BOX INC

Previous wording

The market for cloud content management services is fragmented, rapidly evolving and highly competitive, with relatively low barriers to entry for certain applications and services. Many of our competitors and potential competitors are larger and have greater brand recognition, longer operating histories, and significantly greater resources than we do. Our primary competitors in the cloud content management market include Microsoft (SharePoint) and OpenText (Documentum). In the enterprise file sync and share market, our primary competitors include Microsoft (OneDrive), Google (Drive) and, to a lesser extent, Dropbox. We also compete with companies in the e-signature, content collaboration, workflow automation, and security and governance markets. With the introduction of new technologies and market entrants, we expect competition to intensify in the future. For example, disruptive technologies such as generative AI may fundamentally alter the market for our services in unpredictable ways, including reduced customer demand and increased costs of doing business. If we fail to compete effectively, our business will be harmed. Some of our competitors offer their products or services at lower prices or for free as part of a broader bundled product sale or enterprise license arrangement, which has placed pricing pressure on our business. If we are unable to achieve our target pricing levels, our operating results will be negatively impacted. For us to compete effectively, we need to introduce new products and services in a timely and cost-effective manner, meet customer expectations and needs at prices that customers are willing to pay, and continue to enhance the features and functionalities of our cloud content management platform. In addition, pricing pressures and increased competition could result in reduced sales, lower margins, losses or the failure of our services to achieve or maintain widespread market acceptance, any of which could harm our business.

Current wording

The market for cloud content management services is fragmented, rapidly evolving and highly competitive, with relatively low barriers to entry for certain applications and services. Many of our competitors and potential competitors are larger and have greater brand recognition, longer operating histories, and significantly greater resources than we do. Our primary competitors in the enterprise content management market include Microsoft (SharePoint) and OpenText (Documentum). In the enterprise file sync and share market, our primary competitors include Microsoft (OneDrive), Google (Drive) and, to a lesser extent, Dropbox. We also compete with companies in the e-signature, content collaboration, workflow automation, artificial intelligence, and security and governance markets. With the introduction of new technologies and market entrants, we expect competition to intensify in the future and our primary competitors may change. For example, disruptive technologies such as generative AI may fundamentally alter the market for our services in unpredictable ways, including reduced customer demand and increased costs of doing business. If we fail to compete effectively, our business will be harmed. Some of our competitors offer their products or services at lower prices or for free as part of a broader bundled product sale or enterprise license arrangement, which has placed pricing pressure on our business. If we are unable to achieve our target pricing levels, our operating results will be negatively impacted. For us to compete effectively, we need to introduce new products and services in a timely and cost-effective manner, meet customer expectations and needs at prices that customers are willing to pay, and continue to enhance the features and functionalities of our cloud content management platform. In addition, pricing pressures and increased competition could result in reduced sales, lower margins, losses or the failure of our services to achieve or maintain widespread market acceptance, any of which could harm our business.

Previous wording

To improve our operating results, it is important that our customers renew their subscriptions with us when their existing subscription term expires. We cannot assure you that customers will renew their subscriptions upon expiration at the same or higher level of service, for the same number of seats or for the same duration of time, if at all. Our net retention rate has fluctuated from period to period and it may decrease again in the future if our customers do not renew their subscriptions with us or decrease their use of our services. Our net retention rate was approximately 101% and 106% as of April 30, 2024 and 2023, respectively.

Current wording

To improve our operating results, it is important that our customers renew their subscriptions with us when their existing subscription term expires. We cannot assure you that customers will renew their subscriptions upon expiration at the same or higher level of service, for the same number of seats or for the same duration of time, if at all. Our net retention rate has fluctuated from period to period and it may decrease again in the future if our customers do not renew their subscriptions with us or decrease their use of our services. Our net retention rate was approximately 102% and 103% as of July 31, 2024 and 2023, respectively.

Previous wording

In addition, our business growth depends in part on our customers expanding their use of our services. The use of our cloud content management platform often expands within an organization as new users are added or as additional services are purchased by or for other departments within an organization. Further, as we have introduced new services throughout our operating history, our existing customers have constituted a significant portion of the users of such services. If our customers do not expand their use of our services, our operating results may be adversely affected.

Current wording

In addition, our business growth depends in part on our customers expanding their use of our services. The use of our cloud content management platform often expands within an organization as new users are added or as additional services are purchased by or for other departments within an organization. Further, as we have introduced new services throughout our operating history, our existing customers have constituted a significant portion of the users of such services, including our recent Box AI offerings. If our customers do not expand their use of our services, our operating results may be adversely affected.

Previous wording

The market for cloud-based enterprise services is not as mature as the on-premise enterprise software market. Because we derive, and expect to continue to derive, substantially all of our revenue and cash flows from sales of our cloud content management solutions, our success will depend to a substantial extent on the widespread adoption of cloud computing in general and of cloud-based content management services in particular. Many organizations have invested substantial personnel and financial resources to integrate traditional enterprise software into their organizations and may be reluctant or unwilling to migrate to a cloud-based model for managing their content. It is difficult to predict customer adoption rates and demand for our services, the future growth rate and size of the cloud computing market or the entry of competitive services. The expansion of the cloud content management market depends on a number of factors, including the cost, performance and perceived value associated with cloud computing, as well as the ability of companies that provide cloud-based services to address security and privacy concerns. If there is a reduction in demand for cloud-based services, it could result in decreased revenue, harm our growth rates, and adversely affect our business and operating results.

Current wording

Since we derive, and expect to continue to derive, substantially all of our revenue and cash flows from sales of our cloud content management solutions, our success will depend to a substantial extent on the widespread adoption of cloud computing in general and of cloud-based content management services in particular. Many organizations have invested substantial personnel and financial resources to integrate traditional enterprise software into their organizations and may be reluctant or unwilling to migrate to a cloud-based model for managing their content. It is difficult to predict customer adoption rates and demand for our services, the future growth rate and size of the cloud computing market or the entry of competitive services. The expansion of the cloud content management market depends on a number of factors, including the cost, performance and perceived value associated with cloud computing, as well as the ability of companies that provide cloud-based services to address security and privacy concerns. If there is a reduction in demand for cloud-based services, it could result in decreased revenue, harm our growth rates, and adversely affect our business and operating results.

Previous wording

To improve our operating results and continue growing our business, it is important that we continue to attract new customers and expand deployment of our solutions and products with existing customers. To the extent we are successful in increasing our customer base, we could incur increased losses because costs associated with new customers are generally incurred up front, while revenue is recognized ratably over the term of our subscription services. Alternatively, to the extent we are unsuccessful in increasing our customer base, we could also incur increased losses as costs associated with marketing programs and new products intended to attract new customers would not be offset by incremental revenue and cash flow. Changes in economic conditions may financially impact our existing and prospective customers and cause them to delay or reduce their technology spending, which may adversely affect our ability to attract new customers. For example, our business has been impacted by pressure from customers’ lower headcount growth and greater budget scrutiny on IT decisions since the second half of fiscal year 2023. All of these factors could negatively impact our future revenue and operating results.

Current wording

To improve our operating results and continue growing our business, it is important that we continue to attract new customers and expand deployment of our solutions and products with existing customers. To the extent we are successful in increasing our customer base, we could incur increased losses because costs associated with new customers are generally incurred up front, while revenue is recognized ratably over the term of our subscription services. Alternatively, to the extent we are unsuccessful in increasing our customer base, we could also incur increased losses as costs associated with marketing programs and new products intended to attract new customers would not be offset by incremental revenue and cash flow. Changes in economic conditions may financially impact our existing and prospective customers and cause them to delay or reduce their technology spending, which may adversely affect our ability to attract new customers. For example, our business continues to be impacted by pressure from customers’ lower headcount growth and greater budget scrutiny on IT decisions. All of these factors could negatively impact our future revenue and operating results.

Previous wording

Our business depends on the overall demand for cloud content management services and on the economic health of our current and prospective customers. The United States and other key international economies have experienced cyclical downturns from time to time that have resulted in a significant weakening of the economy, more limited availability of credit, a reduction in business confidence and activity, and other difficulties that may affect the industries to which we sell our services. An economic downturn, recession, or uncertainty about economic conditions, including volatility in the credit, equity and foreign exchange markets, inflation, rising interest rates, potential United States (U.S.) sovereign default, bank failures and financial instability, ongoing supply chain disruptions, unemployment trends, the adverse effects of pandemics and geopolitical issues, such as the Hamas-Israel and Russia-Ukraine conflicts, could cause customers to delay or reduce their information technology spending. This has in the past and may in the future result in reduced sales, longer sales cycles, reduced renewal rates, slower adoption of new technologies, and increased price competition. Any of these events would likely have an adverse effect on our business, operating results and financial position. Since the second half of our fiscal year 2023, we have seen an impact from additional customer scrutiny being placed on deals due to the economic environment. In addition, there can be no assurance that cloud content management and collaboration spending levels will increase following any recovery.

Current wording

Our business depends on the overall demand for cloud content management services and on the economic health of our current and prospective customers. The United States and other key international economies have experienced cyclical downturns from time to time that have resulted in a significant weakening of the economy, more limited availability of credit, a reduction in business confidence and activity, and other difficulties that may affect the industries to which we sell our services. An economic downturn, recession, or uncertainty about economic conditions, including volatility in the credit, equity and foreign exchange markets, inflation, rising interest rates, potential United States (U.S.) sovereign default, bank failures and financial instability, ongoing supply chain disruptions, unemployment trends, the adverse effects of pandemics and geopolitical issues, such as the Hamas-Israel and Russia-Ukraine conflicts, could cause customers to delay or reduce their information technology spending. This has in the past and may in the future result in reduced sales, longer sales cycles, reduced renewal rates, slower adoption of new technologies, and increased price competition. Any of these events would likely have an adverse effect on our business, operating results and financial position. We continue to face challenges from customers scrutinizing deals more closely due to the economic environment. In addition, there can be no assurance that enterprise content management and collaboration spending levels will increase following any recovery.

Previous wording

Issues relating to the use of new and evolving technologies such as generative AI powered by large language models and machine learning that we integrate into our product offerings may cause us to experience brand or reputational harm, competitive harm, legal liability, new or enhanced governmental or regulatory scrutiny, and to incur additional costs to resolve such issues. As with many innovations, AI presents risks and challenges that could undermine or slow its adoption, and therefore harm our business. For example, perceived or actual technical, legal, compliance, privacy, security, ethical or other issues relating to the use of AI may cause public confidence in AI to be undermined, which could slow our customers’ adoption of our products and services that use AI. In addition, litigation or government regulation related to the use of AI may also adversely impact our and others’ abilities to develop and offer products that use AI, as well as increase the cost and complexity of doing so. Developing, testing and deploying third-party AI systems may also increase the cost profile of our product offerings due to the nature of the computing costs involved in such systems, which could impact our margins and adversely affect our business and operating results. Our business may be disrupted if any of the third-party AI services we use become unavailable due to extended outages or interruptions or because they are no longer available on commercially reasonable terms or prices. Further, market demand and acceptance of AI technologies are uncertain, and we may be unsuccessful in our product development efforts.

Current wording

Issues relating to the use of new and evolving technologies such as generative AI powered by large language models and machine learning that we integrate into our product offerings may cause us to experience brand or reputational harm, competitive harm, legal liability, new or enhanced governmental or regulatory scrutiny, and to incur additional costs to resolve such issues. As with many innovations, AI presents risks and challenges that could undermine or slow its adoption, and therefore harm our business. For example, perceived or actual technical, legal, compliance, privacy, security, ethical or other issues relating to the use of AI may cause public confidence in AI to be undermined, which could slow our customers’ adoption of our products and services that use AI. In addition, litigation or government regulation related to the use of AI may also adversely impact our and others’ abilities to develop and offer products that use AI, as well as increase the cost and complexity of doing so. For example, the European Parliament adopted legislation, the EU AI Act on March 13, 2024, that imposes significant obligations related to the use of AI systems and is anticipated to be augmented by secondary legislation in the European Union. Additionally, on October 30, 2023, President Biden issued a robust Executive Order on AI (“EO 14110”) with the goal of promoting safe, secure, and trustworthy development and use of AI. EO 14110 may ultimately create certain de facto standards and practices given the size and influence of the U.S. government as a customer to major tech companies, like Box. Furthermore, in the U.S Senate, committees of jurisdiction passed several AI bills that establish additional industry standards and further impose significant obligations in relation to the use of AI systems. On the state level, several U.S. states have considered AI legislation, including California, which aims to reduce risk associated with the use of AI; while certain states have passed comprehensive AI legislation, such as the Colorado AI Act, which will go into effect in February 2026. Developing, testing, and deploying third-party AI systems may also increase the cost profile of our product offerings due to the nature of the computing costs involved in such systems, which could impact our margins and adversely affect our business and operating results. Our business may be disrupted if any of the third-party AI services we use become unavailable due to extended outages or interruptions or because they are no longer available on commercially reasonable terms or prices. Further, market demand and acceptance of AI technologies are uncertain, and we may be unsuccessful in our product development efforts.

Previous wording

We sell our services and incur operating expenses in various currencies. Therefore, fluctuations in the relative value of the U.S. dollar and foreign currencies, particularly the Japanese Yen, and to a lesser extent, the British pound and the Euro, may impact our operating results. For example, the Japanese Yen, the British pound and the Euro have all experienced declines in value vis-à-vis the U.S. dollar, which negatively affected our results of operations during the year ended January 31, 2024 and the three months ended April 30, 2024 and could continue to negatively impact our results of operations in future periods. We currently primarily manage our exchange rate risk by maintaining offsetting foreign currency assets and liabilities and by minimizing non-U.S. dollar cash balances, and we have begun implementing hedging programs in fiscal year 2025 to further mitigate the risk of exchange rate fluctuations. Such practices may not ultimately be available and/or effective at mitigating the foreign currency risk to which we are exposed. If we are unsuccessful in detecting material exposures in a timely manner, any hedging strategies we deploy are not effective, or there are no hedging strategies available for certain exposures that are prudent given the associated risks and the potential mitigation of the underlying exposure achieved, our operating results or financial position could be negatively affected in the future.

Current wording

We sell our services and incur operating expenses in various currencies. Therefore, fluctuations in the relative value of the U.S. dollar and foreign currencies, particularly the Japanese Yen, and to a lesser extent, the British pound and the Euro, may impact our operating results. For example, the Japanese Yen has experienced a decline in value vis-à-vis the U.S. dollar, which negatively affected our results of operations during the year ended January 31, 2024 and the six months ended July 31, 2024 and could continue to negatively impact our results of operations in future periods. We currently primarily manage our exchange rate risk by maintaining offsetting foreign currency assets and liabilities and by minimizing non-U.S. dollar cash balances, and we have begun implementing hedging programs in fiscal year 2025 to further mitigate the risk of exchange rate fluctuations. Such practices may not ultimately be available and/or effective at mitigating the foreign currency risk to which we are exposed. If we are unsuccessful in detecting material exposures in a timely manner, any hedging strategies we deploy are not effective, or there are no hedging strategies available for certain exposures that are prudent given the associated risks and the potential mitigation of the underlying exposure achieved, our operating results or financial position could be negatively affected in the future.

Previous wording

We generated net income of $129.0 million and $26.8 million during the years ended January 31, 2024 and 2023, respectively, and incurred a net loss of $41.5 million during the year ended January 31, 2022. We generated net income of $17.2 million in the three months ended April 30, 2024. As of April 30, 2024, we had an accumulated deficit of $1.2 billion. The accumulated deficit reflect the substantial investments we made to acquire new customers and develop our services. We intend to continue scaling our business to increase our number of users and paying organizations and to meet the increasingly complex needs of our customers and may incur additional expenses as we make investments to scale our business. Further, it is difficult to predict the size and growth rate of our market, customer demand for our platform and for any new features or products we develop, and the success of competitive products or services. As a result, we may not sustain profitable growth in future periods.

Current wording

We generated net income of $129.0 million and $26.8 million during the years ended January 31, 2024 and 2023, respectively, and incurred a net loss of $41.5 million during the year ended January 31, 2022. We generated net income of $37.7 million in the six months ended July 31, 2024. As of July 31, 2024, we had an accumulated deficit of $1.2 billion. The accumulated deficit reflect the substantial investments we made to acquire new customers and develop our services. We intend to continue scaling our business to increase our number of users and paying organizations and to meet the increasingly complex needs of our customers and may incur additional expenses as we make investments to scale our business. Further, it is difficult to predict the size and growth rate of our market, customer demand for our platform and for any new features or products we develop, and the success of competitive products or services. As a result, we may not sustain profitable growth in future periods.

Previous wording

We cannot guarantee that any security measures that we or third parties on which we rely have implemented will be completely effective against current or future security threats, or that our systems and networks or those of such third parties have not been breached or otherwise compromised, or that they and any software in our or their supply chains do not contain bugs, vulnerabilities, or compromised code that could result in a breach of or disruption to our systems and networks or the systems and networks of third parties that support us or our products or services. Given that our customers manage significant amounts of sensitive and proprietary information on our platform, and many of our customers are in heavily regulated industries where there may be a greater concentration of sensitive and proprietary data, our reputation and market position are particularly sensitive to impacts from actual or perceived security breaches or incidents, security vulnerabilities, or concerns regarding security. If our security measures or those of third parties on which we rely are or are believed to be inadequate or breached or otherwise compromised as a result of third-party action, employee negligence, error or malfeasance, product defects, social engineering techniques, improper user configuration or otherwise, and this results in, or is believed to result in, unauthorized access to or disclosure, modification, misuse, loss, corruption, unavailability, or destruction of our data or our customers’ data, or any other disruption of the confidentiality, integrity or availability of our data or our customers’ data, we could incur significant liability to various parties, including our customers and individuals or organizations whose information is stored by our customers, and our business, reputation or competitive position may be harmed. Techniques used to obtain unauthorized access to, or to sabotage, systems or networks, are constantly evolving and generally are not recognized until launched against a target. Therefore, we may be unable to anticipate these techniques, react in a timely manner, or implement adequate preventive measures, and we may face delays in our detection or remediation of, or other responses to, security breaches and other security-related incidents or vulnerabilities. We have observed increased level of sophistication in the types of techniques, including social engineering techniques, that malicious third parties may use in an attempt to gain access to our or our users’ data. Due to the Hamas-Israel and Russia-Ukraine conflicts, or other areas of geopolitical tension around the world, we and the third parties on which we rely are vulnerable to a heightened risk of cybersecurity attacks, social engineering attacks, viruses, malware, ransomware, hacking or similar breaches and incidents from nation-state and affiliated actors, including attacks that could materially disrupt our supply chain and our systems, operations and platform. Addit…

Excerpt shortened here; the source contains the full paragraph.

Current wording

We cannot guarantee that any security measures that we or third parties on which we rely have implemented will be completely effective against current or future security threats, or that our systems and networks or those of such third parties have not been breached or otherwise compromised, or that they and any software in our or their supply chains do not contain bugs, vulnerabilities, or compromised code that could result in a breach of or disruption to our systems and networks or the systems and networks of third parties that support us or our products or services. Given that our customers manage significant amounts of sensitive and proprietary information on our platform, and many of our customers are in heavily regulated industries where there may be a greater concentration of sensitive and proprietary data, our reputation and market position are particularly sensitive to impacts from actual or perceived security breaches or incidents, security vulnerabilities, or concerns regarding security. If our security measures or those of third parties on which we rely are or are believed to be inadequate or breached or otherwise compromised as a result of third-party action, employee negligence, error or malfeasance, product defects, social engineering techniques, improper user configuration or otherwise, and this results in, or is believed to result in, unauthorized access to or disclosure, modification, misuse, loss, corruption, unavailability, or destruction of our data or our customers’ data, or any other disruption of the confidentiality, integrity or availability of our data or our customers’ data, we could incur significant liability to various parties, including our customers and individuals or organizations whose information is stored by our customers, and our business, reputation or competitive position may be harmed. Techniques used to obtain unauthorized access to, or to sabotage, systems or networks, are constantly evolving and generally are not recognized until launched against a target. Therefore, we may be unable to anticipate these techniques, react in a timely manner, or implement adequate preventive measures, and we may face delays in our detection or remediation of, or other responses to, security breaches and other security-related incidents or vulnerabilities. We have observed increased levels of sophistication in the types of techniques, including social engineering techniques, that malicious third parties may use in an attempt to gain access to our or our users’ data. Due to the Hamas-Israel and Russia-Ukraine conflicts, or other areas of geopolitical tension around the world, we and the third parties on which we rely are vulnerable to a heightened risk of cybersecurity attacks, social engineering attacks, viruses, malware, ransomware, hacking or similar breaches and incidents from nation-state and affiliated actors, including attacks that could materially disrupt our supply chain and our systems, operations and platform. Addi…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

In 2018, the State of California enacted the California Consumer Privacy Act (CCPA), which became operative on January 1, 2020. The CCPA requires covered companies to, among other things, provide new disclosures to California consumers and afford such consumers new abilities to opt-out of certain sales of personal information. Additionally, the California Privacy Rights Act (CPRA) was approved by California voters in November 2020 and amended and expanded the CCPA. The CPRA’s substantive provisions became effective on January 1, 2023, and the newly formed California Privacy Protection Agency began its rulemaking process to adopt proposed regulations, with an enforcement date of March 29, 2024. Our CPRA compliance efforts are subject to change and may result in continued uncertainty and require additional costs and expenses to ensure readiness, compliance and decrease risks. Further, other states have been considering, and in some cases enacting, laws relating to privacy and cybersecurity, many of which are comprehensive privacy statutes imposing obligations similar to the CCPA and CPRA. For example, Virginia, Colorado, Connecticut, and Utah enacted such legislation that became effective in 2023, and Delaware, Tennessee, Iowa, Indiana,

Current wording

In 2018, the State of California enacted the California Consumer Privacy Act (CCPA), which became operative on January 1, 2020. The CCPA requires covered companies to, among other things, provide new disclosures to California consumers and afford such consumers new abilities to opt-out of certain sales of personal information. Additionally, the California Privacy Rights Act (CPRA) was approved by California voters in November 2020 and amended and expanded the CCPA. The CPRA’s substantive provisions became effective on January 1, 2023, and the newly formed California Privacy Protection Agency began its rulemaking process to adopt proposed regulations, with an enforcement date of March 29, 2024. Our CPRA compliance efforts are subject to change and may result in continued uncertainty and require additional costs and expenses to ensure readiness, compliance and decrease risks. Further, other states have been considering, and in some cases enacting, laws relating to privacy and cybersecurity, many of which are comprehensive privacy statutes imposing obligations similar to the CCPA and CPRA. For example, laws enacted in Virginia, Colorado, Utah, Texas, and Oregon are currently effective, Montana has enacted such legislation that becomes effective on October 1, 2024, and laws enacted in Delaware, Tennessee, Iowa, Indiana, Maryland, Nebraska, New Hampshire, New Jersey, Kentucky, Minnesota, and Rhode Island will become effective between 2025 and 2026. Other U.S. states, including Pennsylvania, Massachusetts, and North Carolina, are anticipated to follow suit. Other states have also enacted privacy laws relating to particular subject matter, such as Washington's enactment of the My Health, My Data Act, which includes a private right of action. Efforts to comply with these laws and related fluctuations in laws relating to privacy and cybersecurity at the federal, state and local levels may impact readiness and compliance, along with the potential to incur additional costs. We cannot fully predict the impact of these laws and other proposed federal and state laws relating to privacy and cybersecurity on our business or operations, but they may require us to modify our data processing practices and policies and incur substantial costs and expenses in an effort to comply.

Previous wording

There are a number of data protection, security, privacy and other government- and industry-specific requirements, including those that require companies to notify individuals of data security incidents involving certain types of personal data. Security compromises experienced by our competitors, by our customers or by us may lead to public disclosures, which could harm our reputation, erode customer confidence in the effectiveness of our security measures, negatively impact our ability to attract new customers, or cause existing customers to elect not to renew their agreements with us. Our customers also expect, and in some instances require, us to meet voluntary certifications or adhere to guidelines or standards established by third parties, to offer particular controls, or otherwise support customer-specific requirements. Although we currently have certain certifications such as AICPA SOC 1, 2 and 3 reports, and ISO/IEC 27001, 27017, 27018, and 27701 we may not be successful in continuing to maintain these certifications or in obtaining other certifications or otherwise being able to adhere to or comply with all customer requirements. In addition, some of the industries and/or regions that we serve have specific requirements relating to security and regulatory standards, such as GxP, FedRAMP and StateRAMP, and those required by HIPAA, FINRA, HITECH Act, the Data Privacy Framework and Asia-Pacific Economic Cooperation Privacy Recognition for Processors and Cross Border Privacy Rules. As we expand into new industries and regions, we will likely need to comply with these and other new requirements to compete effectively. We may not always be able to support or comply with all of these customer requirements. If we cannot adequately comply with these requirements, our growth could be adversely impacted, we may face a loss of customers or difficulty attracting new customers in impacted industries, and we could incur significant liability and our reputation and business could be significantly harmed. In addition, as regulations in the EU and the U.K. continue to shift, it could impact our ability to comply with and maintain EU and U.K. Processor and Controller Binding Corporate Rules.

Current wording

1, 2 and 3 reports, and ISO/IEC 27001, 27017, 27018, and 27701 we may not be successful in continuing to maintain these certifications or in obtaining other certifications or otherwise being able to adhere to or comply with all customer requirements. In addition, some of the industries and/or regions that we serve have specific requirements relating to security and regulatory standards, such as GxP, FedRAMP and StateRAMP, and those required by HIPAA, FINRA, HITECH Act, the Data Privacy Framework and Asia-Pacific Economic Cooperation Privacy Recognition for Processors and Cross Border Privacy Rules. As we expand into new industries and regions, we will likely need to comply with these and other new requirements to compete effectively. We may not always be able to support or comply with all of these customer requirements. If we cannot adequately comply with these requirements, our growth could be adversely impacted, we may face a loss of customers or difficulty attracting new customers in impacted industries, and we could incur significant liability and our reputation and business could be significantly harmed. In addition, as regulations in the EU and the U.K. continue to shift, it could impact our ability to comply with and maintain EU and U.K. Processor and Controller Binding Corporate Rules.

Previous wording

In order to grow our business, we anticipate that we will continue to depend on our relationships with third parties, such as alliance partners, resellers, distributors, system integrators and developers. For example, we have entered into agreements with partners such as Adobe, Apple, Cisco, Cloudflare, Google, IBM, Macnica Networks, Microsoft, Mitsui Knowledge Industry, Okta,

Current wording

In order to grow our business, we anticipate that we will continue to depend on our relationships with third parties, such as alliance partners, resellers, distributors, system integrators and developers. For example, we have entered into agreements with partners such as Adobe, Apple, Carahsoft, Cisco, Cloudflare, Guidewire, Google, IBM, Macnica, Microsoft, Mitsui Knowledge Industry, Okta, Oracle-Netsuite, Palo Alto Networks, Salesforce, ServiceNow, Slack, USDM, Zoom and Zscaler to market, resell, or integrate with our services. Identifying partners and resellers, and negotiating and documenting relationships with them, requires significant time and resources.

Previous wording

We have acquired, and may in the future acquire, other companies, employee teams, or technologies to complement or expand our services and grow our business. For example, in December 2023, we acquired Crooze Corporation, a provider of no-code enterprise content management applications built on the Box platform. We may not be able to successfully complete or integrate identified acquisitions. Moreover, we may not successfully evaluate or utilize the acquired technology or personnel, or accurately forecast the financial impact of an acquisition. The risks we face in connection with acquisitions include:

Current wording

We have acquired, and may in the future acquire, other companies, employee teams, or technologies to complement or expand our services and grow our business. For example, in December 2023, we acquired Crooze Corporation, a provider of no-code enterprise content management applications built on the Box platform, and in August 2024, we acquired the intelligent document processing technology of Alphamoon. We may not be able to successfully complete or integrate identified acquisitions. Moreover, we may not successfully evaluate or utilize the acquired technology or personnel, or accurately forecast the financial impact of an acquisition. The risks we face in connection with acquisitions include:

Previous wording

We repurchase shares of our Class A common stock in open market transactions from time to time pursuant to publicly announced stock repurchase program approved by our Board of Directors. During fiscal year 2024, we repurchased 6.6 million shares for a total amount of $177.0 million and during fiscal year 2023, we repurchased 10.2 million shares for a total amount of $266.7 million. For the three months ended April 30, 2024, we repurchased 1.4 million shares for a total amount of $37.2 million. Any share repurchases remain subject to the circumstances in place at that time, including prevailing market prices, and we are not obligated to repurchase a specified number or dollar value of shares. As a result, there can be no guarantee around the timing or volume of our share repurchases. In addition, as part of the Inflation Reduction Act signed into law in August 2022, the United States implemented a 1% excise tax on the value of certain stock repurchases by publicly traded companies. This tax could increase the costs to us of any share repurchases. The stock repurchase program could affect the price of our Class A common stock, increase volatility and diminish our cash reserves. Our repurchase program may be suspended or terminated at any time and, even if fully implemented, may not enhance long-term stockholder value.

Current wording

We repurchase shares of our Class A common stock in open market transactions from time to time pursuant to publicly announced stock repurchase program approved by our Board of Directors. During fiscal year 2024, we repurchased 6.6 million shares for a total amount of $177.0 million and during fiscal year 2023, we repurchased 10.2 million shares for a total amount of $266.7 million. For the six months ended July 31, 2024, we repurchased 5.3 million shares for a total amount of $139.1 million. Any share repurchases remain subject to the circumstances in place at that time, including prevailing market prices, and we are not obligated to repurchase a specified number or dollar value of shares. As a result, there can be no guarantee around the timing or volume of our share repurchases. In addition, as part of the Inflation Reduction Act signed into law in August 2022, the United States implemented a 1% excise tax on the value of certain stock repurchases by publicly traded companies. This tax could increase the costs to us of any share repurchases. The stock repurchase program could affect the price of our Class A common stock, increase volatility and diminish our cash reserves. Our repurchase program may be suspended or terminated at any time and, even if fully implemented, may not enhance long-term stockholder value.

Previous wording

Our ability to make required cash payments in connection with conversions of the Convertible Notes, repurchase the Convertible Notes in the event of a fundamental change, or to repay or refinance the Convertible Notes at maturity will depend on market conditions and our past and expected future performance, which is subject to economic, financial, competitive, and other factors beyond our control. We also may not use the cash proceeds we raised through the issuance of the Convertible Notes in an optimally productive and profitable manner. Since inception, our business has generated net losses, and while we were profitable in fiscal year 2024, we may continue to incur significant losses in the future. As a result, we may not have enough available cash or be able to obtain financing, or financing at acceptable terms, at the time we are required to repurchase or repay the Convertible Notes or pay cash with respect to Convertible Notes being converted.

Current wording

Our ability to make required cash payments in connection with conversions of the Convertible Notes, repurchase the Convertible Notes in the event of a fundamental change, or to repay or refinance the Convertible Notes will depend on market conditions and our past and expected future performance, which is subject to economic, financial, competitive, and other factors beyond our control. We also may not use the cash proceeds we raised through the issuance of the Convertible Notes in an optimally productive and profitable manner. Since inception, our business has generated net losses, and while we were profitable in fiscal year 2024, we may continue to incur significant losses in the future. As a result, we may not have enough available cash or be able to obtain financing, or financing at acceptable terms, at the time we are required to repurchase or repay the Convertible Notes or pay cash with respect to Convertible Notes being converted.

Previous wording

Pursuant to that certain Investment Agreement dated April 7, 2021, by and among Box, Inc. and Powell Investors III L.P., KKR-Milton Credit Holdings L.P., KKR-NYC Credit C L.P., Tailored Opportunistic Credit Fund, and CPS Holdings (US) L.P. (the “Investment Agreement”), KKR has the right to designate one candidate for nomination for election to our Board of Directors for so long as KKR and its permitted transferees maintain minimum aggregate holdings of our stock as described in further detail in the

Current wording

Pursuant to that certain Investment Agreement dated April 7, 2021, by and among Box, Inc. and Powell Investors III L.P., KKR-Milton Credit Holdings L.P., KKR-NYC Credit C L.P., Tailored Opportunistic Credit Fund, and CPS Holdings (US) L.P. (the “Investment Agreement”), KKR has the right to designate one candidate for nomination for election to our Board of Directors for so long as KKR and its permitted transferees maintain minimum aggregate holdings of our stock as described in further detail in the Investment Agreement. Notwithstanding the fact that all directors are subject to fiduciary duties to us and to applicable law, the interests of the KKR director designee may differ from the interests of our security holders as a whole or of our other directors.

Previous wording

On March 4, 2024, our Board of Directors authorized the repurchase of an additional $100 million shares of our Class A common stock. During the three months ended April 30, 2024, we repurchased 1.4 million shares at a weighted average price of $27.10 per share for a total amount of $37.2 million. We have entered into pre-set trading plans adopted in accordance with Rule 10b5-1 under the Exchange Act to effect such repurchases. The authorized repurchase plan will expire on March 4, 2025.

Current wording

On March 5, 2024, we announced that our Board of Directors authorized the repurchase of an additional $100 million shares of our Class A Common Stock. During the three months ended July 31, 2024, we repurchased 3.9 million shares at a weighted average price of $26.25 per share for a total amount of $101.9 million. We have entered into pre-set trading plans adopted in accordance with Rule 10b5-1 under the Exchange Act to effect such repurchases. On August 25, 2024, our Board of Directors authorized a $100 million expansion of the share repurchase plan. The authorized repurchase plan will expire on August 25, 2025.