Fastly, Inc.

Previous wording

Investing in our common stock involves a high degree of risk. Investors should carefully consider the risks and uncertainties described below, together with all of the other information contained in this Quarterly Report on Form 10-Q, including the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our unaudited condensed consolidated financial statements and related notes, before deciding to invest in our Class A common stock. Unless otherwise indicated, references to our business being harmed in these risk factors will include harm to our business, reputation, customer growth, results of operations, financial condition, or prospects. Any of these events could cause the trading price of our Class A common stock to decline, which would cause our stockholders to lose all or part of their investment. Our business, results of operations, financial condition, or prospects could also be harmed by risks and uncertainties not currently known to us or that we currently do not believe are material.

Current wording

Investing in our common stock involves a high degree of risk. Investors should carefully consider the risks and uncertainties described below, together with all of the other information contained in this Quarterly Report on Form 10-Q, including the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our unaudited condensed consolidated financial statements and related notes, before deciding to invest in our common stock. Unless otherwise indicated, references to our business being harmed in these risk factors will include harm to our business, reputation, customer growth, results of operations, financial condition, or prospects. Any of these events could cause the trading price of our common stock to decline, which would cause our stockholders to lose all or part of their investment. Our business, results of operations, financial condition, or prospects could also be harmed by risks and uncertainties not currently known to us or that we currently do not believe are material.

Previous wording

•If our IT Systems or data, or those of third parties upon which we rely, are compromised, limited, or fail, our business could experience materially adverse consequences, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, loss of revenue or profits, loss of customers or sales, reputational harm, and other adverse consequences.*

Current wording

•If our IT Systems or data, or those of third parties upon which we rely or with which we have strategic partnerships, are compromised, limited, or fail, our business could experience materially adverse consequences, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, loss of revenue or profits, loss of customers or sales, reputational harm, and other adverse consequences.*

Previous wording

We currently serve our customers from our POPs located around the world. Our customers need to be able to access our platform at any time, without interruption or degradation of performance. However, we have not developed redundancies for all aspects of our platform. We depend, in part, on our third-party facility providers’ ability to protect these facilities against damage or interruption from natural disasters, extreme weather events, power or telecommunications failures, criminal acts, armed conflict, public health issues, such as a pandemic or epidemic, and similar events. In some cases, third-party cloud providers run their own platforms that we access, and we are, therefore, vulnerable to their service interruptions. In the event that there are any defects or errors in software, failures of hardware, damages to a facility, or misconfigurations of any of our services, we may have to divert resources away from other planned work, could experience lengthy interruptions in our platform, and also incur delays and additional expenses in arranging new facilities and services. Our customers may choose to divert their traffic away from our platform as a result of interruptions or delays. Business continuity arrangements, including the existence of redundant data centers that are designed to become active during certain lapses of service, may not function as intended, and any disruptions to our service could harm our business.

Current wording

We currently serve our customers from our POPs located around the world. Our customers need to be able to access our platform at any time, without interruption or degradation of performance. However, we have not developed redundancies for all aspects of our platform. We depend, in part, on our third-party facility providers’ ability to protect these facilities against damage or interruption from natural disasters, extreme weather events, power or telecommunications failures, criminal acts, armed conflict, public health issues, such as a pandemic or epidemic, and similar events. In some cases, third-party cloud providers run their own platforms that we access, and we are, therefore, vulnerable to their service interruptions. In the event that there are any defects or errors in software, cyber incidents, failures of hardware, damages to a facility, or misconfigurations of any of our services, we may have to divert resources away from other planned work, could experience lengthy interruptions in our platform, and also incur delays and additional expenses in arranging new facilities and services. Our customers may choose to divert their traffic away from our platform as a result of interruptions or delays. Business continuity arrangements, including the existence of redundant data centers that are designed to become active during certain lapses of service, may not function as intended, and any disruptions to our service could harm our business.

Previous wording

We design our system infrastructure and procure and own or lease the computer hardware used for our platform. Design and mechanical errors, spikes in usage volume, and failure to follow system protocols and procedures could cause our systems to fail, resulting in interruptions on our platform. Moreover, we have experienced and may in the future experience system failures or interruptions in our platform as a result of human error. These outages have resulted and may in the future result in service level agreement claims. Any interruptions or delays in our platform, whether caused by our products or our data centers, third-party error, our own error, natural disasters (such as drought, flooding, wildfires, and storms), or security breaches, whether accidental or willful, could harm our relationships with customers, reduce customers’ usage of our platform, cause our revenue to decrease and our expenses to increase, and divert resources away from product development. Climate change and other environmental or social pressures are expected to increase the frequency and severity of certain events, as well as contribute to chronic changes (such as changes in meteorological and hydrological patterns) that may also result in similar or additional risks. Also, in the event of damage or interruption, our insurance policies may not adequately compensate us for any losses that we may incur. These factors in turn could further reduce our revenue, subject us to liability and cause us to issue service credits or cause customers to fail to renew their customer contracts, any of which could harm our business.

Current wording

We design our system infrastructure and procure and primarily own or lease the computer hardware used for our platform, or in some cases, specify requirements for systems owned by third parties on which our platform relies. Design and mechanical errors, spikes in usage volume, and failure to follow system protocols and procedures could cause our systems to fail, resulting in interruptions on our platform. Moreover, we have experienced and may in the future experience system failures or interruptions in our platform as a result of human error. These outages have resulted and may in the future result in service level agreement claims. Any interruptions or delays in our platform, whether caused by our products, our data centers, third party hardware or services, third-party error, our own error, natural disasters (such as drought, flooding, wildfires, and storms), or security breaches, whether accidental or willful, could harm our relationships with customers, reduce customers’ usage of our platform, cause our revenue to decrease and our expenses to increase, and divert resources away from product development. Climate change and other environmental or social pressures are expected to increase the frequency and severity of certain events, as well as contribute to chronic changes (such as changes in meteorological and hydrological patterns) that may also result in similar or additional risks. Also, in the event of damage or interruption, our insurance policies may not adequately compensate us for any losses that we may incur. These factors in turn could further reduce our revenue, subject us to liability and cause us to issue service credits or cause customers to fail to renew their customer contracts, any of which could harm our business.

Previous wording

The occurrence of any defects, errors, disruptions in service, failures involving redundant data centers, or other performance problems, interruptions, or delays with our platform, whether in connection with the day-to-day operations or otherwise, could result in:

Current wording

The occurrence of any defects, errors, disruptions in service, failures involving redundant data centers, or other performance problems, including on third-party hardware or services on which we rely, interruptions, or delays with our platform, whether in connection with the day-to-day operations or otherwise, could result in:

Previous wording

For some of our products, we charge our customers based on their usage of our platform. Most of our customers, including some of our largest large customers, do not have long-term contractual financial commitments to us. Some of our customers, who generally do not include our large customers, enter into “click-through” agreements with us via our self-service model, and agree to a minimum monthly fee by signing up online with a credit card, and can easily terminate their subscriptions, or switch to a less expensive plan, at will with little advance notice. In addition, most of our current customer contracts are only one year in duration and these customers may not use our platform in a subsequent year. In order for us to maintain or improve our results of operations, it is important that our customers, in particular, our large customers, use our platform in excess of their commitment levels, if any, and continue to use our platform on the same or more favorable terms. Our ability to retain our largest customers and expand their usage could be impaired for a variety of reasons, including customer budget constraints, customer satisfaction, changes in our customers’ underlying businesses, changes in the type and size of our customers, pricing changes, competitive conditions (including customers building their own CDNs), the acquisition of our customers by other companies, governmental actions, or the possibility thereof, and general economic conditions. Because many of our largest customers’ minimum usage commitments for our platform are relatively low compared to their expected usage, it can be easy for certain customers to quickly reallocate usage or switch from our platform to an alternative platform altogether. In addition, certain customers may reduce or cease their use of our products at any time without penalty or termination charges, even after they have expanded usage in prior periods.

Current wording

For some of our products, we charge our customers based on their usage of our platform. Most of our customers, including some of our largest large customers, do not have long-term contractual financial commitments to us. Some of our customers, who generally do not include our large customers, enter into “click-through” agreements with us via our self-service model and can easily terminate their subscriptions at will with little advance notice. In addition, most of our current customer contracts are only one year in duration and these customers may not use our platform in a subsequent year. In order for us to maintain or improve our results of operations, it is important that our customers, in particular, our large customers, use our platform in excess of their commitment levels, if any, and continue to use our platform on the same or more favorable terms. Our ability to retain our largest customers and expand their usage could be impaired for a variety of reasons, including customer budget constraints, customer satisfaction, changes in our customers’ underlying businesses, changes in the type and size of our customers, pricing changes, competitive conditions (including customers building their own CDNs), the acquisition of our customers by other companies, governmental actions, or the possibility thereof, and general economic conditions. Because many of our largest customers’ minimum usage commitments for our platform are relatively low compared to their expected usage, it can be easy for certain customers to quickly reallocate usage or switch from our platform to an alternative platform altogether. In addition, certain customers may reduce or cease their use of our products at any time without penalty or termination charges, even after they have expanded usage in prior periods.

Previous wording

Our future success depends on establishing and maintaining successful relationships with a diverse set of customers. We currently receive a substantial portion of our revenues from a limited number of customers and within a limited number of industries, such as media and entertainment. Our 10 largest customers accounted for 37% and 31% of revenue for thethree months ended June 30, 2026 and 2025, respectively. For thethree months ended June 30, 2026, there was one customer who accounted for 11% of our revenue. For thesix months ended June 30, 2026, there was one customer who accounted for 10% of our revenue. It is likely that we will continue to be dependent upon a limited number of customers for a significant portion of our revenues for the foreseeable future and, in some cases, the portion of our revenues attributable to individual customers may increase in the future. In addition, changes to our customers’ businesses may contribute to further customer concentration, including any impact from acquisition activities, internal business reorganizations leading to operational and decision making changes, and corporate structure changes such as subsidiary consolidation and reorganization that may arise in the future. The loss of one or more key customers or a reduction in usage by any major customers would reduce our revenues. If we fail to maintain existing customers or develop relationships with new customers and across different industries, our business would be harmed.

Current wording

Our future success depends on establishing and maintaining successful relationships with a diverse set of customers. We currently receive a substantial portion of our revenues from a limited number of customers and within a limited number of industries, such as media and entertainment. Our 10 largest customers accounted for 39% and 32% of revenue for thethree months ended September 30, 2026 and 2025, respectively. For the three months ended September 30, 2026, there was one customer who accounted for 12% of our revenue. For the nine months ended September 30, 2026, there was one customer who accounted for 11% of our revenue. It is likely that we will continue to be dependent upon a limited number of customers for a significant portion of our revenues for the foreseeable future and, in some cases, the portion of our revenues attributable to individual customers has increased and may continue to increase in the future. In addition, changes to our customers’ businesses may contribute to further customer concentration, including any impact from acquisition activities, internal business reorganizations leading to operational and decision making changes, and corporate structure changes such as subsidiary consolidation and reorganization that may arise in the future. The loss of one or more key customers or a reduction in usage by any major customers would reduce our revenues. If we fail to maintain existing customers or develop relationships with new customers and across different industries, our business would be harmed.

Previous wording

To ensure adequate supply of parts and components, we must forecast server needs and expenses and place orders sufficiently in advance with our suppliers based on estimates of future demand for network capacity. As we continue to experience growth, we may face challenges managing adequate server capacity due to potential component delays, shortages, price increases, hardware efficiencies gained through internal development, or any potential changes in server architecture including due to technological advances or obsolescence. For example, as a result of increasing deployment and adoption of artificial intelligence ("AI") technologies, demand for network capacity may increase and our server needs and expenses may increase as a result. Additionally, increased energy consumption, including as a result of AI adoption, climate-related events, energy market volatility, and power grid disruptions, may increase energy prices, which could cause increases in the operational costs related to our servers and POPs. We may incur charges in future periods related to server management or incorrectly forecast our network capacity needs in future periods. If we have excess server capacity, we have in the past needed to, and may in the future need to, write-down or write-off server assets, which may materially harm our operating results. For example, in the year ended December 31, 2025, we recognized certain equipment, internal-use software project and right-of-use asset related write-off charges of $0.4 million. Conversely, if we underestimate network capacity needs, we may in future periods be unable to meet demand and be required to incur higher costs to secure necessary parts and components of our servers, which could adversely affect our customer relationships and harm our business.

Current wording

To ensure adequate supply of parts and components, we must forecast server needs and expenses and place orders sufficiently in advance with our suppliers based on estimates of future demand for network capacity. As we continue to experience growth, we may face challenges managing adequate server capacity due to potential component delays, shortages, price increases, hardware efficiencies gained through internal development, or any potential changes in server architecture including due to technological advances or obsolescence. For example, as a result of increasing deployment and adoption of artificial intelligence ("AI") technologies, demand for network capacity may increase and our server needs and expenses may increase as a result. Additionally, increased energy consumption, including as a result of AI adoption, climate-related events, energy market volatility, and power grid disruptions, may increase energy prices, which could cause increases in the operational costs related to our servers and POPs. We may incur charges in future periods related to server management or incorrectly forecast our network capacity needs in future periods. If we have excess server capacity, we have in the past needed to, and may in the future need to, write-down or write-off server assets, which may materially harm our operating results. Conversely, if we underestimate network capacity needs, we may in future periods be unable to meet demand and be required to incur higher costs to secure necessary parts and components of our servers, which could adversely affect our customer relationships and harm our business.

Previous wording

We generated a net loss of $36.1 million for the six months ended June 30, 2026 and we had an accumulated deficit of $1,150.6 million. We will need to generate and sustain increased revenue levels and manage costs in future periods in order to become profitable; even if we achieve profitability, we may not be able to maintain or increase our level of profitability. We intend to continue to expend significant funds to support further growth and further develop our platform, including expanding the functionality of our platform, expanding our technology infrastructure and business systems to meet the needs of our customers, expanding our direct sales force and partner ecosystem, increasing our marketing activities, and growing our international operations. We have in the past faced, and will continue to face, increased compliance costs associated with growth and expansion of our customer base. Our efforts to grow our business may be costlier than we expect, and we may not be able to increase our revenue enough to offset our increased operating expenses. We may incur significant losses in the future for a number of reasons, including the other risks described herein, and unforeseen expenses, difficulties, complications and delays, and other unknown events. If we are unable to achieve and sustain profitability, our business may be harmed.

Current wording

We generated a net loss of $47.4 million for the nine months ended September 30, 2026 and we had an accumulated deficit of $1,161.9 million. We will need to generate and sustain increased revenue levels and manage costs in future periods in order to become profitable; even if we achieve profitability, we may not be able to maintain or increase our level of profitability. We intend to continue to expend significant funds to support further growth and further develop our platform, including expanding the functionality of our platform, expanding our technology infrastructure and business systems to meet the needs of our customers, expanding our direct sales force and partner ecosystem, increasing our marketing activities, and growing our international operations. We have in the past faced, and will continue to face, increased compliance costs associated with growth and expansion of our customer base. Our efforts to grow our business may be costlier than we expect, and we may not be able to increase our revenue enough to offset our increased operating expenses. We may incur significant losses in the future for a number of reasons, including the other risks described herein, and unforeseen expenses, difficulties, complications and delays, and other unknown events. If we are unable to achieve and sustain profitability, our business may be harmed.

Previous wording

If our IT Systems or data, or those of third parties upon which we rely, are compromised, limited, or fail, our business could experience materially adverse consequences, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, loss of revenue or profits, loss of customers or sales, reputational harm, and other adverse consequences.*

Current wording

If our IT Systems or data, or those of third parties upon which we rely or with which we have strategic partnerships, are compromised, limited, or fail, our business could experience materially adverse consequences, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, loss of revenue or profits, loss of customers or sales, reputational harm, and other adverse consequences.*

Previous wording

Our business depends on providing our customers with fast, efficient, and reliable distribution of applications and content over the Internet, and we rely on IT Systems to provide our products and services, including for internal and external operations that are critical to our business. “IT Systems” includes computer systems, hardware, software, technology infrastructure and websites and networks. In the ordinary course of business, we and the third parties upon which we rely, collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share Sensitive Information. "Sensitive Information" includes our, our customers', and our customers' end users' proprietary, confidential, and sensitive data, including personal information, intellectual property, trade secrets, and encryption keys. Maintaining the security and availability of our platform, IT Systems, and Sensitive Information is a critical issue for us and our customers, and we expend significant resources, and may need to fundamentally change our business activities and modify our practices and operations, in an effort to protect against security incidents and to mitigate, detect, and remediate actual and potential vulnerabilities.

Current wording

Our business depends on providing our customers with fast, efficient, and reliable distribution of applications and content over the Internet, and we rely on IT Systems to provide our products and services, including for internal and external operations that are critical to our business. “IT Systems” includes computer systems, hardware, software, technology infrastructure and websites and networks. In the ordinary course of business, we and the third parties upon which we rely or with which we have strategic partnerships, collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share Sensitive Information. "Sensitive Information" includes our, our customers', and our customers' end users' proprietary, confidential, and sensitive data, including personal information, intellectual property, trade secrets, and encryption keys. Maintaining the security and availability of our platform, IT Systems, and Sensitive Information is a critical issue for us and our customers, and we expend significant resources, and may need to fundamentally change our business activities and modify our practices and operations, in an effort to protect against security incidents and to mitigate, detect, and remediate actual and potential vulnerabilities.

Previous wording

Cyber-attacks, malicious Internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our Sensitive Information and IT Systems, and those of the third parties upon which we rely. Such threats are prevalent and continue to become more so. They are difficult to detect, and come from a variety of sources and threat actors, including “hacktivists,” personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors.

Current wording

Cyber-attacks, malicious Internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our Sensitive Information and IT Systems, and those of the third parties upon which we rely or with which we have strategic partnerships. Such threats are prevalent and continue to become more so. They are difficult to detect, and in some cases, remediate, and come from a variety of sources and threat actors, including “hacktivists,” personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors. These threats may be facilitated or enhanced by AI technologies, such as autonomous AI agents, which may themselves act in unintended, unpredictable, or malicious ways.

Previous wording

Some threat actors engage in cyber-attacks for geopolitical reasons and in conjunction with military conflicts and defense activities. We have in the past been subject to cyber-attacks from third parties, including parties who we believe are sponsored by government actors. Since our customers share our multi-tenant architecture, cyber-attacks on any one of our customers could have a negative effect on our other customers. In the past, these attacks have significantly increased the bandwidth used on our platform and have strained our network. During times of war and other major conflicts, we, the third parties upon which we rely, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our IT Systems and operations, supply chain, and ability to produce, sell, and distribute our services.

Current wording

Some threat actors engage in cyber-attacks for geopolitical reasons and in conjunction with military conflicts and defense activities. We have in the past been subject to cyber-attacks from third parties, including parties who we believe are sponsored by government actors. Since our customers share our multi-tenant architecture, cyber-attacks on any one of our customers could have a negative effect on our other customers. In the past, these attacks have significantly increased the bandwidth used on our platform and have strained our network. During times of war and other major conflicts, we, the third parties upon which we rely or with which we have strategic partnerships, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our IT Systems and operations, supply chain, and ability to produce, sell, and distribute our services.

Previous wording

We and the third parties upon which we rely are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code, malware (including as a result of advanced persistent threat intrusions), DDoS attacks, account takeover attacks, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, attacks facilitated or enhanced by AI such as prompt injection or AI model inversion attacks, loss of data or other information technology assets, adware, telecommunications failures, natural disasters, and other similar threats. For example, we have experienced DDoS attacks of significant size and severity that caused us to invest resources into improving our systems, and we expect to continue to be subject to DDoS and other forms of attacks in the future, particularly as they have become more prevalent in our industry. Similarly, we have been the target of phishing and social engineering schemes that may be designed to, among other things, improperly gain access to our Sensitive Information or fraudulently obtain payments or funds from us. Further, we are not immune from the possibility of a malicious insider compromising our IT Systems or misappropriating our Sensitive Information.

Current wording

We and the third parties upon which we rely or with which we have strategic partnerships are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly difficult to identify as fake, and phishing attacks), malicious code, malware (including as a result of advanced persistent threat intrusions), DDoS attacks, account takeover attacks, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, attacks facilitated or enhanced by AI (including prompt injection or AI model inversion attacks, and attacks conducted by autonomous AI agents capable of independently identifying and exploiting actual or potential software vulnerabilities), loss of data or other information technology assets, adware, telecommunications failures, natural disasters, and other similar threats. For example, we have experienced DDoS attacks of significant size and severity that caused us to invest resources into improving our systems, and we expect to continue to be subject to DDoS and other forms of attacks in the future, particularly as they have become more prevalent in our industry. Similarly, we have been the target of phishing and social engineering schemes that may be designed to, among other things, improperly gain access to our Sensitive Information or fraudulently obtain payments or funds from us. Further, we are not immune from the possibility of a malicious insider compromising our IT Systems or misappropriating our Sensitive Information.

Previous wording

In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised. The potential liability and associated consequences we could suffer as a result of such a large-scale event could be catastrophic and result in irreparable harm.

Current wording

We are incorporated into the supply chain of a number of companies worldwide and, as a result, if our services are compromised, a significant number or, in some instances, all of our customers and their data could be simultaneously affected. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised. The potential liability and associated consequences we could suffer as a result of such a large-scale event could be catastrophic and result in irreparable harm.

Previous wording

We rely on third-party service providers and technologies to operate critical IT Systems and to process Sensitive Information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, content delivery to customers, and other functions. Like many other companies, our ability to monitor third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy and data security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.

Current wording

We rely on third-party service providers and technologies to operate critical IT Systems and to process Sensitive Information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, content delivery to customers, and other functions. Like many other companies, our ability to monitor third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. If our third-party service providers or partners experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers or partners fail to satisfy their privacy and data security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.

Previous wording

Any adverse impact to the availability, integrity, or confidentiality of our Sensitive Information or IT Systems, including as a result of the previously identified or similar threats, could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our Sensitive Information or our IT Systems, or those of the third parties upon whom we rely. A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely) to provide our platform, products and services.

Current wording

Any adverse impact to the availability, integrity, or confidentiality of our Sensitive Information or IT Systems, including as a result of the previously identified or similar threats, could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our Sensitive Information or our IT Systems, or those of the third parties upon whom we rely or with which we have strategic partnerships. A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely or with which we have strategic partnerships) to provide our platform, products and services.

Previous wording

While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. Additionally, we may not be able to detect and remediate all vulnerabilities because the threats and techniques used to exploit the vulnerability change frequently and are often sophisticated in nature. For example, as new technology, particularly AI, makes it easier to detect and understand vulnerabilities, it may become easier for third parties to exploit such vulnerabilities. These vulnerabilities pose material risks to our business, and they may not be detected until after a security incident has occurred or at all. Further, we may need to dedicate greater time and resources to vulnerability detection and remediation than in the past and may experience delays in developing and deploying more advanced measures designed to detect and remediate any identified vulnerabilities.

Current wording

While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. Additionally, we may not be able to detect and remediate all vulnerabilities because the threats and techniques used to exploit the vulnerability change frequently and are often sophisticated in nature. For example, as new technology, particularly AI, makes it easier to detect and understand vulnerabilities, it may also become easier for third parties to exploit such vulnerabilities. These vulnerabilities pose material risks to our business, and they may not be detected until after a security incident has occurred or at all. Further, we may need to dedicate greater time and resources to vulnerability detection and remediation than in the past and may experience delays in developing and deploying more advanced measures designed to detect and remediate any identified vulnerabilities.

Previous wording

Applicable privacy and data security obligations may require us to notify relevant stakeholders, including affected individuals, customers, regulators, and investors of security incidents. For example, SEC rules require disclosure on Form 8-K of the nature, scope and timing of any material cybersecurity incident and the reasonably likely impact of such incident. Compliance with such disclosure efforts is costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences. If we (or a third party upon whom we rely) experience any adverse impact to the availability, integrity, or confidentiality of our IT Systems or Sensitive Information, we may experience adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight, restrictions on processing Sensitive Information (including personal data); litigation (including class action claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions or degradation of performance in our services (including availability of data); financial loss; and other similar harms. Security incidents and attendant consequences may also impact customers’ systems and data, and cause customers to stop using our platform, products, and services, cause us to offer pricing and other concessions, deter new customers from using our platform, products, and services, result in litigation, and negatively impact our ability to grow and operate our business.

Current wording

Applicable privacy and data security obligations may require us to notify relevant stakeholders, including affected individuals, customers, regulators, and investors of security incidents. For example, SEC rules require disclosure on Form 8-K of the nature, scope and timing of any material cybersecurity incident and the reasonably likely impact of such incident. Compliance with such disclosure efforts is costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences. If we (or a third party upon whom we rely or with which we have a strategic partnership) experience any adverse impact to the availability, integrity, or confidentiality of our IT Systems or Sensitive Information, we may experience adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight, restrictions on processing Sensitive Information (including personal data); litigation (including class action claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions or degradation of performance in our services (including availability of data); financial loss; and other similar harms. Security incidents and attendant consequences may also impact customers’ systems and data, and cause customers to stop using our platform, products, and services, cause us to offer pricing and other concessions, deter new customers from using our platform, products, and services, result in litigation, and negatively impact our ability to grow and operate our business.

Previous wording

We are, and may in the future be, subject to litigation such as putative class action and stockholder derivative lawsuits brought by stockholders. For example, on May 24, 2024, we and certain of our officers were named as defendants in putative securities class action filed in the United States District Court for the Northern District of California purportedly brought on behalf of holders of our common stock. On November 1, 2024, the lead plaintiff filed an amended complaint. On June 12, 2024, July 1, 2024, and June 29, 2026, stockholder derivative complaints were filed in the United States District Court for the

Current wording

We are, and may in the future be, subject to litigation such as putative class action and stockholder derivative lawsuits brought by stockholders. For example, on May 24, 2024, we and certain of our officers were named as defendants in a putative securities class action filed in the United States District Court for the Northern District of California purportedly brought on behalf of holders of our common stock. On November 1, 2024, the lead plaintiff filed an amended complaint.

Previous wording

Defendants filed a motion to dismiss the putative securities class action on January 15, 2025. The lead plaintiff filed an opposition to defendants’ motion to dismiss on March 17, 2025. Defendants filed a reply in support of the motion to dismiss on April 30, 2025. On September 24, 2025, the court issued an order granting in part and denying in part the motion to dismiss. On October 24, 2025, the lead plaintiff filed a second amended complaint. On December 9, 2025, Defendants filed a motion to dismiss the second amended complaint. On January 26, 2026, Lead Plaintiff filed an opposition. Defendants filed a reply in support of the motion to dismiss the second amended complaint on February 19, 2026. A hearing scheduled for April 30, 2026 on Defendants’ motion to dismiss the second amended complaint was vacated, and we are awaiting a ruling on the motion. We anticipate that we may be a target for lawsuits in the future, as we have been in the past. Any litigation to which we are a party may result in an onerous or unfavorable judgment that may not be reversed on appeal, or we may decide to settle lawsuits on similarly unfavorable terms. Any such negative outcome could result in payments of substantial monetary damages and accordingly our business could be seriously harmed. The results of lawsuits and claims cannot be predicted with certainty. Regardless of the final outcome, defending these claims, and associated indemnification obligations, are costly and can impose a significant burden on management and employees, and we may receive unfavorable preliminary, interim, or final rulings in the course of litigation, which could seriously harm our business.

Current wording

We anticipate that we and our officers and directors may be a target for lawsuits in the future, as we have been in the past. Any litigation to which we or our officers and directors are a party may result in an onerous or unfavorable judgment that may not be reversed on appeal, or we may decide to settle lawsuits on similarly unfavorable terms. Any such negative outcome could result in payments of substantial monetary damages and accordingly our business could be seriously harmed. The results of lawsuits and claims cannot be predicted with certainty. Regardless of the final outcome, defending these claims, and associated indemnification obligations, are costly and can impose a significant burden on management and employees, and we may receive unfavorable preliminary, interim, or final rulings in the course of litigation, which could seriously harm our business.

Previous wording

We believe that our success has depended, and continues to depend, on the efforts and talents of senior management and key employees, including Artur Bergman, our Chief Technology Officer. There have been, and from time to time, there may continue to be, changes in our management team resulting from the hiring or departure of executives and key employees, or the transition of executives within our business, which could disrupt our business. For example, Charles Compton began serving as our new Chief Executive Officer, replacing Todd Nightingale, effective June 16, 2025. Such changes in our executive management team may be disruptive to our business. Some of our executive officers and members of our management team have been with us for a short period of time and we continue to develop key functions within various aspects of our business.

Current wording

We believe that our success has depended, and continues to depend, on the efforts and talents of senior management and key employees, including Artur Bergman, our Chief Technology Officer. There have been, and from time to time, there may continue to be, changes in our management team resulting from the hiring or departure of executives and key employees, or the transition of executives within our business, which could disrupt our business. For example, Charles Compton began serving as our Chief Executive Officer, replacing Todd Nightingale, effective June 16, 2025. Such changes in our executive management team may be disruptive to our business. Some of our executive officers and members of our management team have been with us for a short period of time and we continue to develop key functions within various aspects of our business. We are also dependent on the continued service of our existing software engineers because of the complexity of our platform. Our senior management, including Mr. Compton and Mr. Bergman, and key employees are employed on an at-will basis. We cannot ensure that we will be able to retain the services of any member of our senior management or other key employees or that we would be able to timely replace members of our senior management or other key employees should any of them depart. The loss of one or more of our senior management or other key employees could harm our business.

Previous wording

We have experienced growth in various aspects of our business in prior periods. For example, our revenue was $183.3 million, and $148.7 million, for the three months ended June 30, 2026 and 2025, respectively. In addition, we are expanding, and expect to continue to expand in the future, our international operations. We have also experienced growth in the number of customers, usage, and amount of data delivered across our platform. This growth has placed, and may continue to place, significant demands on our corporate culture, operational infrastructure, and management. Although our business has experienced growth in the past, we cannot provide any assurance that our business will continue to grow at the same rate, or at all. Overall growth of our business depends on a number of factors, including our ability to:

Current wording

We have experienced growth in various aspects of our business in prior periods. For example, our revenue was $190.2 million and $158.2 million for the three months ended September 30, 2026 and 2025, respectively. In addition, we are expanding, and expect to continue to expand in the future, our international operations. We have also experienced growth in the number of customers, usage, and amount of data delivered across our platform. This growth has placed, and may continue to place, significant demands on our corporate culture, operational infrastructure, and management. Although our business has experienced growth in the past, we cannot provide any assurance that our business will continue to grow at the same rate, or at all. Overall growth of our business depends on a number of factors, including our ability to:

Previous wording

These activities will require significant investments and allocation of valuable management and employee resources, and our growth will continue to place significant demands on our management and our operational and financial infrastructure. There are no guarantees we will be able to grow our business in an efficient or timely manner, or at all. If we fail to manage the growth of our business and operations effectively, the quality of our services and the efficiency of our operations could suffer, which could adversely affect our business, financial condition, and results of operations. If we are unable to return to our prior level of growth, our business will be harmed.

Current wording

These activities will require significant investments and allocation of valuable management and employee resources, and our growth will continue to place significant demands on our management and our operational and financial infrastructure. There are no guarantees we will be able to grow our business in an efficient or timely manner, or at all. If we fail to manage the growth of our business and operations effectively, the quality of our services and the efficiency of our operations could suffer, which could adversely affect our business, financial condition, and results of operations. If we are unable to sustain our recent level of growth, our business will be harmed.

Previous wording

If adequate funds are not available on acceptable terms, we may be forced to reduce or delay our business activities and capital expenditures, unable to invest in future growth opportunities, sell assets, or restructure or refinance all or a portion of our debt on or before maturity, all of which could harm our business, operating results, and financial condition. Furthermore, if we issue additional equity securities, stockholders will experience dilution, and the new equity securities could have rights senior to those of our common stock. Any debt financing we secure may have higher interest rates and could involve additional restrictive covenants relating to our capital raising activities and other financial and operational matters, which may make it more difficult for us to obtain additional capital and to pursue business opportunities, including potential acquisitions. If we were to violate the covenants under our Credit Agreement or any additional restrictive covenants, we could incur penalties, increased expenses and an acceleration of the payment terms of our outstanding debt, which could in turn materially harm our business and financial condition. Because our decision to issue securities in future offerings will depend on numerous considerations, including factors beyond our control, we cannot predict or estimate the amount, timing, or nature of any future issuances of debt or equity securities. As a result, our stockholders bear the risk of future issuances of debt or equity securities reducing the value of our common stock and diluting their interests.

Current wording

Furthermore, if we issue additional equity securities, stockholders will experience dilution, and the new equity securities could have rights senior to those of our common stock. Any debt financing we secure may have higher interest rates and could involve additional restrictive covenants relating to our capital raising activities and other financial and operational matters, which may make it more difficult for us to obtain additional capital and to pursue business opportunities, including potential acquisitions. If we were to violate the covenants under our Credit Agreement or any additional restrictive covenants, we could incur penalties, increased expenses and an acceleration of the payment terms of our outstanding debt, which could in turn materially harm our business and financial condition. Because our decision to issue securities in future offerings will depend on numerous considerations, including factors beyond our control, we cannot predict or estimate the amount, timing, or nature of any future issuances of debt or equity securities. As a result, our stockholders bear the risk of future issuances of debt or equity securities reducing the value of our common stock and diluting their interests.

Previous wording

A component of our growth strategy involves the further expansion of our operations and customer base internationally. For both the three and six months ended June 30, 2026, the percentage of revenue generated from customers outside the United States was approximately 30% of our total revenue. We continue to adapt to and develop strategies to address international markets but there is no guarantee that such efforts will have the desired effect. As of June 30, 2026, approximately 24.6% of our full-time employees were located outside of the United States. We expect that our international activities will grow over the foreseeable future as we continue to pursue opportunities in existing and new international markets, which will require significant management attention and financial resources. In connection with such expansion, we may face difficulties including costs associated with varying seasonality patterns, potential adverse movement of currency exchange rates, longer payment cycles, difficulties in collecting accounts receivable in some countries, tariffs and trade barriers, a variety of regulatory or contractual limitations on our ability to operate, adverse tax events, reduced protection of intellectual property rights in some countries, and a geographically and culturally diverse workforce and customer base. Failure to overcome any of these difficulties could harm our business. Our current and future international business and operations involve a variety of risks, including:

Current wording

A component of our growth strategy involves the further expansion of our operations and customer base internationally. For both the three and nine months ended September 30, 2026, the percentage of revenue generated from customers outside the United States was approximately 30% of our total revenue. We continue to adapt to and develop strategies to address international markets but there is no guarantee that such efforts will have the desired effect. As of September 30, 2026, approximately 25.7% of our full-time employees were located outside of the United States. We expect that our international activities will grow over the foreseeable future as we continue to pursue opportunities in existing and new international markets, which will require significant management attention and financial resources. In connection with such expansion, we may face difficulties including costs associated with varying seasonality patterns, potential adverse movement of currency exchange rates, longer payment cycles, difficulties in collecting accounts receivable in some countries, tariffs and trade barriers, a variety of regulatory or contractual limitations on our ability to operate, adverse tax events, reduced protection of intellectual property rights in some countries, and a geographically and culturally diverse workforce and customer base. Failure to overcome any of these difficulties could harm our business. Our current and future international business and operations involve a variety of risks, including:

Previous wording

The preparation of financial statements in conformity with generally accepted accounting principles in the United States (“U.S. GAAP”) requires management to make estimates and assumptions that affect the amounts reported in the condensed consolidated financial statements and accompanying notes. We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as provided in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Critical Accounting Estimates.” The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities, and equity and the amount of revenue and expenses that are not readily apparent from other sources. Our results of operations may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our results of operations to fall below the expectations of securities analysts and investors, resulting in a decline in the trading price of our common stock.

Current wording

Discussion and Analysis of Financial Condition and Results of Operations—Critical Accounting Estimates.” The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities, and equity and the amount of revenue and expenses that are not readily apparent from other sources. Our results of operations may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our results of operations to fall below the expectations of securities analysts and investors, resulting in a decline in the trading price of our common stock.

Previous wording

While our previous material weakness has been remediated, if we fail to identify future material weaknesses in our internal control over financial reporting, if we are unable to comply with the requirements of Section 404 or assert that our internal control over financial reporting is effective, or if our independent registered public accounting firm is unable to express an unqualified opinion or expresses a qualified or adverse opinion about the effectiveness of our internal control over financial reporting, investors may lose confidence in the accuracy and completeness of our financial reports and the market price of our common stock could be negatively affected. Moreover, any failure to identify new material weaknesses in our internal control over financial reporting, could result in material misstatements in our financial statements that may continue undetected and cause us to fail to meet our reporting and financial obligations or incur significant additional costs to remediate new material weaknesses, each of which could harm our ability to raise capital on favorable terms in the future or otherwise have a negative impact on our financial condition. In addition, we could become subject to investigations by The Nasdaq Stock Market LLC ("Nasdaq"), the SEC, and other regulatory authorities, which could require additional financial and management resources.

Current wording

While our previous material weakness has been remediated, if we identify future material weaknesses in our internal control over financial reporting, if we are unable to comply with the requirements of Section 404 or assert that our internal control over financial reporting is effective, or if our independent registered public accounting firm is unable to express an unqualified opinion or expresses a qualified or adverse opinion about the effectiveness of our internal control over financial reporting, investors may lose confidence in the accuracy and completeness of our financial reports and the market price of our common stock could be negatively affected. Moreover, any failure to identify new material weaknesses in our internal control over financial reporting, could result in material misstatements in our financial statements that may continue undetected and cause us to fail to meet our reporting and financial obligations or incur significant additional costs to remediate new material weaknesses, each of which could harm our ability to raise capital on favorable terms in the future or otherwise have a negative impact on our financial condition. In addition, we could become subject to investigations by The Nasdaq Stock Market LLC ("Nasdaq"), the SEC, and other regulatory authorities, which could require additional financial and management resources.

Previous wording

We need to continue to improve our internal systems, processes, and controls to effectively manage our operations and growth. We may not be able to successfully implement and scale improvements to our systems and processes in a timely or efficient manner or in a manner that does not negatively affect our operating results. For example, we may not be able to effectively monitor certain extraordinary contract requirements or provisions that are individually negotiated by our sales force as the number of transactions continues to grow. Moreover, as we continue to improve our pricing structure, we will need to implement and maintain corresponding updates to our systems around payment of sales commissions to account for these new or revised structures. We may experience difficulties in managing improvements to our systems, processes, and controls or in connection with third-party software, which could impair our ability to manage our business, pay sales commissions, or offer our platform to our customers in a timely manner, causing us to lose customers or employees, limit our growth, limit us to smaller deployments of our products, or increase our technical support costs. In addition, our systems and processes may not prevent or detect all errors, omissions, or fraud.

Current wording

We need to continue to improve our internal systems, processes, and controls to effectively manage our operations and growth. We may not be able to successfully implement and scale improvements to our systems and processes in a timely or efficient manner or in a manner that does not negatively affect our operating results. For example, we may not be able to effectively monitor certain extraordinary contract requirements or provisions that are individually negotiated by our sales force as the number of transactions continues to grow. Moreover, as we continue to improve our pricing structure, we will need to implement and maintain corresponding updates to our systems around billing and payment of sales commissions to account for these new or revised structures. We may experience difficulties in managing improvements to our systems, processes, and controls or in connection with third-party software, which could impair our ability to manage our business, bill customers, pay sales commissions, or offer our platform to our customers in a timely manner, causing us to lose customers or employees, limit our growth, limit us to smaller deployments of our products, or increase our technical support costs. In addition, our systems and processes may not prevent or detect all errors, omissions, or fraud.

Previous wording

Market practices with respect to these new disclosures are continuously evolving, and securities analysts and investors may not fully understand the implications of our disclosures or how or why they may differ from similar disclosures by other companies. Any additional new accounting standards could have a significant effect on our reported results. If our reported results fall below analyst or investor expectations, our stock price could decline.

Current wording

Market practices with respect to new disclosures are continuously evolving, and securities analysts and investors may not fully understand the implications of our disclosures or how or why they may differ from similar disclosures by other companies. Any additional new accounting standards could have a significant effect on our reported results. If our reported results fall below analyst or investor expectations, our stock price could decline.

Previous wording

In the past few years, numerous U.S. states have enacted comprehensive privacy and data security laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their Personal Information. As applicable, such rights may include the right to access, correct, or delete certain Personal Information, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain Personal Information, including sensitive Personal Information, such as conducting data privacy impact assessments or requiring prior consent. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020, collectively ("CCPA") applies to Personal Information of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights related to their Personal Information. The CCPA allows for statutory fines for noncompliance (up to $7,988 per violation), as well as a private right of action for individuals affected by certain data breaches to recover significant statutory damages.

Current wording

In the past few years, numerous U.S. states have enacted comprehensive privacy and data security laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their Personal Information. As applicable, such rights may include the right to access, correct, or delete certain Personal Information, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain Personal Information, including sensitive Personal Information, such as conducting data privacy impact assessments or requiring prior consent. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020, (collectively, the "CCPA") applies to Personal Information of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights related to their Personal Information. The CCPA allows for statutory fines for noncompliance (up to $7,988 per violation), as well as a private right of action for individuals affected by certain data breaches to recover significant statutory damages.

Previous wording

We may also become subject to new laws in the EU that regulate cybersecurity and non-personal information. For example, the European Union Data Act ("Data Act") became applicable in September 2025. The Data Act establishes new requirements for providers of data processing services (including cloud and SaaS) into the EU. The Data Act requires providers to enable customers to switch to other providers or on-premise solutions and to port customer data within certain timeframes; remove technical, contractual, and commercial obstacles to service switching (including switching charges); and include certain mandatory terms in customer contracts. Failure to comply with the Data Act can result in regulatory enforcement and fines, civil claims, and reputational damage. Depending on how all these laws are interpreted, we may have to adapt our business practices and products to comply with such obligations.

Current wording

We may also become subject to new laws in the EU that regulate cybersecurity and non-personal information. For example, the European Union Data Act ("Data Act") became applicable in September 2025. The Data Act establishes new requirements for providers of data processing services (including cloud and SaaS) into the EU. The Data Act requires providers to enable customers to switch to other providers or on-premise solutions and to port customer data within certain timeframes; remove technical, contractual, and commercial obstacles to service switching (including switching charges); and include certain mandatory terms in customer contracts. Failure to comply with the Data Act can result in regulatory enforcement and fines, civil claims, and reputational damage. Depending on how these laws are interpreted, we may have to adapt our business practices and products to comply with such obligations.

Previous wording

Our employees and personnel may increasingly use AI to perform their work, and our customers may deploy AI models or technologies using our platform, including because we develop products that enable AI workloads for our customers. However, the regulatory framework for AI is rapidly evolving as many federal, state, and foreign governments have passed and are likely to pass additional laws regulating the development and deployment of AI. For example, in the United States, the current executive administration’s approach to investment in, and regulation of, AI technologies has and is expected to continue to deviate from that of the previous administration, and we will need to adapt to any changes that may result from such approach, including as the result of new or changing executive orders. The current administration issued an AI-focused Executive Order on December 11, 2025 entitled “Ensuring a National Policy Framework for Artificial Intelligence”. This Executive Order establishes a federal policy favoring a uniform national AI regulatory framework and calls for developing federal standards and legislation that would preempt conflicting state AI regulations and create a federal litigation task force focused on challenging state AI laws in court if implemented. The current administration may continue to rescind other existing federal orders or administrative policies relating to AI, may implement new executive orders or other rule making relating to AI in the future, or challenge state laws regulating AI.

Current wording

However, the regulatory framework for AI is rapidly evolving as many federal, state, and foreign governments have passed and are likely to pass additional laws regulating the development and deployment of AI. For example, in the United States, the current executive administration’s approach to investment in, and regulation of, AI technologies has and is expected to continue to deviate from that of the previous administration, and we will need to adapt to any changes that may result from such approach, including as the result of new or changing executive orders. The current administration issued an AI-focused Executive Order on December 11, 2025 entitled “Ensuring a National Policy Framework for Artificial Intelligence”. This Executive Order establishes a federal policy favoring a uniform national AI regulatory framework and calls for developing federal standards and legislation that would preempt conflicting state AI regulations and create a federal litigation task force focused on challenging state AI laws in court if implemented. The current administration may continue to rescind other existing federal orders or administrative policies relating to AI, may implement new executive orders or other rule making relating to AI in the future, or challenge state laws regulating AI.

Previous wording

Additionally, several jurisdictions around the world, including in Europe and certain U.S. states, have proposed, enacted, or are considering laws governing the development and deployment of AI. For example, California enacted several new laws in 2024 and 2025 that regulate the use of AI technologies and provide consumers with additional protections around companies’ use of AI technologies, such as requiring companies to disclose certain uses of generative AI and provide further transparency about how such AI was developed. Other states have also passed AI-focused legislation, such as Colorado’s Automated Decision-Making Technology Act, which repealed and replaced its Artificial Intelligence Act with a narrower framework focused on imposing disclosure and transparency requirements on the developers and deployers of AI technologies; Utah’s Artificial Intelligence Policy Act, which establishes disclosure requirements and accountability measures for the use of generative AI in certain consumer interactions; and the Texas Responsible Artificial Intelligence Governance Act, which prohibits the development and deployment of AI systems for certain purposes while establishing a regulatory sandbox. Such additional regulations, the manner in which such new laws are interpreted, and uncertainty around whether they will survive legal challenges or how they will be enforced, may impact our ability to develop, use, procure and commercialize AI and machine learning technologies in the future.

Current wording

Additionally, several jurisdictions around the world, including in Europe and certain U.S. states, have proposed, enacted, or are considering laws governing the development and deployment of AI. For example, California enacted several new laws since 2024 that regulate the use of AI technologies and provide consumers with additional protections around companies’ use of AI technologies, such as requiring companies to disclose certain uses of generative AI and provide further transparency about how such AI was developed. Other states have also passed AI-focused legislation, such as Colorado’s Automated Decision-Making Technology Act, which repealed and replaced its Artificial Intelligence Act with a narrower framework focused on imposing disclosure and transparency requirements on the developers and deployers of AI technologies; Utah’s Artificial Intelligence Policy Act, which establishes disclosure requirements and accountability measures for the use of generative AI in certain consumer interactions; and the Texas Responsible Artificial Intelligence Governance Act, which prohibits the development and deployment of AI systems for certain purposes while establishing a regulatory sandbox. Such additional regulations, the manner in which such new laws are interpreted, and uncertainty around whether they will survive legal challenges or how they will be enforced, may impact our ability to develop, use, procure and commercialize AI and machine learning technologies in the future.

Previous wording

Further, jurisdictions around the world, including the European Union, are considering or have enacted their own AI-focused regulations. The EU Artificial Intelligence Act (“EU AI Act”), which establishes a risk-based governance framework for AI in the EU market, entered into force on August 1, 2024. This framework categorizes AI applications into risk categories such as “unacceptable”, “high”, “limited”, and “minimal”. In June 2026, amendments to the EU AI Act were formally adopted as part of the EU’s digital “omnibus” simplification package, which, among other things, extend the compliance deadlines for “high” risk AI systems to December 2, 2027 (for stand-alone “high” risk AI systems). AI applications in the “high” risk category will be subject to new ex ante conformity assessments and other new requirements related to risk management, testing, technical documentation and robustness, data training and data governance and log recording, transparency, human oversight, and cybersecurity, while AI applications in the “limited” risk category became subject to the new transparency obligations on August 2, 2026, with output labelling obligations for certain generative AI systems placed on the market before that date applying from December 2, 2026. Fines for breaches of the EU AI Act can be up to the greater of €35 million or 7% of worldwide annual turnover. The EU AI Act, together with developing guidance and/or decisions in this area, may affect our use of AI technologies and our ability to provide, improve or commercialize our services, require additional compliance measures and changes to our operations and processes, result in increased compliance costs and potential increases in civil claims against us, and could adversely affect our business, operations and financial condition. If our current or future AI applications fall within the “high” or “limited” risk categories, the increased cost and complexity to comply could adversely affect our business, financial condition and results of operations. We expect other jurisdictions will adopt similar laws.

Current wording

Further, jurisdictions around the world, including the European Union, are considering or have enacted their own AI-focused regulations. The EU Artificial Intelligence Act (“EU AI Act”), which establishes a risk-based governance framework for AI in the EU market, entered into force on August 1, 2024. This framework categorizes AI applications into risk categories such as “unacceptable”, “high”, “limited”, and “minimal”. In June 2026, amendments to the EU AI Act were formally adopted as part of the EU’s digital “omnibus” simplification package, which, among other things, extend the compliance deadlines for “high” risk AI systems to December 2, 2027 (for stand-alone “high” risk AI systems). AI applications in the “high” risk category will be subject to new ex ante conformity assessments and other new requirements related to risk management, testing, technical documentation and robustness, data training and data governance and log recording, transparency, human oversight, and cybersecurity, while AI applications in the “limited” risk category became subject to the new transparency obligations on August 2, 2026, with output labelling obligations for certain generative AI systems placed on the market before that date applying from December 2, 2026. Fines for breaches of the EU AI Act can be up to the greater of €35 million or 7% of worldwide annual turnover. The EU AI Act, together with developing guidance and/or decisions in this area, may affect our use of AI technologies and our ability to develop, provide, improve or commercialize our services, require additional compliance measures and changes to our operations and processes, result in increased compliance costs and potential increases in civil claims against us, and could adversely affect our business, operations and financial condition. If our current or future AI applications fall within the “high” or “limited” risk categories, the increased cost and complexity to comply could adversely affect our business, financial condition and results of operations. We expect other jurisdictions will adopt similar laws.

Previous wording

Our products are subject to United States export controls, including the Export Administration Regulations administered by the United States Commerce Department, and economic sanctions administered by the Office of Foreign Assets Control of the United States Treasury Department (“OFAC”). We incorporate encryption technology into certain of our products. These encryption products and the underlying technology may be exported outside of the United States only with the required export authorizations. Other countries also regulate the import and export of certain encryption products and technology through import and export licensing requirements, and have enacted laws that could limit our ability to distribute our products or could limit our customers’ ability to implement our products in those countries. Additionally, export restrictions imposed on Russia,

Current wording

Our products are subject to United States export controls, including the Export Administration Regulations administered by the United States Commerce Department, and economic sanctions administered by the Office of Foreign Assets Control of the United States Treasury Department (“OFAC”). We incorporate encryption technology into certain of our products. These encryption products and the underlying technology may be exported outside of the United States only with the required export authorizations. Other countries also regulate the import and export of certain encryption products and technology through import and export licensing requirements, and have enacted laws that could limit our ability to distribute our products or could limit our customers’ ability to implement our products in those countries. Additionally, export restrictions imposed on Russia, Belarus, and restricted regions of Ukraine in connection with the military conflict involving Ukraine specifically restrict the export of encryption software to these locations.

Previous wording

Global economic conditions have impacted, and will likely continue to impact, businesses around the world, including ours. Inflation and other macroeconomic pressures in the U.S. and the global economy such as rising interest rates, banking instability and recession fears are creating a complex and challenging environment for us and our customers. Ongoing military conflicts and resulting geopolitical instability have had negative impacts on the global economy, have contributed to elevated energy prices, and created uncertainty in the global capital markets, and are expected to have further global economic consequences, including disruption of the global supply chain and energy markets. Our results of operations may vary based on the impact of changes in our industry or the global economy on us or our customers and potential customers. Current or future economic uncertainties or downturns could adversely affect our business and results of operations. Global capital markets experienced and continue to experience extreme volatility. While our ability to do business has not been materially affected, the global restrictive measures that have been taken in response to such events, and could be taken in the future, have created significant global economic uncertainty that could prolong and escalate tensions and expand the geopolitical conflict, which could have a lasting impact on regional and global economies, any of which could harm our business and operating results. Further, due to political uncertainty and international military actions, we and the third parties upon which we rely may be vulnerable to a heightened risk of security breaches, computer malware, social-engineering attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, and other cyber-attacks, including attacks that could materially disrupt our systems and operations, supply chain, and ability to do business. These attacks are expected to continue to occur in the future. Furthermore, inflation rates in the U.S. in the past few years have increased to levels not seen in decades, prompting the Federal Reserve to increase interest rates. Negative conditions in the general economy both in the United States and abroad, including conditions resulting from changes in gross domestic product growth, financial and credit market fluctuations, currency and interest rate fluctuations, political turmoil, actual or potential government shutdowns, natural catastrophes, warfare, public health issues, and terrorist attacks on the United States,

Current wording

Global economic conditions have impacted, and will likely continue to impact, businesses around the world, including ours. Inflation and other macroeconomic pressures in the U.S. and the global economy such as rising interest rates, banking instability and recession fears are creating a complex and challenging environment for us and our customers. Ongoing military conflicts and resulting geopolitical instability have had negative impacts on the global economy, have contributed to elevated energy prices, and created uncertainty in the global capital markets, and are expected to have further global economic consequences, including disruption of the global supply chain and energy markets. Our results of operations may vary based on the impact of changes in our industry or the global economy on us or our customers and potential customers. Current or future economic uncertainties or downturns could adversely affect our business and results of operations. Global capital markets experienced and continue to experience extreme volatility. While our ability to do business has not been materially affected, the global restrictive measures that have been taken in response to such events, and could be taken in the future, have created significant global economic uncertainty that could prolong and escalate tensions and expand the geopolitical conflict, which could have a lasting impact on regional and global economies, any of which could harm our business and operating results. Further, due to political uncertainty and international military actions, we and the third parties upon which we rely may be vulnerable to a heightened risk of security breaches, computer malware, social-engineering attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, and other cyber-attacks, including attacks that could materially disrupt our systems and operations, supply chain, and ability to do business. These attacks are expected to continue to occur in the future. Furthermore, inflation rates in the U.S. in the past few years have increased to levels not seen in decades, prompting the Federal Reserve to increase interest rates. Negative conditions in the general economy both in the United States and abroad, including conditions resulting from changes in gross domestic product growth, financial and credit market fluctuations, currency and interest rate fluctuations, political turmoil, actual or potential government shutdowns, natural catastrophes, warfare, public health issues, and terrorist attacks on the United States, Europe, the Asia Pacific region, or elsewhere, could cause a downturn or recession and a decrease in business investments, including spending on information technology, which would harm our business. In addition, international trade disputes may disrupt our supply chain and increase pricing of the equipment components we use to operate our network and provide products t…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

As of June 30, 2026, we have outstanding a total of 159.1 million shares of common stock. All of our outstanding shares are eligible for sale in the public market, other than shares and options held by directors, executive officers, and other affiliates that are subject to volume limitations under Rule 144 of the Securities Act, various vesting agreements, and shares that must be sold under an effective registration statement. Additionally, the shares of common stock subject to outstanding options and restricted stock unit awards under our equity incentive plans and the shares reserved for future issuance under our equity incentive plans will become eligible for sale in the public market upon issuance, subject to applicable insider trading policies. The 2030 Notes are convertible at the option of the holders from July 1, 2026 until September 30, 2026, and the 2028 Notes will also become convertible at the option of the holders, subject to certain limitations and restrictions, prior to June 1, 2028.

Current wording

As of September 30, 2026, we have outstanding a total of 161.0 million shares of common stock. All of our outstanding shares are eligible for sale in the public market, other than shares and options held by directors, executive officers, and other affiliates that are subject to volume limitations under Rule 144 of the Securities Act, various vesting agreements, and shares that must be sold under an effective registration statement. Additionally, the shares of common stock subject to outstanding options and restricted stock unit awards under our equity incentive plans and the shares reserved for future issuance under our equity incentive plans will become eligible for sale in the public market upon issuance, subject to applicable insider trading policies. The 2030 Notes are convertible at the option of the holders from October 1, 2026 until December 31, 2026, and the 2028 Notes will also become convertible at the option of the holders, subject to certain limitations and restrictions, prior to June 1, 2028.