Palo Alto Networks Inc

Previous wording

•Issues in the development and deployment of AI may result in reputational harm and legal liability and could adversely affect our results of operations.

Current wording

•Issues in the development, deployment or use of AI may result in reputational harm, legal liability and could adversely affect our business and results of operations.

Previous wording

•We may not have the ability to raise the funds necessary to settle conversions of the CyberArk Notes, repurchase the CyberArk Notes upon a fundamental change, or repay the CyberArk Notes in cash at their maturity, and our other debt may contain limitations on our ability to pay cash upon conversion or repurchase of the CyberArk Notes.

Current wording

•We may not have the ability to raise the funds necessary to settle conversions of the 2030 Notes, repurchase the 2030 Notes upon a fundamental change, or repay the 2030 Notes in cash at their maturity, and our other debt may contain limitations on our ability to pay cash upon conversion or repurchase of the 2030 Notes.

Previous wording

•The capped call transactions may affect the value of the CyberArk Notes and our common stock.

Current wording

•The capped calls may affect the value of the 2030 Notes and our common stock.

Previous wording

We have experienced growth and increased demand for our products and subscriptions over recent years. As a result, our employee headcount has increased, and we expect it to continue to grow over the next year. For example, from the end of fiscal 2025 to the end of the second quarter of fiscal 2026, our headcount increased from 16,068 to 17,027 employees. In addition, as we have grown, the number of end-customers has also increased, and we have managed more complex deployments of our products and subscriptions with larger end-customers. The growth and expansion of our business and product, subscription, and support offerings places a significant strain on our management, operational, and financial resources. To manage any future growth effectively, we must continue to improve and expand our information technology and financial infrastructure, our operating and administrative systems and controls, and our ability to manage headcount, capital, and processes in an efficient manner.

Current wording

We have experienced growth and increased demand for our products and subscriptions over recent years. As a result, our employee headcount has increased, and we expect it to continue to grow over the next year. For example, from the end of fiscal 2025 to the end of the third quarter of fiscal 2026, our headcount increased from 16,068 to 21,491 employees, including approximately 4,166 additional headcount as a result of the CyberArk acquisition. In addition, as we have grown, the number of end-customers has also increased, and we have managed more complex deployments of our products and subscriptions with larger end-customers. The growth and expansion of our business and product, subscription, and support offerings places a significant strain on our management, operational, and financial resources. To manage any future growth effectively, we must continue to improve and expand our information technology and financial infrastructure, our operating and administrative systems and controls, and our ability to manage headcount, capital, and processes in an efficient manner.

Previous wording

We have experienced revenue growth rates of 15% and 14% for the six months ended January 31, 2026 and 2025, respectively. Our revenue for any quarterly or annual period should not be relied upon as an indication of our future revenue or revenue growth for any future period. If we are unable to maintain consistent or increasing revenue or revenue growth, the market price of our common stock could be volatile, and it may be difficult for us to maintain profitability or maintain or increase cash flow on a consistent basis.

Current wording

We have experienced revenue growth rates of 21% and 15% for the nine months ended April 30, 2026 and 2025, respectively. Our revenue for any quarterly or annual period should not be relied upon as an indication of our future revenue or revenue growth for any future period. If we are unable to maintain consistent or increasing revenue or revenue growth, the market price of our common stock could be volatile, and it may be difficult for us to maintain profitability or maintain or increase cash flow on a consistent basis.

Previous wording

We believe there are significant seasonal factors that may cause our second and fourth fiscal quarters to record greater revenue sequentially than our first and third fiscal quarters. We believe that this seasonality results from a number of factors, including:

Current wording

We believe there are seasonal factors that may cause our second and fourth fiscal quarters to record greater revenue sequentially than our first and third fiscal quarters. We believe that this seasonality results from a number of factors, including:

Previous wording

Subscription and support revenue accounts for a significant portion of our revenue, comprising 81.3% of total revenue in the six months ended January 31, 2026 and 82.4% of total revenue in the six months ended January 31, 2025. Sales and renewals of subscription and support contracts may decline and fluctuate as a result of a number of factors, including end-customers’ level of satisfaction with our products and subscriptions, the frequency and severity of subscription outages, our product uptime or latency, the prices of our products and subscriptions, and reductions in our end-customers’ spending levels. Existing end-customers have no contractual obligation to, and may not, renew their subscription and support contracts after the completion of their initial contract period. Additionally, our end-customers may renew their subscription and support agreements for shorter contract lengths or on other terms that are less economically beneficial to us. If our sales of new or renewal subscription and support contracts decline, our total revenue and revenue growth rate may decline, and our business will suffer. In addition, because we recognize subscription and support revenue over the term of the relevant service period, which is typically one to five years, a decline in subscription or support contracts in any one fiscal quarter will not be fully or immediately reflected in revenue in that fiscal quarter but will negatively affect our revenue in future fiscal quarters.

Current wording

Subscription and support revenue accounts for a significant portion of our revenue, comprising 80.9% of total revenue in the nine months ended April 30, 2026 and 81.6% of total revenue in the nine months ended April 30, 2025. Sales and renewals of subscription and support contracts may decline and fluctuate as a result of a number of factors, including end-customers’ level of satisfaction with our products and subscriptions, the frequency and severity of subscription outages, our product uptime or latency, the prices of our products and subscriptions, and reductions in our end-customers’ spending levels. Existing end-customers have no contractual obligation to, and may not, renew their subscription and support contracts after the completion of their initial contract period. Additionally, our end-customers may renew their subscription and support agreements for shorter contract lengths or on other terms that are less economically beneficial to us. If our sales of new or renewal subscription and support contracts decline, our total revenue and revenue growth rate may decline, and our business will suffer. In addition, because we recognize subscription and support revenue over the term of the relevant service period, which is typically one to five years, a decline in subscription or support contracts in any one fiscal quarter will not be fully or immediately reflected in revenue in that fiscal quarter but will negatively affect our revenue in future fiscal quarters.

Previous wording

Substantially all of our revenue is generated by sales through our channel partners, including distributors and resellers. For the six months ended January 31, 2026, three distributors individually represented 10% or more of our total revenue and in the aggregate represented 42% of our total revenue. As of January 31, 2026, three distributors individually represented 10% or more of our gross accounts receivable and in the aggregate represented 46% of our gross accounts receivable.

Current wording

Substantially all of our revenue is generated by sales through our channel partners, including distributors and resellers. For the nine months ended April 30, 2026, two distributors individually represented 10% or more of our total revenue and in the aggregate represented 31% of our total revenue. As of April 30, 2026, two distributors individually represented 10% or more of our gross accounts receivable and in the aggregate represented 29% of our gross accounts receivable.

Previous wording

•independent vendors that may offer a mix of security products, such as CheckPoint, Crowdstrike, Delinea, Fortinet, Okta, SailPoint, Wiz, and Zscaler, vendors that may offer a mix of observability products, such as DataDog, Dynatrace, and Elastic, or vendors that may offer a mix of security and observability products;

Current wording

•independent vendors that may offer a mix of security products, such as CheckPoint, Crowdstrike, Delinea, Fortinet, Okta, SailPoint, and Zscaler, vendors that may offer a mix of observability products, such as DataDog, Dynatrace, and Elastic, or vendors that may offer a mix of security and observability products;

Previous wording

Conditions in our market could change rapidly and significantly as a result of technological advancements, partnering, acquisitions or strategic investments by our competitors, or continuing market consolidation. Our competitors and potential competitors may be able to develop new or disruptive technologies, products, or services, and leverage new business models that are equal or superior to ours, achieve greater market acceptance of their products and services, disrupt our markets, and increase sales by utilizing different distribution channels than we do. In addition, new and enhanced technologies, including AI and machine learning, continue to increase our competition. To compete successfully, we must accurately anticipate technology developments and deliver innovative, relevant, and useful products, services, and technologies in a timely manner. Some of our competitors have made or could make acquisitions of businesses that may allow them to offer more directly competitive and comprehensive solutions than they had previously offered and adapt more quickly to new technologies and end-customer needs. Our current and potential competitors may also establish cooperative relationships among themselves or with third parties that may further enhance their resources or product or service offerings.

Current wording

Conditions in our market could change rapidly and significantly as a result of technological advancements, including with respect to artificial intelligence (“AI”), partnering, acquisitions or strategic investments by our competitors, or continuing market consolidation. Our competitors and potential competitors may be able to develop new or disruptive technologies, products, or services, and leverage new business models that are equal or superior to ours, achieve greater market acceptance of their products and services, disrupt our markets, and increase sales by utilizing different distribution channels than we do. In addition, new and enhanced technologies, including AI and machine learning, continue to increase our competition, and our competitors may more successfully incorporate AI into their products, gain or leverage superior access to certain AI technologies, and achieve higher market acceptance of their AI solutions. To compete successfully, we must accurately anticipate technology developments and deliver innovative, relevant, and useful products, services, and technologies in a timely manner. Some of our competitors have made or could make acquisitions of businesses that may allow them to offer more directly competitive and comprehensive solutions than they had previously offered and adapt more quickly to new technologies and end-customer needs. Our current and potential competitors may also establish cooperative relationships among themselves or with third parties that may further enhance their resources or product or service offerings.

Previous wording

Issues in the development and deployment of AI may result in reputational harm and legal liability and could adversely affect our results of operations.

Current wording

Issues in the development, deployment or use of AI may result in reputational harm, legal liability and could adversely affect our business and results of operations.

Previous wording

We have incorporated, and are continuing to develop and deploy, AI into many of our products and solutions, including services that support our products and solutions. We are also incorporating AI into the operations of our business. AI presents challenges and risks that could affect our products and solutions, and the operations of our business. For example, AI algorithms may have flaws, and datasets used to train models may be insufficient or contain biased information. The AI that is being incorporated into our products, solutions, and business operation tools may not be successful or beneficial, and instead may cause technical, legal or ethical problems or result in increased costs. The investments that we are making across our business in AI reflect our ongoing efforts to innovate and provide products and services that are useful to our customers, as well as provide efficiencies in our business. Such investments ultimately may not be commercially viable or may not result in an adequate return of capital and we may incur unanticipated liabilities. These efforts could subject us to regulatory risk, legal liability, including under legislation regulating AI in jurisdictions such as the E.U. and laws and regulations being considered in other jurisdictions, or brand or reputational harm.

Current wording

We have incorporated, and are continuing to develop and deploy, AI into many of our products and solutions, including services that support our products and solutions. We are also incorporating AI into the operations of our business. AI presents challenges, risks, and potentially unintended consequences that could affect our products and solutions, and the operations of our business. For example, AI algorithms may have flaws, and datasets used to train AI models may be insufficient or contain biased information. The AI that is being incorporated into our products, solutions, and business operation tools may not be successful or beneficial, and instead may cause technical, legal or ethical problems or result in increased costs. The investments that we are making across our business in AI reflect our ongoing efforts to innovate and provide products and services that are useful to our customers, as well as provide efficiencies in our business. Such investments ultimately may not be commercially viable or may not result in an adequate return of capital and we may incur unanticipated liabilities.

Previous wording

The rapid evolution of AI, including potential government regulation of AI, requires us to invest significant resources to develop, test, and maintain AI in our products and services in a manner that meets evolving requirements and expectations. The rules and regulations adopted by policymakers over time may require us to make changes to our business practices. Developing, testing, and deploying AI systems may also increase the cost profile of our offerings due to the nature of the computing costs involved in such systems.

Current wording

The rapid evolution of AI, including potential government regulation of AI, requires us to invest significant resources to develop, test, and maintain AI in our products and services in a manner that meets evolving requirements and expectations. The rules and regulations adopted by policymakers over time may require us to make changes to our business practices, and our efforts and investments regarding AI could subject us to regulatory risk, legal liability, including under legislation regulating AI in jurisdictions such as the E.U. and laws and regulations being considered in other jurisdictions, or brand or reputational harm. Developing, testing, and deploying AI systems may also increase the cost profile of our offerings due to the nature of the computing costs involved in such systems.

Previous wording

Increasingly, companies are subject to a wide variety of attacks on an ongoing basis. In addition to traditional computer “hackers,” malicious code (such as viruses and worms), phishing attempts, employee theft or misuse, and denial of service attacks, sophisticated nation-state and nation-state supported actors engage in intrusions and attacks (including advanced persistent threat intrusions and supply chain attacks), and add to the risks to our internal networks, cloud-deployed enterprise and customer-facing environments and the information they store and process. Incidences of cyberattacks and other cybersecurity breaches and incidents have increased and are likely to continue to increase. We and our third-party service providers face security threats and attacks from a variety of sources. Despite our efforts and processes to prevent breaches of our internal networks, systems, and websites, our data, corporate systems, and security measures, as well as those of our third-party service providers, are still vulnerable to computer viruses, break-ins, phishing attacks, ransomware attacks, or other types of attacks from outside parties, or breaches due to employee error, malfeasance, or some combination of these. We cannot guarantee that the measures we have taken to protect our networks, systems, and websites will provide adequate security. Furthermore, as a well-known provider of security solutions, we may be a more attractive target for such attacks. The Russia-Ukraine war and associated activities in Ukraine and Russia may increase the risk of cyberattacks on various types of infrastructure and operations, and the United States government has warned companies to be prepared for additional Russian cyberattacks in response to the Sanctions on Russia.

Current wording

Increasingly, companies are subject to a wide variety of attacks on an ongoing basis. In addition to traditional computer “hackers,” malicious code (such as viruses and worms), phishing attempts, employee theft or misuse, and denial of service attacks, sophisticated nation-state and nation-state supported actors engage in intrusions and attacks (including advanced persistent threat intrusions and supply chain attacks), and add to the risks to our internal networks, cloud-deployed enterprise and customer-facing environments and the information they store and process. Incidences of cyberattacks and other cybersecurity breaches and incidents have increased and are likely to continue to increase. We and our third-party service providers face security threats and attacks from a variety of sources. Despite our efforts and processes to prevent breaches of our internal networks, systems, and websites, our data, corporate systems, and security measures, as well as those of our third-party service providers, are still vulnerable to computer viruses, break-ins, phishing attacks, ransomware attacks, or other types of attacks from outside parties, or breaches due to employee error, malfeasance, or some combination of these. In addition, the adoption of AI poses risks. AI can be exploited by malicious actors to develop advanced cyberattacks, bypass security measures, and exploit system vulnerabilities, including potentially identifying weaknesses in our systems before we become aware of or can remediate them. We cannot guarantee that the measures we have taken to protect our networks, systems, and websites will provide adequate security. Furthermore, as a well-known provider of security solutions, we may be a more attractive target for such attacks. The Russia-Ukraine war and associated activities in Ukraine and Russia may increase the risk of cyberattacks on various types of infrastructure and operations, and the United States government has warned companies to be prepared for additional Russian cyberattacks in response to the Sanctions on Russia.

Previous wording

Further, we do not have volume purchase contracts with any of our component suppliers, and they could cease selling to us at any time. If we are unable to obtain a sufficient quantity of these components in a timely manner for any reason, sales of our hardware products could be delayed or halted, or we could be forced to expedite shipment of such components or our hardware products at dramatically increased costs. Our component suppliers also change their selling prices frequently in response to market trends, including industry-wide increases in demand, such as the recent increased demand for memory-related components, which changes could adversely impact our business or results of operations, including by resulting in lower gross margins. Because we do not have, for the most part, volume purchase contracts with our component suppliers, we are susceptible to price fluctuations related to raw materials and components and may not be able to adjust our prices accordingly. Additionally, poor quality in any of the sole-sourced components in our products could result in lost sales or sales opportunities.

Current wording

Further, we do not have volume purchase contracts with any of our component suppliers, and they could cease selling to us at any time. If we are unable to obtain a sufficient quantity of these components in a timely manner for any reason, sales of our hardware products could be delayed or halted, or we could be forced to expedite shipment of such components or our hardware products at dramatically increased costs. Our component suppliers also change their selling prices frequently in response to market trends, including industry-wide increases in demand, which changes could adversely impact our business or results of operations, including by resulting in lower gross margins. For example, there is currently a global shortage of memory-related components, which are a component in certain of our products. Accordingly, there are, and may continue to be, constraints on the availability of memory-related components, which may lead to delays in the production and delivery of certain of our products and increased costs to source available memory chips and other components. Because we do not have, for the most part, volume purchase contracts with our component suppliers, we are susceptible to price fluctuations related to raw materials and components and may not be able to adjust our prices accordingly. Additionally, poor quality in any of the sole-sourced components in our products could result in lost sales or sales opportunities.

Previous wording

We have entered into forward contracts in an effort to reduce our foreign currency exchange exposure related to our foreign currency denominated revenue and operating expenditures. As of January 31, 2026, the total notional amount of our outstanding foreign currency forward contracts was $1.1 billion. For more information on our hedging transactions, refer to Note 6. Derivative Instruments in Part I, Item 1 of this Quarterly Report on Form 10-Q. The effectiveness of our existing hedging transactions and the availability and effectiveness of any hedging transactions we may decide to enter into in the future may be limited and we may not be able to successfully hedge our exposure, which could adversely affect our financial condition and operating results.

Current wording

We have entered into forward contracts in an effort to reduce our foreign currency exchange exposure related to our foreign currency denominated revenue and operating expenditures. As of April 30, 2026, the total notional amount of our outstanding foreign currency forward contracts was $1.2 billion. For more information on our hedging transactions, refer to Note 6. Derivative Instruments in Part I, Item 1 of this Quarterly Report on Form 10-Q. The effectiveness of our existing hedging transactions and the availability and effectiveness of any hedging transactions we may decide to enter into in the future may be limited and we may not be able to successfully hedge our exposure, which could adversely affect our financial condition and operating results.

Previous wording

We have business operations in Israel, which meaningfully expanded as a result of the acquisition of CyberArk, and we intend to continue growing our presence in Israel. Our operations in Israel could be disrupted by political instability, civil unrest, terrorist attacks, acts of violence, acts of war, or other military actions, including the hostilities in Israel and the surrounding region. The future of peace efforts between Israel and its Arab neighbors remains uncertain. The effects of hostilities and violence on the Israeli economy and our operations in Israel are unclear, and we cannot predict the effect on us of further increases in these hostilities or future armed conflict, political instability, or violence in the region. Current or future tensions and conflicts in the Middle East could adversely affect our business, operating results, financial condition, and cash flows.

Current wording

We have business operations in Israel, which meaningfully expanded as a result of the acquisition of CyberArk, and we intend to continue growing our presence in Israel. Our operations in Israel could be disrupted by political instability, civil unrest, terrorist attacks, acts of violence, acts of war, or other military actions, including the hostilities in Israel and the surrounding region. The future of peace efforts between Israel and its Arab neighbors remains uncertain. The effects of hostilities and violence on the Israeli economy and our operations in Israel are unclear, and we cannot predict the effect on us of further increases in these hostilities or future armed conflict, political instability, or violence in the region. Current or future tensions and conflicts in the Middle East could adversely affect our business, operating results, financial condition, and cash flows. For example, the recent military conflict involving Iran could escalate in the future and adversely affect our business and operations in Israel.

Previous wording

In addition, the U.K. government enacted the U.K. Data (Use and Access) Act 2025 on June 19, 2025, which includes changes to the U.K.’s data protection regime that cause it to deviate from the GDPR. This creates new compliance challenges and uncertainty, including with respect to the European Commission’s adequacy determination for the U.K.’s data protection regime.

Current wording

In addition, the U.K. Data (Use and Access) Act 2025, enacted on June 19, 2025, includes changes to the U.K.’s data protection regime that cause it to deviate from the GDPR. This creates new compliance challenges and uncertainty, including with respect to the European Commission’s adequacy determination for the U.K.’s data protection regime.

Previous wording

We are also subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”). The CCPA requires, among other things, covered businesses to provide enhanced disclosures to California consumers and to afford such consumers certain rights regarding their personal data, including the right to opt out of data sales for targeted advertising, and creates a private right of action to individuals affected by a data breach, if the breach was caused by a lack of reasonable security. The effects of the CCPA have been significant, requiring us to modify our data processing practices and policies and to incur substantial costs and expenses for compliance. Moreover, other U.S. states have enacted laws relating to privacy and security that are potentially relevant to us. These include laws enacted in at least 20 U.S. states, a portion of which are expected to come into effect over the course of our fiscal 2026. The U.S. Department of Justice also has issued rules regarding access to, or transfer of, certain bulk sensitive personal data by countries of concern. Increasingly complex federal or state laws and regulations relating to privacy and security, and interpretations and enforcement of existing laws and regulations relating to these matters, may require us to modify our data practices and policies, incur substantial compliance costs and expenses, and add further complexity to our compliance efforts that could adversely affect our business or increase our potential liability if we fail to comply or are alleged to have done so.

Current wording

We are also subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”). The CCPA requires, among other things, covered businesses to provide enhanced disclosures to California consumers and to afford such consumers certain rights regarding their personal data, including the right to opt out of data sales for targeted advertising, and creates a private right of action to individuals affected by a data breach, if the breach was caused by a lack of reasonable security. The effects of the CCPA have been significant, requiring us to modify our data processing practices and policies and to incur substantial costs and expenses for compliance. Moreover, other U.S. states have enacted laws relating to privacy and security that are potentially relevant to us. These include laws enacted in at least 22 U.S. states. The U.S. Department of Justice also has issued rules regarding access to, or transfer of, certain bulk sensitive personal data by countries of concern. Increasingly complex federal or state laws and regulations relating to privacy and security, and interpretations and enforcement of existing laws and regulations relating to these matters, may require us to modify our data practices and policies, incur substantial compliance costs and expenses, and add further complexity to our compliance efforts that could adversely affect our business or increase our potential liability if we fail to comply or are alleged to have done so.

Previous wording

We may also from time to time be subject to obligations relating to personal data by contract, or face assertions that we are subject to self-regulatory obligations or industry standards. Additionally, the Federal Trade Commission and many state attorneys general are more regularly bringing enforcement actions in connection with federal and state consumer protection laws for false or deceptive acts or practices in relation to the online collection, use, dissemination, and security of personal data. Internationally, data localization laws may mandate that personal data collected in a foreign country be processed and stored within that country.

Current wording

We may also from time to time be subject to obligations relating to personal data by contract, or face assertions that we are subject to self-regulatory obligations or industry standards. Additionally, the Federal Trade Commission and many state attorneys general are more regularly bringing enforcement actions in connection with federal and state consumer protection laws for false or deceptive acts or practices in relation to the online collection, use, dissemination, and security of personal data.

Previous wording

New legislation affecting the scope of personal data and personal information where we or our customers and partners have operations, especially relating to classification of Internet Protocol (“IP”) addresses, machine identification, AI and machine learning, location data, and other information, may limit or inhibit our ability to operate or expand our business, including limiting strategic partnerships that may involve the sharing or uses of data, and may require significant expenditures and efforts in order to comply. Notably, public perception of potential privacy, data protection, or information security concerns—whether or not valid—may harm our reputation and inhibit adoption of our products and subscriptions by current and future end-customers. Each of these laws and regulations, and any changes to these laws and regulations, or new laws and regulations, could impose significant limitations, or require changes to our business model or practices or growth strategy, which may increase our compliance expenses and make our business more costly or less efficient to conduct.

Current wording

New legislation affecting the scope of personal data and personal information where we or our customers and partners have operations, especially relating to classification of Internet Protocol (“IP”) addresses, machine identification, AI and machine learning, location data, and other information, may limit or inhibit our ability to operate or expand our business, including limiting strategic partnerships that may involve the sharing or uses of data, and may require significant expenditures and efforts in order to comply. Internationally, data localization laws may mandate that personal data collected in a foreign country be processed and stored within that country, which may require us to restructure our cloud infrastructure at significant cost. Notably, public perception of potential privacy, data protection, or information security concerns—whether or not valid—may harm our reputation and inhibit adoption of our products and subscriptions by current and future end-customers. Each of these laws and regulations, and any changes to these laws and regulations, or new laws and regulations, could impose significant limitations, or require changes to our business model or practices or growth strategy, which may increase our compliance expenses and make our business more costly or less efficient to conduct.

Previous wording

In addition, our future income tax obligations and effective tax rates could be adversely affected by changes in, or interpretations of, tax laws, regulations, policies, or decisions in the United States or in the other jurisdictions in which we operate including as a result of the U.S. federal tax legislation commonly referred to as the One Big Beautiful Bill Act, which was signed into law on July 4, 2025.

Current wording

In addition, our future income tax obligations and effective tax rates could be adversely affected by changes in, or interpretations of, tax laws, regulations, policies, or decisions in the United States or in the other jurisdictions in which we operate including as a result of the U.S. federal tax legislation commonly referred to as the One Big Beautiful Bill Act, which was signed into law on July 4, 2025. In addition, our effective tax rates could be affected by fluctuations in the market price of our common stock and changes in the fair value of CyberArk’s $1.25 billion aggregate principal amount of 0.00% Convertible Senior Notes due 2030 (the “2030 Notes”) and the fair value of the capped calls we acquired in connection with the CyberArk acquisition. If our future tax obligations or effective tax rates increase as a result of these or other factors, it could have an adverse effect on our financial condition and operating results.

Previous wording

There is an increasing focus from regulators, certain investors, and other stakeholders concerning corporate responsibility matters, both in the United States and internationally. We communicate certain corporate responsibility-related initiatives, goals, and/or commitments regarding sustainability matters, inclusion, responsible sourcing and social investments, and other matters in our annual Corporate Responsibility Report, on our website, in our filings with the SEC, and elsewhere. These initiatives, goals, or commitments could be difficult to achieve and costly to implement. We could fail to achieve, or be perceived to fail to achieve, our corporate responsibility-related initiatives, goals, or commitments. In addition, we could be criticized for the timing, scope or nature of these initiatives, goals, or commitments, or for any revisions to them. To the extent that our required and voluntary disclosures about corporate responsibility matters increase, we could be criticized for the accuracy, adequacy, or completeness of such disclosures. Our actual or perceived failure to achieve our corporate responsibility-related initiatives, goals, or commitments could negatively impact our reputation, result in corporate responsibility-focused investors not purchasing and holding our stock, or otherwise materially harm our business.

Current wording

There is an evolving and varied focus from regulators, investors, customers, and other stakeholders concerning corporate responsibility matters, both in the United States and internationally. We communicate certain corporate responsibility-related initiatives, goals, and/or commitments regarding sustainability matters, inclusion, responsible sourcing, community impact, and other matters in our annual Corporate Responsibility Report, on our website, in our filings with the SEC, and elsewhere. These initiatives, goals, or commitments could be difficult to achieve and costly to implement and we may fail to achieve, or be perceived to fail to achieve them. In addition, we could be criticized for the timing, scope or nature of these initiatives, goals, or commitments, or for any revisions to them. To the extent that our required and voluntary disclosures about corporate responsibility matters increase, we could be criticized for the accuracy, adequacy, or completeness of such disclosures. Our actual or perceived failure to achieve our corporate responsibility-related initiatives, goals, or commitments could negatively impact our reputation, result in corporate responsibility-focused investors not purchasing and holding our stock, or otherwise materially harm our business.

Previous wording

In addition, we are or may become subject to various new and proposed sustainability-related laws and regulations, including, for example, the E.U.’s Corporate Sustainability Reporting Directive. Additional regulation may require us to incur significant additional costs associated with increased compliance burdens, including the implementation of additional internal controls processes and procedures, and impose increased oversight obligations on our management and board of directors, as well as require us to retain third-party experts. Noncompliance with applicable regulations or requirements could subject us to investigations, sanctions, enforcement actions, fines or litigation, which could negatively impact our business, operating results or financial condition.

Current wording

In addition, we are or may become subject to various new, proposed and evolving sustainability-related laws and regulations, including, for example, the E.U.’s Corporate Sustainability Reporting Directive. Additional regulation may require us to incur significant costs associated with increased compliance burdens, including the implementation of additional internal controls processes and procedures, and impose increased oversight obligations on our management and board of directors, as well as require us to retain third-party experts. Noncompliance with applicable regulations or requirements could subject us to investigations, sanctions, enforcement actions, fines or litigation, which could negatively impact our business, operating results or financial condition.

Previous wording

Our restated certificate of incorporation authorizes us to issue up to 2.0 billion shares of common stock and up to 100 million shares of preferred stock with such rights and preferences as may be determined by our board of directors. Subject to compliance with applicable rules and regulations, we may issue shares of common stock or securities convertible into or exchangeable for shares of our common stock from time to time in connection with a financing or other capital raising, acquisition, investment, our stock incentive plans, the settlement of CyberArk’s $1.25 billion aggregate principal amount of 0.00% Convertible Senior Notes due 2030 (the “CyberArk Notes”), or otherwise. Any such issuance could result in substantial dilution to our existing stockholders and cause the market price of our common stock to decline.

Current wording

Our restated certificate of incorporation authorizes us to issue up to 2.0 billion shares of common stock and up to 100 million shares of preferred stock with such rights and preferences as may be determined by our board of directors. Subject to compliance with applicable rules and regulations, we may issue shares of common stock or securities convertible into or exchangeable for shares of our common stock from time to time in connection with a financing or other capital raising, acquisition, investment, our stock incentive plans, the settlement of the 2030 Notes, or otherwise. Any such issuance could result in substantial dilution to our existing stockholders and cause the market price of our common stock to decline.

Previous wording

We may not have the ability to raise the funds necessary to settle conversions of the CyberArk Notes, repurchase the CyberArk Notes upon a fundamental change, or repay the CyberArk Notes in cash at their maturity, and our other debt may contain limitations on our ability to pay cash upon conversion or repurchase of the CyberArk Notes.

Current wording

We may not have the ability to raise the funds necessary to settle conversions of the 2030 Notes, repurchase the 2030 Notes upon a fundamental change, or repay the 2030 Notes in cash at their maturity, and our other debt may contain limitations on our ability to pay cash upon conversion or repurchase of the 2030 Notes.

Previous wording

In connection with the consummation of the CyberArk acquisition, we entered into the First Supplemental Indenture (the “Supplemental Indenture”) to the Indenture, dated as of June 10, 2025 (as supplemented by the Supplemental Indenture, the “Indenture”), governing the CyberArk Notes, and in the Supplemental Indenture we agreed to guarantee the CyberArk Notes.

Current wording

In connection with the consummation of the CyberArk acquisition, we entered into the a supplemental indenture (the “Supplemental Indenture”) to the Indenture, dated as of June 10, 2025 (as supplemented by the Supplemental Indenture, the “Indenture”), governing the 2030 Notes, and in the Supplemental Indenture we agreed to guarantee the 2030 Notes.

Previous wording

Accordingly, we or CyberArk will need to make cash payments (a) if holders of the CyberArk Notes require CyberArk to repurchase all, or a portion of, the CyberArk Notes upon the occurrence of a fundamental change before the maturity date, (b) upon conversion of the CyberArk Notes, or (c) to repay the CyberArk Notes in cash at their maturity, unless earlier converted or repurchased.

Current wording

Accordingly, we or CyberArk will need to make cash payments (a) if holders of the 2030 Notes require CyberArk to repurchase all, or a portion of, the 2030 Notes upon the occurrence of a fundamental change before the maturity date, (b) upon conversion of the 2030 Notes, or (c) to repay the 2030 Notes in cash at their maturity, unless earlier converted or repurchased.

Previous wording

In addition, our ability to repurchase or to pay cash upon conversion of the CyberArk Notes may be limited by law, regulatory authority, or agreements governing our other indebtedness. Our failure to repurchase the CyberArk Notes at a time when the repurchase is required by the indenture governing the CyberArk Notes, or to pay any cash amount due upon their maturity or conversion when required by the Indenture would constitute a default under the Indenture. A default under the Indenture could also lead to a default under agreements governing our other indebtedness. If the payment of the related indebtedness were to be accelerated after any applicable notice or grace periods, we may not have sufficient funds to satisfy all amounts due under the other indebtedness and the CyberArk Notes.

Current wording

In addition, our ability to repurchase or to pay cash upon conversion of the 2030 Notes may be limited by law, regulatory authority, or agreements governing our other indebtedness. Our failure to repurchase the 2030 Notes at a time when the repurchase is required by the indenture governing the 2030 Notes, or to pay any cash amount due upon their maturity or conversion when required by the Indenture would constitute a default under the Indenture. A default under the Indenture could also lead to a default under agreements governing our other indebtedness. If the payment of the related indebtedness were to be accelerated after any applicable notice or grace periods, we may not have sufficient funds to satisfy all amounts due under the other indebtedness and the 2030 Notes.

Previous wording

The capped call transactions may affect the value of the CyberArk Notes and our common stock.

Current wording

The capped calls may affect the value of the 2030 Notes and our common stock.

Previous wording

In connection with the issuance of the CyberArk Notes, CyberArk had previously entered into a number of capped call transactions (each, a “Capped Call”), each with a financial institution (each, together with its affiliates, a “Dealer”). In connection with the CyberArk acquisition, we entered into substantially identical amended and restated letter agreements with respect to the Capped Calls, under which the Capped Calls were assigned to us and now reference our common stock. The Capped Calls are generally expected to reduce the potential dilution to our common stock upon conversion of the CyberArk Notes and/or offset any potential cash payments we are required to make in excess of the principal amount of converted CyberArk Notes, with such reduction and/or offset subject to a cap.

Current wording

In connection with the issuance of the 2030 Notes, CyberArk had previously entered into a number of capped call transactions (each, a “Capped Call”), each with a financial institution (each, together with its affiliates, a “Dealer”). In connection with the CyberArk acquisition, we entered into substantially identical amended and restated letter agreements with respect to the Capped Calls, under which the Capped Calls were assigned to us and now reference our common stock. The Capped Calls are generally expected to reduce the potential dilution to our common stock upon conversion of the 2030 Notes and/or offset any potential cash payments we are required to make in excess of the principal amount of converted 2030 Notes, with such reduction and/or offset subject to a cap.

Previous wording

Any Dealer may modify or unwind its hedge positions by entering into or unwinding various derivatives with respect to our common stock and/or purchasing or selling our common stock or other securities of ours in secondary market transactions prior to the maturity of the CyberArk Notes (and is likely to do so following any conversion of the CyberArk Notes, any repurchase of the CyberArk Notes by us on any fundamental change repurchase date, any redemption date, or any other date on which the CyberArk Notes are retired by us, in each case, if we exercise the relevant election under the Capped Calls and in connection with any negotiated unwind or modification of the Capped Calls). This activity could cause or prevent an increase or a decrease in the market price of our common stock or the CyberArk Notes, which could affect a note holder’s ability to convert its CyberArk Notes and, to the extent the activity occurs during any observation period related to a conversion of the CyberArk Notes, it could affect the amount and value of the consideration that the note holder would receive upon conversion of the CyberArk Notes.

Current wording

Any Dealer may modify or unwind its hedge positions by entering into or unwinding various derivatives with respect to our common stock and/or purchasing or selling our common stock or other securities of ours in secondary market transactions prior to the maturity of the 2030 Notes (and is likely to do so following any conversion of the 2030 Notes, any repurchase of the 2030 Notes by us on any fundamental change repurchase date, any redemption date, or any other date on which the 2030 Notes are retired by us, in each case, if we exercise the relevant election under the Capped Calls and in connection with any negotiated unwind or modification of the Capped Calls). This activity could cause or prevent an increase or a decrease in the market price of our common stock or the 2030 Notes, which could affect a note holder’s ability to convert its 2030 Notes and, to the extent the activity occurs during any observation period related to a conversion of the 2030 Notes, it could affect the amount and value of the consideration that the note holder would receive upon conversion of the 2030 Notes.

Previous wording

We do not make any representation or prediction as to the direction or magnitude of any potential effect that the transactions described above may have on the price of the CyberArk Notes or our common stock. In addition, we do not make any representation that any Dealer has engaged with or will engage in these transactions or that these transactions, if commenced, have not been or will not be discontinued without notice.

Current wording

We do not make any representation or prediction as to the direction or magnitude of any potential effect that the transactions described above may have on the price of the 2030 Notes or our common stock. In addition, we do not make any representation that any Dealer has engaged with or will engage in these transactions or that these transactions, if commenced, have not been or will not be discontinued without notice.

Previous wording

During the three months ended January 31, 2026, we issued a total of 1,805,174 shares of our unregistered common stock in connection with an acquisition (the “Transaction”). The Transaction did not involve any underwriters, any underwriting discounts or commissions, or any public offering. The issuances of the securities pursuant to the Transaction were exempt from registration under Section 4(a)(2) of the Securities Act and Rule 506 of Regulation D promulgated thereunder.

Current wording

During the three months ended April 30, 2026, we issued a total of 346,107 shares of our unregistered common stock in connection with an acquisition (the “Transaction”). The Transaction did not involve any underwriters, any underwriting discounts or commissions, or any public offering. The issuances of the securities pursuant to the Transaction were exempt from registration under Section 4(a)(2) of the Securities Act and Rule 506 of Regulation D promulgated thereunder.

Previous wording

In February 2019, we announced that our board of directors authorized a $1.0 billion share repurchase program, which is funded from available working capital. We subsequently announced additional increases to this share repurchase program, bringing the total authorization to $4.1 billion, with $1.0 billion remaining as of January 31, 2026. The expiration date of this repurchase authorization was extended to December 31, 2026, and our repurchase program may be suspended or discontinued at any time. Repurchases under our program are to be made at management’s discretion on the open market, through privately negotiated transactions, transactions structured through investment banking institutions, block purchase techniques, 10b5-1 trading plans, or a combination of the foregoing. During the three months ended January 31, 2026, we did not repurchase any shares pursuant to our share repurchase program.

Current wording

(1) In February 2019, we announced that our board of directors authorized a $1.0 billion share repurchase program, which is funded from available working capital. We subsequently announced additional increases to this share repurchase program, bringing the total authorization to $5.1 billion, with $1.0 billion remaining as of April 30, 2026. The expiration date of this repurchase authorization was extended to December 31, 2026, and our repurchase program may be suspended or discontinued at any time. Repurchases under our program are to be made at management’s discretion on the open market, through privately negotiated transactions, transactions structured through investment banking institutions, block purchase techniques, 10b5-1 trading plans, or a combination of the foregoing.