JFrog Ltd

Previous wording

our expectations about the impact of global economic disruptions resulting from natural disasters, public health epidemics, protests or riots, and geopolitical tensions, such as the imposition of tariffs and other non-tariff trade barriers, or war, such as the war between Hamas, Hezbollah, and Israel, and the war between Israel and Iran, regional conflict in the Middle East, and the war in Ukraine, on our business, results of operations and financial condition;

Current wording

our expectations about the impact of global economic disruptions resulting from natural disasters, public health epidemics, protests or riots, and geopolitical tensions, such as the imposition of tariffs and other non-tariff trade barriers, or war, including conflicts in the Middle East, as well as the war in Ukraine, on our business, results of operations and financial condition;

Previous wording

We have experienced significant growth and increased demand for our products over time. Our total revenues for the three months ended June 30, 2025 and 2024 were $127.2 million and $103.0 million, respectively, representing 23% growth, and $249.6 million and $203.4 million for the six months ended June 30, 2025 and 2024, respectively, representing 23% growth. Our employee headcount has also increased from approximately 1,400 as of December 31, 2023 to approximately 1,600 as of December 31, 2024. We focus on growing the number of large customers as a measure of our ability to scale with our customers and attract larger organizations to adopt our products. As of June 30, 2025, 1,076 of our customers had ARR of $100,000 or more, increasing from 1,018 customers as of December 31, 2024, and 61 of our customers had ARR of $1,000,000 or more, increasing from 52 customers as of December 31, 2024. The growth and expansion of our business places a continuous and significant strain on our management, operational, and financial resources. In addition, as customers adopt our products for an increasing number of use cases, we have had to support more complex commercial relationships. We must continue to improve and expand our information technology and financial infrastructure, our security and compliance requirements, our operating and administrative systems, our relationships with various partners and other third parties, and our ability to manage headcount and processes in an efficient manner to manage our growth effectively.

Current wording

We have experienced significant growth and increased demand for our products over time. Our total revenues for the three months ended September 30, 2025 and 2024 were $136.9 million and $109.1 million, respectively, representing 26% growth, and $386.5 million and $312.4 million for the nine months ended September 30, 2025 and 2024, respectively, representing 24% growth. Our employee headcount has also increased from approximately 1,400 as of December 31, 2023 to approximately 1,600 as of December 31, 2024. We focus on growing the number of large customers as a measure of our ability to scale with our customers and attract larger organizations to adopt our products. As of September 30, 2025, 1,121 of our customers had ARR of $100,000 or more, increasing from 1,018 customers as of December 31, 2024, and 71 of our customers had ARR of $1,000,000 or more, increasing from 52 customers as of December 31, 2024. The growth and expansion of our business places a continuous and significant strain on our management, operational, and financial resources. In addition, as customers adopt our products for an increasing number of use cases, we have had to support more complex commercial relationships. We must continue to improve and expand our information technology and financial infrastructure, our security and compliance requirements, our operating and administrative systems, our relationships with various partners and other third parties, and our ability to manage headcount and processes in an efficient manner to manage our growth effectively.

Previous wording

In 2024, we released multiple JFrog Platform features across our core functionalities in DevOps, DevSecOps, and MLOps, as we continued to expand our position as the system of record for the unified software release lifecycle. We released significant enhancements to JFrog Advanced Security, including JFrog Runtime Security, as well as greatly expanded our MLOps functionality with the acquisition of Qwak AI, Ltd. (“Qwak”) as a foundational technology for our JFrog ML offering. These enhancements and releases represent continuing expansion beyond our core DevOps business, delving more deeply into DevSecOps and Artificial Intelligence/MLOps. We may not be able to sustain the pace of improvements to our products successfully or implement systems, processes, and controls in an efficient or timely manner or in a manner that does not negatively affect our results of operations. Our failure to improve our systems, processes, and controls, or their failure to operate in the intended manner, may result in our inability to manage the growth of our business and to forecast our revenue, expenses, and earnings accurately, or to prevent losses.

Current wording

In 2024, we released multiple JFrog Platform features across our core functionalities in DevOps, DevSecOps, and MLOps, as we continued to expand our position as the system of record for the unified software release lifecycle. We released significant enhancements to JFrog Advanced Security, including JFrog Runtime Security, as well as greatly expanded our MLOps functionality with the acquisition of Qwak AI, Ltd. (“Qwak”) as a foundational technology for our JFrog ML product and other machine learning or artificial intelligence (“AI”) technology-oriented offerings. These enhancements and releases represent continuing expansion beyond our core DevOps business, delving more deeply into DevSecOps and Artificial Intelligence/MLOps. We may not be able to sustain the pace of improvements to our products successfully or implement systems, processes, and controls in an efficient or timely manner or in a manner that does not negatively affect our results of operations. Our failure to improve our systems, processes, and controls, or their failure to operate in the intended manner, may result in our inability to manage the growth of our business and to forecast our revenue, expenses, and earnings accurately, or to prevent losses.

Previous wording

As noted above, our total revenues for the three and six months ended June 30, 2025 both grew by 23%, compared to the corresponding prior year periods. You should not rely on the results of any prior quarterly or annual period as an indication of our future performance. Even if our revenue continues to increase, we expect our revenue growth rate to decline in future periods. Many factors may contribute to declines in our growth rate, including greater market penetration, increased competition, market consolidation, slowing demand for our platform, a failure by us to continue capitalizing on growth opportunities, the maturation of our business, the protracted conflict in the Middle East, the imposition of tariffs and other non-tariff trade barriers, and global economic downturn, among others. If our growth rate declines, investors’ perceptions of our business and the market price of our ordinary shares could be adversely affected.

Current wording

As noted above, our total revenues for the three and nine months ended September 30, 2025 grew by 26% and 24%, respectively, compared to the corresponding prior year periods. You should not rely on the results of any prior quarterly or annual period as an indication of our future performance. Even if our revenue continues to increase, we expect our revenue growth rate to decline in future periods. Many factors may contribute to declines in our growth rate, including greater market penetration, increased competition, market consolidation, slowing demand for our platform, a failure by us to continue capitalizing on growth opportunities, the maturation of our business, the protracted conflict in the Middle East, the imposition of tariffs and other non-tariff trade barriers, and global economic downturn, among others. If our growth rate declines, investors’ perceptions of our business and the market price of our ordinary shares could be adversely affected.

Previous wording

the impact of political uncertainty or unrest, including the Russia-Ukraine war, the war between Israel, Hamas and Hezbollah, the war between Israel and Iran, the regional conflict in the Middle East, other areas of geopolitical tension around the world, including Syria, or the worsening of such conflicts or tensions and any related global economic disruptions, including as a result of the imposition of tariffs and other non-tariff trade barriers.

Current wording

the impact of political uncertainty or unrest, including the Russia-Ukraine war, the conflicts in the Middle East, other areas of geopolitical tension around the world, including Syria, or the worsening of such conflicts or tensions and any related global economic disruptions, including as a result of the imposition of tariffs and other non-tariff trade barriers.

Previous wording

We expect to derive a significant portion of our revenue from renewals of existing subscriptions. Our customers have no contractual obligation to renew their subscriptions after the completion of their subscription term. Our self-managed subscriptions are offered on an annual and multi-year basis, while our SaaS subscriptions are offered on a monthly, annual, and multi-year basis and can consist of fixed and usage-based fees. Our customers’ renewals may decline or fluctuate as a result of a number of factors, including their satisfaction with our products and our customer support, the frequency and severity of product outages, our product uptime or latency, the pricing of our, or competing, products, additional new features and capabilities that we offer, new integrations, and updates to our products as a result of updates by technology partners. If our customers renew their subscriptions, they may renew for shorter subscription terms or on other terms that are less economically beneficial to us. We may not accurately predict future renewal trends. If our customers do not renew their subscriptions, or renew on less favorable terms, our revenue may grow more slowly than expected or decline.

Current wording

We expect to derive a significant portion of our revenue from renewals of existing subscriptions. Our customers have no contractual obligation to renew their subscriptions after the completion of their subscription term. Our self-managed subscriptions are offered on an annual and multi-year basis, while our SaaS subscriptions are offered on a monthly, annual, and multi-year basis and can consist of fixed and usage-based fees. Our customers’ renewals may decline or fluctuate as a result of a number of factors, including their satisfaction with our products and our customer support, the frequency and severity of product outages (including, without limitation, possible outages with public cloud providers), our product uptime or latency, the pricing of our, or competing, products, additional new features and capabilities that we offer, new integrations, and updates to our products as a result of updates by technology partners. If our customers renew their subscriptions, they may renew for shorter subscription terms or on other terms that are less economically beneficial to us. We may not accurately predict future renewal trends. If our customers do not renew their subscriptions, or renew on less favorable terms, our revenue may grow more slowly than expected or decline.

Previous wording

To execute our growth plan, we must attract and retain highly qualified personnel. Competition for these employees is intense, specifically for engineers for research and development, security experts, and support positions who are experienced in DevOps, DevSecOps, or MLOps, and such competition often results in increasing wages, especially in Israel, where most of our research and development positions are located, and in the San Francisco Bay Area, where our U.S. headquarters are located. Therefore, we may not be successful in attracting and retaining qualified personnel. We have from time to time in the past experienced, and we expect to continue to experience, difficulty in hiring and retaining highly skilled employees with appropriate qualifications. Our recent hires and planned hires may not become as productive as we expect, and we may be unable to hire, integrate, or retain sufficient numbers of qualified individuals. Many of the companies with which we compete for experienced personnel have greater resources than we have, and due to our profile and market position, such competitors actively seek to hire skilled personnel away from us, even if such employees have entered into a non-compete agreement with us. Israeli labor courts have required employers seeking to enforce non-compete undertakings of a former employee to demonstrate that the competitive activities of the former employee will harm one of a limited number of material interests of the employer that have been recognized by the courts, such as the protection of a company’s trade secrets or other intellectual property. We may not be able to make such a demonstration.

Current wording

Our recent hires and planned hires may not be as productive as we expect, and we may be unable to hire, integrate, or retain sufficient numbers of qualified individuals. Many of the companies with which we compete for experienced personnel have greater resources than we have, and due to our profile and market position, such competitors actively seek to hire skilled personnel away from us, even if such employees have entered into a non-compete agreement with us. Israeli labor courts have required employers seeking to enforce non-compete undertakings of a former employee to demonstrate that the competitive activities of the former employee will harm one of a limited number of material interests of the employer that have been recognized by the courts, such as the protection of a company’s trade secrets or other intellectual property. We may not be able to make such a demonstration.

Previous wording

Our products are inherently complex and, despite extensive testing and quality control, have in the past and may in the future contain defects or errors, especially when first introduced, or not perform as contemplated. These defects, security vulnerabilities, errors, or performance failures could cause breach of contractual provisions, thereby exposing us to liabilities, termination of agreements, loss of customers or revenue, order cancellations, service terminations, damage to our reputation, or lack of market acceptance of our products. As the use of our products, including products that were recently acquired or developed, expands to more sensitive, secure, or mission critical uses by our customers, we may be subject to increased contractual liability, scrutiny, loss of revenue or customers, potential reputational risk, or potential liability should our products fail to perform as contemplated in such deployments. We have in the past and may in the future need to issue corrective releases of our products to fix these defects, errors, or performance failures, and develop processes and controls which could require us to allocate significant research and development and customer support resources to address these problems.

Current wording

Our products are inherently complex and, despite extensive testing and quality control, have in the past and may in the future contain defects or errors, especially when first introduced, or not perform as contemplated. These defects, security vulnerabilities, errors, or other performance failures could cause breach of contractual provisions, thereby exposing us to liabilities, termination of agreements, loss of customers or revenue, order cancellations, service terminations, damage to our reputation, or lack of market acceptance of our products. As the use of our products, including products that were recently acquired or developed, expands to more sensitive, secure, or mission critical uses by our customers, we may be subject to increased contractual liability, scrutiny, loss of revenue or customers, potential reputational risk, or potential liability should our products fail to perform as contemplated in such deployments. We have in the past and may in the future need to issue corrective releases of our products to fix these defects, errors, or performance failures, and develop processes and controls which could require us to allocate significant research and development and customer support resources to address these problems.

Previous wording

Our failure to generate the significant capital or raise additional capital necessary to expand our operations and invest in new products could reduce our ability to compete and could harm our business.

Current wording

Our failure to generate significant capital or raise additional capital necessary to expand our operations and invest in new products could reduce our ability to compete and could harm our business.

Previous wording

government sectors until we have attained such revised certification or certifications. Government demand and payment for our products may be affected by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our products. Additionally, any actual or perceived privacy, data protection, or data security incident, or even any perceived defect with regard to our practices or measures in these areas, may negatively impact public sector demand for our products.

Current wording

Sales to government entities are subject to a number of risks that are specific to public sector customers. Selling to government entities can be highly complex, competitive, and may have longer sales cycles, often requiring significant upfront time, expertise, and expense without any assurance that these efforts will generate a sale. Government certification requirements for products like ours may change, thereby restricting our ability to sell into the U.S. federal government, U.S. state governments, or non-U.S. government sectors until we have attained such revised certification or certifications. Government demand and payment for our products may be affected by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our products. Additionally, any actual or perceived privacy, data protection, or data security incident, or even any perceived defect with regard to our practices or measures in these areas, may negatively impact public sector demand for our products.

Previous wording

We have undertaken and expect to continue to undertake certain sustainability and governance-related initiatives, goals, and commitments, which we have communicated on our website, in our SEC filings, and elsewhere. These initiatives, goals, or commitments could be difficult to achieve and costly to implement. We could fail to achieve, or be perceived to fail to achieve, these initiatives, goals, or commitments. In addition, we could be criticized for the timing, scope, or nature of these initiatives, goals, or commitments, or for any revisions to them. Stakeholders could also challenge the accuracy, adequacy, or completeness of our disclosures related to these initiatives. Our actual or perceived failure to achieve some or all of these initiatives, goals, or commitments or maintain sustainability or governance practices that meet evolving stakeholder expectations or regulatory requirements could harm our reputation, adversely impact our ability to attract and retain employees or customers, and expose us to increased scrutiny from sustainability and governance-focused investors, regulatory authorities, and others, or subject us to liability. Damage to our reputation or reduced demand for our products may adversely impact our business, financial condition, or results of operations.

Current wording

We have undertaken and expect to continue to undertake certain sustainability and governance-related initiatives, goals, and commitments, which we have communicated on our website, in our SEC filings, and elsewhere. These initiatives, goals, or commitments could be difficult to achieve and costly to implement. We could fail to achieve, or be perceived to fail to achieve, these initiatives, goals, or commitments. In addition, we could be criticized for the timing, scope, or nature of these initiatives, goals, or commitments, or for any revisions to them. Stakeholders could also challenge the accuracy, adequacy, or completeness of our disclosures related to these initiatives. For example, many sustainability initiatives leverage data, methodologies, technologies, and/or standards that are complex, subject to varying interpretations, and continuing to evolve. As with other companies, our approach is expected to continue to evolve as well, and we cannot guarantee that our approach will align with the expectations or interpretations of any particular stakeholder. Stakeholders (including, without limitation, policymakers) have varying, and at times conflicting, expectations. Our actual or perceived failure to achieve some or all of these initiatives, goals, or commitments or maintain sustainability or governance practices that meet evolving stakeholder expectations or regulatory requirements could harm our reputation (including, without limitation, impacts to any related ratings), adversely impact our ability to attract and retain employees or customers, and expose us to increased scrutiny from sustainability and governance-focused investors, regulatory authorities, and others, or subject us to liability. Damage to our reputation or reduced demand for our products may adversely impact our business, financial condition, or results of operations.

Previous wording

A significant portion of our intellectual property has been developed by our employees in the course of their employment for us. Under the Israeli Patents Law, 5727-1967 (the “Patents Law”), inventions conceived by an employee in the course and as a result of or arising from his or her employment with a company are regarded as “service inventions,” which belong to the employer, absent a specific agreement between the employee and employer giving the employee service invention rights. The Patents Law also provides that if there is no such agreement between an employer and an employee, the Israeli Compensation and Royalties Committee (the “Committee”), a body constituted under the Patents Law, shall determine whether the employee is entitled to remuneration for his or her inventions. Case law clarifies that the right to receive consideration for “service inventions” can be waived by the employee and that, in certain circumstances, such waiver does not necessarily have to be explicit. The Committee will examine, on a case-by-case basis, the general contractual framework between the parties, applying interpretation rules of the general Israeli contract laws. Further, the Committee has not yet determined one specific formula for calculating this remuneration, but rather uses the criteria specified in the Patents Law. Although we generally enter into assignment-of-invention agreements with our employees pursuant to which such individuals assign to us all rights to any inventions created in the scope of their employment or engagement with us, we may face claims demanding remuneration in consideration for assigned inventions. As a consequence of such claims, we could be required to pay additional remuneration or royalties to our current and former employees, or be forced to litigate such claims, which could negatively affect our business.

Current wording

A significant portion of our intellectual property has been developed by our employees in the course of their employment for us. Under the Israeli Patents Law, 5727-1967 (the “Patents Law”), inventions conceived by an employee in the course and as a result of or arising from his or her employment with a company are regarded as “service inventions,” which belong to the employer, absent a specific agreement between the employee and employer giving the employee service invention rights. The Patents Law also provides that if there is no such agreement between an employer and an employee, the Israeli Compensation and Royalties Committee (the “Committee”), a body constituted under the Patents Law, shall determine whether the employee is entitled to remuneration for his or her inventions. Case law clarifies that the right to receive consideration for “service inventions” can be waived by the employee and that, in certain circumstances, such waiver does not necessarily have to be explicit. The Committee will examine, on a case-by-case basis, the general contractual framework between the parties, applying interpretation rules of the general Israeli contract laws. Further, the Committee has not yet determined one specific formula for calculating this remuneration, but rather uses the criteria specified in the Patents Law. Although we generally enter into assignment of invention and waiver agreements with our employees pursuant to which such individuals assign to us all rights to any inventions created in the scope of their employment or engagement with us, we may face claims demanding remuneration in consideration for assigned inventions. As a consequence of such claims, we could be required to pay additional remuneration or royalties to our current and former employees, or be forced to litigate such claims, which could negatively affect our business.

Previous wording

Our agreements with customers and other third parties may include indemnification provisions under which we agree to indemnify them for losses suffered or incurred as a result of claims by third parties against customers, alleging intellectual property infringement, misappropriation or violation, or other liabilities relating to or arising from our software, services or other contractual obligations. Large indemnity payments could harm our business, results of operations, and financial condition. Pursuant to certain agreements, we do not have a cap on our liability for indemnity claims and any payments under such agreements would harm our business, results of operations, and financial condition. Any dispute with a customer with respect to such obligations could have adverse effects on our relationship with that customer and other existing customers and new customers and harm our business and results of operations.

Current wording

Our agreements with customers and other third parties generally include indemnification provisions under which we agree to indemnify them for losses suffered or incurred as a result of claims by third parties against customers, alleging intellectual property infringement, misappropriation or violation, or other liabilities relating to or arising from our software, services or other contractual obligations. Pursuant to certain agreements, we do not have a cap on our liability for indemnity claims and any payments under such agreements would harm our business, results of operations, and financial condition. Any dispute with a customer with respect to such obligations could have adverse effects on our relationship with that customer and other existing customers and new customers and harm our business and results of operations.

Previous wording

Although our products do not involve the processing of large amounts of personal data or personal information, our platform and products support customers’ software, which may involve the processing of large amounts of personal data, personal information, and information that is confidential or otherwise sensitive or proprietary. Data security incidents affecting widely trusted data security architecture (such as historical incidents affecting SolarWinds Orion, the incident involving Accellion FTA, the incident affecting Microsoft Exchange, the incident affecting Kaseya VSA, the incident involving Log4j, and the software update incident involving CrowdStrike – none of which have directly affected us) may increase customer expectations regarding the security, testing, and compliance documentation of our platform and products for secure software development operations, management, automation, and releases. In addition, these or other incidents may trigger new laws and regulations that increase our compliance burdens, add reporting obligations, or otherwise increase costs for oversight and monitoring of our platform, products, and supply chain.

Current wording

Although our products do not involve the processing of large amounts of personal data or personal information, our platform and products support customers’ software, which may involve the processing of large amounts of personal data, personal information, and information that is confidential or otherwise sensitive or proprietary. Security incidents affecting widely trusted data security architecture have occurred in recent years, and these or future incidents may increase customer expectations regarding the security, testing, and compliance documentation of our platform and products for secure software development operations, management, automation, and releases. In addition, these or other incidents may trigger new laws and regulations that increase our compliance burdens, add reporting obligations, or otherwise increase costs for oversight and monitoring of our platform, products, and supply chain.

Previous wording

We do collect and store certain sensitive and proprietary information, and to a lesser degree, personal data and personal information, in the operation of our business. This information includes trade secrets, intellectual property, employee data, and other confidential data. We have taken measures to protect our own sensitive and proprietary information, personal data, and personal information, as well as such information that we otherwise obtain, including from our customers. We also engage vendors and service providers to store and otherwise process some of our and our customers’ data, including sensitive and proprietary information, personal data, and personal information. Our vendors and service providers have been and, in the future may be, the targets of cyberattacks, malicious software, supply chain attacks, phishing schemes, fraud, and other risks to the confidentiality, security, and integrity of their systems and the data they process for us. Our ability to monitor our vendors and service providers’ data security is limited, and, in any event, third parties may be able to circumvent those security measures, resulting in the unauthorized or unlawful access to, misuse, disclosure, loss, acquisition, corruption, unavailability, alteration, modification, or destruction of our and our customers’ data, including sensitive and proprietary information, personal data, and personal information.

Current wording

We collect and store certain sensitive and proprietary information, and to a lesser degree, personal data and personal information, in the operation of our business. This information includes trade secrets, intellectual property, employee data, and other confidential data. We have taken measures to protect our own sensitive and proprietary information, personal data, and personal information, as well as such information that we otherwise obtain, including from our customers. We also engage vendors and service providers to store and otherwise process some of our and our customers’ data, including sensitive and proprietary information, personal data, and personal information. Our vendors and service providers have been and, in the future may be, the targets of cyberattacks, malicious software, supply chain attacks, phishing schemes, fraud, and other risks to the confidentiality, security, and integrity of their systems and the data they process for us. Further, our vendors and service providers have suffered, and in the future may suffer, security breaches and other incidents, including breaches and incidents that may result in unauthorized access to, or other processing of, certain data they process for us. Our ability to monitor our vendors and service providers’ data security is limited, and, in any event, third parties may be able to circumvent those security measures, resulting in the unauthorized or unlawful access to, misuse, disclosure, loss, acquisition, corruption, unavailability, alteration, modification, or destruction of our and our customers’ data, including sensitive and proprietary information, personal data, and personal information.

Previous wording

Security breaches and other security incidents that affect us may result from employee or contractor error or negligence or those of vendors, service providers, and strategic partners on which we rely. These attacks may come from individual hackers, criminal groups, and state-sponsored organizations. There have been and may continue to be significant supply chain attacks, and we cannot guarantee that our or our vendors or service providers’ systems and networks have not been breached or that they do not contain exploitable vulnerabilities, defects, or bugs that could result in a breach of or disruption to our systems and networks or the systems and networks of third parties that support us and our services. In addition, our customers and users may also disclose or leak their passwords, API keys, or secrets that could lead to unauthorized access to their accounts and data, including information about their software, source code, and security environment, stored within our products. As we continue to expand the products that we can offer our customers, including through the acquisition of complementary businesses, such as our acquisition of Vdoo in 2021 and our acquisition of Qwak in July 2024, and through internal development, such as developing new security services, our products will likely have access to more sensitive and personal information of our customers, which could result in greater adverse effects from security breaches and other security incidents. Also, our expansion into new services and products could subject us to additional regulations. In addition, we are subject to other laws and regulations that obligate us to employ reasonable security measures. From time to time, we do identify product vulnerabilities, including through our bug bounty program. Certain vulnerabilities under certain circumstances could be exploited if our customers do not patch vulnerable versions of the product. In the future, we also may experience security breaches, including breaches resulting from a cybersecurity attack, phishing attack, or other means, including unauthorized access, unauthorized usage, malware, or similar breaches or disruptions. We incur significant costs in an effort to detect and prevent security breaches and other security-related incidents, including those to secure our product development, test, evaluation, and deployment activities, and we expect our costs will increase as we make improvements to our systems and processes to prevent future breaches and incidents.

Current wording

Security breaches and other security incidents that affect us may result from employee or contractor error or negligence or those of vendors, service providers, and strategic partners on which we rely. These attacks may come from individual hackers, criminal groups, and state-sponsored organizations. There have been and may continue to be significant supply chain attacks, and certain of our vendors and service providers have suffered from security incidents. We cannot guarantee that our or our vendors or service providers’ systems and networks have not been breached or that they do not contain exploitable vulnerabilities, defects, or bugs that could result in a breach of, incident impacting, or other disruption to our systems and networks or the systems and networks of third parties that support us and our services. In addition, our customers and users may also disclose or leak their passwords, API keys, or secrets that could lead to unauthorized access to their accounts and data, including information about their software, source code, and security environment, stored within our products. As we continue to expand the products that we can offer our customers, including through the acquisition of complementary businesses, such as our acquisition of Vdoo in 2021 and our acquisition of Qwak in July 2024, and through internal development, such as developing new security services, our products will likely have access to more sensitive and personal information of our customers, which could result in greater adverse effects from security breaches and other security incidents. Also, our expansion into new services and products could subject us to additional regulations. In addition, we are subject to other laws and regulations that obligate us to employ reasonable security measures. From time to time, we do identify product vulnerabilities, including through our bug bounty program. Certain vulnerabilities under certain circumstances could be exploited if our customers do not patch vulnerable versions of the product. In the future, we also may experience security breaches and incidents, including breaches resulting from a cybersecurity attack, phishing attack, or other means, including unauthorized access, unauthorized usage, malware, or similar breaches or disruptions. We incur significant costs in an effort to detect and prevent security breaches and other security-related incidents, including those to secure our product development, test, evaluation, and deployment activities, and we expect our costs will increase as we make improvements to our systems and processes to prevent future breaches and incidents.

Previous wording

Despite our efforts, our systems and those of our vendors, service providers, and strategic partners also are potentially vulnerable to computer malware, malicious access or delivery of ransomware or other malicious software to our customers, AI risks, viruses, computer hacking, fraudulent use, social engineering attacks, phishing attacks, ransomware attacks, credential stuffing attacks, denial-of-service attacks, unauthorized access, exploitation of bugs, defects, and vulnerabilities, breakdowns, damage, interruptions, system malfunctions, power outages, terrorism, acts of vandalism, failures, security breaches and incidents, inadvertent or intentional actions by our employees, contractors, consultants, partners, and/or other third parties, and other real or perceived cyberattacks. Our risks of cyberattacks and other sources of security breaches and incidents, and those faced by our vendors, service providers, and strategic partners, may be heightened in connection with the war between Israel, Hamas and Hezbollah, the war between Israel and Iran, the regional conflict in the Middle East, the war between Russia and Ukraine, and other associated geopolitical tensions and regional instability. Any of these incidents or any compromise of our security or any unauthorized access to or breaches of the security of our or our service providers’ systems or data processing tools or processes, or of our platform and product offerings, as a result of third-party action, employee error, vulnerabilities, defects or bugs, malfeasance, or otherwise, could result in unauthorized or unlawful access to, misuse, disclosure, loss, acquisition, corruption, unavailability, alteration, modification, or destruction of our and our customers’ data, including sensitive and proprietary information, personal data and personal information, or a risk to the security of our or our customers’ systems. We, our vendors, service providers, and strategic partners may be unable to anticipate these techniques and vulnerabilities, react, remediate, or otherwise address any security breach or other security incident in a timely manner, or implement adequate preventative measures.

Current wording

Despite our efforts, our systems and those of our vendors, service providers, and strategic partners also are vulnerable to computer malware, malicious access or delivery of ransomware or other malicious software to our customers, AI risks, viruses, computer hacking, fraudulent use, social engineering attacks, phishing attacks, ransomware attacks, credential stuffing attacks, denial-of-service attacks, unauthorized access, exploitation of bugs, defects, and vulnerabilities, breakdowns, damage, interruptions, system malfunctions, power outages, terrorism, acts of vandalism, failures, security breaches and incidents, inadvertent or intentional actions by our employees, contractors, consultants, partners, and/or other third parties, and other real or perceived cyberattacks and other sources of security breaches and incidents. Our risks of cyberattacks and other sources of security breaches and incidents, and those faced by our vendors, service providers, and strategic partners, may be heightened in connection with the regional conflict in the Middle East, the war between Russia and Ukraine, and other associated geopolitical tensions and regional instability. Any of these incidents or any compromise of our security or any unauthorized access to or breaches of, or other incidents impacting, the security of our or our service providers’ systems or data processing tools or processes, or of our platform and product offerings, as a result of third-party action, employee error, vulnerabilities, defects or bugs, malfeasance, or otherwise, which may have resulted in and in the future could result in unauthorized or unlawful access to, misuse, disclosure, loss, acquisition, corruption, unavailability, alteration, modification, or destruction of our and our customers’ data, including sensitive and proprietary information, personal data and personal information, or a risk to the security of our or our customers’ systems. We, our vendors, service providers, and strategic partners may be unable to anticipate these techniques and vulnerabilities, react, remediate, or otherwise address any security breach or other security incident in a timely manner, or implement adequate preventative measures.

Previous wording

We may be more susceptible to security breaches and other security incidents in view of many of our employees and employees of our service providers working remotely, because we and our service providers have less capability to implement, monitor, and enforce our information security and data protection policies for those employees. Based on the examples set in other recent incidents, the more widespread our platform and products become, the more they may be viewed by malicious cyber threat actors as an attractive target for such an attack. We and our service providers may be unable to anticipate these techniques, react, remediate, or otherwise address any security breach or other security incident in a timely manner, or implement adequate preventative measures. In the past, we have experienced vulnerabilities, none of which led to account takeover and all such known vulnerabilities have been remedied.

Current wording

We may be more susceptible to security breaches and other security incidents in view of many of our employees and employees of our service providers working remotely, because we and our service providers have less capability to implement, monitor, and enforce our information security and data protection policies for those employees. Based on the examples set in recent incidents suffered by third parties, the more widespread our platform and products become, the more they may be viewed by malicious cyber threat actors as an attractive target for such an attack. We and our service providers may be unable to anticipate these techniques, react, remediate, or otherwise address any security breach or other security incident in a timely manner, or implement adequate preventative measures. In the past, we have experienced vulnerabilities, none of which led to account takeover and all such known vulnerabilities have been remedied.

Previous wording

A security breach or other incident could result in reputational damage, litigation, regulatory investigations and orders, loss of business, indemnity obligations, damages for contract breach, penalties for violation of applicable laws, regulations, or contractual obligations, and significant costs, fees, and other monetary payments for remediation, including in connection with forensic examinations and costly and burdensome breach notification requirements. Any belief by customers or others that a security breach or other incident has affected us or any of our vendors or service providers, even if a security breach or other incident has not affected us or any of our vendors or service providers or has not actually occurred, could have any or all of the foregoing impacts on us, including damage to our reputation. Even the perception of inadequate security may damage our reputation and negatively impact our ability to gain new customers and retain existing customers. In the event of any such breach or incident, we could be required to expend significant capital and other resources to address our or our vendor or service provider’s incident. Considering the SolarWinds Orion incident and the Kaseya VSA incident, if our products were compromised in a way that offered a means of malicious access or delivery of ransomware or other malicious software to our customers, the impact of such an incident would likely be significant.

Current wording

A security breach or other incident could result in reputational damage, litigation, regulatory investigations and orders, loss of business, indemnity obligations, damages for contract breach, penalties for violation of applicable laws, regulations, or contractual obligations, and significant costs, fees, and other monetary payments for remediation, including in connection with forensic examinations and costly and burdensome breach notification requirements. Any belief by customers or others that a security breach or other incident has affected us or any of our vendors or service providers, even if a security breach or other incident has not affected us or any of our vendors or service providers or has not actually occurred, could have any or all of the foregoing impacts on us, including damage to our reputation. Even the perception of inadequate security may damage our reputation and negatively impact our ability to gain new customers and retain existing customers. In the event of any such breach or incident, we could be required to expend significant capital and other resources to address our or our vendor or service provider’s incident. If our products were compromised in a way that offered a means of malicious access or delivery of ransomware or other malicious software to our customers, the impact of such an incident would likely be significant.

Previous wording

We receive, collect, store, process, transfer, retain, use, and otherwise process personal information and other data relating to users of our products, our employees and contractors, and other persons. We have legal and contractual obligations regarding the protection of confidentiality and appropriate use of certain data, including personal data and personal information. We are subject to numerous federal, state, local, and international laws, directives, and regulations regarding privacy, data protection, e-marketing, cybersecurity, AI, and data security and the collection, storing, sharing, use, processing, transfer, retention, security, disclosure, and protection of personal information and other data, the scope of which are changing, subject to differing interpretations, and may be inconsistent among jurisdictions or conflict with other legal and regulatory requirements. We are also subject to certain contractual obligations to third parties related to privacy, data protection, cybersecurity, AI, and data security. We strive to comply with our applicable policies and applicable laws, regulations, contractual obligations, and other legal obligations relating to privacy, data protection, cybersecurity, and data security to the extent possible. However, the regulatory framework for privacy, data protection, cybersecurity, e-marketing, AI, and data security worldwide is, and is likely to remain for the foreseeable future, uncertain and complex, and it is possible that these or other actual or alleged obligations may be interpreted and applied in a manner that we do not anticipate or that is inconsistent from one jurisdiction to another and may conflict with other legal obligations or our practices. Any perception of privacy, data security, cybersecurity, or data protection concerns or an inability to comply with applicable laws, regulations, policies, industry standards, contractual obligations, or other legal obligations, even if unfounded, may result in additional cost and liability to us, harm our reputation and inhibit adoption of our products by current and future customers, and adversely affect our business, financial condition, and results of operations. Further, any significant change to applicable laws, regulations, or industry practices regarding the collection, storing, sharing, use, retention, security, protection, disclosure, other processing of data, or their interpretation, or any changes regarding the manner in which the consent of users or other data subjects for the collection, use, retention, disclosure, or other processing of such data must be obtained, could increase our costs and require us to modify our services and features, possibly in a material manner, which we may be unable to complete, and may limit our ability to store and process user data or develop new services and features.

Current wording

We receive, collect, store, process, transfer, retain, use, and otherwise process personal information and other data relating to users of our products, our employees and contractors, and other persons. We have legal and contractual obligations regarding the protection of confidentiality and appropriate use of certain data, including personal data and personal information. We are subject to numerous federal, state, local, and international laws, directives, and regulations regarding privacy, data protection, e-marketing, cybersecurity, AI, and data security and the collection, storing, sharing, use, processing, transfer, retention, security, disclosure, and protection of personal information and other data, the scope of which are changing, subject to differing interpretations, and may be inconsistent among jurisdictions or conflict with other legal and regulatory requirements. We are also subject to certain contractual obligations to third parties related to privacy, data protection, cybersecurity, AI, data security, and the collection, storing, sharing, use, processing, transfer, retention, security, disclosure, and protection of personal information and other data. We strive to comply with our applicable policies and applicable laws, regulations, contractual obligations, and other legal obligations relating to privacy, data protection, cybersecurity, AI, data security, and the collection, storing, sharing, use, processing, transfer, retention, security, disclosure, and protection of personal information and other data to the extent possible. However, the regulatory framework for these matters worldwide is, and is likely to remain for the foreseeable future, uncertain and complex, and it is possible that these or other actual or alleged obligations may be interpreted and applied in a manner that we do not anticipate or that is inconsistent from one jurisdiction to another and may conflict with other legal obligations or our practices. For example, the European Union’s Data Act which became effective on September 12, 2025, may require us to adjust contractual terms with customers and develop technical measures for data portability. Any perception of concerns relating to these matters or an inability to comply with applicable laws, regulations, policies, industry standards, contractual obligations, or other legal obligations, even if unfounded, may result in additional cost and liability to us, harm our reputation and inhibit adoption of our products by current and future customers, and adversely affect our business, financial condition, and results of operations. Further, any significant change to applicable laws, regulations, or industry practices relating to privacy, data protection, cybersecurity, AI, data security, or the collection, storing, sharing, use, retention, security, protection, disclosure, other processing of data, or their interpretation, or any changes regarding the manner in which the consent of users or other data subjects for …

Excerpt shortened here; the source contains the full paragraph.

Previous wording

If we were found in violation of any applicable laws or regulations relating to privacy, data protection, cybersecurity, AI, or data security, in addition to any regulatory fines, penalties, contract breach, costs for remediation, or litigation costs, our business may be materially and adversely affected and we would likely have to change our business practices and potentially the services and features available through our platform. In addition, these laws and regulations could constrain our ability to use and process data in manners that may be commercially desirable. In addition, if a breach of data security were to occur or to be alleged to have occurred, if any violation of laws and regulations relating to privacy, data protection, or data security were to be alleged, or if we had any actual or alleged defect in our safeguards or practices relating to privacy, data protection, or data security, our solutions may be perceived as less desirable and our business, prospects, financial condition, and results of operations could be materially and adversely affected. Our insurance covering certain security and privacy damages and claim expenses may not be sufficient to compensate for all liabilities we may incur.

Current wording

If we were found in violation of any applicable laws or regulations relating to privacy, data protection, cybersecurity, AI, data security, or otherwise relating to the collection, storing, sharing, use, processing, transfer, retention, security, disclosure, and protection of personal information or other data, in addition to any regulatory fines, penalties, contract breach, costs for remediation, or litigation costs, our business may be materially and adversely affected and we would likely have to change our business practices and potentially the services and features available through our platform. In addition, these laws and regulations could constrain our ability to use and process data in manners that may be commercially desirable. In addition, if a security breach or incident were to occur or to be alleged to have occurred, if any violation of laws and regulations relating to privacy, data protection, or data security were to be alleged, or if we had any actual or alleged defect in our safeguards or practices relating to privacy, data protection, or data security, our solutions may be perceived as less desirable and our business, prospects, financial condition, and results of operations could be materially and adversely affected. Our insurance covering certain security and privacy damages and claim expenses may not be sufficient to compensate for all liabilities we may incur.

Previous wording

The regulatory environment applicable to the handling of EEA residents' personal data, and our actions taken in response, may cause us to assume additional liabilities or incur additional costs and could result in our business, operating results, and financial condition being harmed. We and our customers may face a risk of enforcement actions by data protection authorities in the EEA relating to personal data transfers to us and by us from the EEA. Any such enforcement actions could result in substantial costs and diversion of resources, distract management and technical personnel, and negatively affect our business, operating results and financial condition. While the EU and U.S. governments have adopted the EU-U.S. Data Privacy Framework (“DPF”) to foster EU-U.S. data transfers, the CJEU upheld the Standard Contractual Clauses (“SCCs”), and addressed the concerns of the CJEU’s “Schrems II” decision, it is uncertain whether the DPF and the SCCs will eventually be overturned or invalidated, as the predecessors to the DPF were. Additionally, certain countries have considered passing laws requiring varying degrees of local data residency. Any actual or perceived failure to comply with these laws could result in a costly investigation or litigation resulting in potentially significant liability, loss of trust by our users, and a material and adverse impact on our reputation and business.

Current wording

The regulatory environment applicable to the handling of European Economic Area (“EEA”) residents’ personal data, and our actions taken in response, may cause us to assume additional liabilities or incur additional costs and could result in our business, operating results, and financial condition being harmed. We and our customers may face a risk of enforcement actions by data protection authorities in the EEA relating to personal data transfers to us and by us from the EEA. Any such enforcement actions could result in substantial costs and diversion of resources, distract management and technical personnel, and negatively affect our business, operating results and financial condition. While the EU and U.S. governments have adopted the EU-U.S. Data Privacy Framework (“DPF”) to foster EU-U.S. data transfers, the Court of Justice of the European Union (“CJEU”) upheld the Standard Contractual Clauses (“SCCs”), and addressed the concerns of the CJEU’s “Schrems II” decision, it is uncertain whether the DPF and the SCCs will eventually be overturned or invalidated, as was the case with the predecessors to the DPF. Additionally, certain countries have considered passing laws requiring varying degrees of local data residency. Any actual or perceived failure to comply with these laws could result in a costly investigation or litigation resulting in potentially significant liability, loss of trust by our users, and a material and adverse impact on our reputation and business.

Previous wording

There are increasing restrictions in the United States on certain personal sensitive data transfers involving foreign countries. Executive Order 14117, effective April 8, 2025, prohibits data transfer of personal identifiers, precise geolocation data, biometric identifiers, health data, and financial data over a certain bulk threshold to identified countries of concern (i.e., China, Hong Kong, Macau, Cuba, Iran, North Korea, Russia, and Venezuela). The regulations also restrict data brokerage agreements, investment agreements, employment agreements, and vendor agreements involving such data and countries of concern. Violations of these regulations may be punishable by criminal and/or civil sanctions, and may result in exclusion from participation in federal and state programs. These data transfer restrictions may create operational challenges and legal risks for our business, particularly with regard to China, where we continue to have limited operations.

Current wording

There are increasing restrictions in the United States on certain personal sensitive data transfers involving foreign countries. Executive Order 14117 entitled “Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern” dated as of February 28, 2024 and which became effective as of April 8, 2025, prohibits data transfer of personal identifiers, precise geolocation data, biometric identifiers, health data, and financial data over a certain bulk threshold to identified countries of concern (i.e., China, Hong Kong, Macau, Cuba, Iran, North Korea, Russia, and Venezuela). The regulations also restrict data brokerage agreements, investment agreements, employment agreements, and vendor agreements involving such data and countries of concern. Violations of these regulations may be punishable by criminal and/or civil sanctions, and may result in exclusion from participation in federal and state programs. These data transfer restrictions may create operational challenges and legal risks for our business, particularly with regard to China, where we continue to have limited operations.

Previous wording

We also expect that there will continue to be changes in interpretations of existing laws and regulations, or new proposed laws and regulations concerning privacy, data security, cybersecurity, data sovereignty, e-marketing, AI, and data protection. We cannot yet determine the impact these laws and regulations or changed interpretations may have on our business, but we anticipate that they could impair our or our customers’ ability to collect, use, or disclose information relating to individuals, which could decrease demand for our platform, increase our costs, and impair our ability to maintain and grow our customer base and increase our revenue. Moreover, because the interpretation and application of many laws and regulations relating to privacy, security, cybersecurity, e-marketing, AI, and data protection, along with mandatory industry standards, are uncertain, it is possible that these laws, regulations and standards, or contractual obligations to which we are or may become subject, may be interpreted and applied in a manner that is inconsistent with our existing or future data management practices or features of our platform and products. Any failure or perceived failure by us to comply with our posted privacy notices, our privacy-related obligations to users or other third parties, or any other actual or asserted legal obligations or regulatory requirements relating to privacy, data protection, cybersecurity, e-marketing, AI, or data security, may result in governmental investigations or enforcement actions, litigation, claims, or public statements against us by privacy advocacy groups or others and could result in significant liability, cause our customers to lose trust in us, and otherwise materially and adversely affect our reputation and business. Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations, other obligations, and policies that are applicable to the businesses of our users may limit the adoption and use of, and reduce the overall demand for, our platform. Additionally, if third parties we work with violate applicable laws, regulations, or contractual obligations, such violations may put our users’ data at risk, could result in governmental investigations or enforcement actions, fines, litigation, claims, or public statements against us by privacy advocacy groups or others, and could result in significant liability, cause our customers to lose trust in us, and otherwise materially and adversely affect our reputation and business. Further, public scrutiny of, or complaints about, technology companies or their data handling or data protection practices, even if unrelated to our business, industry, or operations, may lead to increased scrutiny of technology companies, including us, and may cause government agencies to enact additional regulatory requirements, or to modify their enforcement or investigation activities, which may increase our costs and risks.

Current wording

We also expect that there will continue to be changes in interpretations of existing laws and regulations, or new proposed laws and regulations concerning privacy, data security, cybersecurity, data sovereignty, e-marketing, AI, and data protection. We cannot yet determine the impact these laws and regulations or changed interpretations may have on our business, but we anticipate that they could impair our or our customers’ ability to collect, use, or disclose information relating to individuals, which could decrease demand for our platform, increase our costs, and impair our ability to maintain and grow our customer base and increase our revenue. Moreover, because the interpretation and application of many laws, regulations, and industry standards relating to privacy, security, cybersecurity, e-marketing, AI, data protection, and the collection, storing, sharing, use, processing, transfer, retention, security, disclosure, and protection of personal information and other data, are uncertain, it is possible that these laws, regulations and standards, or contractual obligations to which we are or may become subject, may be interpreted and applied in a manner that is inconsistent with our existing or future data management practices or features of our platform and products. Any failure or perceived failure by us to comply with our posted privacy notices, our privacy-related obligations to users or other third parties, or any other actual or asserted legal obligations or regulatory requirements relating to privacy, data protection, cybersecurity, e-marketing, AI, or data security, may result in governmental investigations or enforcement actions, litigation, claims, or public statements against us by privacy advocacy groups or others and could result in significant liability, cause our customers to lose trust in us, and otherwise materially and adversely affect our reputation and business. Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations, other obligations, and policies that are applicable to the businesses of our users may limit the adoption and use of, and reduce the overall demand for, our platform. Additionally, if third parties we work with violate applicable laws, regulations, or contractual obligations, such violations may put our users’ data at risk, could result in governmental investigations or enforcement actions, fines, litigation, claims, or public statements against us by privacy advocacy groups or others, and could result in significant liability, cause our customers to lose trust in us, and otherwise materially and adversely affect our reputation and business. Further, public scrutiny of, or complaints about, technology companies or their data handling or data protection practices, even if unrelated to our business, industry, or operations, may lead to increased scrutiny of technology companies, including us, and may cause government agencies to enact additional regulatory requirements, or …

Excerpt shortened here; the source contains the full paragraph.

Previous wording

different labor regulations, especially in Israel, the EU and India, where labor laws are generally more advantageous to employees as compared to the U.S., including differing hourly wages and overtime regulations in these locations;

Current wording

different labor regulations, especially in Israel, the EU, Asia, and India, where labor laws are generally more advantageous to employees as compared to the U.S., including complex termination processes, differing hourly wages and overtime regulations in these locations;

Previous wording

changes in a specific country’s or region’s political or economic conditions, such as the war between Israel, Hamas and Hezbollah, the war between Israel and Iran, the regional conflict in the Middle East, the war between Russia and Ukraine and associated geopolitical tensions, as well as economic sanctions the U.S., the EU, and other countries have imposed on Russia and certain of its allies and the impact of the foregoing on the global economy;

Current wording

changes in a specific country’s or region’s political or economic conditions, such as the conflict in the Middle East, the war between Russia and Ukraine and associated geopolitical tensions, as well as economic sanctions the U.S., the EU, and other countries have imposed on Russia and certain of its allies and the impact of the foregoing on the global economy;

Previous wording

risks relating to the implementation of exchange controls, including restrictions promulgated by the OFAC, and other similar trade protection regulations and measures in the U.S., the EU, or in other jurisdictions;

Current wording

risks relating to the implementation of exchange controls and trade compliance, including restrictions promulgated by the United States Department of the Treasury’s Office of Foreign Assets Control (“OFAC”), and other similar trade protection regulations and measures in the U.S., the EU, or in other jurisdictions;

Previous wording

Application of and limitations related to the DSL and PIPL regulations over processing of data and personal data within China as well as cross-border data transfers and other activities outside of China; and

Current wording

Application of and limitations related to the Data Security Law of 2021 and Personal Information Protection Law of 2021 regulations over processing of data and personal data within China as well as cross-border data transfers and other activities outside of China; and

Previous wording

In some cases, our software is subject to export control laws and regulations, including the Export Administration Regulations administered by the U.S. Department of Commerce, and our activities may be subject to trade and economic sanctions, including those administered by the United States Department of the Treasury’s Office of Foreign Assets Control (“OFAC”) (collectively, “Trade Controls”). As such, a license may be required to export or re-export our products, or provide related services, to certain countries and end-users, and for certain end-uses. Further, our products incorporating encryption functionality may be subject to special controls applying to encryption items and/or certain reporting requirements.

Current wording

In some cases, our software is subject to export control laws and regulations, including the Export Administration Regulations administered by the U.S. Department of Commerce, and our activities may be subject to trade and economic sanctions, including those administered by the OFAC (collectively, “Trade Controls”). As such, a license may be required to export or re-export our products, or provide related services, to certain countries and end-users, and for certain end-uses. Further, our products incorporating encryption functionality may be subject to special controls applying to encryption items and/or certain reporting requirements.

Previous wording

We are subject to the U.S. Foreign Corrupt Practices Act of 1977, as amended (the “FCPA”), the U.S. domestic bribery statute contained in 18 U.S.C. § 201, the U.S. Travel Act, the USA PATRIOT Act, the United Kingdom Bribery Act 2010, the Proceeds of Crime Act 2002, Chapter 9 (sub-chapter 5) of the Israeli Penal Law, 1977, the Israeli Prohibition on Money Laundering Law–2000 and possibly other anti-bribery and anti-money laundering laws in countries outside of the U.S. in which we conduct our activities. Anti-corruption and anti-bribery laws have been enforced aggressively in recent years and are interpreted broadly to generally prohibit companies, their employees, agents, representatives, business partners, and third-party intermediaries from authorizing, offering, or providing, directly or indirectly, improper payments or benefits to recipients in the public or private sector.

Current wording

We are subject to the U.S. Foreign Corrupt Practices Act of 1977, as amended (the “FCPA”), the U.S. domestic bribery statute contained in 18 U.S.C. § 201, the U.S. Travel Act, the USA PATRIOT Act of 2001, the United Kingdom Bribery Act 2010, the Proceeds of Crime Act 2002, Chapter 9 (sub-chapter 5) of the Israeli Penal Law, 1977, the Israeli Prohibition on Money Laundering Law–2000 and possibly other anti-bribery and anti-money laundering laws in countries outside of the U.S. in which we conduct our activities. Anti-corruption and anti-bribery laws have been enforced aggressively in recent years and are interpreted broadly to generally prohibit companies, their employees, agents, representatives, business partners, and third-party intermediaries from authorizing, offering, or providing, directly or indirectly, improper payments or benefits to recipients in the public or private sector.

Previous wording

actual or perceived breaches of, or failures relating to, privacy, data protection, or data security;

Current wording

actual or perceived breaches of, or failures or other incidents relating to, privacy, data protection, or data security;

Previous wording

other events or factors, including those resulting from war, including the war between Israel, Hamas and Hezbollah, the war between Israel and Iran, and incidents of terrorism or responses to these events.

Current wording

other events or factors, including those resulting from the conflict in the Middle East and incidents of terrorism or responses to these events.

Previous wording

Our executive officers, directors, current 5% or greater shareholders and affiliated entities together beneficially owned approximately 21% of our ordinary shares outstanding as of June 30, 2025. As a result, these shareholders, acting together, will have control over certain matters that require approval by our shareholders, including matters such as the appointment and dismissal of directors, capital increases, amendment to our articles of associations, and approval of certain corporate transactions. Corporate action might be taken even if other shareholders oppose them. This concentration of ownership might also have the effect of delaying or preventing a change of control of us that other shareholders may view as beneficial. It should be noted that we are not aware of any voting agreement or arrangement between our shareholders.

Current wording

Our executive officers, directors, current 5% or greater shareholders and affiliated entities together beneficially owned approximately 20% of our ordinary shares outstanding as of September 30, 2025. As a result, these shareholders, acting together, will likely have control over certain matters that require approval by our shareholders, including matters such as the appointment and dismissal of directors, capital increases, amendment to our articles of associations, and approval of certain corporate transactions. Corporate action might be taken even if other shareholders oppose them. This concentration of ownership might also have the effect of delaying or preventing a change of control of us that other shareholders may view as beneficial. It should be noted that we are not aware of any voting agreement or arrangement between our shareholders.

Previous wording

In October 2023, Hamas militants and members of other terrorist organizations infiltrated Israel’s southern border from the Gaza Strip and conducted a series of terror attacks on civilian and military targets. Hezbollah militants conducted a series of terror attacks on civilian and military targets from the northern border of Israel. Since the commencement of these events, there have been additional active hostilities with other parties in the region, including Iran and its proxies. Although certain ceasefire agreements have been reached, these agreements have failed to be upheld, and military activity and hostilities continue to exist at varying levels of intensity. The situation remains volatile, with the potential for escalation into a broader regional conflict involving additional terrorist organizations and possibly other countries (including Hezbollah and Lebanon). Furthermore, the intensity and duration of Israel’s current war against Hamas, Hezbollah, Iran, and other terror organizations are difficult to predict (including with respect to the recent geopolitical changes in Syria and the involvement of other regional actors), as are such war’s economic implications on the Company’s business and operations and on Israel’s economy in general. These events may imply wider macroeconomic indications of a deterioration of Israel’s economic standing (including as the result of a downgrade in Israel’s credit rating by certain credit rating agencies), which may have a material adverse effect on the Company and its ability to effectively conduct its operations.

Current wording

In October 2023, Hamas militants and members of other terrorist organizations infiltrated Israel’s southern border from the Gaza Strip and conducted a series of terror attacks on civilian and military targets. Hezbollah militants conducted a series of terror attacks on civilian and military targets from the northern border of Israel. Since the commencement of these events, there have been additional active hostilities with other parties in the region, including Iran and its proxies. In October 2025, a ceasefire agreement was reached between Israel and Hamas, leading to a cessation of direct conflict between these parties. However, the situation remains volatile, with the potential for renewed escalation. The intensity and duration of these conflicts, as well as their economic implications for the Company and Israel’s economy, remain difficult to predict. These events may have wider macroeconomic implications, including a deterioration of Israel’s economic standing (such as the result of a downgrade in Israel’s credit rating by certain credit rating agencies), which may have a material adverse effect on the Company and its ability to effectively conduct its operations.

Previous wording

Certain countries, companies, and organizations participate in a boycott of Israeli companies, and there have been increased efforts recently to cause companies and consumers to boycott Israeli goods and services or restrict business with Israel. Any boycott, restrictive laws, policies, or practices directed towards Israel, Israeli businesses, or Israeli citizens could, individually or in the aggregate, have a material adverse effect on our business. In January 2024, the International Court of Justice, or ICJ, issued an interim ruling against Israel, which could have a material adverse effect on our business. In November 2024, the International Criminal Court issued arrest warrants for Israeli leaders. There are concerns that companies and businesses will terminate, and may have already terminated, certain commercial relationships with Israeli companies following the ICJ decision. Additionally, proposed changes to Israel's judicial system may lead to political instability or civil unrest, adversely affecting our business, results of operations, and ability to raise additional funds if needed.

Current wording

Certain countries, companies, and organizations participate in a boycott of Israeli companies, and there have been increased efforts recently to cause companies and consumers to boycott Israeli goods and services or restrict business with Israel. Any boycott, restrictive laws, policies, or practices directed towards Israel, Israeli businesses, or Israeli citizens could, individually or in the aggregate, have a material adverse effect on our business. The International Court of Justice issued rulings and has taken actions relating to Israel, which could have a material adverse effect on our business. There are concerns that companies and businesses will terminate, or may have already terminated, certain commercial relationships with Israeli companies following such international legal proceedings or decisions. Additionally, proposed changes to Israel's judicial system may lead to political instability or civil unrest, adversely affecting our business, results of operations, and ability to raise additional funds if needed.

Previous wording

The impact of the war between Israel, Hamas and Hezbollah, the war between Israel and Iran, and regional conflict in the Middle East, the war between Russia and Ukraine, and other areas of geopolitical tension around the world, including the related global economic disruptions, remains uncertain at this time, and could harm or continue to harm our business and results of operations.

Current wording

The impact of the regional conflict in the Middle East, the war between Russia and Ukraine, and other areas of geopolitical tension around the world, including the related global economic disruptions, remains uncertain at this time, and could harm or continue to harm our business and results of operations.

Previous wording

The war between Israel, Hamas and Hezbollah, the war between Israel and Iran, and regional conflict in the Middle East, the war between Russia and Ukraine, and other areas of geopolitical tension around the world continue to impact worldwide economic activity and financial markets. As a result, we could experience disruptions in our business or the business of our partners, customers, or the economy as a whole, any of which could adversely affect and could materially adversely impact our business, results of operations, and overall financial condition in future periods.

Current wording

The regional conflict in the Middle East, the war between Russia and Ukraine, and other areas of geopolitical tension around the world continue to impact worldwide economic activity and financial markets. In October 2025, a ceasefire agreement was reached between Israel and Hamas, resulting in a cessation of active hostilities between these parties. However, the situation remains volatile, and there is still a risk of renewed escalation or spillover involving other parties in the region. As a result, we could experience disruptions in our business or the business of our partners, customers, or the economy as a whole, any of which could adversely affect and could materially adversely impact our business, results of operations, and overall financial condition in future periods.

Previous wording

The extent and continued impact of the war between Israel, Hamas and Hezbollah, the war between Israel and Iran, the regional conflict in the Middle East, the Russia-Ukraine war, and related global economic disruptions on our operational and financial condition will depend on certain developments, including: government responses to the wars; the impact of the wars on our customers and our sales cycles; their impacts on customer, industry, or technology-based community events; and their effect on our partners, some of which are uncertain, difficult to predict, and not within our control. General economic conditions and disruptions in global markets due to the war between Israel, Hamas and Hezbollah, the war between Israel and Iran, the regional conflict in the Middle East, the Russia-Ukraine war, and other areas of geopolitical tension around the world, and any actions taken by governmental authorities and other third parties in response may also affect our future performance.

Current wording

The regional conflict in the Middle East, the Russia-Ukraine war, and related global economic disruptions on our operational and financial condition will depend on certain developments, including: government responses to the conflicts and wars; the impact of the conflicts and wars on our customers and our sales cycles; their impacts on customer, industry, or technology-based community events; and their effect on our partners, some of which are uncertain, difficult to predict, and not within our control. General economic conditions and disruptions in global markets due to the regional conflict in the Middle East, the Russia-Ukraine war, and other areas of geopolitical tension around the world, and any actions taken by governmental authorities and other third parties in response may also affect our future performance.

Previous wording

As of the date of this Quarterly Report on Form 10-Q, the full impact of the war between Israel, Hamas and Hezbollah, the war between Israel and Iran, the regional conflict in the Middle East, the war between Russia and Ukraine, and related global economic disruptions on our financial condition and results of operations remains uncertain. Furthermore, because of our subscription-based business model, the impact of these factors may not be fully reflected in our results of operations and overall financial condition until future periods, if at all.

Current wording

As of the date of this Quarterly Report on Form 10-Q, the full impact of the regional conflict in the Middle East, the war between Russia and Ukraine, and related global economic disruptions on our financial condition and results of operations remains uncertain. Furthermore, because of our subscription-based business model, the impact of these factors may not be fully reflected in our results of operations and overall financial condition until future periods, if at all.

Previous wording

A significant natural disaster, such as an earthquake, fire, flood, or significant power outage could have an adverse impact on our business, results of operations, and financial condition. We have a number of our employees and executive officers located in the San Francisco Bay Area where our U.S. headquarters are located, a region known for seismic activity and increasingly, wildfires. In the event our or our partners’ abilities are hindered by any of the events discussed above, sales could be delayed, resulting in missed financial targets for a particular quarter. In addition, acts of terrorism, pandemics, such as the outbreak of the novel coronavirus or another public health crisis, protests, riots, and other geopolitical unrest could cause disruptions in our business or the business of our partners, customers, or the economy as a whole. Any disruption in the business of our partners or customers that affects sales in a given fiscal quarter could have a significant adverse impact on our quarterly results for that and future quarters. All of the aforementioned risks may be further increased if our disaster recovery plans prove to be inadequate.

Current wording

A significant catastrophic event (such as an earthquake, fire, flood, heat wave, hurricane, severe weather, storm, tornado, tsunami, typhoon, volcanic eruption, or other natural disaster), or significant power outage could have an adverse impact on our business, results of operations, and financial condition. Climate change and other environmental factors are contributing to an increase in erratic weather patterns globally and intensifying the impact of certain types of catastrophes. We have a number of our employees and executive officers located in the San Francisco Bay Area where our U.S. headquarters are located, a region known for seismic activity, rising ocean levels, and increasingly, wildfires and associated flash floods. A significant natural disaster, such as an earthquake, tsunami, wildfire, flood or significant power outage affecting the Bay Area, could have a material adverse impact on our business, results of operations, and financial condition. In the event our or our partners’ abilities are hindered by any of the events discussed above, sales could be delayed, resulting in missed financial targets for a particular quarter. In addition, acts of terrorism, pandemics (such as the outbreak of the novel coronavirus or another public health crisis), protests, riots, armed conflict, and other geopolitical unrest could cause disruptions in our business or the business of our partners, customers, or the economy as a whole.