, fines, judgments, awards, penalties, sanctions, and costly litigation (including class actions).

Any of the foregoing could harm our reputation, distract our management and technical personnel, increase our costs of doing business, adversely affect the demand for our products and services, and ultimately result in the imposition of liability, any of which could have a material adverse effect on our business, operating results, and financial condition.

Any failure or perceived failure by us to comply with our privacy policies, or applicable data privacy and security laws, rules, regulations, standards, certifications or contractual obligations, or any compromise of security that results in unauthorized access to, or unauthorized loss, destruction, use, modification, acquisition, disclosure, release or transfer of personal data, may result in requirements to modify or cease certain operations or practices, the expenditure of substantial costs, time and other resources, proceedings or actions against us, legal liability, government investigations, enforcement actions, claims, fines, judgments, awards, penalties, sanctions, and costly litigation (including class actions).

Any of the foregoing could result in significant operational and compliance costs, harm our reputation, distract our management and technical personnel, adversely affect the demand for our products and services, and ultimately result in the imposition of liability, any of which could have a material adverse effect on our business, operating results, and financial condition.

We are currently in, and may in the future, become involved in litigation that may adversely affect us.

From time to time, we have been subject to claims, suits and other proceedings.

From time to time, we are subject to claims, suits and other proceedings.

For example, we are currently the subject of securities litigation and commercial litigation.

For additional information regarding these litigation matters, see the section titled “Legal Proceedings.” Regardless of the outcome, legal proceedings can have an adverse impact on us because of legal costs and diversion of management attention and resources, and could cause us to incur significant expenses or liability, adversely affect our brand recognition or require us to change our business practices.

For additional information regarding these litigation matters, see the section titled “Legal Proceedings.” Regardless of the outcome, legal proceedings can have an adverse impact on us because of legal costs and diversion of management’s attention and resources, and could cause us to incur significant expenses or liability, adversely affect our brand recognition or require us to change our business practices.

The expense of litigation and the timing of this expense from period to period are difficult to estimate, subject to change and could adversely affect our business, operating results, and financial condition.

2 unchanged sentences

Because of the potential risks, expenses and uncertainties of litigation, we may, from time to time, settle disputes, even where we have meritorious claims or defenses, by agreeing to settlement agreements.

Because litigation is inherently unpredictable, we cannot assure you that the results of any of these actions will not have a material adverse effect on our business, operating results,

financial condition, and prospects.

Because litigation is inherently unpredictable, we cannot assure you that the results of any of these actions will not have a material adverse effect on our business, operating results, financial condition, and prospects.

Any of these consequences could adversely affect our business, operating results, and financial condition.

6 unchanged sentences

We are continuing to develop and refine our disclosure controls, internal control over financial reporting and other procedures that are designed to ensure information required to be disclosed by us in our consolidated financial statements and in the reports that we will file with the SEC is recorded, processed, summarized and reported within the time periods specified in SEC rules and forms, and information required to be disclosed in reports under the Exchange Act is accumulated and communicated to our principal executive and financial officers.

Our current controls and any new controls we develop may become inadequate because of changes in conditions in our business.

Additionally, to the extent we acquire other businesses, the acquired companies may not have a sufficiently robust system of internal controls and we may uncover new deficiencies.

Our current controls and any new controls we develop may become inadequate due to changes in conditions in our business.

Additionally, to the extent we acquire other businesses, the acquired companies may not have sufficiently robust systems of internal controls and we may uncover new deficiencies.

Further, weaknesses in our internal controls may be discovered in the future.

2 unchanged sentences

Our management is also required, pursuant to Section 404 of the Sarbanes-Oxley Act, to certify financial and other information in our quarterly and annual reports and provide an annual report on the effectiveness of our internal control over financial reporting.

In addition, changing laws, regulations, and standards relating to corporate governance and public disclosure, including those related to climate change and other environmental, social, and governance (ESG)-focused disclosures, are creating uncertainty for public companies, increasing legal and financial compliance costs, and making some activities more time consuming.

These laws, regulations, and standards are subject to varying interpretations, in many cases due to their lack of specificity, and, as a result, their application in practice may evolve over time as new guidance is provided by regulatory and governing bodies.

This could result in continuing uncertainty regarding compliance matters and higher costs necessitated by ongoing revisions to disclosure and governance practices.

We intend to continue to invest resources to comply with evolving laws, regulations, and standards, and this investment may result in increased general and administrative expenses and a diversion of management’s time and attention from revenue-generating activities to compliance activities.

If our efforts to comply with new laws, regulations, and standards differ from the activities intended by regulatory or governing bodies due to ambiguities related to their application and practice, regulatory authorities may initiate legal proceedings against us, and our business may be adversely affected.

In addition, we are subject to evolving laws, regulations, policies, and international accords relating to matters beyond our core products and services, including, but not limited to, environmental sustainability, climate change, human capital, and employment matters.

In particular, we face challenges inherent in effectively and efficiently managing a workforce across a large number of jurisdictions, many of which have differing labor law requirements, including the need to implement appropriate systems, policies, benefits, and compliance programs.

Compliance with such laws, regulations, and policies may require significant investment and expense.

Further, if we fail to implement the necessary programs, frameworks and principles for compliance, our reputation, business, and financial condition may be adversely affected.

We have incurred significant costs with respect to our directors’ and officers’ insurance coverage.

In the future, it may be more expensive or more difficult for us to obtain director and officer liability insurance, and we may be required to accept reduced coverage or incur substantially higher costs to obtain coverage.

These factors would also

make it more difficult for us to attract and retain qualified members of our board of directors, particularly to serve on our audit committee and compensation committee, and qualified executive officers.

These factors would also make it more difficult for us to attract and retain qualified members of our board of directors, particularly to serve on our audit committee and compensation committee, and qualified executive officers.

Being a public company requires significant resources and management oversight.

As a result, management’s attention may be diverted from other business concerns, which could harm our business, operating results, and financial condition.

We could be subject to additional tax liabilities and US federal and global income tax reform could adversely affect us.

We are subject to US federal, state, local and sales taxes in the US and foreign income taxes, withholding taxes and transaction taxes in numerous foreign jurisdictions.

We could be subject to additional tax liabilities and United States federal and global income tax reform could adversely affect us.

We are subject to U.S.

federal, state, and sales taxes in the U.S.

and foreign income taxes, withholding taxes and transaction taxes in numerous foreign jurisdictions.

Significant judgment is required in evaluating our tax positions and our worldwide provision for income taxes.

During the ordinary course of business, there are many activities and transactions for which the ultimate tax determination is uncertain.

In addition, our future income tax obligations could be adversely affected by changes in, or interpretations of, tax laws in the US or in other jurisdictions in which we operate.

For example, the US tax law legislation, commonly referred to as the Tax Cuts and Jobs Act of 2017, significantly reformed the Internal Revenue Code of 1986, as amended (the Internal Revenue Code), reducing US federal tax rates, making sweeping changes to rules governing international business operations, and imposing significant additional limitations on tax benefits, including the deductibility of interest and the use of net operating loss carryforwards.

During the ordinary course of business, there are many activities and transactions for which the determination of our ultimate tax liabilities is uncertain.

In addition, our future income tax obligations could be adversely affected by changes in, or interpretations of, tax laws in the U.S.

or in other jurisdictions in which we operate.

For example, the United States tax law legislation, commonly referred to as the Tax Cuts and Jobs Act of 2017 significantly reformed the Internal Revenue Code of 1986, as amended (the Internal Revenue Code), reducing U.S.

federal tax rates, making sweeping changes to rules governing international business operations, and imposing significant additional limitations on tax benefits, including the deductibility of interest and the use of net operating loss carryforwards.

On August 16, 2022, President Biden signed the Inflation Reduction Act of 2022 (IRA) into law.

2 unchanged sentences

The first pillar is focused on the allocation of taxing rights between countries for in-scope multinational enterprises that sell goods and services into countries with little or no local physical presence and is intended to apply to multinational enterprises with global turnover above €20 billion.

The second pillar is focused on developing a global minimum tax rate of at least 15 percent applicable to in-scope multinational enterprises and is intended to apply to multinational enterprises with annual consolidated group revenue in excess of €750 million.

We are still evaluating the impact of the pillar two rules as they continue to be refined by the OECD and implemented by various national governments.

However, it is possible that the pillar two rules, as implemented by various national governments, could adversely affect our effective tax rate or result in higher cash tax liabilities.

The second pillar is focused on developing a global minimum tax rate of at least 15% applicable to in-scope multinational enterprises and is intended to apply to multinational enterprises with annual consolidated group revenue in excess of €750 million.

The rules were effective for us beginning in fiscal 2025.

Numerous countries have enacted or substantially enacted legislation to implement these rules.

While Pillar Two did not have an impact on our tax provision or effective tax rate in fiscal 2025, we continue to monitor Pillar Two and other evolving tax legislation in the jurisdictions in which we operate.

Due to the large and expanding scale of our international business activities, these types of changes to the taxation of our activities could impact the tax treatment of our foreign earnings, increase our worldwide effective tax rate, increase the amount of taxes imposed on our business, and harm our financial position.

1 unchanged sentence

Our ability to use our net operating loss carryforwards and certain other tax attributes may be limited.

As of January 31, 2024, we had aggregate US federal and state net operating loss carryforwards of $721.2 million and $390.6 million, respectively, which may be available to offset future taxable income for US income tax purposes.

As of January 31, 2025, we had aggregate U.S.

federal and state net operating loss carryforwards of $772.4 million and $447.9 million, respectively, which may be available to offset future taxable income for U.S.

income tax purposes.

If not utilized, the federal net operating loss carryforwards will begin to expire in 2031, and the state net operating loss carryforwards will begin to expire in 2027.

2 unchanged sentences

Realization of these net operating loss and research and development credit carryforwards depends on future income, and there is a risk that certain of our existing carryforwards could expire unused and be unavailable to offset future income tax liabilities, which could adversely affect our operating results and financial condition.

shareholders” over a rolling three-year period, the corporation’s ability to use its pre-change net operating loss carryovers and other pre-change tax attributes, such as research and development credits, to offset its post-change income or taxes may be limited.

Similar rules apply under US state tax laws.

In addition, under Sections 382 and 383 of the Internal Revenue Code, if a corporation undergoes an “ownership change,” generally defined as a greater than 50% change (by value) in ownership by “5% shareholders” over a rolling three-year period, the corporation’s ability to use its pre-change net operating loss carryovers and other pre-change tax attributes, such as research and development credits, to offset its post-change income or taxes may be limited.

Similar rules apply under U.S.

state tax laws.

We have, and may in the future, experience ownership changes as a result of shifts in our stock ownership.

As a result, if we earn net taxable income, our ability to use our pre-change US net operating loss carryforwards to offset US federal taxable income may be subject to limitations, which could potentially result in increased future tax liability to us.

As a result, if we earn net taxable income, our ability to use our pre-change U.S.

net operating loss carryforwards to offset U.S.

federal taxable income may be subject to limitations, which could potentially result in increased future tax liability to us.

We could be required to collect additional sales, use, value added, digital services, or other similar taxes or be subject to other liabilities with respect to past or future sales, that may increase the costs our customers would have to pay for our solutions and adversely affect our business, operating results, and financial condition.

1 unchanged sentence

Sales and use, value added, and similar tax laws and rates vary greatly by jurisdiction.

Certain jurisdictions in which we do not collect such taxes may seek to impose incremental or new sales, use, value added, digital services, or assert other tax collection obligations on us that such taxes are applicable, which could result in tax assessments, penalties and interest, to us or our customers for the past amounts, and we may be required to collect such taxes in the future.

We may be required to collect such taxes in the future.

If we are unsuccessful in collecting such taxes from our customers, we could be held liable for such costs, which may adversely affect our results of operations.

Further, an increasing number of US states have considered or adopted laws that attempt to impose tax collection obligations on out-of-state companies.

A successful assertion by one or more US states requiring us to collect taxes where we presently do not do so, or to collect more taxes in a jurisdiction in which we currently do collect some taxes, could result in substantial liabilities, including taxes on past sales, as well as interest and penalties.

Furthermore, certain jurisdictions, such as the UK, France and Canada, have enacted a digital services tax, which is generally a tax on gross revenue generated from users or customers located in in those jurisdictions, and other jurisdictions are considering enacting similar laws.

A successful assertion by a US state or local government, or other country or jurisdiction that we should have been or should be collecting additional sales, use, value added, digital services or other similar taxes could, among other things, result in substantial tax payments, create significant administrative burdens for us, discourage potential customers from subscribing to our platform due to the incremental cost of any such sales or other related taxes, or otherwise harm our business.

Further, an increasing number of U.S.

states have considered or adopted laws that attempt to impose tax collection obligations on out-of-state companies.

A successful assertion by one or more U.S.

states requiring us to collect taxes where we presently do not do so, or to collect more taxes in a jurisdiction in which we currently do collect some taxes, could result in substantial liabilities, including taxes on past sales, as well as interest and penalties.

Furthermore, certain jurisdictions, such as the U.K., France and Canada, have enacted a digital services tax, which is generally a tax on gross revenue generated from users or customers located in in those jurisdictions, and other jurisdictions are considering enacting similar laws.

A successful assertion by a U.S.

state or local government, or other country or jurisdiction that we should have been or should be collecting additional sales, use, value added, digital services or other similar taxes could, among other things, result in substantial tax payments, create significant administrative burdens for us, discourage potential customers from subscribing to our platform due to the incremental cost of any such sales or other related taxes, or otherwise harm our business.

Our corporate structure and intercompany arrangements are subject to the tax laws of various jurisdictions, and we could be obligated to pay additional taxes, which would harm our operating results and financial condition.

1 unchanged sentence

We generally conduct our international operations through wholly-owned subsidiaries and are or may be required to report our taxable income in various jurisdictions worldwide based upon our business operations in those jurisdictions.

Our corporate structure and associated transfer pricing policies contemplate future growth in international markets, and consider the functions, risks, and assets of the various entities involved in intercompany transactions.

transactions.

Furthermore, increases in tax rates, new or revised tax laws, and new interpretations of existing tax laws and policies by taxing authorities and courts in various jurisdictions, could result in an increase in our overall tax obligations which could adversely affect our business.

Our intercompany relationships and intercompany transactions are subject to complex transfer pricing rules administered by taxing authorities in various jurisdictions in which we operate with potentially divergent tax laws.

The amount of taxes we pay in different jurisdictions will depend on the application of the tax laws of the various jurisdictions, including the US, to our intercompany transactions, international business activities, changes in tax rates, new or revised tax laws or interpretations of existing tax laws and policies by taxing authorities and courts in various jurisdictions, and our ability to operate our business in a manner consistent with our corporate structure and intercompany arrangements.

It is not uncommon for tax authorities in different countries to have conflicting views, for instance, with respect to, among other things, the manner in which the arm’s length standard is applied for transfer pricing purposes, the transfer pricing and charges for intercompany services and other intercompany transactions, or with respect to the valuation of our intellectual property and the manner in which our intellectual property is utilized within our group.

In 2022, we began negotiating a bilateral Advance Pricing Agreement (APA) with the US and the Israeli

governments, covering various transfer pricing matters for intercompany transactions relating to the intergroup utilization of our intellectual property among our group enterprises.

An APA, if obtained, will provide us with a more predictable future business operating model, and preclude the relevant tax authorities from making certain transfer pricing adjustments within the scope of these agreements.

These transfer pricing matters may be significant to our consolidated financial statements.

If taxing authorities in any of the jurisdictions in which we conduct our international operations were to successfully challenge our transfer pricing, we could be required to reallocate part or all of our income to reflect transfer pricing adjustments, which could result in an increased tax liability to us.

The amount of taxes we pay in different jurisdictions will depend on the application of the tax laws of the various jurisdictions, including the U.S., to our intercompany transactions, international business activities, changes in tax rates, new or revised tax laws or interpretations of existing tax laws and policies by taxing authorities and courts in various jurisdictions, and our ability to operate our business in a manner consistent with our corporate structure and intercompany arrangements.

It is not uncommon for tax authorities in different countries to have conflicting views, for instance, with respect to, among other things, the manner in which the arm’s length standard is applied for transfer pricing purposes, the transfer pricing and charges for intercompany services and other intercompany transactions, or with respect to the valuation of our intellectual property for tax purposes and the manner in which our intellectual property is owned and utilized within our group.

Since 2022, we have been negotiating a bilateral Advance Pricing Agreement (APA) with the U.S.

and the Israeli governments, covering various transfer pricing matters for intercompany transactions relating to the intergroup ownership and utilization of our intellectual property among our group enterprises and the provision of intergroup services.

An APA, if obtained and implemented, will provide us with greater certainty regarding our tax obligations in respect of our U.S.

and Israeli intercompany transactions, transfer pricing and charges, and a more predictable future business operating model, and will preclude the relevant tax authorities from making certain transfer pricing adjustments within the scope of these agreements.

As of January 31, 2025, the APA negotiation remains ongoing and the parties have not agreed upon a framework for a settlement or resolution.

If we agree to an APA, we may, as part of that agreement, be required to make significant payments to the Israeli government.

Alternatively, if we are unable to agree upon an APA, the ITA may initiate an audit of our intercompany agreements and transactions, which may result in a potential tax assessment.

While we intend to vigorously defend our tax position, any fines, penalties, settlement or adverse judgment relating to such matter may have a material and adverse impact on our business, operating results, financial conditions and cash flows.

For more information see Note 12, Income Taxes, to our consolidated financial statements included in Part II, Item 8, Financial Statements and Supplementary Data.

In addition, if taxing authorities in any of the jurisdictions in which we conduct our international operations were to successfully challenge our transfer pricing, we could be required to reallocate part or all of our income to reflect transfer pricing adjustments, which could result in an increased tax liability to us.

In such circumstances, if the country from where the income was reallocated did not agree to the reallocation, we could become subject to tax on the same income in both countries, resulting in double taxation.

1 unchanged sentence

We believe that our tax and financial accounting positions are reasonable and our tax reserves are adequate to cover any potential liability.

We also believe that our assumptions, judgements, and estimates are reasonable and that our transfer pricing for these intercompany transactions are on arm’s-length terms.

However, the relevant tax authorities may disagree with our tax positions, including any assumptions, judgements or estimates used for these transfer pricing matters and intercompany transactions.

If any of these tax authorities determine that our transfer pricing for these intercompany transactions do not meet arm’s-length criteria, and were successful in challenging our positions, we could be required to pay additional taxes, interest and penalties related thereto, which could be in excess of any reserves established therefore, and which could result in higher effective tax rates, reduced cash flows, and lower overall profitability of our operations.

We believe that our assumptions, judgements, and estimates are reasonable and that our transfer pricing for these intercompany transactions are on arm’s-length terms.

However, the relevant tax authorities may disagree with our tax positions, including any assumptions, judgements, valuations or estimates used for these transfer pricing matters and intercompany transactions.

If any of these tax authorities determine that our transfer pricing for these intercompany transactions do not meet arm’s-length criteria, and were successful in challenging our positions, we could be required to pay additional taxes, interest, indexation charges and/or penalties related thereto, which could be in excess of any reserves established therefore, and which could result in higher effective tax rates, reduced cash flows and lower overall profitability of our operations.

Our financial statements could fail to reflect adequate reserves to cover such a contingency.

2 unchanged sentences

If our estimates or judgments relating to our critical accounting policies prove to be incorrect or financial reporting standards or interpretations change, our operating results could be adversely affected.

The preparation of financial statements in conformity with generally accepted accounting principles (GAAP) requires management to make estimates and assumptions that affect the amounts reported in our consolidated financial statements and accompanying notes.

The preparation of financial statements in conformity with U.S.

generally accepted accounting principles (GAAP) requires management to make estimates and assumptions that affect the amounts reported in our consolidated financial statements and accompanying notes.

We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as discussed in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations.” The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities and equity, and the amount of revenue and expenses that are not readily apparent from other sources.

3 unchanged sentences

As a result of new standards, changes to existing standards and changes in their interpretation, we might be required to change our accounting policies, alter our operational policies and implement new or enhance existing systems so that they reflect new or amended financial reporting standards, or we may be required to restate our published financial statements.

For example, SEC proposals on climate-related disclosures may require us to update our accounting or operational policies, processes, or systems to reflect new or amended financial reporting standards.

Such changes to existing standards or changes in their interpretation may have an adverse effect on our reputation, business, financial condition and profit, or cause an adverse deviation from our revenue and operating profit target, which may adversely affect our financial results.

We are exposed to fluctuations in currency exchange rates, which could negatively affect our business, operating results, and financial condition.

Our sales contracts are denominated in US dollars, and therefore our revenue is not subject to foreign currency risk.

However, strengthening of the US dollar increases the real cost of our platform to our customers outside of the US, which could lead to delays in the purchase of our platform and the lengthening of our sales cycle.

If the US dollar continues to strengthen, this could adversely affect our operating results and financial condition.

Our sales contracts are denominated in U.S.

dollars, and therefore our revenue is not subject to foreign currency risk.

However, the strengthening of the U.S.

dollar increases the real cost of our platform to our customers outside of the U.S., which could lead to delays in the purchase of our platform and the lengthening of our sales cycle.

dollar continues to strengthen, this could adversely affect our operating results and financial condition.

In addition, increased international sales in the future, including through continued international expansion, our channel partners and other partnerships, could result in foreign currency denominated sales, which would increase our foreign currency risk.

Our operating expenses incurred outside the US and denominated in foreign currencies are increasing and are subject to fluctuations due to changes in foreign currency exchange rates.

Our operating expenses incurred outside the U.S.

and denominated in foreign currencies are increasing and are subject to fluctuations due to changes in foreign currency exchange rates.

These expenses are denominated in foreign currencies and are subject to fluctuations due to changes in foreign currency exchange rates.

4 unchanged sentences

If we raise additional funds through equity or convertible debt issuances, our existing stockholders may suffer significant dilution and these securities could have rights, preferences, and privileges that are superior to those of holders of our Class A common stock.

We expect that our existing cash and cash equivalents will be sufficient to meet our anticipated cash needs for working capital and capital expenditures for at least the next 12 months.

We expect that our existing cash, cash equivalents and investments will be sufficient to meet our anticipated cash needs for working capital and capital

expenditures for at least the next 12 months.

If we obtain additional funds through debt financing, we may not be able to obtain such financing on terms favorable to us.

Further, the current global macroeconomic environment may make it more difficult to raise additional capital on favorable terms, it at all.

Further, the current global macroeconomic environment may make it more difficult to raise additional capital on favorable terms, if at all.

Such terms may involve restrictive covenants making it difficult to engage in capital raising activities and pursue business opportunities, including potential acquisitions.

The trading prices of technology companies have been highly volatile as a result of the conflict in the Middle East, Ukraine and tensions between China and Taiwan, inflation, interest rate volatility, actual or perceived instability in the banking system, and market downturns, which may reduce our ability to access capital on favorable terms or at all.

The trading prices of technology companies have been highly volatile as a result of regional geopolitical conflicts around the world, inflation, interest rate volatility, from changes in U.S.

federal spending, changes in tariffs and trade restrictions, actual or perceived instability in the banking system, and market downturns, which may reduce our ability to access capital on favorable terms or at all.

In addition, a recession, depression, or other sustained adverse market event could adversely affect our business and the value of our Class A common stock.

17 unchanged sentences

• any major changes in our management or our board of directors;

• the global political, economic and macroeconomic climate, including but not limited to, actual or perceived instability in the banking industry, potential uncertainty with respect to the federal debt ceiling and budget and potential government shutdowns related thereto, labor shortages, supply chain disruptions, potential recession, inflation, and rising interest rates;

• other events or factors, including those resulting from war, armed conflict, including the conflicts in the Middle East, Ukraine and tensions between China and Taiwan, incidents of terrorism or responses to these events;

• the global political, economic and macroeconomic climate, including but not limited to, the changes in U.S.

federal spending, changes in tariffs and trade restrictions, actual or perceived instability in the banking industry, labor shortages, supply chain disruptions, potential recession, inflation, and fluctuating interest rates;

• other events or factors, including those resulting from war, armed conflict, regional geopolitical conflicts around the world, incidents of terrorism or responses to these events;

• cybersecurity incidents.

In addition, the stock market in general, and the market for technology companies in particular, has experienced extreme price and volume fluctuations that have often been unrelated or disproportionate to the operating performance of those companies, particularly during the current period of global macroeconomic uncertainty, including rising inflation, increasing interest rates, labor shortages and fluctuations in international currency rates, as well as the impacts of regional geopolitical conflicts, including the conflicts in the Middle East, Ukraine and tensions between China and Taiwan.

In addition, the stock market in general, and the market for technology companies in particular, has experienced extreme price and volume fluctuations that have often been unrelated or disproportionate to the operating performance of those companies, particularly during the current period of global macroeconomic uncertainty, including inflation, fluctuating interest rates, changes in tariffs and trade restrictions, labor shortages and fluctuations in international currency rates, as well as the impacts of regional geopolitical conflicts around the world.

These economic, political, regulatory and market conditions have and may continue to negatively impact the market price of our Class A common stock, regardless of our actual operating performance.

4 unchanged sentences

Sales of a substantial number of shares of our Class A common stock into the public market, including shares of Class A common stock held by our existing stockholders that have been converted from shares of Class B common stock, and particularly sales by our directors, executive officers, and principal stockholders, or the perception that these sales might occur, could cause the market price of our Class A common stock to decline.

In addition, pursuant to our amended and restated investors’ rights agreement, dated October 28, 2020, certain stockholders have the right, subject to certain conditions, to require us to file a registration statement for the public resale of such capital stock or to include such shares in registration statements that we may file for us or other

stockholders.

Any registration statement we file to register additional shares, whether as a result of registration rights or otherwise, could cause the market price of our Class A common stock to decline or be volatile.

8 unchanged sentences

Weingarten is no longer providing services to us as an officer, employee, consultant or member of our board of directors, (v) the date fixed by our board of directors following the date on which, if applicable, Mr.

Weingarten is terminated for cause, as defined in our restated certificate of incorporation, and (vi) the date that is 12 months after the death or disability, as defined in our restated certificate of incorporation, of Mr.

Weingarten is terminated for cause, as defined in our restated certificate of incorporation, and (vi) the date that is 12 months after the death or disability, as defined in

our restated certificate of incorporation, of Mr.

This concentrated control will limit or preclude your ability to influence corporate matters for the foreseeable future, including the election of directors, amendments of our organizational documents, and any merger, consolidation, sale of all or substantially all of our assets, or other major corporate transaction requiring stockholder approval.

6 unchanged sentences

In addition, several stockholder advisory firms and large institutional investors oppose the use of multiple class structures.

As a result, the dual class structure of our common stock may make us ineligible for inclusion in certain indices, may discourage such indices from selecting us for inclusion (notwithstanding our automatic termination provision) may cause stockholder advisory firms to publish negative commentary about our corporate governance practices or otherwise seek to cause us to change our capital structure, and may result in large institutional investors not purchasing shares of our Class A common stock.

As a result, the dual class structure of our common stock may make us ineligible for inclusion in certain indices and may discourage such indices from selecting us for inclusion, notwithstanding our automatic termination provision, may cause stockholder advisory firms to publish negative commentary about our corporate governance practices or otherwise seek to cause us to change our capital structure, and may result in large institutional investors not purchasing shares of our Class A common stock.

Any exclusion from certain stock indices could result in less demand for our Class A common stock.

Any actions or publications by stockholder advisory firms or institutional investors critical of our

corporate governance practices or capital structure could also adversely affect the value of our Class A common stock.

Any actions or publications by stockholder advisory firms or institutional investors critical of our corporate governance practices or capital structure could also adversely affect the value of our Class A common stock.

General Risk Factors

3 unchanged sentences

In addition, our global operations expose us to risks associated with public health crises, such as pandemics and epidemics, which could harm our business and cause our operating results to suffer.

Further, acts of war, armed conflict, terrorism and other geopolitical unrest, such as the conflicts in the Middle East, Ukraine and tensions between China and Taiwan, could cause disruptions in our business or the businesses of our partners or the economy as a whole.

Further, acts of war, armed conflict, terrorism and other geopolitical unrest, such as the conflicts in the Middle East and Ukraine, and tensions between China and Taiwan, could cause disruptions in our business or the businesses of our partners or the economy as a whole.

We maintain an office in Tel Aviv, Israel and had approximately 11% of our personnel in Israel as of January 31, 2025.

We are closely monitoring the unfolding events of the armed conflict in Israel which began in October 2023.

We are closely monitoring the unfolding events of the armed conflict in Israel.

While this conflict is still evolving, to date, the conflict has not had an adverse impact on our business results of operations and we have implemented continuity measures to address the safety of our employees and continue our operations in the event of reduced employee availability in the conflict region.

3 unchanged sentences

Moreover, any of our office locations may be vulnerable to the adverse effects of climate change.

For example, our corporate offices are located in California, a state that frequently experiences earthquakes, wildfires and resultant air quality impacts and power shutoffs associated with wildfire prevention, heatwaves, and droughts.

For example, our corporate office is located in California, a state that frequently experiences earthquakes, wildfires and resultant air quality impacts and power shutoffs associated with wildfire prevention, heatwaves, and droughts.

These events can, in turn, have impacts on inflation risk, food security, water security and on our employees’ health and well-being.

Additionally, all the aforementioned risks will be further increased if we do not implement an effective disaster recovery plan or our partners’ disaster recovery plans prove to be inadequate.

Additionally, all the aforementioned risks will be further increased if we do not implement an effective disaster recovery plan or if our partners’ disaster recovery plans prove to be inadequate.

Investors’ expectations of our performance relating to environmental, social and governance factors may impose additional costs and expose us to new risks.

There is an increasing focus from certain regulators, investors, employees, users and other stakeholders concerning corporate responsibility, specifically related to ESG matters both in the US and internationally.

There is an increasing focus from certain regulators, investors, employees, users and other stakeholders concerning corporate responsibility, specifically related to ESG matters both in the U.S.

and internationally.

Some investors may use these non-financial performance factors to guide their investment strategies and, in some cases, may choose not to invest in us if they believe our policies and actions relating to corporate responsibility are inadequate.

3 unchanged sentences

Moreover, California recently adopted two new climate-related bills, which require companies doing business in California that meet certain revenue thresholds to publicly disclose certain greenhouse gas emissions data and climate-related financial risk reports, and compliance with such requirements could require significant effort and resources.

Additionally, in March 2024, the SEC enacted comprehensive climate change disclosure rules, which have since been challenged by various third parties.

landscape in these areas on a timely basis, or at all, could adversely affect our reputation, business, and financial performance.

Additionally, in March 2024, the SEC enacted comprehensive climate change disclosure rules, although the SEC has since issued an order to stay the rules pending the completion of judicial review of multiple petitions challenging the rules.

Our business may face increased scrutiny related to these activities and our related disclosures, including from the investment community, and our failure to achieve progress or manage the dynamic public sentiment and legal landscape in these areas on a timely basis, or at all, could adversely affect our reputation, business, and financial performance.

If industry or financial analysts do not publish research or reports about our business, or if they issue inaccurate or unfavorable research regarding our Class A common stock, our stock price and trading volume could decline.

1 unchanged sentence

We do not control these analysts or the content and opinions included in their reports.

If any of the analysts who cover us issues an inaccurate or unfavorable opinion regarding our stock price, our stock price would likely decline.

If any of the analysts who cover us issues an inaccurate or unfavorable opinion regarding our stock price, our stock price could potentially decline.

If our financial results fail to meet, or significantly exceed, our announced guidance or the expectations of analysts or public investors, analysts could downgrade our Class A common stock or publish unfavorable research about us.

If one or more of these analysts cease coverage of our Class A common stock or fail to publish reports on us regularly, our visibility in the financial markets could decrease, which in turn could cause our stock price or trading volume to decline.

We are currently subject to and can in the future be subject to securities class action litigation.

30 unchanged sentences

Moreover, Section 22 of the Securities Act creates concurrent jurisdiction for federal and state courts over all claims brought to enforce any duty or liability created by the Securities Act or the rules and regulations thereunder.

Our restated certificate of incorporation provides that the federal district courts of the US will, to the fullest extent permitted by law, be the exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act (Federal Forum Provision).

Our restated certificate of incorporation provides that the federal district courts of the U.S.

will, to the fullest extent permitted by law, be the exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act (Federal Forum Provision).

Our decision to adopt a Federal Forum Provision followed a decision by the Supreme Court of the State of Delaware holding that such provisions are facially valid under Delaware law.

8 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors