What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-03-19 compared with 2025-03-26 · 245 added, 292 removed, 730 unchanged (42% of the section changed)

1 unchanged sentence

You should carefully consider the risks and uncertainties described below, together with all of the other information in this Annual Report on Form 10-K, including the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” and our consolidated financial statements and the accompanying notes included before making a decision to invest in our Class A common stock.

These disclosures reflect the Company’s belief and opinions as to factors that could materially and adversely affect the Company and its securities in the future.

References to past events are provided by way of example only and are not intended to be a complete listing or a representation as to whether or not such factors have occurred in the past or their likelihood of occurring in the future.

Our business, financial condition, operating results, or prospects could also be adversely affected by risks and uncertainties that are not presently known to us or that we currently believe are not material.

11 unchanged sentences

• Adverse global macroeconomic conditions or reduced information technology spending could adversely affect our business, operating results, and financial condition.

• We may not be successful in our artificial intelligence initiatives, which could adversely affect our business, reputation, or financial results.

• A security incident against us or our third-party vendors and service providers, whether actual, alleged, or perceived, would harm our reputation, create liability, and regulatory exposure, and adversely affect our business, operating results, and financial condition.

6 unchanged sentences

• If we are unable to maintain successful relationships with our channel partners and alliance partners, or if our channel partners or alliance partners fail to perform, our ability to market, sell and distribute our platform will be limited, and our business, operating results, and financial condition will be harmed.

Risks Related to Regulatory Matters

• We are subject to laws and regulations affecting our business, including those related to the privacy and data protection of the personal data or other information we collect, process or share.

Our actual or perceived failure to comply with such laws or regulations could harm our business.

• Complying with laws and regulations related to privacy and data protection could result in additional costs and liabilities to us, especially as new laws or regulations are enacted, change or are subject to various interpretations.

Risks Related to Our People

3 unchanged sentences

• Third parties have claimed and may claim in the future that our platform infringes their intellectual property rights, and this may create liability for us or otherwise adversely affect our business, operating results and financial condition.

Risks Related to Regulatory Matters

• We are subject to laws and regulations affecting our business, including those related to the privacy and data protection of the personal data or other information we collect, process or share.

Our actual or perceived failure to comply with such laws or regulations could harm our business.

Risks Related to Ownership of Our Class A Common Stock

6 unchanged sentences

If our assumptions regarding these risks and uncertainties are incorrect or change due to fluctuations in our markets or otherwise, or if we do not address these risks successfully, our operating and financial results could differ materially from our expectations and our business and operating results would be adversely affected.

We cannot assure you that we will be successful in addressing these and other challenges we

may face in the future.

We cannot assure you that we will be successful in addressing these and other challenges we may face in the future.

The risks associated with having a limited operating history may be exacerbated by current macroeconomic conditions.

5 unchanged sentences

While we have historically experienced significant growth in revenue, we cannot predict when or whether we will reach or maintain profitability.

We also expect our operating expenses to increase in the future as we continue to invest in our future growth, including expanding our research and development function to drive further development of our platform, expanding our sales and marketing activities, developing the functionality to expand into adjacent markets, and reaching customers in new geographic locations, which could negatively affect our operating results if our total revenue does not increase.

In addition to the anticipated costs to grow our business, we have incurred and expect to continue to incur significant legal, accounting, and other expenses as a public company.

Our revenue growth is expected to slow as we scale and our revenue may decline for a number of other reasons, including reduced demand for our platform, increased competition, a decrease in the growth or reduction in the size of our overall market, or if we cannot capitalize on growth opportunities, including acquisitions, new products, services, and feature releases.

While we consistently evaluate opportunities to reduce our operating costs and optimize efficiencies, we cannot guarantee that these efforts will be successful or that we will not re-accelerate operating expenditures in the future in order to capitalize on growth opportunities.

We also expect our operating expenses to increase in the future as we continue to invest in our future growth, including expanding our research and development function to drive further development of our platform, expanding our sales and marketing activities, and expanding into adjacent markets and geographic locations, which could negatively affect our operating results if our total revenue does not increase.

In addition to the anticipated costs to grow our business, we have incurred and expect to continue to incur significant legal, accounting, and other

expenses as a public company.

Our revenue growth is expected to slow down as we scale and our revenue may decline for a number of other reasons, including reduced demand for our platform, increased competition, a decrease in the growth or reduction in the size of our overall market, or if we cannot capitalize on growth opportunities, including acquisitions, new products, services, and feature releases.

While we consistently evaluate opportunities to reduce our operating costs and optimize efficiencies, including personnel restructuring plans, we cannot guarantee that these efforts will be successful or that we will not re-accelerate operating expenditures in the future in order to capitalize on growth opportunities.

If we fail to increase our revenue to offset increases in our operating expenses, or manage our costs as we invest in our business, we may not achieve or sustain profitability.

7 unchanged sentences

• our ability to attract, train, retain, and motivate talented employees;

• our ability to successfully incorporate new technologies into our platform, including generative AI;

• our ability to successfully incorporate new technologies into our platform, including generative and agentic AI;

• the budgeting cycles, seasonal buying patterns, and purchasing practices of our customers, including any slowdown in technology spending due to U.S.

and general global macroeconomic conditions;

• general global macroeconomic and political conditions, both domestically and in our foreign markets that could impact some or all regions where we operate, including the changes in U.S.

federal spending, changes in tariffs and trade restrictions, global economic slowdowns, actual or perceived global banking and finance related issues, increased risk of inflation, interest rate volatility, supply chain disruptions, labor shortages, and potential global recession;

• general global macroeconomic and political conditions, both domestically and in our foreign markets that could impact regions where we operate, including changes in U.S.

federal spending, significant political or regulatory developments including changes in trade policy, global economic slowdowns, actual or perceived global banking and finance related issues, government shutdowns, inflation, interest rate volatility, supply chain disruptions, labor shortages, and potential global recession;

• the impact of natural or man-made global events on our business, including regional geopolitical conflicts around the world;

• changes in customer, distributor or reseller requirements or market needs;

• price competition;

• the timing and success of new product and service introductions by us or our competitors or any other change in the competitive landscape of our industry, including consolidation among our competitors or customers and strategic partnerships entered into by and between our competitors;

• changes in customer, distributor, or reseller requirements, or market needs or preferences;

• the timing and success of new product and service introductions by us or our competitors, or any other change in the competitive landscape of our industry, including consolidation among our competitors or customers, and strategic partnerships entered into by and between our competitors, and changes in pricing;

• changes in our mix of products, subscriptions and services sold, including changes in the average contract length for subscriptions and support;

5 unchanged sentences

• our ability to execute, complete, or efficiently integrate any acquisitions that we may undertake;

• increased expenses, unforeseen liabilities, or write-downs and any impact on our operating results from any acquisitions we consummate;

• our ability to increase the size and productivity of our distribution channels;

2 unchanged sentences

• insolvency or credit difficulties confronting our customers, which could increase due to U.S.

and global macroeconomic issues, including actual or perceived global banking and finance related issues, inflation, interest rate volatility, and market downturns, which would adversely affect their ability to purchase or pay for our platform, products, and services in a timely manner or at all;

and global macroeconomic issues, including actual or perceived global banking and finance related issues, inflation, interest rate volatility, government shutdowns and market downturns;

• the cost and potential outcomes of litigation or other proceedings, which could have a material adverse effect on our business;

4 unchanged sentences

Our competitors may also have greater resources for research and development of new technologies, customer support and to pursue acquisitions, or they may have other financial, technical, or other resource advantages.

Our larger competitors have substantially broader and more diverse product and service offerings and more mature distribution

and go-to-market strategies, which allow them to leverage their existing customer and distributor relationships to gain business in a manner that discourages potential customers from purchasing our platform.

Conditions in our market could change rapidly and significantly as a result of technological advancements, including but not limited to increased advancements and proliferation in the use of open artificial intelligence applications, partnering or acquisitions by our competitors or continuing market consolidation.

Some of our competitors have recently made or could make acquisitions of businesses or have established cooperative relationships that may allow them to offer more directly competitive and comprehensive products and services than were previously offered and adapt more quickly to new technologies and customer needs.

These competitive pressures in our market or our failure to compete effectively may result in price reductions, fewer orders, reduced revenue and gross margin, increased net losses, and loss of market share.

Our larger competitors have substantially broader and more diverse product and service offerings and more mature distribution and go-to-market strategies, which allow them to leverage their existing customer and distributor relationships to gain business in a manner that discourages potential customers from purchasing our platform.

Conditions in our market could change rapidly and significantly as a result of technological advancements, including but not limited to increased advancements and proliferation in the use of artificial intelligence applications, partnering or acquisitions by our competitors or continuing market consolidation.

Competitive pressures in our market or our failure to compete effectively may result in price reductions, fewer orders, reduced revenue and gross margin, increased net losses, and loss of market share.

Even if there is significant demand for endpoint and cloud security solutions like ours, if our competitors include functionality that is, or is perceived to be, equivalent to or better than ours in legacy products that are already generally accepted as necessary components of an organization’s IT security architecture, we will have difficulty increasing the market penetration of our platform.

3 unchanged sentences

Our operating results have varied significantly from period to period in the past, and we expect that our operating results will continue to vary significantly in the future such that period-to-period comparisons of our operating results may not be meaningful.

This could adversely affect our business, operating results, and financial condition.

Accordingly, our financial results in any one quarter should not be relied upon as indicative of future performance.

1 unchanged sentence

Our quarterly financial results may fluctuate as a result of a number of factors, many of which are outside of our control and may be difficult to predict, including, without limitation:

• general global macroeconomic and political conditions, both domestically and in our foreign markets that could impact some or all regions where we operate, including the changes in U.S.

• the impact of natural or man-made global events on our business, including regional geopolitical conflicts around the world;

• global events, general global macroeconomic and political conditions, both domestically and internationally, including geopolitical conflicts (including, but not limited to, the conflict in Iran), changes in U.S.

federal spending, significant political or regulatory developments including changes in trade policy, tariffs, global economic slowdowns, actual or perceived global banking and finance related issues, government shutdowns, increased risk of inflation, interest rate volatility, supply chain disruptions, labor shortages and potential global recession;

• our ability to attract new and retain existing customers or sell additional features to existing customers;

• the budgeting cycles, seasonal buying patterns, and purchasing practices of customers;

including decisions by organizations to purchase security solutions from larger, more established security vendors or from their primary IT equipment vendors and insolvency or credit difficulties confronting our customers, affecting their ability to purchase or pay for our solution

including decisions by organizations to purchase security solutions from larger, more established security vendors or from their primary IT equipment vendors and customer insolvency or credit difficulties;

• the timing and length of our sales cycles;

10 unchanged sentences

• increases or decreases in our expenses caused by fluctuations in foreign currency exchange rates.

In addition, we experience seasonal fluctuations in our financial results as we typically receive a higher percentage of our annual orders from new customers, as well as renewal orders from existing customers, in our fourth fiscal quarter as compared to other quarters due to the annual budget approval process of many of our customers.

In addition, we experience seasonal fluctuations in our financial results as we typically receive a higher percentage of our annual orders from new customers, as well as renewal orders from existing customers, in our fourth fiscal quarter due to the annual budget approval process of many of our customers.

Any of the above factors, individually or in the aggregate, may result in significant fluctuations in our financial and other operating results from period to period.

1 unchanged sentence

Moreover, this variability and unpredictability could result in our failure to meet our operating plan or the expectations of investors or analysts for any period.

If we fail to meet such expectations for the reasons described above or other reasons, our stock price could fall substantially, and we could face costly lawsuits, including securities class action lawsuits.

If we fail to meet such expectations, our stock price could fall substantially, and we could face costly lawsuits, including securities class action lawsuits.

Adverse global macroeconomic conditions or reduced information technology spending could adversely affect our business, operating results, and financial condition.

2 unchanged sentences

Weak global and regional economic conditions, including the changes in U.S.

federal spending, changes in tariffs and trade restrictions, U.S.

federal spending, significant political or regulatory developments including changes in trade policy (including actual or threatened changes in tariffs and trade restrictions), U.S.

and global macroeconomic issues, actual or perceived global banking and finance related issues, labor shortages, supply chain disruptions, fluctuating interest rates and inflation, spending environments, geopolitical instability, warfare and uncertainty, weak economic conditions in certain regions or a reduction in information technology spending regardless of macroeconomic conditions, including the effects of the conflicts in the Middle East and Ukraine, and tensions between China and Taiwan, could adversely affect our business, operating results, and financial condition, including resulting in longer sales cycles, a negative impact on our ability to attract and retain new customers or expand our platform or sell additional products and services to our existing customers, lower prices for our platform, higher default rates among our channel partners, reduced sales to new or existing customers and slower or declining growth.

For example, as a result of current uncertainty in macroeconomic conditions and related higher cost consciousness around IT budgets, we have experienced certain impacts on our business, including a decline in usage and consumption patterns from certain customers, especially larger enterprise customers, longer sales cycles, and deal downsizing by new customers and of renewals by existing customers, especially larger enterprises.

For example, as a result of current uncertainty in macroeconomic conditions and related higher cost consciousness around IT budgets, we have continued to experience certain impacts on our business, including a decline in usage and consumption patterns from certain customers, especially larger enterprise customers, longer sales cycles, and deal downsizing by new customers and of renewals by existing customers, especially larger enterprises.

We expect the global macroeconomic conditions impacting demand to persist in the near term.

2 unchanged sentences

We are meaningfully investing in our platform, including growing our cloud security product.

For example, in February 2024, we acquired PingSafe, a cloud security platform, which we expect will enable us to couple PingSafe’s CNAPP with our cloud workload security and cloud data security capabilities and Stride, a workflow automation tool that will enable us to further our autonomous platform vision.

For example, in September 2025, we acquired Prompt, a private company focused on the generative and agentic AI security space, and Observo, an AI-ready data pipeline company.

It is difficult to predict customer adoption and demand for our platform, the size and growth rate of this market, the entry of competitive products and services or the success of existing competitive products and services.

4 unchanged sentences

If we do not succeed in convincing customers that our platform should be an integral part of their overall approach to security, our sales will not grow as quickly as anticipated, or at all, which would have an adverse impact on our business, operating results, and financial condition.

If businesses do not continue to adopt our platform for any of the reasons discussed above or for other reasons not contemplated, our sales would not grow as quickly as anticipated, or at all, and our business, operating results, and financial condition would be adversely affected.

We may not be successful in our artificial intelligence initiatives, which could adversely affect our business, reputation, or financial results.

We incorporate generative AI into many of our offerings, including Purple AI which streamlines threat hunting across various types of data and synthesizes threat intelligence and insights in natural language.

As with many innovations, generative AI presents risks, challenges, and unintended consequences that could impact our successful ability to incorporate the use of generative AI in our business.

For example, language models may provide flawed results or misinterpret prompts.

We incorporate generative AI into many of our offerings, including Purple AI and Wayfinder.

Purple AI streamlines threat hunting across various types of data and synthesizes threat intelligence and insights in natural language.

Wayfinder uses agentic AI, which applies advanced reasoning and automation to process volumes of telemetry and security data, triaging security alerts more accurately and with context.

As with many innovations, generative AI presents risks, challenges, and unintended consequences that could impact our ability to incorporate the use of generative AI in our business.

For example, language models may provide flawed or inaccurate results or misinterpret prompts.

Further, data practices by us or others that result in controversy could also impair the acceptance of AI solutions.

This in turn could undermine confidence in the decisions, predictions, analyses or other content that our AI initiatives produce.

Our generative AI solutions are reliant on third-party foundation models that may change their availability or commercial model in a manner that negatively affects our offering.

Our generative AI solutions are reliant on third-party foundation models that may change their availability or commercial terms in a manner that negatively affects our offering.

Furthermore, the integration of third-party AI models with our products and services relies on certain safeguards implemented by the third-party developers of the underlying AI models, including those related to the accuracy, bias, and other variables of the data and their safeguards may be insufficient.

In addition, our competitors or other third parties may incorporate generative AI solutions into their products more successfully than us, and their solutions may achieve higher market acceptance than ours, which may result in us failing to recoup our investments in developing generative AI-powered offerings.

We have made and expect to continue to make significant investments in our AI technology, including in Purple AI.

We have made and expect to continue to make significant investments in our AI technology, including in Purple AI and Wayfinder.

Our ability to employ AI, or the ability of our competitors to do so more successfully, may negatively impact our gross margins, impair our ability to compete effectively, result in reputational harm and have an adverse impact on our operating results.

2 unchanged sentences

Moreover, AI may give rise to litigation risk, including potential intellectual property, privacy, or cybersecurity liability.

Because AI is an emerging technology, there is not a mature body of case law construing the appropriateness of certain of its uses of data whether through the employment of large language models or other models leveraging data found on the Internet and the evolution of this law may limit our ability to exploit AI tools, or expose us to litigation.

Further, AI presents emerging ethical issues and if our use of AI algorithms draws controversy due to their perceived or actual impact on society, we may experience brand or reputational harm, or competitive harm.

Because AI is an emerging technology, there is not a mature body of case law, particularly around copyright, construing the appropriateness of certain of its uses of data whether through the employment of large language models or other models leveraging data found on the Internet and the evolution of this law may limit our ability to exploit AI tools, or expose us to litigation.

Intellectual property disputes regarding the use of copyrighted or proprietary data to train AI models, or the outputs generated by such models, could result in costly litigation and liability.

Further, AI presents emerging ethical issues and if our use of AI algorithms draws controversy due to their perceived or actual impact on society such as concerns regarding bias, discrimination, misinformation, automation or transparency, we may experience brand or reputational harm, or competitive harm.

In addition, given the complex nature of AI technology, we face an evolving regulatory landscape.

federal government, various state legislatures and other government entities worldwide have implemented and are in the process of implementing specific laws, regulations, policies and obligations relating to the use of AI, and we will need to continue to monitor these developments to ensure our products that we sell to government entities remain compliant with such applicable regulations.

Furthermore, the current administration’s approach to investment in and regulation of AI is expected to deviate from that of the previous administration and we will need to adapt to any resulting changes, including new or revised executive orders and initiatives.

For example, the E.U.

AI Act, which entered into force in 2024 with phased implementation that began in 2025, imposes obligations on AI providers and deployers based on risk classification, including requirements for transparency, documentation, and risk management.

In the U.S., a December 2025 executive order asserted federal preemption over the state AI regulations, creating regulatory uncertainty as the scope and enforceability of this preemption claim remains subject to debate and challenge.

Compliance with evolving AI regulations will require significant investment in quality assurance, testing, documentation, and reporting systems, and failure to comply could result in fines, enforcement actions, or restrictions on our ability to offer AI-powered products and services.

Moreover, we are subject to significant competition from other companies, some of which have longer operating histories and significantly greater financial, technical, marketing, distribution, professional services, or other resources than us.

3 unchanged sentences

Companies are subject to an increasing number and wide variety of attacks on their networks on an ongoing basis.

Traditional computer “hackers,” malicious code (such as viruses and worms), phishing attempts, ransomware, account takeover, business email compromise, employee fraud, theft or misuse, denial of service attacks, and sophisticated nation-state and nation-state supported actors engage in intrusions and attacks that create risks for our internal networks, cloud deployed products and the information they store and process.

Traditional computer “hackers,” malicious code (such as viruses and worms), phishing attempts, ransomware, account takeover, business email compromise, employee fraud, theft or misuse, social engineering (including phishing, deepfakes, voice cloning), software supply-chain compromises, denial of service attacks, reverse-engineering of AI algorithms, and sophisticated nation-state and nation-state supported actors engage in intrusions and attacks that create risks for our internal networks, cloud deployed products and the information they store and process.

Cybersecurity companies face particularly intense attack efforts, and we have faced, and will continue to face, cyber threats and attacks from a variety of sources.

3 unchanged sentences

Our work protecting these entities increases the likelihood that we may be targeted by nation-state actors, including those from countries with a history of conducting cyber operations against such organizations.

State-supported and geopolitical-related cyberattacks may rise in connection with regional geopolitical conflicts such as the conflicts in the Middle East and Ukraine, and tensions between China and Taiwan.

State-supported and geopolitical-related cyberattacks may rise in connection with regional geopolitical conflicts.

In addition, our cybersecurity product is likely considered a valuable target for lateral attacks because of its highly privileged access.

Additionally, bad actors are beginning to utilize AI-based tools to execute attacks, creating unprecedented cybersecurity challenges.

Additionally, bad actors are utilizing AI-based tools to execute more sophisticated and scalable attacks, creating unprecedented cybersecurity challenges.

Although we have implemented security measures designed to prevent such attacks, our networks and systems, and those of our third-party vendors and service providers may be breached due to the actions of outside parties, human error, insufficient cybersecurity controls, malfeasance, a combination of these, or otherwise, and as a result, an unauthorized party may obtain access to our and/or our customers’ systems, networks, or data.

3 unchanged sentences

If compromised, our own systems or the systems of our third-party vendors and service providers could be used to facilitate or magnify an attack.

Further, the trend towards remote and hybrid work by

companies and individuals in has generally increased the attack surface available to bad actors for exploitation, and as such, the risk of a cybersecurity incident potentially occurring has increased.

Further, the trend towards remote and hybrid work by companies and individuals has generally increased the attack surface available to bad actors for exploitation, and as such, the risk of a cybersecurity incident potentially occurring has increased.

We have accordingly increased our investments in protective measures and risk mitigation strategies, but we cannot guarantee that our efforts, or the efforts of our third-party vendors and service providers or efforts of others upon whom we rely and partner with, will be successful in preventing any such information security incidents.

Protecting our own assets has become more expensive from a dollar investment and time perspective and these costs may increase as the threat landscape increases, including as a result of the use of AI by bad actors.

Protecting our own assets has become more expensive from a dollar investment and time perspective and these costs may increase as the threat landscape evolves, including as a result of the use of AI by bad actors.

Any actual, alleged, or perceived security breach in our systems or networks or those of our third-party vendors and service providers, or any other actual, alleged or perceived data security incident we suffer, could result in damage to our reputation, negative publicity, loss of customers and sales, loss of competitive advantages over our competitors, increased costs to remedy any problems and otherwise respond to any incident, regulatory investigations and enforcement actions, fines and penalties, costly litigation, and other liability.

We would also be exposed to a risk of loss or litigation and potential liability under laws, regulations, and contracts that protect the privacy and security of personal data.

For example, the California Consumer Privacy Act of 2018, as amended (CCPA), imposes a private right of action for security breaches of personal data that could lead to some form of remedy including regulatory scrutiny, fines, private right of action settlements, and other consequences.

Where a security incident involves a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data from the European Economic Area (EEA) or the U.K.

in respect of which we are a controller or processor under the E.U.

General Data Protection Regulation (collectively, the GDPR), this could result in fines of up to €20 million (£17.5 million) or 4% of annual global turnover, whichever is greater.

We may also be required to provide notice of such breaches to regulators and/or individuals which may result in us incurring additional costs, penalties, fines or litigation.

We may also be required to publicly disclose material security breaches, which could exacerbate the adverse impact of such incidents.

We would also be exposed to a risk of loss or litigation and potential liability under applicable laws, regulations, and contracts that protect the privacy and security of personal data.

For additional information regarding these laws and regulations, see the Risk Factor titled “We are subject to laws and regulations affecting our business, including those related to the privacy and data protection of the personal data or other information we collect, process or share.

Our actual or perceived failure to comply with such laws or regulations could harm our business.”

In addition, our customer agreements may require us to promptly report security breaches to our customers involving their data on our systems or those of third-party vendors or subcontractors processing such data on our behalf.

This mandatory disclosure could be costly, result in litigation, harm our reputation, erode customer trust, and require significant resources to mitigate issues stemming from actual or perceived security breaches.

Further, some of our customers may also be subject to the E.U.

Digital Operational Resilience Act (DORA), which requires them to impose contractual provisions on us, including certain mandatory third-party risk management provisions.

If we fail to materially comply with these contractual requirements, we may be subject to litigation, investigations, audits or other adverse consequences.

Some of our customers may be subject to sector specific regulations, such as the E.U.

Digital Operational Resilience Act (DORA) for financial services entities, which may require them to comply with enhanced third-party risk management and contractual obligations.

In addition, if a high-profile cybersecurity incident occurs with respect to another SaaS provider or cybersecurity vendor, customers may lose trust in the security of the SaaS business model generally or in cybersecurity companies generally, which could adversely affect our ability to retain existing customers or attract new ones.

We may also incur significant financial and operational costs to investigate, remediate, eliminate and put in place additional tools and devices designed to prevent actual or perceived security breaches and other security incidents, as well as costs to comply with any notification obligations resulting from any security incidents.

Any of these negative outcomes could adversely affect the market perception of our platform and customer and investor confidence in our company, and would adversely affect our business, operating results, and financial condition.

Defects, errors, or vulnerabilities in our platform, the failure of our platform to block malware or prevent a security breach, misuse of our platform, or risks of product liability claims would harm our reputation and adversely impact our business, operating results, and financial condition.

Defects, errors, or vulnerabilities in our platform, misuse of our platform, or risks of product liability claims would harm our reputation and adversely impact our business, operating results, and financial condition.

Our platform and product features are multi-faceted, rely on third-party software and infrastructure, and may be deployed with material defects, vulnerabilities, software “bugs” or errors that are not detected until after their commercial release and deployment to our customers.

3 unchanged sentences

Our platform and product features also provide our customers with the ability to customize a multitude of settings, and administer devices on the applicable computing environment, and it is possible that a customer, partner or internal services team member could misconfigure or misuse our platform or otherwise fail to configure our products in an optimal manner.

Such defects and misconfigurations of our platform could cause our platform to operate at suboptimal efficacy, cause it to fail to secure customers’ computing environments and detect and block threats, or temporarily

interrupt our customers’ computing environments.

We also make frequent updates to our platform, which may fail or be deployed incorrectly resulting in temporary vulnerability, or a material defect or downtime in our customer environments.

1 unchanged sentence

Furthermore, as a well-known provider of security solutions and because security solutions are highly privileged in customers environments, our networks, platform, products, including cloud-based technology, and customers could be targeted by attacks specifically designed to disrupt our business, harm our reputation or use our technology to gain unauthorized access.

In addition, regional geopolitical conflicts around the world, may result in increased cyberattacks against our customers, resulting in an increased risk of a security breach of our customers’ systems.

In addition, defects or errors in our platform could result in a failure to effectively update customers’ cloud-based products.

2 unchanged sentences

Advances in computer capabilities, discoveries of new weaknesses and other developments with software generally used online may increase the risk we will suffer a security breach.

Furthermore, our platform may fail to detect or prevent malware, ransomware, viruses, worms or similar threats for any number of reasons, including our failure to enhance and expand our platform to reflect industry trends, new technologies and new operating environments, the complexity of the environment of our clients and the sophistication of malware, viruses and other threats.

Our platform may fail to detect or prevent threats in any particular test for a number of reasons.

Our platform may fail to interoperate or conflict with customer environments causing customer downtime.

We or our service providers may also suffer security breaches or unauthorized access to personal data, financial account information, and other confidential information due to employee error, rogue employee activity, unauthorized access by third parties acting with malicious intent or who commit an inadvertent mistake or social engineering.

malicious intent or who commit an inadvertent mistake or social engineering.

If we experience, or our service providers experience, any breaches of security measures or sabotage or otherwise suffer unauthorized use or disclosure of, or access to, personal data, financial account information or other confidential information, we might be required to expend significant capital and resources to address these problems.

We may not be able to remedy any problems caused by hackers or other similar actors in a timely manner, or at all.

To the extent potential customers, industry analysts or testing firms believe that the failure to detect or prevent any particular threat is a flaw or indicates that our platform does not provide significant value, our reputation and business would be harmed.

13 unchanged sentences

We expect that the risks associated with cybersecurity incidents and the costs of preventing such attacks will continue to increase in the future.

In addition, we cannot assure that any limitation of liability provisions in our customer agreements, contracts with third-party vendors and service providers, or other contracts would be enforceable or adequate or would otherwise protect us from any liabilities or damages with respect to any particular claim relating to a security breach or other security-related matter or as a result of federal, state, or local laws or ordinances, or unfavorable judicial decisions in the U.S., or other countries.

Limitation of liability provisions in our contracts may not fully protect us from security-related claims, particularly under applicable data protection laws.

We maintain insurance to protect against certain claims associated with the use of our platform, but our insurance coverage may not adequately cover any claim asserted against us.

Furthermore, our insurance coverage may not extend to all risks we face, including all AI-related risks, and may not cover us for all losses for errors or omissions caused by AI.

In addition, even claims that ultimately are unsuccessful could result in our expenditure of funds in litigation, divert management’s time and other resources, and harm our reputation.

We also cannot be certain that our insurance coverage will be adequate for data handling or data security liabilities actually incurred, that insurance will continue to be available to us on economically reasonable terms, or at all, or that any future claim will not be excluded or otherwise be denied coverage by any insurer.

We cannot be certain that our insurance coverage will be adequate for data handling or data security liabilities actually incurred, that insurance will continue to be available to us on economically reasonable terms, or at all, or that any future claim will not be excluded or otherwise be denied coverage by any insurer.

The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could adversely affect our business, operating results, and financial condition.

1 unchanged sentence

As part of our business strategy, we have in the past and expect to continue to make investments in and/or acquire complementary companies, services, products, technologies, or talent.

For example, in February 2024 we acquired both PingSafe, a cloud security platform, and Stride, a security automation company.

We have also invested in certain privately held companies through our S Ventures fund, and we may not realize a return on these investments.

All of our venture investments are subject to a risk of partial or total loss of investment capital.

For example, in February 2024 we acquired both PingSafe, a cloud security platform, and Stride, a security automation company, and in September 2025, we acquired Prompt, a private company focused on the generative and agentic AI security space, and Observo, an AI-ready data pipeline company.

We have also invested in certain privately held companies through our S Ventures fund, which may not generate returns and are subject to a risk of partial or total loss of investment capital.

Our ability as an organization to acquire and integrate other companies, services or technologies in a successful manner is not guaranteed.

In the future, we may not be able to find suitable acquisition candidates, and we may not be able to complete such acquisitions on favorable terms, if at all.

Our due diligence efforts may fail to identify all of the challenges, problems, liabilities or other shortcomings involved in an acquisition.

If we do complete acquisitions, we may not ultimately strengthen our competitive position or ability to achieve our business objectives, and any acquisitions we announce or complete could be viewed negatively by our customers or investors.

In addition, if we are unsuccessful at integrating existing and future acquisitions, or the technologies and personnel associated with such acquisitions, into our company, the revenue and operating results of the combined company could be adversely affected.

We may not be able to find suitable acquisition candidates, or complete acquisitions on favorable terms, if at all.

Our due diligence efforts may fail to identify all of the material risks, liabilities or other challenges involved in an acquisition.

Even if completed, acquisitions or investments may not strengthen our competitive position, may not achieve expected benefits, and may be viewed negatively by our customers or investors.

In addition, if we are unsuccessful at integrating acquired business, technologies or personnel, the revenue and operating results of the combined company could be adversely affected.

Any integration process may require significant time and resources, and we may not be able to manage the process successfully.

We may not successfully evaluate or utilize the acquired technology or personnel, or accurately forecast the financial impact of an acquisition transaction, causing unanticipated write-offs or accounting charges.

Additionally, integrations could take longer than expected, or if we move too quickly in trying to integrate an acquisition, strategic investment, partnership, or other alliance, we may fail to achieve the desired efficiencies.

We have, and may in the future have, to pay cash, incur debt, or issue equity securities to pay for any such acquisition, each of which could adversely affect our financial condition and the market price of our Class A common stock.

The sale of equity or issuance of debt to finance any such acquisitions could result in dilution to our stockholders, which depending on the size of the acquisition, may be significant.

We have in the past and may in the future finance acquisitions through cash, debt, or equity securities, each of which could adversely affect our financial condition and the market price of our Class A common stock.

The issuance of equity or debt to finance any such acquisitions could result in dilution to our stockholders, which may be significant.

The incurrence of indebtedness would result in increased fixed obligations and could also include covenants or other restrictions that would impede our ability to manage our operations.

Additional risks we may face in connection with acquisitions include:

• diversion of management’s time and focus from operating our business to addressing acquisition integration challenges;

• the inability to coordinate research and development and sales and marketing functions;

• the inability to integrate product and service offerings;

• retention of key employees from the acquired company;

• changes in relationships with strategic partners or the loss of any key customers or partners as a result of product acquisitions or strategic positioning resulting from the acquisition;

• diversion of management’s attention and resources;

• the inability to integrate products, service offerings, technologies, operations, systems, controls or personnel;

• failure to retain key employees, customers or partners;

• cultural challenges associated with integrating employees from the acquired company into our organization;

• integration of the acquired company’s accounting, customer relationship management, management information, human resources and other administrative systems;

• the need to implement or improve controls, procedures and policies at a business that prior to the acquisition may have lacked sufficiently effective controls, procedures and policies;

4 unchanged sentences

• liability for activities of the acquired company before the acquisition, including intellectual property infringement claims, violations of laws, commercial disputes, tax liabilities, and other known and unknown liabilities.

• failing to achieve the expected benefits of the acquisition or investment;

• litigation or other claims in connection with the acquired company, including claims from or against terminated employees, customers, current and former stockholders, or other third parties.

Our failure to address these risks or other problems encountered in connection with acquisitions and investments could cause us to fail to realize the anticipated benefits of these acquisitions or investments, cause us to incur unanticipated liabilities, and harm our business generally.

4 unchanged sentences

• maintain, renew and expand our existing customer base;

• continue to attract new customers;

• induce customers to expand deployment of the initially adopted module(s) of our platform across their organizations and infrastructure, and to adopt additional modules of our platform and services;

• continue to attract new customers and drive broader and deeper adoption of our platform and services;

• improve the capabilities of our platform through research and development;

1 unchanged sentence

• continue to successfully expand our business domestically and internationally;

• successfully compete with other companies in the cybersecurity industry.

Our customers have no obligation to renew their subscription for our platform after the expiration of their contractual subscription period, which is generally one to three years, and in the normal course of business, some customers have elected not to renew.

In addition, our customers may renew for shorter contract subscription lengths or cease using certain features.

• successfully compete in the cybersecurity industry.

Our customers have no obligation to renew their subscription for our platform after the expiration of their contractual subscription period, which is generally one to three years.

In the normal course of business, some customers have elected not to renew or have reduced the scope or duration of their subscriptions.

Our customer retention and expansion may decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with our services, our pricing, customer security and networking issues and requirements, our customers’ spending levels, our channel partner strategy and pricing, decreases in the number of endpoints to which our customers deploy our solution, mergers and acquisitions involving our customers, industry developments, competition, general economic conditions, or the perceived decline in the incidence of cyberattacks.

5 unchanged sentences

These issues could cause longer deployment and integration times for our platform, leading to customer churn, which would adversely affect our business, operating results, and financial condition.

In addition, government and other customers may require our platform to comply with certain security or other certifications and standards.

If we are unable to achieve, or are delayed in achieving, compliance with these certifications and standards, we may be disqualified from selling our platform to such customers, or may otherwise be at a competitive disadvantage, either of which could adversely affect our business, operating results, and financial condition.

Government and other customers may require our platform to comply with certain security certifications and standards;

failure to maintain such compliance could disqualify us from selling to these customers or create a competitive disadvantage.

Disruptions or other business interruptions that affect the availability of our platform could adversely impact our customer relationships and overall business.

1 unchanged sentence

Our software and systems are designed to use computing, storage capabilities, bandwidth, and other services provided by such cloud hosting providers, and currently our cloud service infrastructure is primarily run on AWS.

We have experienced, and expect in the future that we may experience from time to time, interruptions, delays or outages in service availability due to a variety of factors.

Capacity constraints could arise from a number of causes such as technical failures, natural disasters, fraud, or security attacks.

We have experienced, and expect in the future that we may experience from time to time, interruptions, delays or outages in service and availability due to a variety of factors, including as we continue to innovate, modernize and transition to new cloud infrastructure.

Product, platform and service disruptions including capacity constraints could arise from a number of causes such as technical failures, natural disasters, fraud, or security attacks.

Such risks may become more pronounced as we continue to scale our business.

The level of service provided by our cloud hosting providers, or regular or prolonged interruptions in that service, could also impact the use of, and our customers’ satisfaction with, our platform and could harm our business and reputation.

In addition, hosting costs are expected to increase as our customer base grows, which could adversely affect our business, operating results, and financial condition.

In addition, hosting costs are expected to increase as our customer base grows, and we may also experience component shortages and pricing increases from our cloud hosting providers as a result of increased demand for computing and storage resources.

Any of these factors could adversely affect our business, operating results, and financial condition.

Furthermore, AWS has discretion to change and interpret its terms of service and other policies with respect to us, including on contract renewal, and those actions may be unfavorable to our business operations.

3 unchanged sentences

Making such changes could be costly in terms of time and financial resources.

Any of these factors could reduce our revenue, subject us to liability, and cause our customers to decline to renew their subscriptions, any of which would harm our business and operating results.

Any of these platform defects, interoperability issues, or service disruptions could reduce our revenue, subject us to liability, and cause our customers to decline to renew their subscriptions, any of which would harm our business and operating results.

We may not timely and cost-effectively scale and adapt our existing technology to meet our customers’ performance and other requirements.

9 unchanged sentences

The cybersecurity market has grown quickly and is expected to continue to evolve rapidly.

Moreover, many of our customers operate in markets characterized by rapidly changing technologies and business plans, which require

them to add numerous network-connected endpoints and adapt to increasingly complex IT environments, incorporating a variety of hardware, software applications, operating systems, and networking protocols.

Moreover, many of our customers operate in markets characterized by rapidly changing technologies and business plans, which require them to add numerous network-connected endpoints and adapt to increasingly complex IT environments, incorporating a variety of hardware, software applications, operating systems, and networking protocols.

As their technologies and business plans grow more complex, we expect these customers to face new and increasingly sophisticated methods of attack.

6 unchanged sentences

If we are not able to maintain and enhance our brand and reputation, our business and operating results may be adversely affected.

We believe that maintaining and enhancing our brand and our reputation as a leading provider of endpoint and platform security solutions is critical to our relationship with our existing customers, channel partners, and alliance partners and our ability to attract new customers and partners.

The successful promotion of our brand will depend on a number of factors, including our ability to continue to develop additional features for our platform, our ability to successfully differentiate our platform from competitive cloud-based or legacy security solutions, our marketing efforts, and, ultimately, our ability to detect and stop breaches.

We believe that maintaining and enhancing our brand and our reputation as a leading platform provider of endpoint, cloud, identity, AI, and data security solutions is critical to our relationship with our existing customers, channel partners, and alliance partners and our ability to attract new customers and partners.

The successful promotion of our brand will depend on a number of factors, including our ability to continue to develop additional features for our platform, our ability to successfully differentiate our platform from competitive AI-powered or legacy security solutions, our marketing efforts, and, ultimately, our ability to detect and stop breaches.

Although we believe it is important for our growth, our brand promotion activities may not be successful or yield increased revenue.

Under certain circumstances, our employees may have access to our customers’ platforms.

An employee may take advantage of such access to conduct malicious activities.

Any such misuse of our platform could result in negative press coverage and negatively affect our reputation, which could result in harm to our business, reputation, and operating results.

In addition, independent industry and research firms often evaluate our solutions and provide reviews of our platform, as well as the products of our competitors, and perception of our platform in the marketplace may be significantly influenced by these reviews.

If these reviews are negative, or less positive as compared to those of our competitors’ products, our brand may be adversely affected.

Under certain circumstances, our employees may have access to our customers’ platforms and misuse of such access, whether actual or perceived, could result in negative press coverage and negatively affect our reputation, which could result in harm to our business, reputation, and operating results.

In addition, independent industry and research firms often evaluate our solutions and provide reviews of our platform, as well as those of our competitors, and perception of our platform in the marketplace may be significantly influenced by these reviews.

If these reviews are negative, or less favorable than those of our competitors, our brand may be adversely affected.

Our solutions may fail to detect or prevent threats in any particular test for a number of reasons that may or may not be related to the efficacy of our solutions in real world environments.

1 unchanged sentence

Moreover, the performance of our channel partners and alliance partners may affect our brand and reputation, as it could negatively impact our reputation if customers do not have a positive experience with these partners.

In addition, we have in the past worked, and continue to work, with high profile customers and have assisted in analyzing and remediating high profile cyberattacks.

Our work with such customers has exposed us to publicity and media coverage.

Negative publicity about us, including about our management, the efficacy and reliability of our platform, our product offerings, our professional services, and the customers we work with, even if inaccurate, could adversely affect our reputation and brand.

6 unchanged sentences

The loss of a substantial number of our channel partners or alliance partners, the failure to recruit additional partners, or failure of partners to meet their purchasing commitments would adversely affect our business, operating results, key financial metrics and financial condition.

To the extent our partners are unsuccessful in selling our platform, or if we are unable to enter into arrangements with and retain a sufficient number of high-quality partners in each of the regions in which we sell or plan to sell our platform, we are unable to keep them motivated to sell our platform, or our partners shift focus to other vendors and/or our competitors, our ability to sell our platform and operating results will be harmed.

If our partners are unsuccessful in selling our platform, or if we are unable to establish and maintain a sufficient number of high-quality partnerships, or if our partners shift focus to other vendors and/or our competitors, our ability to sell our platform and operating results will be harmed.

To the extent our partners fail to meet their purchasing commitments, they may fail to pay us or attempt to renegotiate our agreements and we risk churn in forecast metrics.

2 unchanged sentences

We are also exposed to credit and liquidity risks and our operating results will be harmed if our partners were to become unable or unwilling to pay us at all or in a timely manner, terminate their relationships with us or go out of business.

Although we have programs in place that are designed to monitor and mitigate such risks, we cannot guarantee these programs will be effective in reducing our risks.

Although we have programs in place that are designed to monitor and mitigate such risks, we cannot guarantee these programs will be effective.

If we are unable to adequately control these risks, our business, operating results, and financial condition would be harmed.

12 unchanged sentences

• government certification, software supply chain or source code transparency requirements applicable to us or our platform may change and, in doing so, restrict our ability to sell into the government sector until we have attained the revised certification or meet other new requirements.

For example, although we are currently FedRAMP authorized, such authorization is costly to maintain and subject to rigorous compliance and if we lose our authorization, it will restrict our ability to sell to government customers;

• government demand and payment for our platform may be impacted by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our platform, including as a result of sudden, unforeseen and disruptive events such as government shutdowns, government defaults on indebtedness, war, regional geopolitical conflicts around the world, incidents of terrorism, natural disasters, and public health concerns or epidemics;

For example, although we are currently FedRAMP authorized, such authorization is costly to maintain and subject to rigorous compliance requirements, and if we lose our authorization, it will restrict our ability to sell to government customers;

• government demand and payment for our platform may be impacted by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our platform, including as a result of sudden, unforeseen and disruptive events such as government shutdowns, agency closures, agency or executive actions, or extensive agency layoffs or restructuring, government defaults on indebtedness, war, regional geopolitical conflicts around the world, incidents of terrorism, natural disasters, and public health concerns or epidemics;

• governments routinely investigate and audit government contractors’ administrative processes, and any unfavorable audit could result in the government refusing to continue buying our platform, which would adversely impact our revenue and operating results, or institute fines or civil or criminal liability if an investigation, audit, or other review, were to uncover improper or illegal activities;

• governments may require certain products to be manufactured, produced, hosted or accessed solely in their country or in other relatively high-cost locations, and we may not produce or host all products in locations that meet these requirements, affecting our ability to sell these products to government agencies;

• refusal to grant certain certifications or clearance by one government agency, or decision by one government agency that our products do not meet certain standards, may cause reputational harm and cause concern with other government agencies.

• refusal to grant, suspension or revocation of certain certifications or clearances, including corporate or individual security clearances, by a government agency, executive order or other government action, or decision by one government agency that our products do not meet certain standards, may cause reputational harm, loss of sales and business opportunities and cause concern with other government agencies.

The occurrence of any of the foregoing could cause government organizations to delay or refrain from purchasing our solutions in the future or otherwise adversely affect our business and operating results.

Furthermore, on January 20, 2025, President Donald Trump announced an executive order establishing the Department of Government Efficiency in an effort to maximize government efficiency and productivity.

Furthermore, the U.S.

Department of Government Efficiency was established in an effort to maximize government efficiency and productivity.

Pressures on and uncertainty surrounding the U.S.

federal government’s budget and potential changes in budgetary priorities, could adversely affect the funding for and purchases of our platform by government organizations.

federal government’s budget and potential changes in budgetary priorities, as well as those of U.S.

states and localities, could adversely affect the funding for and purchases of our platform by government organizations.

Our long-term success depends, in part, on our ability to expand the sale of our platform to customers located outside of the U.S.

2 unchanged sentences

• fluctuations in foreign currency exchange rates, which could add volatility to our operating results;

• new, or changes in, regulatory requirements;

• tariffs, export and import restrictions, restrictions on foreign investments, sanctions, and other trade barriers or protection measures;

• new, or changes in, regulatory requirements, including tariffs, export and import restrictions, restrictions on foreign investments, sanctions, and other measures;

• exposure to numerous, increasing, stringent (particularly in the E.U.), and potentially inconsistent laws and regulations relating to privacy, data protection, information security and AI;

• costs of localizing products and services (including, but not limited to data localization requirements);

• costs of localizing products and services (including, but not limited to data localization requirements) and potential;

• lack of acceptance of localized products and services;

• the need to make significant investments in people, solutions and infrastructure, typically well in advance of revenue generation;

• challenges inherent in efficiently managing an increased number of employees over large geographic distances, including the need to implement appropriate systems, policies, benefits, and compliance programs;

• difficulties in maintaining our corporate culture with a dispersed and distant workforce due to the trend towards hybrid working;

• the need to make significant upfront investments in people, solutions and infrastructure;

• challenges in managing an increased number of geographically dispersed employees, including the need to implement appropriate systems, policies, benefits, and compliance programs and maintaining corporate culture;

• treatment of revenue from international sources, evolving domestic and international tax environments, and other potential tax issues, including with respect to our corporate operating structure and intercompany arrangements;

1 unchanged sentence

• economic weakness or currency-related crises;

• compliance with multiple, conflicting, ambiguous or evolving government laws and regulations, including employment, tax, data privacy, anti-corruption, import/export, antitrust, data transfer, storage and protection, and industry-specific laws and regulations, including rules related to compliance by our third-party resellers and our ability to identify and respond timely to compliance issues when they occur and regulations applicable to us and our third party data providers from whom we purchase and resell syndicated data;

• compliance with multiple, conflicting, ambiguous or evolving government laws and regulations, including employment, tax, data privacy, anti-corruption, antitrust, data transfer, storage and protection, and industry-specific laws and regulations, and our ability to identify and respond timely to compliance issues;

• vetting and monitoring our third-party channel partners in new and evolving markets to confirm they maintain standards consistent with our brand and reputation;

3 unchanged sentences

• dependence on certain third parties, including channel partners with whom we do not have extensive experience;

• natural disasters, acts of war, terrorism, or pandemics, including regional geopolitical conflicts around the world;

• natural disasters, acts of war, terrorism, or pandemics, including regional geopolitical conflicts around the world and political instability;

• actual or perceived instability in the global banking system;

• changes in tariffs and trade restrictions;

• cybersecurity incidents.

• corporate espionage;

• political instability and security risks in the countries where we are doing business and changes in the public perception of governments in the countries where we operate or plan to operate.

We have undertaken, and will continue to undertake, additional corporate operating restructurings from time to time that involve our group of foreign country subsidiaries through which we do business abroad.

7 unchanged sentences

In addition, as we have grown, our number of customers has also increased significantly, and we have increasingly managed more complex deployments of our platform in more complex computing environments.

The rapid growth and expansion of our business places a significant strain on our management, operational, and financial resources.

The rapid growth and expansion of our business places a significant strain on our management, operational, and financial

To manage any future growth effectively, we must continue to improve and expand our information technology and financial infrastructure, our operating and administrative systems and controls, and our ability to manage headcount, capital, and processes in an efficient manner.

As a result of macroeconomic conditions, in June 2023, and March and July 2025, we approved restructuring plans designed to improve operational efficiencies and operating costs, and better align our workforce and operations with current business needs, priorities, and near term growth expectations.

If we continue to experience rapid growth, we may not be able to successfully implement or scale improvements to our systems, processes, and controls in an efficient or timely manner.

17 unchanged sentences

Further, competition continues to increase in the market segments in which we participate, and we expect competition to further increase in the future, thereby leading to increased pricing pressures.

Larger competitors with more diverse products and service offerings may reduce the price of products or services that compete with ours or may bundle them with other

products and services.

Larger competitors with more diverse products and service offerings may reduce the price of products or services that compete with ours or may bundle them with other products and services.

This could lead customers to demand greater price concessions or additional functionality at the same price levels.

2 unchanged sentences

We generally recognize revenue from customers ratably over the term of their subscription, which is generally one to three years.

As a result, a substantial portion of the revenue we report in each period is attributable to the recognition of deferred revenue relating to agreements that we entered into during previous periods.

As a result, a substantial portion of the revenue we report in each period is attributable to the

recognition of deferred revenue relating to agreements that we entered into during previous periods.

Consequently, any increase or decrease in new sales or renewals in any one period will not be immediately reflected in our revenue for that period.

21 unchanged sentences

However, as we continue to grow, indemnification claims against us for the obligations listed may increase.

When our customers or other third parties whom we do business with make intellectual property rights or other indemnification claims against us, we incur significant legal expenses and may have to pay damages, license fees

and/or stop using technology found to be in violation of the third party’s rights.

When our customers or other third parties with whom we do business with make intellectual property rights or other indemnification claims against us, we incur significant legal expenses and may have to pay damages, license fees and/or stop using technology found to be in violation of the third party’s rights.

We may also have to seek a license for the technology.

11 unchanged sentences

Key business metrics and other estimates are subject to inherent challenges in measurement and to change as our business evolves, and our business, operating results, and financial condition could be adversely affected by real or perceived inaccuracies in those metrics or any changes in metrics we disclose.

We regularly review key business metrics, including our annualized recurring revenue (ARR), number of customers with ARR of $100,000, and other measures to evaluate growth trends, measure our performance, and make strategic decisions.

We regularly review key business metrics, including our annualized recurring revenue (ARR), number of customers with ARR of $100,000 or more, and other measures to evaluate growth trends, measure our performance, and make strategic decisions.

These metrics are calculated using internal company data and have not been validated by an independent third party.

3 unchanged sentences

Moreover, we may periodically change the definition or methodology underlying our metrics.

For example, as a result of a decline in usage and consumption in the quarter ended April 30, 2023, we decided to change our methodology of calculating ARR for consumption and usage-based agreements to reflect committed contract values as opposed to based on consumption and usage.

In addition, as part of our quarterly review of ARR in connection with the preparation of our condensed consolidated financial statements for the quarter ended April 30, 2023, we discovered some historical inaccuracies relating to ARR on certain contracts, which we have corrected.

As a result, we made a one-time adjustment of approximately 5% of total ARR, which we reflected in our total ARR as of April 30, 2023.

If our key metrics are inaccurate or if investors perceive any changes to our key business metrics or the methodologies for calculating these metrics negatively, our business could be adversely affected.

2 unchanged sentences

Our future success is dependent, in part, on our ability to hire, integrate, train, manage, retain, and motivate the members of our management team and other key employees throughout our organization.

The loss of key personnel,

including key members of our management team or members of our board of directors, as well as certain of our key marketing, sales, finance, support, product development, people team, or technology personnel, could disrupt our operations and have an adverse effect on our ability to grow our business.

In particular, we are highly dependent on the services of Tomer Weingarten, our co-founder, Chairman of the Board of Directors, President, and Chief Executive Officer, who is critical to the development of our technology, platform, future vision, and strategic direction.

The loss of key personnel, including key members of our management team or members of our board of directors, as well as certain of our key marketing, sales, finance, support, product development, people team, or technology personnel, could disrupt our operations and have an adverse effect on our ability to grow our business.

In particular, we are highly dependent on the services of Tomer Weingarten, our co-founder, Chairman of our board of directors, President, and Chief Executive Officer, who is critical to the development of our technology, platform, future vision, and strategic direction.

From time to time, there have been and may in the future be changes in our management team.

While we seek to manage any such transitions carefully, such changes may result in a loss of institutional knowledge, cause disruptions to our business and negatively affect our business.

Competition for highly skilled personnel is intense, especially in the San Francisco Bay Area, where we have a substantial presence and need for highly skilled personnel, and we may not be successful in hiring or retaining qualified personnel to fulfill our current or future needs.

More generally, the technology industry, and the cybersecurity industry more specifically, is also subject to substantial and continuous competition for engineers with high levels of experience in designing, developing and managing software and related services.

Moreover, the industry in which we operate generally experiences high employee attrition.

Competition for highly skilled personnel is intense, especially in the San Francisco Bay Area, where we have a substantial presence and need for such talent, and we may not be successful in hiring or retaining qualified personnel to fulfill our current or future needs.

In particular, the scarcity of individuals with the specialized skills required to develop and enhance AI-driven technologies has led to increased competition and may lengthen our hiring cycles or inflate compensation expectations.

As we continue to integrate artificial intelligence across our platform, any failure

to recruit such individuals could delay our product roadmap and harm our competitive position.

We have, from time to time, experienced, and we expect to continue to experience, difficulty in hiring and retaining highly skilled employees with appropriate qualifications.

For example, in recent years, recruiting, hiring and retaining employees with expertise in the cybersecurity industry has become increasingly difficult as the demand for cybersecurity professionals has increased as a result of the recent cybersecurity attacks on global corporations and governments.

We may be required to provide more training to our personnel than we currently anticipate.

Further, labor is subject to external factors that are beyond our control, including our industry’s highly competitive market for skilled workers and leaders, cost inflation, overall macroeconomics and workforce participation rates.

Further, labor is subject to external factors that are beyond our control, including cost inflation, overall macroeconomic conditions and workforce participation rates.

Should our competitors recruit our employees, our level of expertise and ability to execute our business plan would be negatively impacted.

21 unchanged sentences

Our recent hires and planned hires may not become productive as quickly as we expect, or at all, and we may be unable to hire or retain sufficient numbers of qualified individuals in the markets where we do business or plan to do business.

Moreover, our international expansion may be slow or unsuccessful if we are unable to retain qualified personnel with international experience, language skills and cultural competencies in the geographic markets which we target.

Moreover, our international expansion may be slow or

unsuccessful if we are unable to retain qualified personnel with international experience, language skills and cultural competencies in the geographic markets which we target.

If we are unable to hire, integrate, train, manage, and retain a sufficient number of effective sales personnel, or the sales personnel we hire are not successful in obtaining new customers or increasing sales to our existing customer base, our business, operating results and financial condition will be adversely affected.

8 unchanged sentences

As we implement more complex organizational structures, we may find it increasingly difficult to maintain the beneficial aspects of our corporate culture, which could negatively impact our future success.

We are also taking steps to develop a more inclusive and diverse workforce, however, there is no guarantee that we will be able to do so.

We are also taking steps to develop a more inclusive workforce, however, there is no guarantee that we will be able to do so.

Risks Related to Our Intellectual Property

9 unchanged sentences

may bring into question the validity of certain software patents and may make it more difficult and costly to prosecute patent applications.

Such changes may lead to uncertainties or increased costs and risks surrounding the prosecution, validity, ownership, enforcement, and defense of our issued patents and patent applications and other intellectual property, the outcome of third-party claims of infringement, misappropriation, or other violation of intellectual property brought against us and the actual or enhanced damages (including treble damages) that may be awarded in connection with any such current or future claims, and could have a material adverse effect on our business, operating results, and financial condition.

(including treble damages) that may be awarded in connection with any such current or future claims, and could have a material adverse effect on our business, operating results, and financial condition.

Despite our efforts to protect our proprietary rights, unauthorized parties may attempt to copy aspects of our platform or obtain and use information that we regard as proprietary.

17 unchanged sentences

Such litigation could result in substantial costs and diversion of resources and could negatively affect our business, operating results and financial condition.

If we are unable to protect our proprietary rights (including aspects of our software and platform protected other than by patent rights), we will find ourselves at a competitive disadvantage to others who need not incur the additional expense, time and effort required to create our platform and

other innovative products that have enabled us to be successful to date.

Moreover, we may need to expend additional resources to defend our intellectual property rights in foreign countries, and our inability to do so could impair our business or adversely affect our international expansion.

9 unchanged sentences

Furthermore, patent holding companies, non-practicing entities, and other adverse patent owners that are not deterred by our existing intellectual property protections may seek to assert patent claims against us.

From time to time, third parties, including certain of these leading companies, have invited us to license their patents and may, in the future, assert patent, copyright, trademark, or other intellectual property rights against us, our channel partners, our alliance partners, or our customers.

From time to time, third parties have invited us to license their patents and may, in the future, assert patent, copyright, trademark, or other intellectual property rights against us, our channel partners, our alliance partners, or our customers.

We have received, and may in the future receive, notices that claim we have misappropriated, misused, or infringed other parties’ intellectual property rights, and, to the extent we gain greater market visibility, we face a higher risk of being the subject of intellectual property infringement claims.

34 unchanged sentences

These claims, regardless of validity, could result in time consuming and costly litigation, divert management’s time and attention away from developing the business, expose us to customer indemnity claims, or force us to disclose source code.

could be costly for us to defend, result in paying damages, entering into unfavorable licenses, have a negative effect on our operating results and financial condition, or cause delays by requiring us to devote additional research and development resources to change our solution.

Litigation could be costly for us to defend, result in paying damages, entering into unfavorable licenses, have a negative effect on our operating results and financial condition, or cause delays by requiring us to devote additional research and development resources to change our solution.

Risks Related to Legal and Regulatory Matters

We are subject to laws and regulations, including government export and import controls, sanctions and anti-corruption laws, that could impair our ability to compete in our markets and subject us to liability if we are not in full compliance with applicable laws.

We are subject to laws and regulations, including government export and import controls, sanctions controls and anti-corruption laws, that could impair our ability to compete in our markets and subject us to liability if we are not in full compliance with applicable laws.

We are subject to laws and regulations, including government export and import controls, that could subject us to liability or impair our ability to compete in our markets.

Our platform and related technology are subject to U.S.

export controls, including the U.S.

Our platform and related technology are subject to the U.S.

Department of Commerce’s Export Administration Regulations (EAR).

We, along with our employees, representatives, contractors, agents, intermediaries, and other third parties are also subject to various economic and trade sanctions regulations administered by OFAC and other U.S.

government agencies.

We incorporate standard encryption algorithms into our platform, which, along with the underlying technology, may be exported or reexported to foreign countries only with the required export authorizations, including by license, license exception or other appropriate government authorizations, which may require the filing of an encryption registration and classification request and other reports submitted on a periodic basis.

We also offer certain customers a ransomware warranty in addition to their subscriptions, providing coverage in the form of a limited monetary payment if they are affected by a ransomware attack (as specified in our ransomware warranty agreement), and though the terms of the warranty do not allow those customers to use warranty claim payments to fund payments to persons on OFAC’s list of Specially Designated Nationals and Blocked Persons or who are otherwise prohibited to receive such payments under U.S.

sanctions, we cannot assure you that all of our customers will comply with our warranty terms or refrain from taking actions in violation of our warranty and applicable law.

Furthermore, U.S.

export control laws and economic sanctions prohibit the export and re-export of certain hardware and software and the provision of certain cloud-based solutions to certain countries, governments and persons targeted by U.S.

sanctions and for certain end-uses.

For example, following Russia’s invasion of Ukraine, the U.S.

and other countries have continued to impose economic sanctions and severe export control restrictions against Russia and Belarus.

Should the conflict escalate, sanctions and export restrictions will likely expand and strengthen, potentially impacting our ability to conduct business in certain regions and with specific individuals and entities in those regions.

We are also subject to the economic and trade sanctions regulations administered by OFAC.

export control laws and economic sanctions prohibit the export, re-export and transfer (in-country) of certain hardware and software and the provision of certain cloud-based solutions to certain countries, governments and parties and for certain end-uses.

Various countries regulate the import of certain encryption technology, including through import permit and license requirements, and have enacted laws that could limit our ability to distribute our platform or could limit our customers’ ability to implement our platform in those countries.

Changes in our platform, and changes in or promulgation of new export and import regulations may create delays in the introduction of our platform into certain international markets, prevent our customers with international operations from deploying our platform globally or, in some cases, prevent the export or import of our platform to certain countries, governments or parties altogether.

Any decreased use of our platform

or limitation on our ability to export or sell our platform would adversely affect our business, operating results, and financial condition.

Further, regulators in the U.S.

and elsewhere have signaled an increased emphasis on sanctions and export control enforcement, including several recent high-profile enforcement actions and increased pressure for companies to self-disclose potential violations.

While we have implemented certain procedures to facilitate compliance with applicable laws and regulations in connection with the collection and distribution of this information, we cannot assure you that these procedures have been fully effective or that we, or third parties who we do not control, have complied with all laws or regulations in this regard.

Failure by our employees, representatives, contractors, channel partners, agents, intermediaries, or other third parties to comply with applicable laws and regulations in the collection and distribution of this information also could have negative consequences to us, including reputational harm, government investigations, loss of export privileges, monetary fines, and other penalties.

We also collect information about cyber threats from open sources, intermediaries and third parties that we make available to our customers in our threat industry publications.

and elsewhere have signaled an increased emphasis on sanctions and export control enforcement.

While we have implemented certain procedures to facilitate compliance with applicable laws and regulations, we cannot assure you that these procedures have been fully effective or that we, or third parties who we do not control, have complied with all laws or regulations in this regard.

Failure by our employees, representatives, contractors, channel partners, agents, intermediaries, or other third parties to comply with applicable laws and regulations also could have negative consequences to us, including reputational harm, government investigations, loss of export privileges, monetary fines, and other penalties.

We also collect information about cyber threats from public sources, intermediaries and third parties that we make available to our customers in our threat intelligence industry publications.

Although we take precautions to prevent our information collection practices and services from being provided in violation of such laws, our information collection practices and services may have been in the past, and could in the future be, provided in violation of such laws.

7 unchanged sentences

Any decreased use of our platform or limitation on our ability to export or sell our platform would adversely affect our business, operating results, and financial condition.

We are also subject to the United States Foreign Corrupt Practices Act of 1977 (FCPA), as amended, the United Kingdom Bribery Act 2010 (the Bribery Act), and other anti-corruption, sanctions, anti-bribery, anti-money laundering and similar laws in the U.S.

and other countries in which we conduct activities.

Anti-corruption and anti-bribery laws, which have been enforced aggressively and are interpreted broadly, prohibit companies and their employees, agents, intermediaries and other third parties from promising, authorizing, making or offering improper payments or other benefits to government officials and others in the public, and in certain cases, private sector.

We leverage third parties, including intermediaries, agents and channel partners, to conduct our business in the U.S.

We are also subject to the United States Foreign Corrupt Practices Act of 1977 (FCPA), as amended, the United Kingdom Bribery Act 2010 (the Bribery Act), and other applicable anti-corruption and anti-bribery laws in the U.S.

jurisdictions where we operate.

Such laws, which are interpreted broadly, prohibit companies and their employees, agents, intermediaries and other third parties from offering, promising, authorizing or providing anything of value, directly or indirectly, to government officials and others in the public, and in certain cases, private sector for the purpose of obtaining or retaining business or securing an improper advantage.

We engage third parties, including intermediaries, agents and channel partners, to conduct our business in the U.S.

and abroad, to sell subscriptions to our platform and to collect information about cyber threats.

We and these third parties may have direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities and we may be held liable for the corrupt or other illegal activities of these third-party business partners and intermediaries, our employees, representatives, contractors, channel partners, agents, intermediaries and other third parties, even if we do not explicitly authorize such activities.

While we have policies and procedures to address compliance with FCPA, Bribery Act and other anti-corruption, sanctions, anti-bribery, anti-money laundering and similar laws, we cannot assure you that they will be effective, or that all of our employees, representatives, contractors, channel partners, agents, intermediaries or other third parties have not taken, or will not take actions, in violation of our policies and applicable law, for which we may be ultimately held responsible.

As we increase our international sales and business, including our business with government organizations, our risks under these laws may increase.

Noncompliance with these laws could subject us to investigations, severe criminal or civil sanctions, settlements, prosecution, loss of export privileges, suspension or debarment from U.S.

government contracts, other enforcement actions, disgorgement of profits, significant fines, damages, other civil and criminal penalties or injunctions, whistleblower complaints, adverse media coverage and other consequences.

Any investigations, actions or sanctions could harm our reputation, business, operating results, and financial condition.

Moreover, the rapid evolution of AI, including potential government regulation of AI, may require significant additional resources to develop, test, and maintain our platform.

Our AI-related initiatives may result in new or enhanced governmental or regulatory scrutiny, including regarding the use of AI in our products and the marketing of products using AI, litigation, customer reporting or documentation requirements, ethical or social concerns, or other complications and may also introduce risks related to accuracy, bias, toxicity, privacy, and security and data provenance.

For example, in Europe, the E.U.

AI Act has started becoming applicable in 2025.

AI Act aims to introduce a common and regulatory framework for AI through regulating AI providers and entities making use of AI tools in a professional capacity and may require the implementation of additional quality assurance controls and measures to be reviewed and approved by regulatory submissions of our offerings.

Additionally, in the United States, the Framework for Artificial Intelligence Diffusion rule entered into effect on January 13, 2025.

The rule amends the EAR to control certain advanced closed-weight dual-use AI models and creates a global license requirement.

The rule may require the implementation of additional procedures to facilitate compliance with applicable laws and regulations.

We and these third parties may have direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities and we can be held liable for unlawful conduct of these third parties, even if we did not authorize or have actual knowledge of the misconduct.

Although we maintain anti-corruption compliance policies, procedures, training and controls designed to reduce the risk of violations, they may not be effective in preventing all improper conduct.

As our international sales and business, and our business with government agencies or state-owned or affiliated entities expands, our risks under these laws will increase.

Noncompliance with these laws could result in investigations, significant civil or criminal penalties, disgorgement, injunctions, suspension or debarment from government contracts, private litigation, reputational harm, diversion of management time and resources, and other legal and business consequences, any of which could harm our reputation, business, operating results, and financial condition.

We are subject to laws and regulations affecting our business, including those related to the privacy and data protection of the personal data or other information we collect, process or share.

Our actual or perceived failure to comply with such laws or regulations could harm our business.

We receive, store, and process some personal data from our employees, customers, the employees of our customers, and our end users.

We collect, receive, store, and process personal data from our employees, customers, the employees of our customers, and our end users.

This personal data is hosted by our third-party vendors and service providers.

2 unchanged sentences

Complying with these various laws and regulations could cause us to incur substantial costs or require us to change our business practices, systems, and compliance procedures in a manner adverse to our business.

Failure to comply with laws, regulations and industry standards regarding personal data or other information could adversely affect our business, operating results, and financial condition.

In the U.S., there are numerous federal and state consumer, privacy, and data security laws and regulations governing the collection, use, disclosure, and protection of personal data, including security breach notification laws and consumer protection laws.

Each of these laws is subject to varying interpretations and constantly evolving.

Notably we may be subject to:

• The CCPA, which took effect in 2020, created new data privacy obligations for covered businesses and provided new privacy rights to California residents, including the right to opt out of certain disclosures of their personal information and receive detailed information about how their personal information.

For example, in California, the California Consumer Privacy Act of 2018 (as amended, “CCPA”) created new data privacy obligations for covered businesses and provided new privacy rights to California residents, including the right to opt out of certain disclosures of their personal information and receive detailed information about how their personal information is collected, used and shared.

Following California’s lead, over a third of other U.S.

states have enacted privacy laws in recent years.

These state laws impose varying requirements regarding consumer rights, data minimization, and security obligations.

In addition, various comprehensive federal privacy bills have been proposed in Congress from time to time.

Compliance with this patchwork of state and federal requirements is costly and creates operational complexity.

As a result of our presence in the E.U.

and the U.K., we are also subject to the GDPR, which governs the collection, use, disclosure, transfer or other processing of personal data of natural persons in the EEA and U.K., and it applies extra-territorially and imposes onerous requirements on controllers and processors of personal data.

A breach of the GDPR could result in fines, penalties, regulatory investigations, reputational damage, orders to cease or change our processing of our data, enforcement notices, and/or assessment notices for a compulsory audit.

Such penalties include potential fines for noncompliance of up to €20 million (£17.5 million in the U.K.) or 4% of a company’s global turnover, whichever is greater.

In addition to the foregoing, a breach of the GDPR could result in regulatory investigations, reputational damage, orders to cease or change our processing of our data, enforcement notices, and/or assessment notices (for a compulsory audit).

Such penalties include potential fines for noncompliance of up to €20 million (£17.5 million in the U.K.) or 4% of global turnover, whichever is greater.

and the U.K., we are also subject to the GDPR, which governs the collection, use, disclosure, transfer or other processing of personal data of natural persons in the EEA and U.K., and it applies extra-territorially and imposes strict requirements on controllers and processors of personal data.

A breach of the GDPR could result in fines of up to €20 million (£17.5 million in the U.K.) or 4% of a company’s global turnover, whichever is greater.

In addition to financial penalties, a breach could result in penalties, regulatory investigations, reputational damage, orders to cease or change our processing of our data, enforcement notices, and/or assessment notices for a compulsory audit.

We may also face civil claims including representative actions and other class action type litigation (where individuals have suffered harm), potentially amounting to significant compensation or damages liabilities, as well as associated costs, diversion of internal resources, and reputational harm.

The GDPR prohibits, among other things, personal data from being transferred outside of the EEA or the U.K.

to any jurisdictions (Third Countries, including the U.S.) that have not been deemed adequate by regulators in the E.U.

or U.K., unless steps are taken to legitimize those data transfers.

The GDPR prohibits personal data from being transferred outside of the EEA or the U.K.

to any jurisdictions that have not been deemed adequate by regulators in the E.U.

(including the U.S.), unless steps are taken to legitimize those data transfers.

Switzerland follows similar legal practices.

We currently rely on the use of Standard Contractual Clauses (SCCs) and our certification under the E.U.-U.S.

Data Privacy Framework (DPF), the U.S.-U.K.

DPF and the Swiss U.S.

DPF for the transfer of personal data from the E.U.

to Third Countries.

However these transfer mechanisms could be subject to further legal challenge which could cause the legal requirements for personal data transfers from these countries to the U.S.

to become uncertain once again.

If we are otherwise unable to transfer personal data between and among countries and regions

in which we operate, it could affect the manner in which we provide our services, adversely affecting our financial results, and possibly making it necessary to establish systems in the EEA, Switzerland, the U.K.

and other jurisdiction to maintain personal data originating from those jurisdictions that adds expenses and may create distractions from our other business pursuits.

As supervisory authorities continue to issue further guidance on personal data transfers, we could suffer additional costs, complaints, or regulatory investigations or fines.

Loss, retention or misuse of certain information and alleged violations of laws and regulations relating to privacy and data security, and any relevant claims, may expose us to potential liability and may require us to expend significant resources on data security and in responding to and defending such allegations and claims.

Moreover, we are also subject to evolving E.U.

privacy laws on cookies and electronic marketing.

Regulation of cookies and similar technologies, and any decline of cookies or similar online tracking technologies as a means to identify and potentially target users, may lead to broader restrictions and impairments on our marketing and personalization activities and may negatively impact our efforts to understand and acquire new users.

Similar concerns around the regulation of cookies and similar technologies may happen under the CCPA regime in California and other current and soon-to-be enacted U.S.

state privacy laws.

Further, we depend on a number of third parties in relation to the operation of our business, many of which process personal data on our behalf or as our sub-processor.

Data Privacy Framework (DPF), the Swiss-U.S.

DPF, and the U.K.

Extension to the E.U.-U.S.

DPF for such transfers of personal data.

However these transfer mechanisms could be subject to further legal challenges.

Some countries have enacted or are considering legislation requiring local storage and processing of data, or similar requirements, which could increase the cost and complexity of delivering our products and services if we were to operate in those countries.

If we are required to implement additional measures for cross-border data transfers or are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, add expenses, create distractions from our other business pursuits and could adversely affect our business, financial condition and results of operations.

We are also subject to evolving laws, including in the E.U.

and U.K., on the use of cookies and electronic marketing technologies.

impairments on our marketing and personalization activities and may negatively impact our efforts to understand and acquire new users.

In recent years, some regulators have proposed or introduced cybersecurity licensing requirements or certification regimes for specific sectors, such as critical infrastructure and financial services.

These may impose new requirements on us or our current or prospective customers such as data processing locations, breach notification, and security standards.

For instance, under DORA, which came into force in January 2025, our E.U.

financial entity clients for whom we are a third-party provider of critical information and communication technology (ICT) services will require us to contract with and manage our relationships with them (and, where applicable, our relationships with critical third-party technology vendors in our own supply chain) in accordance with DORA’s requirements for ICT risk management, reporting, resilience and oversight.

In addition to DORA, the E.U.’s Data Act (the “Data Act”) became applicable on September 12, 2025.

Among other things, the Data Act imposes data and cloud service interoperability and switching obligations to enable users to switch between cloud service providers.

If we are subject to the Data Act, we may be required to revise our customer contracts and pricing models, and implement new switching procedures.

Such requirements may cause us to incur significant organizational costs and increase barriers of entry into new markets.

We depend on a number of third parties in relation to the operation of our business, many of which process personal data on our behalf or as our sub-processor.

To the extent required by applicable law, we attempt to mitigate the associated risks of using third parties by performing security assessments and detailed due diligence, entering into contractual arrangements to ensure that providers only process personal data according to our instructions or comparable instructions to the instructions of our customer (as applicable), and that they have sufficient technical and organizational security measures in place.

There is no assurance that these contractual measures and our own privacy and security-related safeguards will protect us from the risks associated with the third-party processing, storage and transmission of such information.

Any violation of privacy, data protection, data or cybersecurity laws by our third-party processors could have a material adverse effect on our business and result in the fines and penalties under the GDPR or other applicable laws.

Any violation of privacy, data protection, data or cybersecurity laws by our third-party processors could have a material adverse effect on our business and result in fines and penalties under the GDPR or other applicable laws.

Any failure or perceived failure by us, even if unfounded, to comply with applicable privacy and data security laws and regulations, our privacy policies, or our privacy-related obligations to customers, users or other third parties, or any compromise of security that results in the unauthorized release or transfer of personal data or other customer data, may result in government enforcement actions, fines, penalties, litigation, or public statements against us by consumer advocacy groups or others and could cause our users to lose trust in us, which would have an adverse effect on our reputation and business.

5 unchanged sentences

In addition, it is possible that future orders issued by, or enforcement actions initiated by, regulatory authorities could cause us to incur substantial costs or require us to change our business practices in a manner materially adverse to our business.

Complying with laws and regulations related to privacy and data protection could result in additional costs and liabilities to us.

We are subject to various state, national, and international laws, regulations, and industry standards that apply to the collection, use, retention, protection, disclosure, transfer and other processing of personal data and other information, which often change in scope, are subject to differing interpretations, and may be inconsistent across countries or conflict with other rules.

The myriad of international and U.S.

privacy and data breach laws are not consistent, and compliance in the event of a widespread data breach is difficult and may be costly.

In many jurisdictions, enforcement actions and consequences for noncompliance are also rising.

In addition to government regulation, privacy advocates and industry groups may propose new and different self-regulatory standards that either legally or contractually apply to us.

Further, some countries (including some outside the EEA) also considering or have passed legislation requiring local storage and processing of data, or similar requirements, which could increase the cost and complexity of delivering our products and services if we were to operate in those countries.

If we are required to implement additional measures to transfer data from the EEA, this could increase our compliance costs, and could adversely affect our business, financial condition and results of operations.

In recent years, some regulators have proposed or introduced cybersecurity licensing requirements or certification regimes for specific sectors, such as critical infrastructure.

These may impose new requirements on us or our current or prospective customers including, but not limited to, data processing locations, breach notification, and security standards.

For instance, under DORA, which came into force in January 2025, our E.U.

Such requirements may cause us to incur significant organizational costs and increase barriers of entry into new markets.

Our failure to comply with applicable laws, directives, and regulations may result in enforcement action against us, including fines, and damage to our reputation, any of which may have an adverse effect on our business and operating results.

Any significant change to applicable laws, regulations or industry practices regarding the use or disclosure of our customers’ data, or regarding the manner in which the express or implied consent of customers for the use and disclosure of such data is obtained – or in how these applicable laws, regulations or industry practices are interpreted and enforced by state, federal and international privacy regulators – could require us to modify our services and features, possibly in a material manner, may subject us to regulatory enforcement actions and fines, and may limit our ability to develop new products, services and features that make use of the data that our customers voluntarily share with us.

Moreover, while we strive to publish and prominently display privacy policies that are accurate, comprehensive, and compliant with applicable laws, rules regulations and industry standards, we cannot ensure that our privacy policies and other statements regarding our practices will be sufficient to protect us from claims, proceedings, liability or adverse publicity relating to data privacy and security.

If our public statements about our use, collection, disclosure and other processing of personal data, whether made through our privacy policies, information provided on our website, press statements or otherwise, are alleged to be deceptive, unfair or misrepresentative of our actual practices, we may be subject to potential government or legal investigation or action, including by the FTC or applicable state attorneys general.

While we strive to publish and prominently display privacy policies that are accurate, comprehensive, and compliant with applicable laws, rules regulations and industry standards, we cannot ensure that our privacy policies and other statements regarding our practices will be sufficient.

If such public statements are alleged to be deceptive, unfair or misrepresentative of our actual practices, we may be subject to potential government or legal investigation or action, including by the FTC or applicable state attorneys general.

Our compliance efforts are further complicated by the fact that data privacy and security laws, rules, regulations and standards around the world are rapidly evolving, may be subject to uncertain or inconsistent interpretations and enforcement, and may conflict among various jurisdictions.

Any failure or perceived failure by us to comply with our privacy policies, or applicable data privacy and security laws, rules, regulations, standards, certifications or contractual obligations, or any compromise of security that results in unauthorized access to, or unauthorized loss, destruction, use, modification, acquisition, disclosure, release or transfer of personal data, may result in requirements to modify or cease certain operations or practices, the expenditure of substantial costs, time and other resources, proceedings or actions against us, legal liability, government investigations, enforcement actions, claims, fines, judgments, awards, penalties, sanctions, and costly litigation (including class actions).

destruction, use, modification, acquisition, disclosure, release or transfer of personal data, may result in requirements to modify or cease certain operations or practices, the expenditure of substantial costs, time and other resources, proceedings or actions against us, legal liability, government investigations, enforcement actions, claims, fines, judgments, awards, penalties, sanctions, and costly litigation (including class actions).

Any of the foregoing could result in significant operational and compliance costs, harm our reputation, distract our management and technical personnel, adversely affect the demand for our products and services, and ultimately result in the imposition of liability, any of which could have a material adverse effect on our business, operating results, and financial condition.

19 unchanged sentences

Further, weaknesses in our internal controls may be discovered in the future.

Any failure to develop or maintain effective controls, or any difficulties encountered in their implementation or improvement, could harm our operating results, may result in a restatement of our consolidated financial statements for prior periods, cause us to fail to meet our reporting obligations, and could adversely affect the results of periodic management evaluations and annual independent registered public accounting firm attestation reports regarding the effectiveness of our internal control over financial reporting.

obligations, and could adversely affect the results of periodic management evaluations and annual independent registered public accounting firm attestation reports regarding the effectiveness of our internal control over financial reporting.

Ineffective disclosure controls and procedures and internal control over financial reporting could also cause investors to lose confidence in our reported financial and other information, which would likely have a negative effect on the market price of our Class A common stock.

Our management is also required, pursuant to Section 404 of the Sarbanes-Oxley Act, to certify financial and other information in our quarterly and annual reports and provide an annual report on the effectiveness of our internal control over financial reporting.

In addition, we are subject to evolving laws, regulations, policies, and international accords relating to matters beyond our core products and services, including, but not limited to, environmental sustainability, climate change, human capital, and employment matters.

In particular, we face challenges inherent in effectively and efficiently managing a workforce across a large number of jurisdictions, many of which have differing labor law requirements, including the need to implement appropriate systems, policies, benefits, and compliance programs.

Compliance with such laws, regulations, and policies may require significant investment and expense.

Further, if we fail to implement the necessary programs, frameworks and principles for compliance, our reputation, business, and financial condition may be adversely affected.

We have incurred significant costs with respect to our directors’ and officers’ insurance coverage.

15 unchanged sentences

The IRA contains certain tax measures, including a corporate alternative minimum tax of 15% on some large corporations and an excise tax of 1% on certain corporate stock buy-backs taking place after December 31, 2022.

In addition, the Organization for Economic Cooperation and Development (OECD) Inclusive Framework of 137 jurisdictions have joined a two-pillar plan to reform international taxation rules.

Further, for our 2022 to 2024 tax years, the Tax Cuts and Jobs Act of 2017 required research and experimental (R&E) expenditures to be capitalized and amortized ratably over a five-year period for domestic expenditures.

Any such expenditures attributable to research conducted outside the United States were required to be capitalized and amortized over a 15-year period.

On July 4, 2025, President Trump signed the One Big Beautiful Bill Act (the OBBBA), restoring immediate deductibility of domestic R&E expenditures beginning with our 2025 tax year, while foreign R&E expenditures will continue to be capitalized and amortized over a 15-year period.

The OBBBA introduced other provisions, such as the permanent extension and modification of certain provisions of the Tax Cuts and Jobs Act of 2017, changes to bonus depreciation rules, and adjustments to interest expense limitations.

The OBBBA did not have a material effect on our consolidated financial statements for the year ended January 31, 2026.

In addition, the Organization for Economic Cooperation and Development (OECD) Inclusive Framework of over 140 jurisdictions have joined a two-pillar plan to reform international taxation rules.

The first pillar is focused on the allocation of taxing rights between countries for in-scope multinational enterprises that sell goods and services into countries with little or no local physical presence and is intended to apply to multinational enterprises with global turnover above €20 billion.

The second pillar is focused on developing a global minimum tax rate of at least 15% applicable to in-scope multinational enterprises and is intended to apply to multinational enterprises with annual consolidated group revenue in excess of €750 million.

The rules were effective for us beginning in fiscal 2025.

The second pillar (Pillar Two) is focused on developing a global minimum tax rate of at least 15% applicable to in-scope multinational enterprises and is intended to apply to multinational enterprises with annual consolidated group revenue in excess of €750 million.

The rules were effective for us beginning in fiscal 2025 but are not expected to be applicable until fiscal 2027.

Numerous countries have enacted or substantially enacted legislation to implement these rules.

In January 2026, the OECD issued additional guidance regarding a

side-by-side agreement, which is intended to provide relief for U.S.-parented multinational corporations from certain provisions of Pillar Two, but will require adoption by OECD member countries to implement.

While Pillar Two did not have an impact on our tax provision or effective tax rate in fiscal 2026, we continue to monitor Pillar Two and other evolving tax legislation in the jurisdictions in which we operate.

5 unchanged sentences

income tax purposes.

If not utilized, the federal net operating loss carryforwards will begin to expire in 2031, and the state net operating loss carryforwards will begin to expire in 2027.

If not utilized, a portion of the federal net operating loss carryforwards will begin to expire in 2031, and the state net operating loss carryforwards will begin to expire in 2027.

In addition, as of January 31, 2026, we had federal research and development credit carryforwards of $13.1 million, which will begin to expire in 2037, and state research and development credit carryforwards of $5.4 million, which do not expire.

We also had foreign net operating loss carryforwards of $93.3 million, as of January 31, 2025, which do not expire.

We had no foreign net operating loss carryforwards as of January 31, 2026.

Realization of these net operating loss and research and development credit carryforwards depends on future income, and there is a risk that certain of our existing carryforwards could expire unused and be unavailable to offset future income tax liabilities, which could adversely affect our operating results and financial condition.

18 unchanged sentences

A successful assertion by a U.S.

state or local government, or other country or jurisdiction that we should have been or should be collecting additional sales, use, value added, digital services or other similar taxes could, among other things, result in substantial tax payments, create significant administrative burdens for us, discourage potential customers from subscribing to our platform due to the incremental cost of any such sales or other related taxes, or otherwise harm our business.

create significant administrative burdens for us, discourage potential customers from subscribing to our platform due to the incremental cost of any such sales or other related taxes, or otherwise harm our business.

Our corporate structure and intercompany arrangements are subject to the tax laws of various jurisdictions, and we could be obligated to pay additional taxes, which would harm our operating results and financial condition.

1 unchanged sentence

We generally conduct our international operations through wholly-owned subsidiaries and are or may be required to report our taxable income in various jurisdictions worldwide based upon our business operations in those jurisdictions.

Our corporate structure and associated transfer pricing policies contemplate future growth in international markets, and consider the functions, risks, and assets of the various entities involved in intercompany

transactions.

Furthermore, increases in tax rates, new or revised tax laws, and new interpretations of existing tax laws and policies by taxing authorities and courts in various jurisdictions, could result in an increase in our overall tax obligations which could adversely affect our business.

2 unchanged sentences

It is not uncommon for tax authorities in different countries to have conflicting views, for instance, with respect to, among other things, the manner in which the arm’s length standard is applied for transfer pricing purposes, the transfer pricing and charges for intercompany services and other intercompany transactions, or with respect to the valuation of our intellectual property for tax purposes and the manner in which our intellectual property is owned and utilized within our group.

Since 2022, we have been negotiating a bilateral Advance Pricing Agreement (APA) with the U.S.

and the Israeli governments, covering various transfer pricing matters for intercompany transactions relating to the intergroup ownership and utilization of our intellectual property among our group enterprises and the provision of intergroup services.

An APA, if obtained and implemented, will provide us with greater certainty regarding our tax obligations in respect of our U.S.

and Israeli intercompany transactions, transfer pricing and charges, and a more predictable future business operating model, and will preclude the relevant tax authorities from making certain transfer pricing adjustments within the scope of these agreements.

As of January 31, 2025, the APA negotiation remains ongoing and the parties have not agreed upon a framework for a settlement or resolution.

If we agree to an APA, we may, as part of that agreement, be required to make significant payments to the Israeli government.

Alternatively, if we are unable to agree upon an APA, the ITA may initiate an audit of our intercompany agreements and transactions, which may result in a potential tax assessment.

While we intend to vigorously defend our tax position, any fines, penalties, settlement or adverse judgment relating to such matter may have a material and adverse impact on our business, operating results, financial conditions and cash flows.

For more information see Note 12, Income Taxes, to our consolidated financial statements included in Part II, Item 8, Financial Statements and Supplementary Data.

On January 8, 2026, we entered into an Assessment Agreement (the Agreement) with the Israeli Tax Authority (ITA) covering various transfer pricing matters for intercompany transactions between us and our Israeli subsidiary, including the valuation and taxation of intellectual property.

The Agreement fully and finally resolves all related Israeli disputed income tax matters between us, our affiliates, and the ITA for the fiscal years ended January 31, 2021 through January 31, 2025.

This settlement with the ITA includes certain principles established in the bilateral Advanced Pricing Agreement (“APA”) process between us, the Internal Revenue Service, and the ITA, which we have been negotiating since fiscal year 2022, and provides a final tax determination on this matter for Israeli tax purposes.

As a result of this final resolution and the related reassessment of our uncertain tax positions, we recorded a total tax expense of $180.9 million, inclusive of interest, during fiscal 2026.

Under the terms of the Agreement, we are required to make installment payments through 2030 and the unpaid balance is subject to a 7.0% annual interest rate.

Additionally, in the event of a change in control, all unpaid amounts plus interest—$255.1 million (792.7 million Israeli New Shekels) —would accelerate and become immediately due.

For more information, see Note 10, Income Taxes, to our consolidated financial statements.

While this matter is resolved in Israel, there can be no assurance that other tax authorities, including the IRS, will not successfully challenge our transfer pricing positions elsewhere, which could result in increased tax liabilities or double taxation.

In addition, if taxing authorities in any of the jurisdictions in which we conduct our international operations were to successfully challenge our transfer pricing, we could be required to reallocate part or all of our income to reflect transfer pricing adjustments, which could result in an increased tax liability to us.

2 unchanged sentences

We believe that our tax and financial accounting positions are reasonable and our tax reserves are adequate to cover any potential liability.

We believe that our assumptions, judgements, and estimates are reasonable and that our transfer pricing for these intercompany transactions are on arm’s-length terms.

However, the relevant tax authorities may disagree with our tax positions, including any assumptions, judgements, valuations or estimates used for these transfer pricing matters and intercompany transactions.

If any of these tax authorities determine that our transfer pricing for these intercompany transactions do not meet arm’s-length criteria, and were successful in challenging our positions, we could be required to pay additional taxes, interest, indexation charges and/or penalties related thereto, which could be in excess of any reserves established therefore, and which could result in higher effective tax rates, reduced cash flows and lower overall profitability of our operations.

We believe that our assumptions, judgments, and estimates are reasonable and that our transfer pricing for these intercompany transactions are on arm’s-length terms.

However, the relevant tax authorities may disagree with our tax positions, including any assumptions, judgments, valuations or estimates used for these transfer pricing matters and intercompany transactions.

effective tax rates, reduced cash flows and lower overall profitability of our operations.

Our financial statements could fail to reflect adequate reserves to cover such a contingency.

15 unchanged sentences

dollar increases the real cost of our platform to our customers outside of the U.S., which could lead to delays in the purchase of our platform and the lengthening of our sales cycle.

dollar continues to strengthen, this could adversely affect our operating results and financial condition.

dollar strengthens, this could adversely affect our operating results and financial condition.

In addition, increased international sales in the future, including through continued international expansion, our channel partners and other partnerships, could result in foreign currency denominated sales, which would increase our foreign currency risk.

Conversely, if the U.S.

dollar weakens relative to the foreign currencies in the jurisdictions in which we have operations, our cost of revenue and operating expenses will increase, which would have an adverse impact on our operating results.

Our operating expenses incurred outside the U.S.

1 unchanged sentence

These expenses are denominated in foreign currencies and are subject to fluctuations due to changes in foreign currency exchange rates.

We do not currently hedge against the risks associated with currency fluctuations but may do so, or use other derivative instruments, in the future.

Other than with respect to the ITA matter, we do not currently hedge against the risks associated with currency fluctuations but may do so, or use other derivative instruments, in the future.

We may require additional capital to fund our business and support our growth, and any inability to generate or obtain such capital may adversely affect our operating results and financial condition.

2 unchanged sentences

If we raise additional funds through equity or convertible debt issuances, our existing stockholders may suffer significant dilution and these securities could have rights, preferences, and privileges that are superior to those of holders of our Class A common stock.

We expect that our existing cash, cash equivalents and investments will be sufficient to meet our anticipated cash needs for working capital and capital

expenditures for at least the next 12 months.

We expect that our existing cash, cash equivalents and investments will be sufficient to meet our anticipated cash needs for working capital and capital expenditures for at least the next 12 months.

If we obtain additional funds through debt financing, we may not be able to obtain such financing on terms favorable to us.

1 unchanged sentence

Such terms may involve restrictive covenants making it difficult to engage in capital raising activities and pursue business opportunities, including potential acquisitions.

The trading prices of technology companies have been highly volatile as a result of regional geopolitical conflicts around the world, inflation, interest rate volatility, from changes in U.S.

federal spending, changes in tariffs and trade restrictions, actual or perceived instability in the banking system, and market downturns, which may reduce our ability to access capital on favorable terms or at all.

In addition, a recession, depression, or other sustained adverse market event could adversely affect our business and the value of our Class A common stock.

The trading prices of technology companies have been highly volatile due to factors such as regional geopolitical conflicts, inflation, interest rate fluctuations, changes in U.S.

federal spending, significant political or regulatory developments, including changes in trade policy, actual or perceived instability in the banking system, and broader market downturns.

This volatility may reduce our ability to access capital on favorable terms or at all.

In addition, a recession, depression, or other sustained adverse market event could negatively affect our business and the value of our Class A common stock.

If we are unable to obtain adequate financing or financing on terms satisfactory to us when we require it, our ability to continue to support our business growth and to respond to business challenges could be significantly impaired and our business may be adversely affected, requiring us to delay, reduce, or eliminate some or all of our operations.

1 unchanged sentence

The market price of our Class A common stock may be volatile, and you could lose all or part of your investment.

Our Class A common stock price is likely to continue to be volatile and could be subject to wide fluctuations.

Our Class A common stock price could be subject to wide fluctuations.

The market price of our Class A common stock depends on a number of factors, including those described in this “Risk Factors” section, many of which are beyond our control and may not be related to our operating performance.

7 unchanged sentences

• the number of shares of our Class A common stock publicly owned and available for trading;

• repurchases by us of any of our outstanding shares of Class A common stock on unfavorable terms or at all;

• failure of industry or financial analysts to maintain coverage of us, changes in financial estimates by any analysts who follow our company, or our failure to meet these estimates or the expectations of investors;

4 unchanged sentences

• the global political, economic and macroeconomic climate, including but not limited to, the changes in U.S.

federal spending, changes in tariffs and trade restrictions, actual or perceived instability in the banking industry, labor shortages, supply chain disruptions, potential recession, inflation, and fluctuating interest rates;

federal spending, significant political or regulatory developments including changes in trade policy, actual or perceived instability in the banking industry, labor shortages, supply chain disruptions, potential recession, inflation, government shutdowns, and fluctuating interest rates;

• other events or factors, including those resulting from war, armed conflict, regional geopolitical conflicts around the world, incidents of terrorism or responses to these events;

• cybersecurity incidents.

In addition, the stock market in general, and the market for technology companies in particular, has experienced extreme price and volume fluctuations that have often been unrelated or disproportionate to the operating performance of those companies, particularly during the current period of global macroeconomic uncertainty, including inflation, fluctuating interest rates, changes in tariffs and trade restrictions, labor shortages and fluctuations in international currency rates, as well as the impacts of regional geopolitical conflicts around the world.

In addition, the stock market in general, and the market for technology companies in particular, has experienced extreme price and volume fluctuations that have often been unrelated or disproportionate to the operating performance of those companies, particularly during the current period of global macroeconomic uncertainty, including inflation, fluctuating interest rates, significant political or regulatory developments including changes in trade policy, labor shortages and fluctuations in international currency rates, as well as the impacts of regional geopolitical conflicts around the world.

These economic, political, regulatory and market conditions have and may continue to negatively impact the market price of our Class A common stock, regardless of our actual operating performance.

8 unchanged sentences

Any such issuance could result in substantial dilution to our existing stockholders and cause the market price of our Class A common stock to decline.

The dual class structure of our common stock has the effect of concentrating voting control with the holders of our Class B common stock who held, in the aggregate, approximately 48% of the voting power of our capital stock as of January 31, 2025, which will limit or preclude your ability to influence corporate matters, including the election of directors and the approval of any change of control transaction.

The dual class structure of our common stock has had the effect of concentrating voting control with the holders of our Class B common stock who held, in the aggregate, approximately 28% of the voting power of our capital stock as of January 31, 2026, which makes it more difficult for you to influence corporate matters, including the election of directors and the approval of any change of control transaction.

Our Class B common stock has 20 votes per share, and our Class A common stock has one vote per share.

As of January 31, 2026, the holders of our outstanding Class B common stock held approximately 28% of the voting power of our outstanding capital stock.

Because of the twenty-to-one voting ratio between our Class B and Class A common stock, the holders of our Class B common stock collectively are expected to continue to control a majority of the combined voting power of our common stock and therefore will be able to control all matters submitted to our stockholders for approval until the earlier of (i) the date specified by a vote of the holders of 66 2/3% of the then outstanding shares of Class B common stock, (ii) seven years from the date of our prospectus filed with the SEC pursuant to Rule 424(b)(4) under the Securities Act (the Final Prospectus), or June 29, 2028, (iii) the first date following the completion of our IPO on which the number of shares of outstanding Class B common stock (including shares of Class B common stock subject to outstanding stock options) held by Tomer Weingarten, including certain permitted entities that Mr.

The outstanding Class B common stock automatically converts to Class A

common stock on the earlier of (i) the date specified by a vote of the holders of 66 2/3% of the then outstanding shares of Class B common stock, (ii) seven years from the date of our prospectus filed with the SEC pursuant to Rule 424(b)(4) under the Securities Act (the Final Prospectus), or June 29, 2028, (iii) the first date following the completion of our IPO on which the number of shares of outstanding Class B common stock (including shares of Class B common stock subject to outstanding stock options) held by Tomer Weingarten, including certain permitted entities that Mr.

Weingarten controls, is less than 25% of the number of shares of outstanding Class B common stock (including shares of Class B common stock subject to outstanding stock options) that Mr.

1 unchanged sentence

Weingarten is no longer providing services to us as an officer, employee, consultant or member of our board of directors, (v) the date fixed by our board of directors following the date on which, if applicable, Mr.

Weingarten is terminated for cause, as defined in our restated certificate of incorporation, and (vi) the date that is 12 months after the death or disability, as defined in

our restated certificate of incorporation, of Mr.

This concentrated control will limit or preclude your ability to influence corporate matters for the foreseeable future, including the election of directors, amendments of our organizational documents, and any merger, consolidation, sale of all or substantially all of our assets, or other major corporate transaction requiring stockholder approval.

Weingarten is terminated for cause, as defined in our restated certificate of incorporation, and (vi) the date that is 12 months after the death or disability, as defined in our restated certificate of incorporation, of Mr.

The dual class structure of our common stock will make it difficult for you to influence corporate matters, including the election of directors, amendments of our organizational documents, and any merger, consolidation, sale of all or substantially all of our assets, or other major corporate transaction requiring stockholder approval.

In addition, this may prevent or discourage unsolicited acquisition proposals or offers for our capital stock that you may feel are in your best interest as one of our stockholders.

Future transfers by holders of our Class B common stock will generally result in those shares converting to Class A common stock, subject to limited exceptions, such as certain transfers effected for estate planning purposes.

The conversion of Class B common stock to Class A common stock will have the effect, over time, of increasing the relative voting power of those holders of our Class B common stock who retain their shares in the long term.

The conversion of Class B common stock to Class A common stock has had the effect, over time, of increasing the relative voting power of those holders of our Class B common stock who retain their shares in the long term.

The dual class structure of our common stock may adversely affect the trading market for our Class A common stock.

12 unchanged sentences

We maintain an office in Tel Aviv, Israel and had approximately 11% of our personnel in Israel as of January 31, 2026.

We are closely monitoring the unfolding events of the armed conflict in Israel.

We are closely monitoring continued armed conflict in Israel.

While this conflict is still evolving, to date, the conflict has not had an adverse impact on our business results of operations and we have implemented continuity measures to address the safety of our employees and continue our operations in the event of reduced employee availability in the conflict region.

6 unchanged sentences

Additionally, all the aforementioned risks will be further increased if we do not implement an effective disaster recovery plan or if our partners’ disaster recovery plans prove to be inadequate.

Investors’ expectations of our performance relating to environmental, social and governance factors may impose additional costs and expose us to new risks.

There is an increasing focus from certain regulators, investors, employees, users and other stakeholders concerning corporate responsibility, specifically related to ESG matters both in the U.S.

Investors’ expectations of our performance relating to corporate sustainability may impose additional costs and expose us to new risks.

There is an increasing focus from certain regulators, investors, employees, users and other stakeholders concerning corporate sustainability both in the U.S.

and internationally.

Some investors may use these non-financial performance factors to guide their investment strategies and, in some cases, may choose not to invest in us if they believe our policies and actions relating to corporate responsibility are inadequate.

We may face reputational damage in the event that we do not meet the ESG standards set by various constituencies.

Further, ESG initiatives, goals or commitments could be difficult to achieve or costly to implement.

If our competitors’ corporate social responsibility performance is perceived to be better than ours, potential or current investors may elect to invest with our competitors instead.

Moreover, California recently adopted two new climate-related bills, which require companies doing business in California that meet certain revenue thresholds to publicly disclose certain greenhouse gas emissions data and climate-related financial risk reports, and compliance with such requirements could require significant effort and resources.

Additionally, in March 2024, the SEC enacted comprehensive climate change disclosure rules, although the SEC has since issued an order to stay the rules pending the completion of judicial review of multiple petitions challenging the rules.

We may face reputational damage in the event that we do not meet the sustainability standards set by various constituencies.

Further, corporate sustainability initiatives, goals or commitments could be difficult to achieve or costly to implement.

If our competitors’ corporate social responsibility performance is perceived to be better than ours, potential or current investors may elect to invest in our competitors instead.

Moreover, California has adopted two new climate-related bills, which require companies doing business in California that meet certain revenue thresholds to publicly disclose certain greenhouse gas emissions data and climate-related financial risk reports, and compliance with such requirements could require significant effort and resources.

Our business may face increased scrutiny related to these activities and our related disclosures, including from the investment community, and our failure to achieve progress or manage the dynamic public sentiment and legal landscape in these areas on a timely basis, or at all, could adversely affect our reputation, business, and financial performance.

If industry or financial analysts do not publish research or reports about our business, or if they issue inaccurate or unfavorable research regarding our Class A common stock, our stock price and trading volume could decline.

The trading market for our Class A common stock may be influenced by the research and reports that industry or financial analysts publish about us, our business, our market and our competitors.

1 unchanged sentence

If any of the analysts who cover us issues an inaccurate or unfavorable opinion regarding our stock price, our stock price could potentially decline.

If our financial results fail to meet, or significantly exceed, our announced guidance or the expectations of analysts or public investors, analysts could downgrade our Class A common stock or publish unfavorable research about us.

If one or more of these analysts cease coverage of our Class A common stock or fail to publish reports on us regularly, our visibility in the financial markets could decrease, which in turn could impact our stock price or trading volume.

If our financial results fail to meet, or exceed, our announced guidance or the expectations of analysts or public investors, analysts could downgrade our Class A common stock or publish unfavorable research about us.

We are currently subject to and can in the future be subject to securities class action litigation.

6 unchanged sentences

We have never declared or paid any cash dividends on our capital stock.

We currently intend to retain all available funds and any future earnings for use in the operation of our business and do not anticipate paying any dividends in the foreseeable future.

We currently intend to retain all available funds and any future earnings for use in the operation of our business and other corporate purposes, which may include share repurchases, and do not anticipate paying any dividends in the foreseeable future.

Any determination to pay dividends in the future will be at the discretion of our board of directors.

33 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors