PROGRESS SOFTWARE CORP /MA

Previous wording

Technology and customer requirements evolve rapidly in our industry, and if we do not continue to develop or acquire new products and enhance our existing products in response to these changes, our business could be harmed. Ongoing enhancements to our product sets (both organically and through acquisitions) will be required to enable us to maintain our competitive position and the competitive position of our ISVs, distributors/resellers, and OEMs. We may not be successful in developing and marketing enhancements to our products on a timely basis, and any enhancements we develop may not adequately address the changing needs of the marketplace. Overlaying the risks associated with our existing products and enhancements are ongoing technological developments and rapid changes in customer and partner requirements. Our future success will depend upon our ability to develop, acquire and introduce new products in a timely manner that take advantage of technological advances and respond to new customer and partner requirements. We may not be successful in developing or acquiring new products incorporating new technology on a timely basis, and any new products we develop or acquire may not adequately address the changing needs of the marketplace or may not be accepted by the market. Failure to develop new products and product enhancements that meet market needs in a timely manner could have a material adverse effect on our business, financial condition and operating results.

Current wording

Technology and customer requirements evolve rapidly in our industry, and if we do not continue to develop or acquire new products and enhance our existing products in response to these changes, our business could be harmed. The markets for our products are characterized by rapid technological advancement, including the introduction of new technologies such as AI. Ongoing enhancements to our product sets (both organically and through acquisitions) will be required to enable us to maintain our competitive position and the competitive position of our ISVs, distributors/resellers, and OEMs. We may not be successful in developing and marketing enhancements to our products on a timely basis, and any enhancements we develop may not adequately address the changing needs of the marketplace. Overlaying the risks associated with our existing products and enhancements are ongoing technological developments and rapid changes in customer and partner requirements. Our future success will depend upon our ability to develop, acquire and introduce new products in a timely manner that leverage technological advances, including AI, and respond to new customer and partner requirements. We may not be successful in developing or acquiring new products that incorporate new technologies on a timely basis, and any new products we develop or acquire may not adequately address the changing needs of our customers or may not be accepted by the market. Failure to develop new products and product enhancements that meet market needs in a timely manner could have a material adverse effect on our business, financial condition, and operating results.

Previous wording

We are substantially dependent on our OpenEdge products. We derive a significant portion of our revenue from software license and maintenance revenue attributable to our OpenEdge product set, which in fiscal year 2024 accounted for approximately 34% of our aggregate revenue on a consolidated basis. Accordingly, our future results depend on continued market acceptance of OpenEdge. If consumer demand declines, or new technologies emerge that are superior to, or are more responsive to customer requirements than OpenEdge, such that we are unable to maintain OpenEdge’s competitive position within its marketplace, our business, financial condition and operating results may be materially adversely affected.

Current wording

We are substantially dependent on our OpenEdge and ShareFile products. We derive a significant portion of our revenue from software license and maintenance revenue attributable to our OpenEdge product set, as well as SaaS revenue attributable to our ShareFile product set, which in fiscal year 2025 together accounted for slightly more than half of our aggregate revenue on a consolidated basis. Accordingly, our future results depend on continued market acceptance of OpenEdge and ShareFile. If consumer demand declines, or new technologies emerge that are superior to, or are more responsive to customer requirements than, OpenEdge or ShareFile, such that we are unable to maintain these products' competitive position within their respective marketplaces, our business, financial condition, and operating results may be materially adversely affected.

Previous wording

We intend to make additional acquisitions of businesses, products or technologies that involve additional risks, which could disrupt our business or harm our financial condition, results of operations or cash flows. A key element of our strategy includes the acquisition of businesses that offer complementary products, services and technologies, augment our revenues and cash flows, and meet our strict financial and other criteria. We may not be able to identify suitable acquisition opportunities or consummate any such transactions on favorable terms or at all. Even if an acquisition is successful, the integration of a new business involves a number of risks that could have a material adverse effect on our business, financial condition, operating results or cash flows, including:

Current wording

We intend to make additional acquisitions of businesses, products, or technologies that involve additional risks, which could disrupt our business or harm our financial condition, results of operations, or cash flows. A key element of our total growth strategy includes the acquisition of businesses that offer complementary products, services, and technologies, augment our revenues and cash flows, and meet our strict financial and other criteria. We may not be able to identify suitable acquisition opportunities or consummate any such transactions on favorable terms or at all. Even if an acquisition is successful, the integration of a new business involves a number of risks that could have a material adverse effect on our business, financial condition, operating results, or cash flows, including:

Previous wording

•lack of experience operating in the industry or markets of the acquired business (e.g., satisfying the requirements of public-sector customers);

Current wording

•lack of experience operating in the industry or markets of the acquired business (e.g., satisfying the highly technical requirements of government and other quasi-public-sector customers);

Previous wording

•the potential for deficiencies in internal controls at the acquired or combined business, including but not limited to with regard to any weaknesses or vulnerabilities in the acquired company’s cybersecurity controls;

Current wording

•the potential for deficiencies in internal controls at the acquired or combined business, including but not limited to any weaknesses or vulnerabilities in the acquired company's cybersecurity controls;

Previous wording

In addition, if we fail to complete an announced acquisition, the market price of our common stock could fall to the extent such price reflects an assumption that such acquisition will be completed, and we may incur significant unrecoverable costs. Further, the failure to consummate an acquisition may result in negative publicity and adversely impact our relationships with our customers, vendors and employees. We may become subject to legal proceedings relating to the acquisition and the integration of acquired businesses may not be successful. Failure to manage and successfully integrate acquired businesses, achieve anticipated levels of profitability of the acquired business, improve margins of the acquired businesses and products, or realize other anticipated benefits of an acquisition could materially harm our business, operating results and margins.

Current wording

In addition, if we fail to complete an announced acquisition, the market price of our common stock could fall to the extent such price reflects an assumption that such acquisition will be completed, and we may incur significant unrecoverable costs. Further, the failure to consummate an acquisition may result in negative publicity and adversely impact our relationships with our customers, vendors, and employees. We may become subject to legal proceedings relating to an acquisition, and the integration of an acquired business may not be successful. Failure to manage and successfully integrate an acquired business, achieve anticipated levels of profitability of an acquired business, improve margins of an acquired business and its products, or realize other anticipated benefits of an acquisition could materially harm our business, operating results, and margins.

Previous wording

Our international operations expose us to additional risks, and changes in global economic and political conditions could adversely affect our international operations, our revenue and our net income. Approximately 41% of our total fiscal 2024 revenue was generated from sales outside North America. Political and/or financial instability, oil price shocks and armed conflict in various regions of the world, including, but not limited to, Russia/Ukraine conflict and the armed conflicts involving Israel, can lead to economic uncertainty and may adversely impact our business. Political instability may lead to significant, continuing volatility in global stock markets and currency exchange rate fluctuations. If customers’ buying patterns, decision-making processes, timing of expected deliveries and timing of new projects unfavorably change due to economic or political conditions, there would be a material adverse effect on our business, financial condition and operating results.

Current wording

Our international operations expose us to additional risks, and changes in global economic and political conditions could adversely affect our international operations, our revenue, and our net income. Approximately 36% of our total fiscal 2025 revenue was generated from sales outside North America. Political and/or financial instability, tariffs, the imposition of import/export controls, or armed conflict in various regions of the world can lead to economic uncertainty and may adversely impact our business. Political instability may lead to significant, continuing volatility in global stock markets and currency exchange rate fluctuations. If customers' buying patterns, decision-making processes, timing of expected deliveries, or timing of new projects unfavorably change due to economic or political conditions, there could be a material adverse effect on our business, financial condition, and operating results.

Previous wording

•economic instability in emerging markets; and

Current wording

•economic instability in emerging markets;

Previous wording

In addition, our business has been, and could in the future be, adversely affected by regional or global health crises. A significant outbreak of contagious diseases, other adverse public health developments, or the fear of such events that results in a widespread health crisis could adversely affect global supply chains and the economies and financial markets of many countries. Any prolonged economic disruption could affect demand for our products and services and adversely impact our business, financial condition and results of operations.

Current wording

•regional or global health crises; and

Previous wording

If our security measures are breached, our products and services may be perceived as not being secure, customers may curtail or stop using our products and services, and we may incur significant legal and financial exposure, including but not limited to from loss of customer or company data, loss of customers or otherwise. Our products and services involve the storage and transmission of our customers’ proprietary information and may be vulnerable to unauthorized access, computer viruses, cyber-attacks, distributed denial of service attacks and other disruptive problems. Individual and groups of hackers and sophisticated organizations, including state-sponsored organizations or nation-states, continuously undertake attacks that pose threats to our customers and our software products, and we have experienced cybersecurity incidents in which such actors have gained unauthorized access to our IT systems and data, including customer systems and data. For example, as disclosed on December 19, 2022, following the detection of irregular activity on certain portions of our corporate network, we engaged outside cybersecurity experts and other incident response professionals to conduct a forensic investigation and assess the extent and scope of the cyber incident (the "November 2022 Cyber Incident"). During the investigation, we and our external advisors uncovered evidence of unauthorized access to our corporate network, including evidence that certain company data had been exfiltrated. As demonstrated by the November 2022 Cyber Incident, due to the actions of outside parties, employee error, malfeasance, or otherwise, an unauthorized party may obtain access to our data or our customers’ data, which could result in its theft, destruction, corruption or misappropriation and thus legal and financial exposure. Security risks in recent years have increased significantly given the increased sophistication and activities of hackers, organized crime, including state-sponsored organizations and nation-states, and other outside parties. Cyber threats are continuously evolving, increasing the difficulty of defending against them. Increased risks of such attacks and disruptions also exist due to the Russian invasion of Ukraine beginning in February 2022. While we have implemented security procedures and controls aimed at addressing these threats, our security measures could be compromised, could prove to be inadequate or could fail. Any security breach or unauthorized access could result in significant legal and financial exposure, increased costs to defend litigation, indemnity and other contractual obligations, government fines and penalties, damage to our reputation and our brand, and a loss of confidence in the security of our products and services that could potentially have an adverse effect on our business and results of operations. Breaches of our network could disrupt our internal systems and business applications, including services provided to our customer…

Excerpt shortened here; the source contains the full paragraph.

Current wording

If our security measures are breached, our products and services may be perceived as not being secure, customers may curtail or stop using our products and services, and we may incur significant legal and financial exposure from loss of customer or company data, loss of customers, or otherwise. Our business requires the storage and transmission of our proprietary information and customer information within Progress' enterprise information technology systems, which may be vulnerable to unauthorized access, distributed denial of service attacks, and other cyber-attacks. Individual and groups of hackers and sophisticated organizations, including state-sponsored organizations or nation-states, continuously undertake attacks that pose threats to our customers and our software products, and we have experienced cybersecurity incidents in which such actors have gained unauthorized access to our IT systems and data, including customer systems and data. For example, as disclosed on December 19, 2022, following the detection of irregular activity on certain portions of our corporate network, we engaged outside cybersecurity experts and other incident response professionals to conduct a forensic investigation and assess the extent and scope of the cyber incident (the "November 2022 Cyber Incident"). During the investigation, we and our external advisors uncovered evidence of unauthorized access to our corporate network, including evidence that certain Company data had been exfiltrated. As demonstrated by the November 2022 Cyber Incident, due to the actions of outside parties, employee error, malfeasance, or otherwise, an unauthorized party may obtain access to our data or our customers' data, which could result in its theft, destruction, corruption, or misappropriation and thus legal and financial exposure. Security risks in recent years have increased significantly given the increased sophistication and activities of hackers, organized crime, including state-sponsored organizations and nation-states, and other outside parties.

Previous wording

If our products contain software defects or security flaws, it could harm our revenues by causing us to lose customers and could increase our liabilities by exposing us to costly governmental investigations or litigation. For example, the exploitation of the zero-day MOVEit Vulnerability in May 2023 has resulted in informal government inquiries, three formal government investigations, and private litigation. Our products, despite extensive testing and quality control, may, and at times do, contain defects, vulnerabilities or security flaws. In the ordinary course of business, we may need to issue corrective releases of our software products to fix any defects, vulnerabilities, or security flaws. Depending upon the severity of any such matters, the detection and correction of such matters can be time consuming and costly. If any such issues are exploited by malicious threat actors, we could experience, among other things, material adverse impact to our revenues due to loss of customers and increased liabilities due to costly governmental investigations or litigation. In addition, any such matters could affect the ability of our products to work with hardware or other software products, delay the development or release of new products or new versions of products (due to a reallocation of our internal resources), and/or adversely affect market acceptance of our products, all of which could have a material adverse effect on our operating results and cash flows.

Current wording

If our products contain software defects or security flaws, it could harm our revenues by causing us to lose customers and could increase our liabilities by exposing us to costly governmental investigations or litigation. For example, the exploitation of the zero-day MOVEit Vulnerability in May 2023 has resulted in informal government inquiries, three formal government investigations, and private litigation. Our products, despite extensive testing and quality control, may, and at times do, contain defects, vulnerabilities, or security flaws. In the ordinary course of business, we may need to issue corrective releases of our software products to fix any defects, vulnerabilities, or security flaws. Depending upon the severity of any such matters, the detection and correction of such matters can be time consuming and costly. If any such issues are exploited by malicious threat actors, we could experience, among other things, a material adverse impact to our revenues due to loss of customers and increased liabilities due to costly governmental investigations or litigation. In addition, any such matters could affect the ability of our products to work with hardware or other software products, delay the development or release of new products or new versions of products (due to a reallocation of our internal resources), and/or adversely affect market acceptance of our products, all of which could have a material adverse effect on our operating results and cash flows.

Previous wording

As previously disclosed, on the evening of May 28, 2023, we learned that our MOVEit Transfer (the on-premise version) and MOVEit Cloud (a cloud-hosted version of MOVEit Transfer) products were attacked via a "zero-day vulnerability" that could provide for unauthorized escalated privileges and access to the customer’s underlying environment (the "MOVEit Vulnerability"). A "zero-day vulnerability" is a vulnerability that has been publicly disclosed and/or exploited (e.g., by an independent researcher or threat actor) before the software vendor has an opportunity to patch it. We continue to monitor the impact of the MOVEit Vulnerability on our business, operations, and financial results. MOVEit Transfer and MOVEit Cloud represented less than 4% in aggregate of our revenue for the fiscal year ended November 30, 2024.

Current wording

As previously disclosed, on the evening of May 28, 2023, we learned that our MOVEit Transfer (the on-premise version) and MOVEit Cloud (a cloud-hosted version of MOVEit Transfer) products were attacked via a "zero-day vulnerability" that could provide for unauthorized escalated privileges and access to the customer's underlying environment (the "MOVEit Vulnerability"). A "zero-day vulnerability" is a vulnerability that has been publicly disclosed and/or exploited (e.g., by an independent researcher or threat actor) before the software vendor has an opportunity to patch it. Following the discovery of the MOVEit Vulnerability and the various remedial actions previously described, we discovered and patched additional vulnerabilities within the MOVEit Transfer and MOVEit Cloud platforms. While we are currently not aware of any evidence that these additional vulnerabilities were exploited by malicious threat actors, we cannot guarantee that we have or will uncover and/or address all vulnerabilities within the MOVEit platform or any of our other products prior to exploitation by threat actors.

Previous wording

As a result of the MOVEit Vulnerability, we are party to certain class action lawsuits filed by individuals who claim to have been impacted by the exfiltration of data from the environments of our MOVEit Transfer customers, which the Judicial Panel on Multidistrict Litigation transferred to the District of Massachusetts for coordinated and consolidated proceedings (the "MDL"). The MDL has also consolidated the previously disclosed insurance subrogation claim (where an insurer is seeking recovery for expenses incurred on behalf of its insured in connection with the MOVEit Vulnerability) and, as of the date of this filing, one customer cross-claim.

Current wording

As a result of the MOVEit Vulnerability, we are party to certain class action lawsuits filed by individuals who claim to have been impacted by the exfiltration of data from the environments of our MOVEit Transfer customers, which the Judicial Panel on Multidistrict Litigation transferred to the District of Massachusetts for coordinated and consolidated proceedings (the "MDL"). The MDL has also consolidated the insurance subrogation complaint (where an insurer is seeking recovery for expenses incurred on behalf of its insured in connection with the MOVEit Vulnerability) and, as of the date of this filing, one customer cross-claim.

Previous wording

Our financial liability arising from any of the foregoing will depend on many factors, including the progression of the MDL; therefore, we are unable at this time to estimate the quantitative impact of any such liability with any reasonable degree of certainty. As our litigation response continues, we will continue to assess the potential impact of the MOVEit Vulnerability on our business, operations, and financial results.

Current wording

Our financial liability arising from the MOVEit Vulnerability will depend on many factors, including the progression of the MDL and additional litigation or indemnification claims, and any settlements resulting from remaining or additional governmental or regulatory investigations; therefore, we are unable at this time to estimate the quantitative impact of any such liability with any reasonable degree of certainty. As our litigation response continues, we will continue to assess the potential impact of the MOVEit Vulnerability on our business, operations, and financial results.

Previous wording

Our business could be damaged, and we could be subject to liability, in the event of any unauthorized access to our data or our customers’ data, including through privacy and data security breach. The use of certain of our products, including MOVEit Cloud and ShareFile, involves the transmission or storage of third-party data in our environment, some of which may be considered personally identifiable, confidential, or sensitive. In the ordinary course of business, we face security threats from malicious threat actors that could obtain unauthorized access to our systems, infrastructure, products, and networks. We anticipate that these threats will continue to grow in scope and complexity over time, particularly as we acquire new products and a larger proportion of our revenues derive from products that transmit or store sensitive data.

Current wording

Our business could be damaged, and we could be subject to liability, in the event of any unauthorized access to our data or our customers' data, including through privacy and data security breach. The use of certain of our products, including MOVEit Cloud and ShareFile, involves the transmission or storage of third-party data in our environment, some of which may be considered personally identifiable, confidential, or sensitive. In the ordinary course of business, we face security threats from malicious threat actors that could obtain unauthorized access to our systems, infrastructure, products, and networks. We anticipate that these threats will continue to grow in scope and complexity over time, particularly as the use of AI by malicious threat actors increases, we acquire new products, and a larger proportion of our revenues derive from products that transmit or store sensitive data.

Previous wording

While we endeavor to continue mitigating security risks for our products, malicious threat actors might use techniques to exploit other zero-day vulnerabilities or use other means that we are unable to defend against, in order to compromise and infiltrate our systems, infrastructure, networks, and products, including, but not limited to, MOVEit, ShareFile or other products.

Current wording

While we endeavor to continue mitigating security risks for our products, malicious threat actors might use techniques to exploit other zero-day vulnerabilities or use other means that we are unable to defend against in order to compromise and infiltrate our systems, infrastructure, networks, and products, including, but not limited to MOVEit or ShareFile.

Previous wording

While we devote significant resources to cyber security related matters in the operation of our business, we may fail to detect the existence of a breach and be unable to prevent unauthorized access to user and company content across our systems, infrastructure, products, and networks. The techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and are often not recognized until launched against a target. They may originate from less regulated or remote areas around the world, or from state-sponsored actors. If our security measures are breached, we may suffer reputational damage, our products may be perceived as insecure, and we may lose existing customers or fail to attract and retain new customers.

Current wording

While we devote significant resources to cybersecurity related matters in the operation of our business, we may fail to detect the existence of a breach and be unable to prevent unauthorized access to user and company content across our systems, infrastructure, products, and networks. The techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and are often not recognized until launched against a target. They may originate from less regulated or remote areas around the world, or from state-sponsored actors. If our security measures are breached, we may suffer reputational damage, our products may be perceived as insecure, and we may lose existing customers or fail to attract and retain new customers.

Previous wording

Integration of artificial intelligence into our product offerings and our use of artificial intelligence in our operations could result in reputational or competitive harm, legal liability, and other adverse effects on our business. We have integrated, and plan to further integrate, artificial intelligence (“AI”) capabilities into certain components of product offerings, and we use and expect to increase the use of AI in our operations. Such integration and use of AI may become more important in our product offerings and operations over time. These AI-related initiatives, whether successful or not, could cause us to incur substantial costs and could result in delays in our software release cadence. Our competitors or other third parties may incorporate AI into their products or operations more quickly or more successfully than we do, which could impair our ability to compete effectively. Additionally, AI algorithms may be flawed and datasets underlying AI algorithms may be insufficient or contain biased information. If the AI tools integrated into our products or that we use in our operations produce analyses or recommendations that are or are alleged to be deficient, inaccurate, or biased, our reputation, business, financial condition, and results of operations may be adversely affected.

Current wording

Integration of artificial intelligence into our product offerings and our use of artificial intelligence in our operations could result in reputational or competitive harm, legal liability, and other adverse effects on our business. We have integrated, and plan to further integrate, AI capabilities into certain components of product offerings, and we use and expect to increase the use of AI in our operations. These AI-related initiatives, whether successful or not, could cause us to incur substantial costs and could result in delays in our software release cadence. Additionally, AI algorithms may be flawed and datasets underlying AI algorithms may be insufficient or contain biased information. If the AI tools integrated into our products or that we use in our operations produce analyses or recommendations that are or are alleged to be deficient, inaccurate, or biased, our reputation, business, financial condition, and results of operations may be adversely affected.

Previous wording

Other companies have experienced cybersecurity incidents that implicate confidential and proprietary company data and/or the personal data of end users of AI applications integrated into their software offerings or used in their operations. If we were to experience a cybersecurity incident related to the integration of AI capabilities into our product offerings or our use of AI applications in our operations, our business and results of operations could be adversely affected. AI also presents various emerging legal, regulatory and ethical issues, and the incorporation of AI into our product offerings and our use of AI applications in our operations could require us to expend significant resources in developing, testing and maintaining our product offerings and may cause us to experience brand, reputational, or competitive harm, or incur legal liability. On October 30, 2023, the Biden administration issued an Executive Order to, among other things, establish extensive new standards for AI safety and security. Other jurisdictions may decide to adopt similar or more restrictive legislation that may render the use of such technologies challenging. These restrictions may make it harder for us to conduct our business using AI, lead to regulatory fines or penalties, require us to change our product offerings or business practices, or prevent or limit our use of AI.

Current wording

Other companies have experienced cybersecurity incidents that implicate confidential and proprietary company data and/or the personal data of end users of AI applications integrated into their software offerings or used in their operations. If we were to experience a cybersecurity incident related to the integration of AI capabilities into our product offerings or our use of AI applications in our operations, our business and results of operations could be adversely affected. AI also presents various emerging legal, regulatory and ethical issues, and the incorporation of AI into our product offerings and our use of AI applications in our operations could require us to expend significant resources in developing, testing and maintaining our product offerings and may cause us to experience brand, reputational, or competitive harm, or incur legal liability. Any legislation concerning AI adopted domestically or globally may make it harder for us to conduct our business using AI, lead to regulatory fines or penalties, require us to change our product offerings or business practices, or prevent or limit our use of AI.

Previous wording

Catastrophic events, including but not limited to cyber events, may disrupt our business. We rely on our network infrastructure and enterprise applications, internal technology systems and website for our development, marketing, operations, support and sales activities. In addition, we rely on third-party hosted services, and we do not control the operation of third-party data center facilities, which increases our vulnerability. A disruption, infiltration or failure of these systems or third-party hosted services in the event of a major earthquake, fire, flood, tsunami or other weather event, power loss, telecommunications failure, software or hardware malfunction, pandemic, cyber-attack or other similar interruption to our business, war, terrorist attack or other catastrophic event that our disaster recovery plans do not adequately address, could cause system interruptions, reputational harm, loss of intellectual property, delays in our product development, lengthy interruptions in our services, breaches of data security and loss, destruction, misappropriation or corruption of critical company or customer data. A catastrophic event that results in the loss, destruction, misappropriation, corruption or disruption of any of our data, our customers’ data or our data centers or our critical business or information technology systems could severely affect our ability to conduct normal business operations and, as a result, our future operating results could be adversely affected, and the adverse effects of any such catastrophic event would be exacerbated if experienced at the same time as another unexpected and adverse event.

Current wording

Catastrophic events, including but not limited to cyber events, may disrupt our business. We rely on our network infrastructure and enterprise applications, internal technology systems, and websites for our development, marketing, operations, support, and sales activities. In addition, we rely on third-party hosted services, and we do not control the operation of third-party data center facilities, which increases our vulnerability. A disruption, infiltration or failure of these systems or third-party hosted services in the event of a major earthquake, fire, flood, tsunami or other weather event, power loss, telecommunications failure, software or hardware malfunction, pandemic, cyber-attack or other similar interruption to our business, war, terrorist attack, or other catastrophic event that our disaster recovery plans do not adequately address, could cause system interruptions, reputational harm, loss of intellectual property, delays in our product development, lengthy interruptions in our services, breaches of data security and loss, destruction, misappropriation, or corruption of critical company or customer data. A catastrophic event that results in the loss, destruction, misappropriation, corruption or disruption of any of our data, our customers' data, or our data centers or our critical business or information technology systems could severely affect our ability to conduct normal business operations and, as a result, our future operating results could be adversely affected, and the adverse effects of any such catastrophic event would be exacerbated if experienced at the same time as another unexpected and adverse event.

Previous wording

We also depend on third-party service providers to provide the data centers and other infrastructure necessary to certain of our products. Any disruption in the services provided by these third parties or any failure to renew the services could adversely affect the performance of products or result in a loss of user content, resulting in harm to our business and reputation. Customers rely on certain of our products to transfer or process their content. The infrastructure on which our products rely may not be adequately designed with sufficient reliability and redundancy to avoid performance delays or outages and/or may not be scalable to meet increasing user demands. If our products are unavailable when users attempt to access them, or if the products do not load or perform as quickly as users expect, they may decrease or discontinue their use of our products, which could be harmful to our business, results of operations, and financial condition. Our third-party service providers along with their datacenters and other facilities are also vulnerable to damage or interruption from human error, intentional bad acts, security breaches and other catastrophic events, any of which could disrupt the availability of our products and/or compromise or destroy user content, which could be harmful to our business, results of operations, and financial condition.

Current wording

We also depend on third-party service providers to provide the data centers and other infrastructure necessary to certain of our products. Any disruption in the services provided by these third parties or any failure to renew the services could adversely affect the performance of products or result in a loss of user content, resulting in harm to our business and reputation. Customers rely on certain of our products to transfer or process their content. The infrastructure on which our products rely may not be adequately designed with sufficient reliability and redundancy to avoid performance delays or outages and/or may not be scalable to meet increasing user demands. If our products are unavailable when users attempt to access them, or if the products do not load or perform as quickly as users expect, they may decrease or discontinue their use of our products, which could be harmful to our business, results of operations, and financial condition. Our third-party service providers along with their data centers and other facilities are also vulnerable to damage or interruption from human error, intentional bad acts, security breaches, and other catastrophic events, any of which could disrupt the availability of our products and/or compromise or destroy user content, which could be harmful to our business, results of operations, and financial condition.

Previous wording

In addition, governmental entities in the U.S. and other countries have enacted or are considering enacting legislation or regulations or may in the near future interpret existing legislation or regulations, in a manner that could significantly impact our ability and the ability of our customers and data partners to collect, augment, analyze, use, transfer and share personal and other information that is integral to certain business functions. For example, U.S. states like Texas and Oregon enacted data privacy laws that took effect in 2024, both of which expanded the consumer's privacy rights and the obligations to the organizations doing business in those states. Other U.S. state legislatures have also implemented varying privacy laws and regulations, or are considering implementing legislation that we expect to become effective in the near term. Moreover, several privacy bills are under congressional review at the U.S. federal level.

Current wording

In addition, governmental entities in the U.S. and other countries have enacted or are considering enacting legislation or regulations or may in the near future interpret existing legislation or regulations, in a manner that could significantly impact our ability and the ability of our customers and data partners to collect, augment, analyze, use, transfer, and share personal and other information that is integral to certain business functions. For example, approximately twenty U.S. state legislatures have implemented varying privacy laws and regulations, or are considering implementing legislation that we expect to become effective in the near term. Moreover, several privacy bills are under congressional review at the U.S. federal level.

Previous wording

We could incur substantial cost in protecting our proprietary software technology and if we fail to protect our technology, we could incur material harm to our business. We rely principally on a combination of contract provisions and copyright, trademark, patent and trade secret laws to protect our proprietary technology. Despite our efforts to protect our proprietary rights, unauthorized parties may attempt to copy aspects of our products or to obtain and use information that we regard as proprietary. Policing unauthorized use of our products is difficult. Litigation may be necessary in the future to enforce our intellectual property rights, to protect our trade secrets or to determine the validity and scope of the proprietary rights of others. This litigation could result in substantial costs and diversion of resources, whether or not we ultimately prevail on the merits. The steps we take to protect our proprietary rights may be inadequate to prevent misappropriation of our technology; moreover, others could independently develop similar technology.

Current wording

We could incur substantial costs in protecting our proprietary software technology, and if we fail to protect our technology we could incur material harm to our business. We rely principally on a combination of contract provisions and copyright, trademark, patent, and trade secret laws to protect our proprietary technology. Despite our efforts to protect our proprietary rights, unauthorized parties may attempt to copy aspects of our products or to obtain and use information that we regard as proprietary. Policing unauthorized use of our products is difficult. Litigation may be necessary in the future to enforce our intellectual property rights, to protect our trade secrets, or to determine the validity and scope of the proprietary rights of others. This litigation could result in substantial costs and diversion of resources, whether or not we ultimately prevail on the merits. The steps we take to protect our proprietary rights may be inadequate to prevent misappropriation of our technology; moreover, others could independently develop similar technology.

Previous wording

We are currently operating in a period of economic uncertainty and capital markets disruption due to various geopolitical and macro-economic factors, which may materially adversely affect our business, financial condition, and results of operations. The overall macro global economy, including ongoing military conflicts in Ukraine and the Middle East, and increasing tensions between the U.S. and China, remain unpredictable and has already led to market disruptions, including volatile capital markets, higher interest rates and debt capital costs, diminished liquidity and credit availability, declines in consumer confidence and discretionary spending, as well as supply chain disruptions and increases in costs of certain raw materials and transportation, which have in turn contributed to global inflationary pressures. Prolonged unrest, military activities, or broad-based sanctions could have a material adverse effect on our operations and business outlook. Given our meaningful reliance on revenue generated outside of North America (which constituted 41% of our total revenue in fiscal 2024) and our reliance on revenue generated in EMEA (which constituted 33% of our total revenue in fiscal 2024), disruption of commercial activities in these regions may materially adversely affect our financial condition and results of operations. Although we cannot predict what the impacts may be, our global operations and reliance on interconnected technology increase the risk to our operations.

Current wording

We are currently operating in a period of economic uncertainty and capital markets disruption due to various geopolitical and macro-economic factors, which may materially adversely affect our business, financial condition, and results of operations. The overall macro global economy, including ongoing military conflicts in Ukraine and the Middle East, and increasing tensions between the U.S. and China, remain unpredictable and has already led to market disruptions, including volatile capital markets, higher interest rates and debt capital costs, diminished liquidity and credit availability, declines in consumer confidence and discretionary spending, as well as supply chain disruptions and increases in costs of certain raw materials and transportation, which have in turn contributed to global inflationary pressures. Prolonged unrest, military activities, or broad-based sanctions could have a material adverse effect on our operations and business outlook. Given our meaningful reliance on revenue generated outside of North America (which constituted 36% of our total revenue in fiscal 2025) and our reliance on revenue generated in EMEA (which constituted 29% of our total revenue in fiscal 2025), disruption of commercial activities in these regions may materially adversely affect our financial condition and results of operations. Although we cannot predict what the impacts may be, our global operations and reliance on interconnected technology increase the risk to our operations.

Previous wording

Fluctuations in foreign currency exchange rates or interest rates have had, and could continue to have, an adverse impact on our financial condition and results of operations. Changes in the value of foreign currencies relative to the U.S. dollar and related changes in interest rates have adversely affected our results of operations and financial position and could continue to do so. In recent periods, as the value of the U.S. dollar has strengthened in comparison to certain foreign currencies (particularly in EMEA), our reported international revenue has been reduced because foreign currencies translate into fewer U.S. dollars. As approximately one-third of our revenue is denominated in foreign currencies, these exchange rate fluctuations have impacted, and we expect will continue to impact, our revenue results. Please see Management’s Discussion and Analysis of Financial Condition and Results of Operations in Part II, Item 7 for additional information. We seek to reduce our exposure to fluctuations in exchange rates by entering into foreign exchange forward contracts to hedge certain actual and forecasted transactions of selected currencies (mainly in Europe, Brazil, India and Australia); however, our currency hedging transactions may not be effective in reducing the adverse impact of fluctuations in foreign currency exchange rates. Further, as geopolitical volatility around the world increases, there is increasing risk of the imposition of exchange or price controls, or other restrictions on the conversion of foreign currencies, which could have a material adverse effect on our business, financial condition and operating results.

Current wording

Fluctuations in foreign currency exchange rates or interest rates have had, and could continue to have, an adverse impact on our financial condition and results of operations. Changes in the value of foreign currencies relative to the U.S. Dollar and related changes in interest rates have adversely affected our results of operations and financial position in the past and could do so again in the future. In the past, as the value of the U.S. Dollar has strengthened in comparison to certain foreign currencies (particularly in EMEA), our reported international revenue has been reduced because foreign currencies translate into fewer U.S. Dollars. As approximately one-third of our revenue is denominated in foreign currencies, these exchange rate fluctuations have impacted, and we expect will continue to impact, our revenue results. Please see Management's Discussion and Analysis of Financial Condition and Results of Operations in Part II, Item 7 for additional information. We seek to reduce our exposure to fluctuations in exchange rates by entering into foreign exchange forward contracts to hedge certain actual and forecasted transactions of selected currencies (mainly in Europe, Brazil, India and Australia); however, our currency hedging transactions may not be effective in reducing the adverse impact of fluctuations in foreign currency exchange rates. Further, as geopolitical volatility around the world increases, there is increasing risk of the imposition of exchange or price controls, or other restrictions on the conversion of foreign currencies, which could have a material adverse effect on our business, financial condition and operating results.

Previous wording

Our revenue and quarterly results may fluctuate, which could adversely affect the market price of our common stock. We have experienced, and may in the future experience, significant fluctuations in our quarterly operating results that may be caused by many factors. These factors include:

Current wording

Our stock price has been, and may continue to be, volatile, and your investment could lose value. Our revenue and quarterly results may fluctuate, which could adversely affect the market price of our common stock. We have experienced, and may in the future experience, fluctuations in our quarterly operating results that may be caused by a variety of factors, including:

Previous wording

•changes in the level of operating expenses, including unforeseen expenses incurred in connection with items such as cyber security instances;

Current wording

•changes in the level of operating expenses, including unforeseen expenses incurred in connection with items such as cybersecurity instances;

Previous wording

The market price of our common stock, like that of other technology companies, is volatile and is subject to wide fluctuations in response to quarterly variations in operating results, announcements of technological innovations or new products by us or our competitors, changes in financial estimates by securities analysts or other events or factors. The market price of our common stock may also be affected by broader market trends unrelated to our performance. As a result, purchasers of our common stock may be unable at any given time to sell their shares at or above the price they paid for them.

Current wording

The market price of our common stock, like that of other technology companies, is volatile and is subject to wide fluctuations in response to a variety of factors, including operating results, announcements of technological innovations or new products by us or our competitors; the proliferation and anticipated impact of AI on the technology sector; changes in financial estimates by securities analysts; purchases or sales of our stock by our officers or directors; repurchases of shares of our common stock; the issuance of additional shares or securities convertible into, or exchangeable or exercisable for, shares of our common stock, including upon the conversion of the Notes (as defined below) or under our equity compensation plans, general economic conditions and other macroeconomic factors; or other events or factors. The market price of our common stock may also be affected by broader market trends unrelated to our performance. As a result, purchasers of our common stock may be unable at any given time to sell their shares at or above the price they paid for them.

Previous wording

In addition, our future effective tax rates could be favorably or unfavorably affected by changes in tax rates, changes in the valuation of our deferred tax assets or liabilities, or changes in tax laws including Pillar Two legislation adopted as part of the Organization for Economic Cooperation and Development (“OECD”) inclusion Framework, which established a global minimum corporate tax rate of 15% for certain multinational enterprises, or the interpretation of such laws. Such changes could have a material adverse impact on our financial results.

Current wording

In addition, our future effective tax rates could be favorably or unfavorably affected by changes in tax rates, changes in the valuation of our deferred tax assets or liabilities, or changes in tax laws including Pillar Two legislation adopted as part of the Organization for Economic Cooperation and Development Inclusive Framework, which established a global minimum corporate tax rate of 15% for certain multinational enterprises, or the interpretation of such laws. Such changes could have a material adverse impact on our financial results.

Previous wording

Our indebtedness and liabilities could limit the cash flow available for our operations and expose us to risks that could adversely affect our business, financial condition and results of operations. As of November 30, 2024, we had approximately $1.5 billion of consolidated indebtedness. We may also incur additional indebtedness to meet future financing needs. Our indebtedness could have significant adverse consequences for our security holders and our business, results of operations and financial condition by, among other things:

Current wording

Our indebtedness and liabilities could limit the cash flow available for our operations and expose us to risks that could adversely affect our business, financial condition, and results of operations. As of November 30, 2025, we had approximately $1.4 billion of consolidated indebtedness. We may also incur additional indebtedness to meet future financing needs. Our indebtedness could have significant adverse consequences for our security holders and our business, results of operations, and financial condition by, among other things:

Previous wording

•diluting the interests of our existing stockholders as a result of issuing shares of our common stock upon conversion of our Convertible Senior Notes with an aggregate principal amount of $360 million, due April 15, 2026, and an aggregate principal amount of $450 million, due March 1, 2030 (together, the "Notes"); and

Current wording

•diluting the interests of our existing stockholders as a result of issuing shares of our common stock upon conversion of our Convertible Senior Notes with an aggregate principal amount of $360.0 million, due April 15, 2026 (the "2026 Notes"), and an aggregate principal amount of $450.0 million, due March 1, 2030 (the "2030 Notes" and, together with the 2026 Notes, the "Notes"); and

Previous wording

We are required to comply with certain financial and operating covenants under our Credit Facility and to make scheduled debt payments as they become due; any failure to comply with those covenants or to make scheduled payments could cause amounts borrowed under the facility to become immediately due and payable or prevent us from borrowing under the facility. In March 2024, we entered into a Fourth Amended and Restated Credit Agreement (the "Credit Agreement"), which provides for a $900.0 million secured revolving credit facility (which may be increased if the existing or additional lenders are willing to make such increased commitments) (the "Credit Facility"). This Credit Facility matures in March 2029, at which time any amounts outstanding will be due and payable in full. We may wish to borrow additional amounts under the facility in the future to support our operations, including for strategic acquisitions and share repurchases.

Current wording

We are required to comply with certain financial and operating covenants under our Credit Facility and to make scheduled debt payments as they become due; any failure to comply with those covenants or to make scheduled payments could cause amounts borrowed under the facility to become immediately due and payable or prevent us from borrowing under the facility. In July 2025, we entered into an amended and restated credit agreement (the "Credit Agreement") with certain lenders, which provides for a $1.5 billion secured revolving credit facility (the "Credit Facility"). This Credit Facility matures on the earlier of July 2030 or the date that is 91 days prior to the maturity date of our 2030 Notes (subject to certain conditions), at which time any amounts outstanding will be due and payable in full. We may wish to borrow additional amounts under the facility in the future to support our operations, including for strategic acquisitions and share repurchases.

Previous wording

We are required to comply with specified financial and operating covenants and to make scheduled repayments of our term loan, which may limit our ability to operate our business as we otherwise might operate it. Our failure to comply with any of these covenants or to meet any payment obligations under the facility could result in an event of default which, if not cured or waived, would result in any amounts outstanding, including any accrued interest and unpaid fees, becoming immediately due and payable. We might not have sufficient working capital or liquidity to satisfy any repayment obligations in the event of an acceleration of those obligations. In addition, if we are not in compliance with the financial and operating covenants at the time we wish to borrow funds, we will be unable to borrow funds.

Current wording

We are required to comply with specified financial and operating covenants of the Credit Facility, which may limit our ability to operate our business as we otherwise might operate it. Our failure to comply with any of these covenants or to meet any payment obligations under the Credit Facility could result in an event of default which, if not cured or waived, would result in any amounts outstanding, including any accrued interest and unpaid fees, becoming immediately due and payable. We might not have sufficient working capital or liquidity to satisfy any repayment obligations in the event of an acceleration of those obligations. In addition, if we are not in compliance with the financial and operating covenants at the time we wish to borrow funds, we will be unable to borrow funds.