The nature of the business activities conducted by the Company subjects it to certain hazards and risks.
−Removed: A description of some of the material risks relating to the Company’s business activities is set forth below.
−Removed: Other risks are described in Part I, Item 1.
+Added: A description of some of the material risk factors that make an investment in the Company speculative or risky is set forth below.
+Added: Such description reflects the Company's beliefs and opinions as to factors that could materially harm the Company's business, financial condition, or results of operations and impair the Company's ability to implement business plans.
+Added: References to past events are provided by way of example only and are not intended to be a complete listing or a representation as to whether or not such factors have occurred in the past or their likelihood of occurring in the future.
+Added: In addition, other risks are described in Part I, Item 1.
“Business—Competition,” Part II, Item 7.
“Management’s Discussion and Analysis of Financial Condition and Results of Operations.—Liquidity and Capital Resources” and Part II, Item 7A.
−Removed: “Quantitative and Qualitative Disclosures About Market Risk.” These risks are not the only risks facing the Company.
+Added: “Quantitative and Qualitative Disclosures About Market Risk.” These risks and those described below are not the only risks facing the Company.
The Company’s business could also be affected by additional risks and uncertainties not currently known to the Company or that it currently deems to be immaterial.
−Removed: If any of these risks actually occurs, it could materially harm the Company’s business, financial condition or results of operations and impair the Company’s ability to implement business plans.
−Removed: In that case, the market price of the Company’s common stock could decline.
Risks Related to Our Business and Industry
1 unchanged sentence
We have experienced rapid growth in recent years.
−Removed: Our revenue grew from $365.3 million to $793.9 million from the fiscal year ended December 31, 2020 to the fiscal year ended January 31, 2025 .
−Removed: Our revenue growth may not continue at a level consistent with historical performance.
+Added: Our revenue grew from $699.6 million to $1.1 billion from the fiscal year ended January 31, 2024 to the fiscal year ended January 31, 2026 .
+Added: Our revenue growth may not continue at a level
+Added: consistent with historical performance.
We believe our revenue growth depends on a number of factors, including, but not limited to:
7 unchanged sentences
To continue to grow our business, it is important that we continue to acquire new customers to purchase and use our solutions.
−Removed: Our success in adding new customers depends on numerous factors, including our ability to (i) offer a compelling identity security platform and solutions, (ii) execute an effective sales and marketing strategy, (iii) attract, effectively train, and
−Removed: retain new sales, marketing, professional services, and support personnel in the markets we pursue, (iv) develop or expand relationships with channel partners, including system integrators, value-added resellers, technology partners, and MSPs, (v) expand into new geographies and vertical markets, (vi) deploy our platform and solutions for new customers, and (vii) provide quality customer support once deployed.
+Added: Our success in adding new customers depends on numerous factors, including our ability to (i) offer a compelling identity security platform and solutions, (ii) execute an effective sales and marketing strategy, (iii) attract, effectively train, and retain new sales, marketing, professional services, and support personnel in the markets we pursue, (iv) develop or expand relationships with channel partners, including system integrators, value-added resellers, technology partners, and MSPs, (v) expand into new geographies and vertical markets, (vi) deploy our platform and solutions for new customers, and (vii) provide quality customer support once deployed.
It is important to our continued growth that our customers renew their arrangements when existing contract terms expire.
14 unchanged sentences
The market for identity security solutions, including our platform and identity security solutions, is rapidly evolving.
+Added: Rapid advancement in AI technologies and capabilities further add to this state of evolution.
As such, it is difficult to predict this market’s potential growth, if any, customer adoption and retention rates, customer demand for identity security platforms, or the success of competitive products.
5 unchanged sentences
Our channel partners provide implementation and other services to our customers in exchange for fees paid by those customers.
−Removed: We may not achieve anticipated revenue growth from
−Removed: our channel partners if we are unable to retain our existing channel partners and expand their sales or add additional motivated channel partners.
+Added: We may not achieve anticipated revenue growth from our channel partners if we are unable to retain our existing channel partners and expand their sales or add additional motivated channel partners.
Our arrangements with our channel partners are generally non-exclusive, meaning they may offer customers the products of several different companies, including products that compete with our solutions and products.
21 unchanged sentences
• changes in the legislative or regulatory environment;
−Removed: • foreign exchange gains and losses related to expenses and sales denominated in currencies other than the U.S.
+Added: • foreign exchange gains and losses related to expenses and sales (including operating metrics such as ARR) denominated in currencies other than the U.S.
dollar or the functional currencies of our subsidiaries;
26 unchanged sentences
Consequently, a decline in new subscription sales or renewals in any one period may not be immediately reflected in our revenue results for that period.
−Removed: This decline, however, will negatively affect our revenue in
−Removed: future periods.
+Added: This decline, however, will negatively affect our revenue in future periods.
Accordingly, the effect of significant downturns in sales and market acceptance of our solutions and potential changes in our rate of renewals may not be fully reflected in our operating results until future periods.
7 unchanged sentences
These factors make it challenging to forecast our revenue as the mix of solutions and services, as well as the size of contracts, are difficult to predict.
−Removed: We face intense competition in our market, both from larger, well-established companies and from emerging companies, and we may lack sufficient financial and other resources to maintain and improve our competitive position.
+Added: We face intense competition in our market, both from larger, well-established companies and from emerging companies and technologies, and we may lack sufficient financial and other resources to maintain and improve our competitive position.
The market for identity security solutions is intensely competitive and is characterized by constant change and innovation.
−Removed: We face competition from large, well-known enterprise software vendors that offer identity solutions within their product portfolios, pure play identity vendors (including new market entrants), and vendors with whom we have not traditionally competed but who may either introduce new products or incorporate features into existing products that compete with our solutions.
−Removed: For example, our competitors include large public companies, such as IBM, Microsoft, and Oracle that offer identity solutions within their product portfolios, and identity centric solution providers, including CyberArk, Okta, and One Identity.
+Added: We face competition from large, well-known enterprise software vendors that offer identity solutions within their product portfolios, pure play identity vendors (including new market entrants), vendors with whom we have not traditionally competed but who may either introduce new products or incorporate features into existing products that compete with our solutions, and various offerings utilizing AI and agentic AI.
+Added: For example, our competitors include large public companies, such as IBM, Microsoft, and Oracle that offer identity solutions within their product portfolios, and identity centric solution providers, including Palo Alto Networks (CyberArk), Okta, and One Identity.
Many of our competitors are larger, have greater resources and existing customer relationships, and may be able to compete and respond more effectively than we can to new or changing opportunities, technologies, standards, or customer requirements.
6 unchanged sentences
In addition, continued industry consolidation may adversely impact customers’ perceptions of the viability of small and medium-sized technology companies and consequently their willingness to purchase from those companies.
−Removed: New start-up companies that innovate and competitors that are making significant investments in research and development may invent similar or superior products and technologies that compete with our solutions, and our business could be materially and adversely affected if such technologies or products are widely adopted.
+Added: New start-up companies that innovate and competitors that are making significant investments in research and development may invent similar or superior products and technologies that compete with our solutions, including technologies that heavily utilize AI and agentic AI, and our business could be materially and adversely affected if such technologies or products are widely adopted.
Conditions in our market could change rapidly and significantly as a result of technological advancements, partnering by our competitors, or continuing market consolidation.
+Added: The development process for competitive offerings that leverage AI and agentic AI technologies in particular may be more condensed than ours, accelerating the time that it takes for such offerings to become available in the market to compete with existing offerings.
These competitive pressures in our market or our failure to compete effectively may result in price reductions, fewer orders, reduced revenue, and gross margins, increased net losses, and loss of market share.
2 unchanged sentences
Our business has experienced significant growth and is becoming increasingly complex.
−Removed: We increased the number of our employees from 1,394 at December 31, 2020 to 2,738 at January 31, 2025 and the number of countries in which we have employees from 18 at December 31, 2020 to 22 at January 31, 2025.
−Removed: We have also experienced growth in the number of our customers from over 1,700 at December 31, 2020 to approximately 2,975 at January 31, 2025 and the number of countries in which we have customers from over 50 at December 31, 2020 to over 60 at January 31, 2025.
+Added: We increased the number of our employees from 2,379 at January 31, 2024 to 3,229 at January 31, 2026 and the number of countries in which we have employees from 22 at January 31, 2024 to 24 at January 31, 2026.
+Added: We have also experienced growth in the number of our customers from over 2,760 at January 31, 2024 to approximately 3,235 at January 31, 2026.
We expect this growth to continue and for our operations to become increasingly complex.
15 unchanged sentences
The Sarbanes-Oxley Act requires, among other things, that we maintain effective disclosure controls and procedures and internal control over financial reporting.
−Removed: In order to maintain and improve the effectiveness of our disclosure controls and procedures and internal control over financial reporting, we have expended, and anticipate that we will continue to expend, significant resources, including accounting-related costs and significant management oversight.
+Added: In order to maintain and improve the effectiveness of our disclosure controls and procedures and internal control over financial reporting, we have expended, and anticipate that we will continue to expend, significant resources, including accounting- and technology-related costs and significant management oversight.
Our internal resources and personnel may in the future be insufficient to avoid accounting errors, and there can be no assurance that we will not have material weaknesses in the future.
3 unchanged sentences
In addition, if we are unable to continue to meet these requirements, we may not be able to remain listed on Nasdaq.
−Removed: We are not currently required to comply with the SEC rules that implement Section 404 of the Sarbanes-Oxley Act and are therefore not required to make a formal assessment of the effectiveness of our internal control over financial reporting for that purpose.
−Removed: We will be required to provide an annual management report on the effectiveness of our internal control over financial reporting commencing with our second annual report on Form 10-K.
−Removed: This assessment will need to include disclosure of any material weaknesses identified by our management in our internal control
−Removed: over financial reporting.
−Removed: Our independent registered public accounting firm will not be required to report on the effectiveness of our internal control over financial reporting pursuant to Section 404 of the Sarbanes-Oxley Act until our second annual report required to be filed with the SEC.
−Removed: At such time, our independent registered public accounting firm may issue a report that is adverse in the event it is not satisfied with the level at which our controls are documented, designed, or operating.
Any failure to maintain effective disclosure controls and internal control over financial reporting could have an adverse effect on our business and operating results and could cause a decline in the price of our common stock.
1 unchanged sentence
We believe that maintaining and enhancing our reputation as a leader and innovator in the market for identity security solutions is critical to our relationship with our existing customers and our ability to attract new customers.
−Removed: The successful promotion of our brand attributes will depend on a number of factors, including our marketing efforts, our ability to continue to develop high-quality solutions, and our ability to successfully differentiate our platform and solutions from competitive products and services.
+Added: The successful promotion of our brand attributes will depend on a number of factors, including our marketing efforts, our ability to continue to develop high-quality solutions, and our ability to successfully differentiate our platform and solutions from competitive products and services across a rapidly evolving market landscape, including changing buyer preferences, new technologies, and shifting channels through which customers discover and evaluate solutions.
+Added: As our platform, product portfolio, and target markets continue to expand, we may face increased challenges in maintaining clear, consistent, and effective messaging regarding our value proposition, differentiation, and brand positioning.
Our brand promotion activities may not be successful or yield increased revenue.
−Removed: In addition, independent industry analysts often provide reports of our solutions, as well as those of our competitors, and perception of our solutions in the marketplace may be significantly influenced by these reports.
+Added: Changes in digital marketing ecosystems, search engine algorithms, social media platforms, and AI-driven discovery tools or answer engines may also reduce the visibility, reach, or effectiveness of our content and brand messaging, which could adversely affect our ability to generate awareness, demand, and customer trust.
+Added: In addition, independent industry analysts often provide reports on our solutions, as well as those of our competitors, and perception of our solutions in the marketplace may be significantly influenced by these reports.
If these reports are negative, or less positive as compared to those of our competitors, our reputation may be adversely affected.
+Added: Our reputation may also be harmed by negative publicity, unfavorable social media commentary, misinformation, or other third-party statements, whether or not accurate, which can spread rapidly and be difficult to counteract.
Additionally, the performance of our channel partners may affect our brand and reputation if customers do not have a positive experience with our solutions as implemented by our channel partners or with the implementation generally.
4 unchanged sentences
We target our sales to enterprise customers and large organizations, which involves risks that may not be present or that are present to a lesser extent with sales to smaller customers, including the commercial customer segment.
−Removed: These risks include longer sales cycles and negotiations, more complex customer requirements (including audit and other requirements driven by such customers’ regulatory and industry contexts), substantial upfront sales costs, and less predictability in completing some of our sales.
+Added: These risks include longer sales cycles and negotiations, more complex customer requirements (including audit and other requirements driven by such customers’ regulatory and industry contexts), substantial upfront sales costs, and less predictability in
+Added: completing some of our sales.
For example, enterprise customers may require considerable time to evaluate and test our platform and solutions and those of our competitors prior to making a purchase decision and placing an order or may need specialized security features to meet regulatory requirements.
8 unchanged sentences
Because our long-term success depends, in part, on our ability to expand the sales and marketing of our solutions to customers located outside of the United States, and we perform a significant portion of our development outside of the United States, our business will be susceptible to risks associated with international operations.
−Removed: At January 31, 2025, we had customers in over 60 countries and employees in over 20 countries, and we intend to continue expanding our international sales and marketing operations.
+Added: At January 31, 2026, we had customers in over 65 countries and employees in 24 countries, and we intend to continue expanding our international sales and marketing operations.
Conducting international operations subjects us to risks that we do not generally face in the United States.
3 unchanged sentences
• heightened risks of unethical, unfair, or corrupt business practices, actual or claimed, in certain geographies and of improper or fraudulent sales arrangements that may impact financial results and result in restatements of, and irregularities in, financial statements;
−Removed: • global and domestic political instability, economic sanctions, terrorist activities, or international conflicts, including the conflict in Israel and the surrounding area and the ongoing conflict between Russia and Ukraine, which have in the past and may in the future impact the operations of our business or the businesses of our customers;
+Added: • global and domestic political instability, economic sanctions, terrorist activities, or international conflicts, including the conflicts in the Middle East (e.g., in Iran, Israel, and the surrounding areas) and between Russia and Ukraine, for example, which have in the past and may in the future impact the operations of our business or the businesses of our customers;
• currency fluctuations;
13 unchanged sentences
Additionally, operating in international markets requires significant management attention and financial resources.
−Removed: cannot be certain that the investment and additional resources required to operate in other countries will produce desired levels of revenue or net income.
+Added: We cannot be certain that the investment and additional resources required to operate in other countries will produce desired levels of revenue or net income.
Unfavorable conditions in our industry or the global economy, including those caused by the ongoing conflicts around the world, or reductions in technology spending, could limit our ability to grow our business and negatively affect our results of operations.
Global business activities face widespread macroeconomic uncertainties, and our results of operations may vary based on the impact of changes in our industry or the global economy on us or our customers and potential customers.
−Removed: Negative conditions in the general economy in the United States, Europe, or Asia and in the global economy, including conditions resulting from changes in gross domestic product growth, financial and credit market fluctuations, inflation and efforts to control further inflation, rising interest rates, bank failures, international trade relations, political turmoil (such as the conflict in Israel and the surrounding area and the ongoing conflict between Russia and Ukraine), potential U.S.
+Added: Negative conditions in the general economy in the United States, Europe, or Asia and in the global economy, including conditions resulting from changes in gross domestic product growth, financial and credit market fluctuations, inflation and efforts to control further inflation, rising interest rates, bank failures, international trade relations, political turmoil (such as the conflicts in the Middle East (e.g., in Iran, Israel, and the surrounding areas) and between Russia and Ukraine, for example), potential U.S.
federal government shutdowns, natural catastrophes, warfare, and terrorist attacks could cause a decrease in business investments by existing or potential customers, including spending on technology, and negatively affect the growth of our business.
8 unchanged sentences
If the global effect of the ongoing conflict in Israel and the surrounding area or the ongoing conflict between Russia and Ukraine escalates or expands, our ability to conduct business in these regions could be adversely impacted, potentially resulting in delays to product development, sales and marketing, and other key business functions.
−Removed: Additionally, in light of reports of an increase in Russian cyber attacks in connection with the current conflict, we may face a heightened risk of state-sponsored cyber attacks in the near term.
+Added: Additionally, as a result of geopolitical conflicts, including in Russia and Iran, we may face a heightened risk of state-sponsored cyber attacks in the near term.
Our competitors, many of whom are larger and have greater financial resources than we do, may respond to challenging market conditions by lowering prices in an attempt to attract our customers, which may require us to respond in kind and may negatively impact our existing customer relationships and new customer acquisition strategy.
64 unchanged sentences
We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as provided in Part II, Item 7, “Management’s Discussion and Analysis of Financial Condition and Results of Operations.” The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities, and equity and the amount of revenue and expenses that are not readily apparent from other sources.
−Removed: Significant assumptions and estimates used in preparing our consolidated financial statements include those related to the fair value allocation of multiple performance obligations in revenue recognition, the expected period of benefit of contract acquisition costs, the assumptions underlying the fair value used for equity-based compensation expense and estimated useful lives, and impairment of intangible assets and goodwill arising from business combinations.
+Added: Significant assumptions and estimates used in preparing our consolidated financial statements include those related to the fair value allocation of multiple performance obligations in revenue recognition, the expected period of benefit of contract acquisition costs, the assumptions underlying the fair value used for equity-based compensation expense for awards prior to our IPO, and estimated useful lives and impairment of intangible assets and goodwill arising from business combinations and the assumptions underlying the fair value used for the redemption value of the redeemable convertible units issued prior to our IPO.
Our operating results may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our operating results to fall below the expectations of securities analysts and investors, resulting in a decline in the trading price of our common stock.
3 unchanged sentences
GAAP is subject to interpretation by the Financial Accounting Standards Board (“FASB”), the SEC, and various bodies formed to promulgate and interpret appropriate accounting principles.
−Removed: A change in these principles or interpretations could have a significant effect on our reported financial results and could affect the reporting of transactions completed before the announcement of a change.
+Added: A change in these principles or interpretations
+Added: could have a significant effect on our reported financial results and could affect the reporting of transactions completed before the announcement of a change.
Adoption of such new standards and any difficulties in implementation of changes in accounting principles, including the ability to modify our accounting systems, could cause us to fail to meet our financial reporting obligations, which could result in regulatory discipline and harm investors’ confidence in us.
12 unchanged sentences
the German Federal Financial Supervisory Authority (BaFin) Minimum Requirements for Risk Management;
−Removed: and the Monetary Authority of Singapore’s Technology Risk Management
+Added: and the Monetary Authority of Singapore’s Technology Risk Management Notices.
These industry standards may change with little or no notice, including changes that could make them more or less onerous for businesses.
9 unchanged sentences
The loss of one or more members of our senior management team, particularly if closely grouped, could adversely affect our ability to execute our business plan and thus, our business, operating results, and prospects.
−Removed: We do not maintain key man insurance on any of our officers or key employees, and we may not be able to find adequate replacements.
+Added: We do not maintain key person insurance on any of our officers or key employees, and we may not be able to find adequate replacements.
Competition for well-qualified employees in all aspects of our business, including sales, professional services, and software engineering, is intense.
1 unchanged sentence
We may need to invest significant amounts of cash and equity to attract and retain new employees, and we may never realize returns on these investments.
−Removed: Additionally, many of our employees may be able to receive significant proceeds from sales of our common stock in the public markets following the expiration of applicable lock-up periods, which may reduce their motivation to continue to work for us.
We believe that our corporate culture has been and will continue to be a key contributor to our success.
2 unchanged sentences
We are exposed to fluctuations in currency exchange rates, which could negatively affect our results of operations.
−Removed: Our platform and solutions are billed in multiple currencies, and therefore, a portion of our revenue is subject to foreign currency risk.
+Added: Our platform and solutions are billed in multiple currencies, and therefore, a portion of our revenue (and, consequently, ARR) is subject to foreign currency risk.
A strengthening of the U.S.
4 unchanged sentences
Our business could be disrupted by catastrophic events.
−Removed: Occurrence of any catastrophic event, including earthquake, fire, flood, tsunami, or other weather event, power loss, telecommunications failure, software or commodity appliance malfunction, cyber attack, war, terrorist attack, explosion, or pandemic could impact our business.
+Added: Occurrence of any catastrophic event, including earthquake, fire, flood, tsunami, or other weather event, power loss, telecommunications failure, software or commodity appliance malfunction, cyber attack, war, military action, terrorist attack, explosion, or pandemic could impact our business.
Our insurance coverage may not compensate us for losses that may occur in the event of a significant natural disaster.
1 unchanged sentence
In the event of a catastrophic event, we may be unable to continue our operations and may endure system interruptions, reputational harm, delays in our product development, lengthy interruptions in our identity security solutions, and breaches of data security, all of which could have an adverse effect on our results of operations.
−Removed: If we are unable to develop adequate plans to ensure that our
−Removed: business functions continue to operate during and after a disaster and to execute successfully on those plans in the event of a disaster or emergency, our business would be harmed.
+Added: If we are unable to develop adequate plans to ensure that our business functions continue to operate during and after a disaster and to execute successfully on those plans in the event of a disaster or emergency, our business would be harmed.
Risks Related to Our Technology and Our Intellectual Property Rights
9 unchanged sentences
Additionally, if any of our employees, contractors, consultants, vendors, or service providers use any third-party AI-powered tools or solutions in connection with our business or the services they provide to us, it may lead to the inadvertent disclosure or incorporation of our confidential information into publicly available training sets, which may impact our ability to realize the benefit of, or adequately maintain, protect, and enforce our intellectual property or confidential information, harming our competitive position and business.
−Removed: Our ability to mitigate risks associated with disclosure of our confidential information, including in connection with AI systems, will depend on our implementation, maintenance, monitoring, and enforcement of appropriate technical and administrative safeguards, policies, and procedures governing the use of AI in our business.
+Added: Our ability to mitigate risks associated with disclosure of our confidential information, including in
+Added: connection with AI systems, will depend on our implementation, maintenance, monitoring, and enforcement of appropriate technical and administrative safeguards, policies, and procedures governing the use of AI in our business.
Additionally, any output created by us using AI tools may not be subject to copyright protection, which may adversely affect our intellectual property rights in, or ability to commercialize or use, any such content.
20 unchanged sentences
If we are unable to generate an adequate return on such investments, we may not be able to compete effectively, and our business and results of operations may be adversely affected.
−Removed: Cyber attacks or other cybersecurity breaches, incidents, or disruptions with respect to our networks, systems, or applications, including unauthorized access to, or disclosure or other processing of, our proprietary, confidential, or sensitive information, including personal information, could disrupt our operations, compromise sensitive information related to our business or personal information processed by us or on our behalf, and expose us to liability, which could harm our reputation and adversely affect our business, financial condition, and results of operations, and as we grow, we may become a more attractive target for cyber attacks.
+Added: Cyber attacks or other cybersecurity breaches, incidents, or disruptions with respect to our networks, systems, or applications, including unauthorized access to, or disclosure or other processing of, our proprietary, confidential, or sensitive information, including personal information, could disrupt our operations, compromise sensitive information related to our business or personal information processed by us or on our behalf, and expose us to liability, which could
+Added: harm our reputation and adversely affect our business, financial condition, and results of operations, and as we grow, we may become a more attractive target for cyber attacks.
Our solutions analyze and otherwise process proprietary and confidential information, including personal information.
3 unchanged sentences
We face threats from a variety of sources, including sophisticated nation-state and nation-state supported actors, cyber criminals, terrorists, and politically motivated groups or individuals that pose risks to our internal networks, our platform, our third-party service providers, and our customers’ systems and the proprietary, confidential, or sensitive information, including personal information processed by us or on our behalf.
+Added: We may face a heightened risk of state-sponsored cyber attacks in the near term as a result of geopolitical conflicts, including in Russia and Iran.
The nature of the attacks perpetrated against us may include theft of sensitive information, exploitation of our solutions as part of a supply chain attack against our customers, manipulation of data, ransomware, or others.
14 unchanged sentences
Additionally, while our insurance policies include liability coverage for certain breaches, subject to retention amounts that could be substantial, we cannot be sure that our insurance coverage will be sufficient to protect us from liabilities, damages, or claims related to any such breaches, that such coverage will continue to be available on commercially reasonable terms or at all or that such coverage will pay future claims.
−Removed: The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or larger deductibles, could adversely affect our business, financial condition, and results of operations.
+Added: The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or larger deductibles, could adversely affect our
+Added: business, financial condition, and results of operations.
Moreover, failure to maintain effective internal accounting controls related to identity security breaches and cybersecurity in general could impact our ability to produce timely and accurate financial statements and could subject us to regulatory scrutiny and/or government enforcement actions.
10 unchanged sentences
Furthermore, any such incident, including a breach of our customers’ systems, could compromise our networks or networks secured by our solutions, creating system disruptions or slowdowns and exploiting security vulnerabilities of our or our customers’ networks, and the information stored on our or our customers’ systems could be accessed or disclosed without authorization, altered, lost, or stolen, which could subject us to liability and cause us financial harm.
−Removed: An actual or perceived breach of our networks, our customers’ networks, those of our third-party service providers or other networks secured by our
−Removed: solutions, whether or not due to a vulnerability in our platform, may also undermine confidence in our platform or our industry and result in expenditure of significant resources in efforts to analyze, correct, eliminate, or work around errors or defects, delayed or lost revenue, delay in the development or release of new solutions, an increase in collection cycles for accounts receivable, damage to our brand and reputation, negative publicity, loss of channel partners, customers and sales, increased costs to remedy any problem, increased insurance expense, and costly litigation.
+Added: An actual or perceived breach of our networks, our customers’ networks, those of our third-party service providers or other networks secured by our solutions, whether or not due to a vulnerability in our platform, may also undermine confidence in our platform or our industry and result in expenditure of significant resources in efforts to analyze, correct, eliminate, or work around errors or defects, delayed or lost revenue, delay in the development or release of new solutions, an increase in collection cycles for accounts receivable, damage to our brand and reputation, negative publicity, loss of channel partners, customers and sales, increased costs to remedy any problem, increased insurance expense, and costly litigation.
In addition, if a high-profile security incident occurs with respect to another identity security solution provider, our customers and potential customers may lose trust in the value of the identity security solution business model generally, including the security of our solutions, which could adversely impact our ability to retain existing customers or attract new ones, potentially causing a negative impact on our business.
8 unchanged sentences
Our related operations depend on protecting the virtual cloud infrastructure hosted in AWS by maintaining its configuration, architecture, features, and interconnection specifications, as well as the information stored in these virtual data centers and which third-party internet service providers transmit.
−Removed: Although we have disaster recovery plans that utilize multiple AWS locations, any incident affecting their infrastructure that may be caused by fire, flood, severe storm, earthquake, or other natural disasters, cyber attacks, terrorist, or other attacks, public health issues, or other similar events beyond our control could negatively affect our SaaS platform.
+Added: Although we have disaster recovery plans that utilize multiple AWS locations, any incident affecting their infrastructure that may be caused by fire, flood, severe storm, earthquake, or other natural disasters, cyber attacks, terrorist, or other attacks, military
+Added: actions, public health issues, or other similar events beyond our control have in the past, and could in the future, negatively affect our SaaS platform.
+Added: For example, in October 2025, we experienced limited disruptions to our SaaS platform due to a widespread AWS outage.
+Added: More recently, we experienced a limited disruption affecting our services hosted in the United Arab Emirates due to the conflict in the Middle East.
+Added: Neither situation has had a significant impact on our business.
A prolonged AWS service disruption affecting our SaaS platform for any of the foregoing or other reasons would negatively impact our ability to serve our customers and could damage our reputation with current and potential customers, expose us to liability, cause us to lose customers, or otherwise harm our business.
We may also incur significant costs for using alternative equipment or taking other actions in preparation for, or in reaction to, events that damage the AWS services we use, which would also likely require significant investments of time.
−Removed: In addition, AWS may terminate the agreement by providing 30 days’ prior written notice and may, in some cases, terminate the agreement immediately for cause upon notice.
+Added: In addition, AWS may terminate our agreement for cause by providing 30 days’ prior written notice.
In the event that our AWS service agreements are terminated, or there is a lapse of service, elimination of AWS services or features that we utilize, interruption of internet service provider connectivity, or damage to such facilities, we could experience interruptions in access to our platform as well as significant delays and additional expense in arranging or creating new facilities and services and/or re-architecting our SaaS solution for deployment on a different cloud infrastructure service provider, which may adversely affect our business, operating results, and financial condition.
8 unchanged sentences
If we fail to adapt and respond effectively to rapidly changing technology, evolving industry standards, changing regulations, and changing customer needs, requirements, or preferences, our platform and solutions may become less competitive.
−Removed: The market in which we compete is relatively new and subject to rapid technological change, evolving industry standards, and changing regulations, as well as changing customer needs, requirements, and preferences.
+Added: The market in which we compete is relatively new and subject to rapid technological change (including increasingly rapid advancement in AI technologies and capabilities), evolving industry standards, and changing regulations, as well as changing customer needs, requirements, and preferences.
The success of our business will depend, in part, on our ability to adapt and respond effectively to these changes on a timely basis.
23 unchanged sentences
We and certain of our third-party service providers have in the past experienced, and may in the future experience, performance issues due to a variety of factors, including infrastructure changes, human or software errors, website, or third-party hosting disruptions or capacity constraints due to a number of potential causes including technical failures, cyber attacks, security incidents, natural disasters, or fraud.
−Removed: We have also been the target of distributed denial of service attacks and other
−Removed: cybersecurity attacks that attempt to disrupt our services.
+Added: We have also been the target of distributed denial of service attacks and other cybersecurity attacks that attempt to disrupt our services.
If our or our third-party service providers’ products, solutions, or corporate security are compromised, our website, professional services, customer support, or SaaS solution is unavailable, or there are flaws in our ML and AI processes, our business could be negatively affected.
39 unchanged sentences
This exposes us to risks over which we may have little or no control.
−Removed: For example, the third-party software we currently license may not always be available, or available on commercially reasonable terms, and we may not have access to alternative third-party software in the event of any issues with such software.
+Added: For example, the third-party software we currently license may not always be available (including as a result of periodic government restrictions on use and licensing), or available on commercially reasonable terms, and we may not have access to alternative third-party software in the event of any issues with such software.
In addition, a third party may assert that we or our customers are in breach of the terms of applicable licenses, which could, among other things, force us to cease use of such software and give such third party the right to terminate the applicable license or seek damages from us, or both.
1 unchanged sentence
We also cannot be certain that activities such as intellectual property protection, maintenance, prosecution, and enforcement by our licensors have been or will be conducted consistent with our best interests or in compliance with applicable laws and regulations or will result in valid and enforceable intellectual property rights.
−Removed: It is possible that our licensors’ infringement proceedings or defense activities may be less vigorous than had we conducted them ourselves or may not be conducted in accordance with our best interests.
+Added: It is possible that our licensors’ infringement proceedings or defense activities may be
+Added: less vigorous than had we conducted them ourselves or may not be conducted in accordance with our best interests.
Furthermore, we cannot be certain that our licensors are not infringing, misappropriating, or otherwise violating the intellectual property rights of third parties or that our licensors have sufficient rights to the licensed intellectual property in all jurisdictions in which we may offer our solutions.
6 unchanged sentences
We strive to protect our intellectual property rights by relying on foreign, federal, state, and common law rights, as well as certain contractual restrictions.
−Removed: However, the steps we take to protect our intellectual property and proprietary rights, including physical, operational, and managerial protections of our confidential information, contractual obligations of confidentiality, assignment agreements with our employees and contractors, license agreements, the prosecution, defense,
−Removed: enforcement, protection, and maintenance of registrations and applications for registration of intellectual property rights, and the defense and enforcement of common law rights require significant resources and may be inadequate.
+Added: However, the steps we take to protect our intellectual property and proprietary rights, including physical, operational, and managerial protections of our confidential information, contractual obligations of confidentiality, assignment agreements with our employees and contractors, license agreements, the prosecution, defense, enforcement, protection, and maintenance of registrations and applications for registration of intellectual property rights, and the defense and enforcement of common law rights require significant resources and may be inadequate.
Effective trade secret, copyright, trademark, patent, and domain name protection is expensive to develop and maintain, both in terms of initial and ongoing registration requirements and expenses and the costs of defending and enforcing our rights.
9 unchanged sentences
Additionally, any such assignment of intellectual property rights may not be self-executing or the assignment agreements may be breached, and we may be forced to bring claims against third parties, or defend claims that they may bring against us, to determine the ownership of what we regard as our intellectual property.
−Removed: Further, although it is our policy to enter into confidentiality agreements with employees and third parties to protect our trade secrets and other proprietary rights, we cannot guarantee that we have entered into such agreements with each party that has or may have had access to our trade secrets, confidential information, software, or other proprietary technology and, even if entered into, these agreements may otherwise fail to effectively prevent disclosure of our proprietary or confidential rights, information, or technologies, may be limited as to their term, or may not provide an adequate remedy in the event of unauthorized disclosure, misappropriation, use, or other violation of our trade secrets, confidential information, and other proprietary rights or technologies.
+Added: Further, although it is our policy to enter into confidentiality agreements with employees and third parties to protect our trade secrets and other proprietary rights, we cannot guarantee that we have entered into such agreements with each party that has or may have had access to our trade secrets, confidential information, software, or other proprietary technology and, even if entered into, these agreements may otherwise fail to effectively prevent disclosure of our proprietary or confidential rights, information, or technologies, may be limited as to their term, or may not provide an adequate remedy in the event of
+Added: unauthorized disclosure, misappropriation, use, or other violation of our trade secrets, confidential information, and other proprietary rights or technologies.
We pursue the registration or protection of our domain names and trademarks in the United States and in certain jurisdictions abroad.
6 unchanged sentences
To the extent we increase our visibility in the market, we face a higher risk of being the subject of intellectual property claims.
−Removed: Additionally, despite our efforts to ensure that our employees, contractors, consultants, vendors, and service providers do not use the intellectual property and other proprietary information or know-how of third parties in their work for us, intellectual property, including copyrighted materials, trade secrets, software code, or other proprietary information, we have been and could in the
−Removed: future be subject to claims that we, our employees, or our contractors, consultants, vendors, and service providers have inadvertently or otherwise used or disclosed intellectual property, copyrighted materials, trade secrets, or other proprietary information of our competitors, former employers, or other parties.
+Added: Additionally, despite our efforts to ensure that our employees, contractors, consultants, vendors, and service providers do not use the intellectual property and other proprietary information or know-how of third parties in their work for us, intellectual property, including copyrighted materials, trade secrets, software code, or other proprietary information, we have been and could in the future be subject to claims that we, our employees, or our contractors, consultants, vendors, and service providers have inadvertently or otherwise used or disclosed intellectual property, copyrighted materials, trade secrets, or other proprietary information of our competitors, former employers, or other parties.
Litigation may be necessary to defend against these claims.
26 unchanged sentences
Open source software is generally freely accessible, usable, and modifiable.
−Removed: However, certain open source licenses may, in certain circumstances, require us to offer our solutions that incorporate the open source software for no cost, make available source
−Removed: code for modifications or derivative works we create based upon the open source software, incorporate or use the open source software, and/or license such modifications or derivative works under the terms of the particular open source license or otherwise unfavorable terms.
+Added: However, certain open source licenses may, in certain circumstances, require us to offer our solutions that incorporate the open source software for no cost, make available source code for modifications or derivative works we create based upon the open source software, incorporate or use the open source software, and/or license such modifications or derivative works under the terms of the particular open source license or otherwise unfavorable terms.
The terms of certain open source licenses to which we are subject have not been interpreted by U.S.
12 unchanged sentences
We may incur significant indebtedness, which could reduce our strategic flexibility and liquidity and may have other adverse effects on our results of operations.
−Removed: We are currently party to a credit agreement (the “Credit Agreement”) that provides for a senior secured term loan facility (the “Term Loan”) in an original aggregate principal amount of $1.59 billion and a senior secured revolving credit facility in an aggregate principal amount of $125.0 million (the “Revolving Credit Facility”).
−Removed: While as of March 27, 2025, we have fully repaid the Term Loan and have no outstanding borrowings or letters of credit under the Revolving Credit Facility, we have historically relied on the availability of debt financing and we may incur significant indebtedness in the future under the Revolving Credit Facility or otherwise.
+Added: We are currently party to a credit agreement (the “2025 Credit Agreement”) that provides for a five-year $250.0 million senior secured revolving credit facility, including a letter of credit sub-facility up to $10.0 million (the “2025 Revolving Credit Facility”).
+Added: While we have no outstanding borrowings or letters of credit under the 2025 Credit Agreement or 2025
+Added: Revolving Credit Facility, we have historically relied on the availability of debt financing and we may incur significant indebtedness in the future under the Revolving Credit Facility or otherwise.
We may also consider investments in joint ventures or acquisitions, which may increase our indebtedness.
33 unchanged sentences
A wide variety of domestic and foreign laws, rules and regulations, and contractual requirements apply to the use and processing of proprietary, confidential, and sensitive information, including personal information.
−Removed: These laws, rules, regulations, industry standards, contractual requirements, and other obligations are constantly evolving, and we expect that we will continue to become subject to new proposed laws, rules, regulations, industry standards, contractual requirements, and other obligations in the United States, the EU, the UK, and other jurisdictions.
+Added: These laws, rules, regulations, industry standards, contractual requirements, and other obligations are constantly evolving, and we will continue to become subject to new proposed laws, rules, regulations, industry standards, contractual requirements, and other obligations in the United States, Europe, and other jurisdictions.
For example, in the United States, there are numerous federal, state, and local privacy, data protection, and cybersecurity laws, rules, and regulations governing the use and processing of personal data.
At the federal level, we are subject to, among other laws, rules, and regulations, the rules and regulations promulgated under the authority of the Federal Trade Commission, which has the authority to regulate and enforce against unfair or deceptive acts or practices in or affecting commerce, including acts and practices with respect to privacy, data protection, and cybersecurity.
−Removed: Moreover, Congress has
−Removed: considered, and continues to consider, many proposals for comprehensive national data privacy and cybersecurity legislation.
+Added: Moreover, Congress has considered, and continues to consider, proposals for comprehensive national data privacy and cybersecurity legislation.
As another example, at the state level, we are subject to laws, rules, and regulations, such as the California Consumer Privacy Act (as amended by the California Privacy Rights Act (collectively, “CCPA”)), which, amongst other things, requires businesses to provide specific disclosures in privacy notices, implement new operational practices, honor requests from California residents to exercise certain privacy rights (such as the right to access and request deletion of their personal information and to opt out of certain sharing and sales of personal information) and provides for civil penalties of up to $7,998 per violation, as well as a private right of action for certain data breaches that may increase the likelihood of and risks associated with data breach litigation.
−Removed: Many other states have also enacted, or are in the process of enacting, comprehensive privacy, data protection, and cybersecurity laws, rules, and regulations that share similarities with the CCPA, which creates the potential for a patchwork of overlapping but different state laws.
+Added: Many other states have also enacted, or are in the process of enacting, comprehensive privacy, data protection, and cybersecurity laws, rules, and regulations many of which share similarities with the CCPA, creating a patchwork of overlapping but different state laws.
In addition, all 50 states have laws that require the provision of notification for security breaches of personal information to affected individuals, state officers, or others.
5 unchanged sentences
Failure to comply with the GDPR and the UK GDPR can result in significant fines and other liability, including fines of up to EUR 20 million (or GBP 17.5 million under the UK GDPR) or four percent of global revenue, whichever is greater.
−Removed: European data protection authorities have shown a willingness to impose significant fines and issue orders preventing the processing of personal data on non-compliant businesses and have already imposed fines for GDPR violations up to, in some cases, hundreds of millions of Euros.
−Removed: While the UK GDPR currently imposes substantially the same obligations as the GDPR, the UK GDPR will not automatically incorporate changes to the GDPR going forward (which would need to be specifically incorporated by the UK government).
−Removed: Moreover, the UK government has publicly announced plans to reform the UK GDPR in ways that, if formalized, are likely to deviate from the GDPR, all of which creates a risk of divergent parallel regimes and related uncertainty, along with the potential for increased compliance costs and risks for affected businesses.
−Removed: Legal developments in the European Economic Area (“EEA”) and the UK, including rulings from the Court of Justice of the European Union (“CJEU”), have also created complexity and uncertainty regarding processing and transfers of personal data from the EEA and the UK to the United States and other so-called third countries outside the EEA and the UK that have not been determined by the relevant data protection authorities to provide an adequate level of protection for privacy rights.
+Added: European data protection authorities have shown a willingness to impose significant fines and issue orders preventing the processing of personal data on non-compliant businesses and have imposed several fines for GDPR violations for hundreds of millions of Euros, and even one fine totaling 1.2 billion Euros.
+Added: Europe's overlapping and yet divergent data protection regimes create increased compliance challenges, costs, and risks for affected businesses.
+Added: Legal developments in the European Economic Area (“EEA”) and the UK, including rulings from the Court of Justice of the European Union (“CJEU”), have also created
+Added: complexity and uncertainty regarding processing and transfers of personal data from the EEA and the UK to the United States and other so-called third countries outside the EEA and the UK that have not been determined by the relevant data protection authorities to provide an adequate level of protection for privacy rights.
Case law from the CJEU indicates that reliance on the standard contractual clauses—a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism—alone may not necessarily be sufficient in all circumstances and that transfers must be assessed on a case-by-case basis.
−Removed: In July 2023, the European Commission adopted an adequacy decision in relation to the new EU-U.S.
+Added: In July 2023, the European Commission adopted an adequacy decision in relation to the EU-U.S.
Data Privacy Framework (“DPF”) rendering the DPF effective as a GDPR transfer mechanism for personal data transferred from the EEA to the United States by U.S.
3 unchanged sentences
While we have taken steps to mitigate the impact on us, such as implementing the European Commission’s standard contractual clauses, the efficacy and longevity of these mechanisms remains uncertain.
−Removed: Other jurisdictions outside the EU and the UK are similarly introducing or enhancing privacy, data protection, and cybersecurity laws, rules, and regulations, which could increase our compliance costs and the risks associated with noncompliance.
−Removed: We cannot yet fully determine the impact these or future laws, rules, and regulations may have on our business or operations.
−Removed: These laws, rules, and regulations may be inconsistent from one jurisdiction to another, subject to differing interpretations, and may be interpreted to conflict with our practices.
+Added: Other jurisdictions outside the EU and the UK are similarly introducing or enhancing privacy, data protection, and cybersecurity laws, rules, and regulations, which increase our compliance costs and the risks associated with noncompliance.
+Added: We cannot fully determine the impact these or future laws, rules, and regulations may have on our business or operations.
+Added: These laws, rules, and regulations are often inconsistent from one jurisdiction to another, subject to differing interpretations, and may be interpreted to conflict with our practices.
While we have implemented controls and procedures designed to comply with the requirements of the privacy, data protection, and cybersecurity laws, rules, and regulations of the jurisdictions in which we operate, such controls and procedures may not be effective in ensuring compliance or preventing unauthorized transfers of personal information.
1 unchanged sentence
These and other applicable data protection and privacy-related laws and regulations are evolving and may result in regulatory and public scrutiny and escalating levels of enforcement and sanctions.
−Removed: See Part I, Item 1, “Business—Government
−Removed: Regulations” for more information.
+Added: See Part I, Item 1, “Business—Government Regulations” for more information.
Our failure to comply with contractual obligations or applicable laws and regulations, or to protect any personal or other customer data, could result in enforcement actions against us, including regulatory fines or other civil or criminal liability, as well as claims for damages, contractual or otherwise, by customers and other affected individuals, damage to our reputation, and loss of goodwill (both in relation to existing customers and prospective customers), any of which could adversely affect our business, operating results, financial performance, and prospects.
2 unchanged sentences
Additionally, a failure or perceived failure to comply with privacy commitments could lead to regulator or civil claims if our commitments are found to be deceptive or otherwise misrepresentative of our actual policies and practices.
−Removed: Loss, retention, or misuse of certain information and alleged violations of laws and regulations relating to privacy and data security, and any relevant claims, may expose us to potential liability and may require us to expend significant resources on identity security and in responding to and defending such allegations and claims.
+Added: Loss, retention, or misuse of certain information and alleged violations of laws and regulations relating to privacy and data security, and any relevant claims, may expose us to potential liability and may require us to expend significant resources in responding to and defending such allegations and claims.
Any failure or perceived failure by us or any third parties with which we do business to comply with laws, rules, regulations, industry standards, contractual requirements, or other actual or asserted obligations to which we or such third parties are or may become subject may result in significant liability, adverse publicity, inability to process data, and investigations, proceedings, and other legal actions against us by governmental entities and private claims, demands, and litigation.
Any such action or other matter could be expensive to defend, may require the expenditure of substantial legal and other costs and substantial time and resources, may result in fines, penalties, or other liabilities, and likely would damage our reputation and adversely affect our business, financial condition, and results of operations.
−Removed: We may in the future be party to such actions and disputes.
+Added: We have in the past and may in the future be party to privacy-related actions and disputes.
In many jurisdictions, enforcement actions and consequences for non-compliance with privacy, data protection, and cybersecurity laws, rules, regulations, industry standards, contractual requirements, or other obligations are rising.
2 unchanged sentences
If we fail or are alleged to fail to follow these standards, even if no personal information is compromised, we may incur significant fines or experience a significant increase in costs and face regulatory investigations and other proceedings or private claims, demands, and litigation.
−Removed: In addition, future laws, regulations, standards, and other obligations, and changes in the interpretation of existing laws, regulations, standards, and other obligations, could impair our customers’ ability to collect, use, or disclose data relating to individuals, which could decrease demand for our platform and solutions, increase our costs, and impair our ability to maintain and grow our customer base and increase our revenue.
+Added: In addition, future laws, regulations, standards, and other obligations, and changes in the interpretation of existing laws, regulations, standards, and other obligations, could impair our customers’ ability to collect, use, or disclose data relating to individuals, which could decrease demand for our platform and solutions, increase our costs, and impair our ability to maintain and grow
+Added: our customer base and increase our revenue.
This includes evolutions in definitions of what constitutes “Personal Information” and “Personal Data” subject to privacy laws, especially relating to classification of intellectual property addresses, machine or device identification numbers, location data and other information.
Changes in the law may limit or inhibit our ability to offer certain solutions or features, limit the growth of features and/or development of new solutions, including that supported by AI or ML, or limit our ability to operate or expand our business and develop technology alliance relationships that may involve the sharing of data.
−Removed: Around the world, there are numerous lawsuits in process against various technology companies that process personal data.
−Removed: If those lawsuits are successful, it could increase the likelihood that our company may be exposed to liability for our own policies and practices concerning the processing of personal data and could hurt our business.
+Added: Around the world, there are a number of lawsuits in process against various technology companies that process personal data.
+Added: If more lawsuits are successful, it could increase the likelihood that our company may be exposed to liability for our own policies and practices concerning the processing of personal data and could hurt our business.
Furthermore, the costs of compliance with, and other burdens imposed by laws, regulations, and policies concerning privacy and identity security that are applicable to the businesses of our customers may limit the use and adoption of our platform or solutions and reduce overall demand for them.
2 unchanged sentences
We publicly post our privacy policies and practices concerning our processing, use, and disclosure of the personally identifiable information provided to us by our website visitors.
−Removed: Our publication of our privacy policies and other statements we publish that provide promises and assurances about privacy and security can subject us to potential state, federal, and international action if they are found to be deceptive or misrepresentative of our actual policies and practices or if our practices are found to be unfair.
+Added: Our publication of our privacy policies and other statements we publish that provide promises and assurances about privacy and security can subject us to potential state, federal, and international action if they are found to be incomplete or misrepresentative of our actual policies and practices or if our practices are found to be unfair.
Regulatory and legislative developments related to the use of AI could adversely affect our use of such technologies in our solutions and business.
17 unchanged sentences
The FCPA prohibits any U.S.
−Removed: individual or business from paying, offering, authorizing payment, or offering of anything of value, directly or indirectly, to any foreign official, political party, or candidate for the purpose of influencing any act or decision of the foreign entity in order to assist the individual or business in obtaining or retaining business.
+Added: individual or business from paying, offering, authorizing payment, or offering anything of value, directly or indirectly, to any foreign official, political party, or candidate for the purpose of influencing any act or decision of the foreign entity in order to assist the individual or business in obtaining or retaining business.
Bribery Act is similar but even broader in scope in that it prohibits bribery of private (non-government) persons as well.
3 unchanged sentences
We and our third-party intermediaries may have direct or indirect interactions with officials and employees of government agencies, state-owned or affiliated entities, and non-governmental commercial entities and may be held liable for the corrupt or other illegal activities of these third-party intermediaries, our employees, representatives, contractors, channel partners, and agents, even if we do not explicitly authorize such activities.
−Removed: While we have policies and procedure to address compliance with these laws, we cannot assure you that all of our employees and agents will not take actions in violation of our policies and applicable law, for which we may be ultimately held responsible.
+Added: While we have policies and procedures to address compliance with these laws, we cannot assure you that all of our employees and agents will not take actions in violation of our policies and applicable law, for which we may be ultimately held responsible.
Noncompliance with these laws could subject us to investigations, sanctions, settlements, prosecution, other enforcement actions, disgorgement of profits, significant fines, damages, other civil and criminal penalties or injunctions, adverse media coverage, and other consequences.
25 unchanged sentences
If such a disagreement were to occur, and our position were not sustained, we could be required to pay additional taxes, interest, and penalties.
−Removed: Such authorities could claim that various withholding requirements apply to us or our subsidiaries or assert that benefits of tax treaties are not available to us or our subsidiaries.
+Added: Such authorities could claim that various withholding requirements apply to us or our subsidiaries
+Added: or assert that benefits of tax treaties are not available to us or our subsidiaries.
Any increase in the amount of taxes we pay or that are imposed on us could increase our worldwide effective tax rate and adversely affect our business and operating results.
20 unchanged sentences
Additionally, many state attorneys general and the Federal Trade Commission have interpreted existing consumer protection laws to impose standards on the privacy, security, use, transfer, disclosure, disposal, and other treatment of an individual’s information, including health information.
−Removed: Increased and complex scrutiny of environmental, social, and governance (“ESG”) matters may require us to incur additional costs or otherwise adversely impact our business.
+Added: Increased and complex scrutiny of environmental, social, governance, and sustainability (“ESG”) matters may require us to incur additional costs or otherwise adversely impact our business.
Increased attention to climate change, diversity, equity, and inclusion, and other ESG issues, may result in increased costs (including but not limited to increased costs related to compliance, stakeholder engagement, and contracting), impact our reputation or otherwise affect our business performance.
In addition, organizations that provide information to investors on corporate governance and related matters have developed ratings processes for evaluating companies on ESG matters.
−Removed: Such ratings are used by some investors to inform their investment or voting decisions.
−Removed: Unfavorable ESG ratings could lead to negative investor sentiment toward us and/or our industry, which could have a negative impact on our access to and costs of capital.
+Added: Such ratings are used by some investors to inform their investment or voting decisions and also by some customers and prospective customers to inform their purchasing decisions.
+Added: Unfavorable ESG ratings could lead to negative investor sentiment toward us and/or our industry, which could have a negative impact on our access to and costs of capital, and could also cause customers and prospective customers to not purchase our solutions.
To the extent ESG matters negatively impact our reputation, we may also not be able to compete as effectively to recruit or retain employees.
−Removed: We may take certain actions, including the establishment of ESG-related goals, to improve our ESG profile and/or respond to stakeholder demand;
−Removed: however, such actions may be costly or be subject to numerous conditions that are outside our control, and we cannot guarantee that such actions will have the desired effect.
−Removed: Moreover, while we may create and publish voluntary disclosures regarding ESG matters from time to time, many of the statements in those voluntary disclosures are based on hypothetical expectations and assumptions that may or may not be representative of current or actual risks or events or forecasts of expected risks or events, including the costs associated therewith.
+Added: We may take certain actions, including the establishment of ESG-related goals, to improve our ESG profile and/or respond to stakeholder demands, and such actions may be costly or be subject to numerous conditions that are outside our control, and we cannot guarantee that such actions will have the desired effect.
+Added: Moreover, while we may have and may continue to create and publish voluntary disclosures regarding ESG matters from time to time, many of the statements in those voluntary disclosures are based on hypothetical expectations and assumptions that may or may not be representative of current or actual risks or events or forecasts of expected risks or events, including the costs associated therewith.
Such expectations and assumptions are necessarily uncertain and may be prone to error or subject to misinterpretation given the long timelines involved and the lack of an established single approach to identifying, measuring, and reporting on many ESG matters.
3 unchanged sentences
Risks Related to Ownership of Our Common Stock
−Removed: The requirements of being a public company, including compliance with the reporting requirements of the Exchange Act and the requirements of the Sarbanes-Oxley Act and Nasdaq, may strain our resources, increase our costs, and distract management, and we may be unable to comply with these requirements in a timely or cost-effective manner.
−Removed: As a public company, we need to comply with laws, regulations, and requirements, certain corporate governance provisions of the Sarbanes-Oxley Act, related regulations of the SEC, and the requirements of Nasdaq.
−Removed: As a newly public company, complying with these statutes, regulations, and requirements will occupy a significant amount of time of our Board and management and will significantly increase our costs and expenses as compared to when we were a private company.
−Removed: For example, as a newly public company, we have had to institute a more comprehensive compliance and reporting function, establish new internal policies, and involve and retain to a greater degree outside counsel and accountants in such activities.
−Removed: In addition, we implemented a new ERP system.
−Removed: The ERP system is intended to combine and streamline the management of our financial, accounting, human resources, sales and marketing, and other functions, enabling it to manage operations and track performance more effectively.
−Removed: Any disruptions or difficulties in using the ERP system could adversely affect our controls and harm our business, financial condition, and results of operations, including our ability to forecast our business and collect receivables.
−Removed: Moreover, such disruption or difficulties could result in unanticipated costs and diversion of management attention.
The trading price of our common stock could be volatile, which could cause the value of your investment to decline.
7 unchanged sentences
Factors that could cause fluctuations in the trading price of our common stock include the following:
−Removed: • announcements of new solutions, products, or technologies, commercial relationships, acquisitions, or other events by us or our competitors;
+Added: • announcements of new solutions, products, or technologies, commercial relationships, acquisitions, or other events by us, our competitors, or other technology industry companies, including potential technology industry disruption as a result of AI and agentic AI advancements;
• changes in how customers perceive the benefits of our solutions;
12 unchanged sentences
• “flash crashes,” “freeze flashes,” or other glitches that disrupt trading on the securities exchange on which we are listed.
−Removed: In addition, if the market for technology stocks or the stock market in general experiences a loss of investor confidence, the trading price of our common stock could decline for reasons unrelated to our business, operating results, or financial condition.
+Added: In addition, if the market for technology stocks or the stock market in general experiences a loss of investor confidence, the trading price of our common stock could decline, including for reasons unrelated to our business, operating results, or financial condition.
The trading price of our common stock might also decline in reaction to events that affect other companies in our industry even if these events do not directly affect us.
34 unchanged sentences
Thoma Bravo controls us, and its interests may conflict with ours or yours in the future .
−Removed: Investment entities affiliated with Thoma Bravo UGP, LLC (together with its affiliated entities, "Thoma Bravo") control approximately 86% of the voting power of our outstanding common stock, which means that, based on its percentage voting power, Thoma Bravo controls the vote of all matters submitted to a vote of our stockholders.
+Added: As of January 31, 2026, investment entities affiliated with Thoma Bravo UGP, LLC (together with its affiliated entities, "Thoma Bravo") control approximately 85% of the voting power of our outstanding common stock, which means that, based on its percentage voting power, Thoma Bravo controls the vote of all matters submitted to a vote of our stockholders.
This control enables Thoma Bravo to control the election of the members of the Board and all other corporate decisions.
1 unchanged sentence
Accordingly, for such period of time, Thoma Bravo will have significant influence with respect to our management, business plans, and policies, including the appointment and removal of our officers, decisions on whether to raise future capital, and amending our charter and bylaws, which govern the rights attached to our common stock.
−Removed: In particular, for so long as Thoma Bravo continues to own a significant percentage of our common stock, Thoma Bravo will be able to cause or prevent a change of control of us or a change in the composition of our Board and could preclude any unsolicited acquisition of us.
+Added: In particular, for so long as Thoma Bravo continues to own a significant percentage of our
+Added: common stock, Thoma Bravo will be able to cause or prevent a change of control of us or a change in the composition of our Board and could preclude any unsolicited acquisition of us.
The concentration of ownership could deprive you of an opportunity to receive a premium for your shares of common stock as part of a sale of us and ultimately might affect the market price of our common stock.
2 unchanged sentences
(ii) a number of nominees for election to our Board (rounded up to the nearest whole number) equal to 40% of the total directors for so long as Thoma Bravo beneficially owns at least 30% and less than 40% of the Original Amount;
−Removed: (iii) a number of nominees for election to our Board (rounded up to the nearest whole number) equal to 30% of the total directors for so long as Thoma Bravo
−Removed: beneficially owns at least 20% and less than 30% of the Original Amount;
+Added: (iii) a number of nominees for election to our Board (rounded up to the nearest whole number) equal to 30% of the total directors for so long as Thoma Bravo beneficially owns at least 20% and less than 30% of the Original Amount;
(iv) a number of nominees for election to our Board (rounded up to the nearest whole number) equal to 20% of the total directors for so long as Thoma Bravo beneficially owns at least 10% and less than 20% of the Original Amount;
17 unchanged sentences
Our certificate of incorporation will also provide that, unless we consent in writing to the selection of an alternative forum, the federal district courts of the United States shall be the exclusive forum for the resolution of any complaint asserting a cause of action arising under the Securities Act.
−Removed: Our certificate of incorporation further provides that any person or entity purchasing or otherwise acquiring or holding any interest in shares of our capital stock is deemed to have notice of and consented to the provisions of our certificate of incorporation described above.
+Added: Our certificate of incorporation further provides that any person or entity
+Added: purchasing or otherwise acquiring or holding any interest in shares of our capital stock is deemed to have notice of and consented to the provisions of our certificate of incorporation described above.
The forum selection provisions in our certificate of incorporation may have the effect of discouraging lawsuits against us or our directors and officers and may limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us.
1 unchanged sentence
While we currently have no basis to expect any such challenge would be successful, if a court were to find our forum selection provisions to be inapplicable or unenforceable with respect to one or more of these specified types of actions or proceedings, we may incur additional costs associated with having to litigate in other jurisdictions, which could have an adverse effect on our business, financial condition, results of operations, cash flows, and prospects and result in a diversion of the time and resources of our employees, management, and Board.
−Removed: A significant portion of our total outstanding shares of common stock are restricted from immediate resale but may be sold into the market in the near future.
−Removed: This could cause the market price of our common stock to drop significantly, even if our business is doing well.
−Removed: Sales of a substantial number of shares of our common stock in the public market could occur at any time.
−Removed: These sales, or the perception in the market that the holders of a large number of shares of common stock intend to sell shares, could reduce the market price of our common stock.
−Removed: A significant number of shares of our common stock are subject to a 180-day lock-up period pursuant to lock-up agreements entered into in connection with our IPO and, are therefore, restricted from immediate resale under the federal securities laws.
−Removed: All of these shares of common stock will, however, be able to be resold after the expiration of the lock-up period, as well as pursuant to customary exceptions thereto or upon the waiver of the lock-up agreement by the representatives on behalf of the underwriters.
−Removed: We have also registered shares of common stock that we may issue under our equity compensation plans, which can be freely sold in the public market upon issuance, subject to the lock-up agreements.
−Removed: As restrictions on resale end, the market price of our stock could decline if the holders of currently restricted shares of common stock sell them or are perceived by the market as intending to sell them.
We are a controlled company within the meaning of the rules of Nasdaq and, as a result, qualify for and are relying on exemptions from certain corporate governance requirements.
9 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.