Rapid7, Inc.

Previous wording

•the timing and success of new product or service introductions by us or our competitors or any other changes in the competitive landscape of our industry, including consolidation among our competitors and initiatives that use artificial intelligence (“AI”);

Current wording

•the timing and success of new product or service introductions by us or our competitors or any other changes in the competitive landscape of our industry, including consolidation among our competitors and initiatives that use AI;

Previous wording

•business disruptions in regions affecting our operations, stemming from actual, imminent or perceived outbreak or reemergence of contagious disease;

Current wording

•business disruptions in regions affecting our operations, stemming from actual, imminent or perceived outbreak or reemergence of contagious diseases;

Previous wording

•the impact of climate change, natural disasters or manmade problems, including terrorism or war (such as the Russia- Ukraine war and the ongoing conflicts in the Middle East); and

Current wording

•the impact of climate change, natural disasters or manmade problems, including terrorism or war; and

Previous wording

Each factor above or discussed elsewhere herein or the cumulative effect of some of these factors may result in fluctuations in our operating results. This variability and unpredictability could result in our failure to meet expectations with respect to operating results, or those of securities analysts or investors, for a particular period. If we fail to meet or exceed expectations for our operating results for these or any other reasons, the market price of our stock could fall and we could face costly lawsuits, including securities class action suits.

Current wording

Each factor above or discussed elsewhere herein or the cumulative effect of some of these factors may result in fluctuations in our operating results. This variability and unpredictability could result in our failure to meet expectations with respect to operating results, including those of securities analysts or investors, for a particular period. If we fail to meet or exceed expectations for our operating results for these or any other reasons, the market price of our stock could fall and we could face costly lawsuits, including securities class action suits.

Previous wording

Our business and operations have experienced significant growth, and if we do not appropriately manage any future growth, or are unable to maintain and scale our infrastructure, systems and processes, our business and results of operations may be negatively affected.

Current wording

Our business and operations have experienced significant growth in the past, and if we do not appropriately manage any future growth, or are unable to maintain and scale our infrastructure, systems and processes, our business and results of operations may be negatively affected. Although we have experienced rapid growth in the past, we cannot provide any assurance that our business will continue to grow at the same rate or at all.

Previous wording

From the year ended December 31, 2020 to the year ended December 31, 2024, our revenue grew from$411.5 million to $844.0 million and our headcount grew from 1,847 to 2,413 employees. Our future growth is dependent upon our ability to continue to meet the expanding needs of our customers and to attract new customers. Although we have experienced rapid growth historically, we cannot provide any assurance that our business will continue to grow at the same rate or at all.

Current wording

From the year ended December 31, 2021 to the year ended December 31, 2025, our revenue grew from $535.4 million to $859.8 million and our headcount grew from 2,353 to 2,613 employees. Our future growth is dependent upon our ability to continue to meet the expanding needs of our customers and to attract new customers. Although we have experienced rapid growth in the past, we cannot provide any assurance that our business will continue to grow at the same rate or at all.

Previous wording

We have not been profitable historically and may not maintain profitability in the future.

Current wording

We may not maintain profitability in the future.

Previous wording

For the year ended December 31, 2024, we have achieved net income of $25.5 million. Prior to 2024, we had posted a net loss in each year since inception, including net losses of $152.8 million and $124.7 million in the years ended December 31, 2023 and 2022, respectively. As of December 31, 2024, we had an accumulated deficit of $988.0 million. While we have experienced significant revenue growth in recent periods and achieved profitability, we may not obtain a high enough volume of sales of our products and service offerings to sustain or increase our growth or maintain profitability in the future. We also expect our costs to increase in future periods, which could negatively affect our future operating results if our revenue does not increase. In particular, we expect to continue to expend financial and other resources on:

Current wording

For the years ended December 31, 2025 and 2024 we achieved net income of $23.4 million and $25.5 million, respectively. Prior to 2024, we posted a net loss in each year since inception, including a net loss of $152.8 million for the year ended December 31, 2023. As of December 31, 2025, we had an accumulated deficit of $964.7 million. While we have experienced significant revenue growth in the past and achieved profitability, we may not obtain a high enough volume of sales of our products and service offerings to sustain or increase our growth or maintain profitability in the future. We also expect our costs to increase in future periods, which could negatively affect our future operating results if our revenue does not increase. In particular, we expect to continue to expend financial and other resources on:

Previous wording

Our subscription offerings are sold on a term basis. In order for us to improve our operating results, it is important that our existing customers renew their subscriptions with us when the existing subscription term expires, and renew on the same or more favorable terms. Our customers have no obligation to renew their subscriptions with us and we may not be able to accurately predict customer renewal rates. Our customers’ renewal rates may decline or fluctuate as a result of a number of factors, including their satisfaction or dissatisfaction with our new or current product offerings, our pricing, the effects of economic conditions, including due to a global economic slowdown, inflation, foreign currency exchange rate fluctuation, the Russia-Ukraine war, the ongoing conflicts in the Middle East and any global economic uncertainty and financial market disruptions, competitive offerings, our customers' perception of their exposure, or alterations or reductions in their spending levels. If our customers do not renew their agreements with us or renew on terms less favorable to us, our revenues and results of operations may be adversely impacted.

Current wording

Our subscription offerings are sold on a term basis. In order for us to improve our operating results, it is important that our existing customers renew their subscriptions with us when the existing subscription term expires, and renew on the same or more favorable terms. Our customers have no obligation to renew their subscriptions with us and we may not be able to accurately predict customer renewal rates. Our customers’ renewal rates may decline or fluctuate as a result of a number of factors, including their satisfaction or dissatisfaction with our new or current product offerings, our pricing, the effects of economic conditions, including due to a global economic slowdown, inflation, foreign currency exchange rate fluctuation, and any global economic uncertainty and financial market disruptions, competitive offerings, our customers' perception of their exposure, or alterations or reductions in their spending levels. If our customers do not renew their agreements with us or renew on terms less favorable to us, our revenues and results of operations may be adversely impacted.

Previous wording

•real or perceived defect, errors or failures;

Current wording

•real or perceived defects, errors or failures;

Previous wording

•poor business conditions for our customers, causing them to delay IT purchases, including as a result of the COVID-19 pandemic; and

Current wording

•poor business conditions for our customers, causing them to delay IT purchases; and

Previous wording

The market for SecOps solutions, including our Command Platform, is highly fragmented, intensely competitive and constantly evolving. We compete with an array of established and emerging security software and services vendors. With the introduction of new technologies and market entrants, we expect the competitive environment to remain intense going forward. The markets we operate in are highly competitive, fragmented, and subject to technology change and innovation. We primarily compete with established and emerging security product vendors, including the large companies that incorporate security products into their products; XDR and SIEM vendors; cloud security vendors; vulnerability risk management vendors; application security vendors; threat intelligence vendors; and legacy security, systems management, MSSP, and other IT vendors.

Current wording

The market for SecOps solutions, including our Command Platform, is highly fragmented, intensely competitive and constantly evolving. With the introduction of new technologies and market entrants, we expect the competitive environment to remain intense going forward. We primarily compete with large companies that incorporate security products into their products, security platform providers, MDR service providers, XDR and SIEM vendors, cloud security vendors, exposure management vendors, vulnerability risk management vendors, application security vendors, threat intelligence vendors and legacy security, systems management, MSSP, and other IT vendors.

Previous wording

Some of our actual and potential competitors have advantages over us, such as longer operating histories, significantly greater financial, technical, marketing or other resources, stronger brand and business user recognition, larger and more mature intellectual property portfolios and broader global distribution and presence. In addition, our industry is evolving rapidly and is becoming increasingly competitive. Larger and more established companies may focus on security operations and could directly compete with us. Smaller companies could also launch new products and services that we do not offer and that could gain market acceptance quickly.

Current wording

Some of our actual and potential competitors have advantages over us, such as longer operating histories, significantly greater financial, technical, marketing or other resources, stronger brand and business user recognition, larger and more mature intellectual property portfolios and broader global distribution and presence. Larger and more established companies may focus on security operations and could directly compete with us. Smaller companies could also launch new products and services that we do not offer and that could gain market acceptance quickly.

Previous wording

Our competitors may be able to respond more quickly and effectively than we can to new or changing opportunities, technologies, standards or customer requirements. With the introduction of new technologies, the evolution of our offerings and new market entrants, we expect competition to intensify in the future. Conditions in our market could change rapidly and significantly as a result of technological advancements, including with respect to AI. Our competitors may more successfully incorporate AI into their products, gain or leverage superior access to certain AI technologies, and achieve higher market acceptance of their AI solutions. For further discussion of the risks related to AI, please see below under “Risks Related to Intellectual Property, Litigation and Government Regulation”.

Current wording

Our competitors may be able to respond more quickly and effectively than we can to new or changing opportunities, technologies, standards or customer requirements. With the introduction of new technologies, the evolution of our offerings and new market entrants, we expect competition to intensify in the future. Our competitors may more successfully incorporate AI into their products, gain or leverage superior access to certain AI technologies, and achieve higher market acceptance of their AI solutions. In addition, advancements in AI, automation, and related technologies may accelerate feature parity or commoditization of certain software capabilities across the industry, which could increase pricing pressure, reduce differentiation among offerings, or shorten product life cycles. For further discussion of the risks related to AI, please see below under “Risks Related to Intellectual Property, Litigation and Government Regulation”.

Previous wording

Furthermore, our current and potential competitors may establish cooperative relationships among themselves or with third parties that may further enhance their resources and product and services offerings in the markets we address. In addition, current or potential competitors may be acquired by third parties with greater available resources. As a result of such relationships and acquisitions, our current or potential competitors might be able to adapt more quickly to new technologies and customer needs, devote greater resources to the promotion or sale of their products and services, initiate or withstand substantial price competition, take advantage of other opportunities more readily or develop and expand their product and service offerings more quickly than we do.

Current wording

Furthermore, our current and potential competitors may establish cooperative relationships among themselves or with third parties that may further enhance their resources and product and services offerings in the markets we address. In addition, current or potential competitors may be acquired by third parties with greater available resources. As a result of such relationships and acquisitions, our current or potential competitors might be able to adapt more quickly to new technologies and customer needs, devote greater resources to the promotion or sale of their products and services, initiate or withstand substantial price competition, take advantage of other opportunities more readily or develop and expand their product and service offerings more quickly than we do. These competitive pressures in our market or our failure to compete effectively may result in price reductions, fewer orders, reduced renewals, reduced revenue and gross margins, and loss of market share. Any failure to address these factors could seriously harm our business and operating results.

Previous wording

Prolonged economic uncertainties or downturns could adversely affect our business operations or financial results. Negative conditions in the general economy in either the United States or abroad, including conditions resulting from financial and credit market fluctuations, changes in economic policy, inflation, foreign currency exchange rate fluctuations, trade uncertainty, including changes in tariffs, sanctions, international treaties, and other trade restrictions, the occurrence of a natural disaster, outbreaks of epidemics or pandemics such as COVID-19, political unrest and social strife, including acts of terrorism, armed conflicts, such as the one between Russia and Ukraine and the ongoing conflicts in the Middle East, have caused and could continue to cause a decrease in corporate spending on security offerings or information technology in general and negatively affect the rate of growth of our business.

Current wording

Prolonged economic uncertainties or downturns could adversely affect our business operations or financial results. Negative conditions in the general economy in either the United States or abroad, including conditions resulting from financial and credit market fluctuations, changes in economic policy, inflation, foreign currency exchange rate fluctuations, trade uncertainty, including changes in tariffs, sanctions, international treaties, and other trade restrictions, the occurrence of a natural disaster, outbreaks of epidemics or pandemics, political unrest and social strife, including acts of terrorism, and armed conflicts, have caused and could continue to cause a decrease in corporate spending on security offerings or information technology in general and negatively affect the rate of growth of our business.

Previous wording

Our customer base spans a variety of industries, including technology services, energy, financial services, healthcare and life sciences, manufacturing, media and entertainment, retail, education, real estate, transportation, government and professional services. A substantial downturn in any of these industries may cause companies to reduce their capital expenditures in general or by specifically reducing their spending on information technology or security offerings. As a result, our current or prospective customers in these industries may delay or cancel information technology projects or seek to lower their costs by renegotiating vendor contracts. For example, due to economic volatility as a result of inflationary pressures and other global events, we have and may continue to see delays in our sales cycle, failures of customers to renew at all or to renew the anticipated scope their subscriptions with us, requests from customers for payment term deferrals as well as pricing or bundling concessions, which, if significant, could materially and adversely affect our business, results of operations and financial condition. To the extent purchases of our offerings are perceived by customers and potential customers to be discretionary, our revenues may be disproportionately affected by delays or reductions in general information technology spending. Also, customers may choose to develop in-house software as an alternative to using our offerings. Moreover, competitors may respond to market conditions by lowering prices and attempting to lure away our customers. In addition, the increased pace of consolidation in certain industries may result in reduced overall spending on our offerings.

Current wording

Our customer base spans a variety of industries, including technology services, energy, financial services, healthcare and life sciences, manufacturing, media and entertainment, retail, education, real estate, transportation, government and professional services. A substantial downturn in any of these industries may cause companies to reduce their capital expenditures in general or by specifically reducing their spending on information technology or security offerings. As a result, our current or prospective customers in these industries may delay or cancel information technology projects or seek to lower their costs by renegotiating vendor contracts. For example, due to economic volatility as a result of inflationary pressures and other global events, we have and may continue to see delays in our sales cycle, failures of customers to renew at all or to renew the anticipated scope of their subscriptions with us, requests from customers for payment term deferrals as well as pricing or bundling concessions, which, if significant, could materially and adversely affect our business, results of operations and financial condition. To the extent purchases of our offerings are perceived by customers and potential customers to be discretionary, our revenues may be disproportionately affected by delays or reductions in general information technology spending. Also, customers may choose to develop in-house software as an alternative to using our offerings. Moreover, competitors may respond to market conditions by lowering prices and attempting to lure away our customers. In addition, the increased pace of consolidation in certain industries may result in reduced overall spending on our offerings.

Previous wording

We cannot predict the timing, strength or duration of any economic slowdown, instability or recovery, generally or within any particular industry or geography. Although we expect that our current cash and cash equivalent balances, including the proceeds of our offering of convertible senior notes in September 2023, together with cash flows that are generated from operations, will be sufficient to meet our domestic and international working capital needs and other capital and liquidity requirements for at least the next 12 months, if the economic conditions of the general economy or industries in which we operate worsen from present levels, our business operations and financial results could be adversely affected.

Current wording

We cannot predict the timing, strength or duration of any economic slowdown, instability or recovery, generally or within any particular industry or geography. Although we expect that our current cash and cash equivalent and investments balances, together with cash flows that are generated from operations and availability under our revolving credit facility, will be sufficient to meet our domestic and international working capital needs and other capital and liquidity requirements for at least the next 12 months, if the economic conditions of the general economy or industries in which we operate worsen from present levels, our business operations and financial results could be adversely affected.

Previous wording

Our hybrid working model and use of service providers with remote working arrangements also subject us to heightened operational risks. For example, technologies in our employees’ and service providers’ homes when they are working remotely may not be as robust as in our offices and could cause the networks, information systems, applications, and other tools available to employees and service providers to be more limited or less reliable than in our offices. Further, the security systems in place at our employees’ and service providers’ homes may be less secure than those used in our offices, and while we have implemented technical and administrative safeguards to help protect our systems as our employees and service providers work from home, we may be subject to increased cybersecurity risk, which could expose us to risks of data or financial loss, and could disrupt our business operations. There is no guarantee that the data security and privacy safeguards we have put in place will be completely effective or that we will not encounter risks associated with employees and service providers accessing company data and systems remotely.

Current wording

Our hybrid working model and use of service providers with remote working arrangements also subjects us to heightened operational risks. For example, technologies in our employees’ and service providers’ homes when they are working remotely may not be as robust as in our offices and could cause the networks, information systems, applications, and other tools available to employees and service providers to be more limited or less reliable than in our offices. Further, the security systems in place at our employees’ and service providers’ homes may be less secure than those used in our offices, and while we have implemented technical and administrative safeguards to help protect our systems as our employees and service providers work from home, we may be subject to increased cybersecurity risk, which could expose us to risks of data or financial loss, and could disrupt our business operations. There is no guarantee that the data security and privacy safeguards we have put in place will be completely effective or that we will not encounter risks associated with employees and service providers accessing company data and systems remotely.

Previous wording

We market and sell our products and service offerings throughout the world and have personnel in many parts of the world. For the years ended December 31, 2024, 2023 and 2022, operations located outside of North America generated 24%, 22% and 21%, respectively, of our revenue. Our growth strategy is dependent, in part, on our continued international expansion. We expect to conduct a significant amount of our business with organizations that are located outside the United States, particularly in Europe and Asia. We cannot assure you that our expansion efforts into international markets will be successful in creating further demand for our products and service offerings or in effectively selling our products and service offerings in the international markets that we enter. Our current international operations and future initiatives will involve a variety of risks, including:

Current wording

We market and sell our products and service offerings throughout the world and have personnel in many parts of the world. For the years ended December 31, 2025, 2024 and 2023, operations located outside of North America generated 25%, 24% and 22%, respectively, of our revenue. Our growth strategy is dependent, in part, on our continued international expansion. For example, in April 2025, we opened a new Global Capability Center in Pune, India, to serve as an innovation hub and SOC. We expect to conduct a significant amount of our business with organizations that are located outside the United States, particularly in Europe and Asia. We cannot assure you that our expansion efforts into international markets will be successful in creating further demand for our products and service offerings or in effectively selling our products and service offerings in the international markets that we enter. Our current international operations and future initiatives will involve a variety of risks, including:

Previous wording

•economic or political instability or uncertainty in foreign markets and around the world;

Current wording

•economic or political instability or uncertainty in foreign markets and around the world, including in response to tariffs and retaliatory tariffs;

Previous wording

•increased exposure to climate change, natural disasters, acts of war (including the Russia-Ukraine war and the ongoing conflicts in the Middle East), terrorism, epidemics, or pandemics and other health crises; and

Current wording

•increased exposure to climate change, natural disasters, acts of war, terrorism, epidemics, or pandemics and other health crises; and

Previous wording

Achieving the anticipated benefits of past or future acquisitions will depend in part upon whether we can integrate acquired operations, products and technology in a timely and cost-effective manner and successfully market and sell these as new product offerings, or as new features within our existing offerings. For example, on July 3, 2024, we acquired Noetic Cyber, Inc. (“Noetic”), a provider of cyber attack surface management technology. The integration of any acquisition may prove to be difficult due to the necessity of coordinating geographically separate organizations and integrating personnel with disparate business backgrounds and accustomed to different corporate cultures and business operations and internal systems. We may need to implement or improve controls, procedures, and policies at a business that prior to the acquisition may have lacked sufficiently effective controls, procedures and policies. The acquisition and integration processes are complex, expensive and time consuming, and may cause an interruption of, or loss of momentum in, product development, sales activities and operations of both companies. Further, we may be unable to retain key personnel of an acquired company following the acquisition. If we are unable to effectively execute or integrate acquisitions, the anticipated benefits of such acquisition, including sales or growth opportunities or targeted synergies may not be realized, and our business, financial condition and operating results could be adversely affected.

Current wording

Achieving the anticipated benefits of past or future acquisitions will depend in part upon whether we can integrate acquired operations, products and technology in a timely and cost-effective manner and successfully market and sell these as new product offerings, or as new features within our existing offerings. The integration of any acquisition may prove to be difficult due to the necessity of coordinating geographically separate organizations and integrating personnel with disparate business backgrounds and accustomed to different corporate cultures and business operations and internal systems. We may need to implement or improve controls, procedures, and policies at a business that prior to the acquisition may have lacked sufficiently effective controls, procedures and policies. The acquisition and integration processes are complex, expensive and time consuming, and may cause an interruption of, or loss of momentum in, product development, sales activities and operations of both companies. Further, we may be unable to retain key personnel of an acquired company following the acquisition. If we are unable to effectively execute or integrate acquisitions, the anticipated benefits of such acquisition, including sales or growth opportunities or targeted synergies may not be realized, and our business, financial condition and operating results could be adversely affected.

Previous wording

Our success is dependent in part upon establishing and maintaining relationships with a variety of channel partners that we utilize to extend our geographic reach and market penetration. We anticipate that we will continue to rely on these partners in order to help facilitate sales of our offerings as part of larger purchases in the United States and to grow our business internationally. For the years ended December 31, 2024, 2023 and 2022, we derived approximately 68%, 62% and 57%, respectively, of our revenue from sales of products and service offerings through channel partners, and the percentage of revenue derived from channel partners may increase in future periods. Our agreements with our channel partners are non-exclusive and do not prohibit them from working with our competitors or offering competing solutions, and some of our channel partners may have more established relationships with our competitors. If our channel partners choose to place greater emphasis on products of their own or those offered by our competitors or do not effectively market and sell our products and service offerings (including our Command Platform), our ability to grow our business and sell our products and service offerings, particularly in key international markets, may be adversely affected. In addition, our failure to recruit additional channel partners, or any reduction or delay in their sales of our products and service offerings or conflicts between channel sales and our direct sales and marketing activities may harm our results of operations. Finally, even if we are successful, our relationships with channel partners may not result in greater customer usage of our products and service offerings or increased revenue.

Current wording

Our success is dependent in part upon establishing and maintaining relationships with a variety of channel partners that we utilize to extend our geographic reach and market penetration. We anticipate that we will continue to rely on these partners in order to help facilitate sales of our offerings as part of larger purchases in the United States and to grow our business internationally. For the years ended December 31, 2025, 2024 and 2023, we derived approximately 73%, 68% and 62%, respectively, of our revenue from sales of products and service offerings through channel partners, and the percentage of revenue derived from channel partners may increase in future periods. Our agreements with our channel partners are non-exclusive and do not prohibit them from working with our competitors or offering competing solutions, and some of our channel partners may have more established relationships with our competitors. If our channel partners choose to place greater emphasis on products of their own or those offered by our competitors or do not effectively market and sell our products and service offerings (including our Command Platform), our ability to grow our business and sell our products and service offerings, particularly in key international markets, may be adversely affected. In addition, our failure to recruit additional channel partners, or any reduction or delay in their sales of our products and service offerings or conflicts between channel sales and our direct sales and marketing activities may harm our results of operations. Finally, even if we are successful, our relationships with channel partners may not result in greater customer usage of our products and service offerings or increased revenue.

Previous wording

Selling to government entities can be highly competitive, expensive and time consuming, and often requires significant upfront time and expense without any assurance that we will win a sale. Government demand and payment for our products and service offerings may also be impacted by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our offerings. Government entities also have heightened sensitivity surrounding the purchase of cybersecurity solutions due to the critical importance of their IT infrastructures, the nature of the information contained within those infrastructures and the fact that they are highly visible targets for cyber attacks. For example, the conflict in Ukraine and associated activities in Ukraine and Russia may increase the risk of cyberattacks on various types of infrastructure and operations, and the United States government has warned companies to be prepared for a significant increase in Russian cyberattacks in response to the sanctions on Russia. Accordingly, increasing sales of our products and service offerings to government entities may be more challenging than selling to commercial organizations. Further, in the course of providing our products and service offerings to government entities, our employees and those of our channel partners may be exposed to sensitive government information. Any failure by us or our channel partners to safeguard and maintain the confidentiality of such information could subject us to liability and reputational harm, which could materially and adversely affect our results of operations and financial performance. Additionally, in the United States, federal government agencies may promulgate regulations, and the President may issue executive orders, requiring federal contractors to adhere to different or additional requirements after a contract is signed. If we do not meet applicable requirements of law or contract, we could be subject to significant liability from our customers or regulators.

Current wording

Government demand and payment for our products and service offerings may also be impacted by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our offerings. Actual or threatened government shutdowns, continuing resolution, sequestration and other fiscal or budgetary disruptions may delay procurements, contract awards, renewals and payments, reduce spending on cybersecurity initiatives and otherwise adversely affect our public sector revenue and cash flows. Government entities also have heightened sensitivity surrounding the purchase of cybersecurity solutions due to the critical importance of their IT infrastructures, the nature of the information contained within those infrastructures and the fact that they are highly-visible targets for cyber attacks. For example, as the United States government has warned, the conflict in Ukraine has led to increasingly sophisticated cyberattacks on various types of infrastructure and operations in response to the sanctions on Russia. Accordingly, increasing sales of our products and service offerings to government entities may be more challenging than selling to commercial organizations. Further, in the course of providing our products and service offerings to government entities, our employees and those of our channel partners may be exposed to sensitive government information. Any failure by us or our channel partners to safeguard and maintain the confidentiality of such information could subject us to liability and reputational harm, which could materially and adversely affect our results of operations and financial performance. Additionally, in the United States, federal government agencies may promulgate regulations, and the President may issue executive orders, requiring federal contractors to adhere to different or additional requirements after a contract is signed. If we do not meet applicable requirements of law or contract, we could be subject to significant liability from our customers or regulators.

Previous wording

Our reporting currency is the U.S. dollar and we generate a majority of our revenue in U.S. dollars. However, for the years ended December 31, 2024, 2023 and 2022, we incurred 19%, 17% and 16%, respectively, of our expenses outside of the United States in foreign currencies, primarily the British pound sterling and euro, principally with respect to salaries and related personnel expenses associated with our sales and research and development operations. Additionally, for the years ended December 31, 2024, 2023 and 2022, 13%, 11% and 10%, respectively, of our revenue was generated in foreign currencies. Accordingly, changes in exchange rates may have an adverse effect on our business, operating results and financial condition. The exchange rate between the U.S. dollar and foreign currencies has fluctuated substantially in recent years and may fluctuate in the future, including as a result of geopolitical factors such as the ongoing conflicts in the Middle East including Israel and the surrounding region, which has impacted the exchange rate between the U.S. dollar and the Israeli New Shekel. Furthermore, a strengthening of the U.S. dollar could increase the cost in local currency of our products and services to customers outside the United States, which could adversely affect our business, results of operations, financial condition and cash flows. We enter into forward contracts designated as cash flow hedges in order to mitigate our exposure to foreign currency fluctuations resulting from certain operating expenses denominated in certain foreign currencies. These forward contracts and other hedging strategies such as options and foreign exchange swaps related to transaction exposures that we may implement to mitigate this risk in the future may not eliminate our exposure to foreign exchange fluctuations.

Current wording

Our reporting currency is the U.S. dollar and we generate a majority of our revenue in U.S. dollars. However, for the years ended December 31, 2025, 2024 and 2023 we incurred 21%, 19% and 17%, respectively, of our expenses outside of the United States in foreign currencies, primarily the British pound sterling and euro, principally with respect to salaries and related personnel expenses associated with our sales and research and development operations. Additionally, for the years ended December 31, 2025, 2024 and 2023, 14%, 13% and 11%, respectively, of our revenue was generated in foreign currencies. Accordingly, changes in exchange rates may have an adverse effect on our business, operating results and financial condition. The exchange rate between the U.S. dollar and foreign currencies has fluctuated substantially in recent years and may fluctuate in the future, including as a result of geopolitical factors such as the ongoing conflicts in the Middle East including Israel and the surrounding region, which has impacted the exchange rate between the U.S. dollar and the Israeli New Shekel. Furthermore, a strengthening of the U.S. dollar could increase the cost in local currency of our products and services to customers outside the United States, which could adversely affect our business, results of operations, financial condition and cash flows. We enter into forward contracts designated as cash flow hedges in order to mitigate our exposure to foreign currency fluctuations resulting from certain operating expenses denominated in certain foreign currencies. These forward contracts and other hedging strategies such as options and foreign exchange swaps related to transaction exposures that we may implement to mitigate this risk in the future may not eliminate our exposure to foreign exchange fluctuations.

Previous wording

In August of 2023, our Board approved a restructuring plan that was designed to improve operational efficiencies, reduce operating costs and better align the Company’s workforce with current business needs, top strategic priorities, and key growth opportunities(the “Restructuring Plan”). The Restructuring Plan included the reduction of our workforce by approximately 16%. We may encounter challenges as a result of these restructuring efforts and our reduction in force that could prevent us from recognizing the intended benefits of the Restructuring Plan or otherwise adversely affect our business, results of operations and financial condition. As of March 31, 2024, the execution of the Restructuring Plan was completed.

Current wording

In August of 2023, our Board approved the Restructuring Plan designed to improve operational efficiencies, reduce operating costs and better align our workforce with strategic priorities and key growth opportunities. The Restructuring Plan included the reduction of our workforce by approximately 16%. We may encounter challenges as a result of these restructuring efforts that could prevent us from recognizing the intended benefits of the Restructuring Plan or otherwise adversely affect our business, results of operations and financial condition. As of March 31, 2024, the execution of the Restructuring Plan was completed.

Previous wording

As a result of the Restructuring Plan, we have incurred and may continue to incur additional costs in the short term, including cash expenditures for employee transition, notice period and severance payments, employee benefits, related facilitation costs non-cash expenditures related to acceleration of vesting of share-based awards and other significant one-time costs. For example, in connection with the Restructuring Plan, we permanently closed certain idle office spaces in Plano, Texas, Los Angeles, California and Toronto, Canada, which resulted in an impairment loss of $3.6 million recorded in 2023. These additional cash and non-cash expenditures could have the effect of reducing our operating margins. Our Restructuring Plan may result in other unintended consequences, including employee attrition beyond our intended reduction in force, which may also be further exacerbated by the actual or perceived declining value of our equity awards; damage to our corporate culture and decreased employee morale among our remaining employees; diversion of management attention; damage to our reputation as an employer, which could make it more difficult for us to hire new employees in the future; and the loss of institutional knowledge and expertise of departing employees. If we experience any of these adverse consequences, our Restructuring Plan may not achieve or sustain its intended benefits, or the benefits, even if achieved, may not be adequate to meet our long-term profitability and operational expectations, which could adversely affect our business, results of operations and financial condition.

Current wording

As a result of the Restructuring Plan, we have incurred additional costs in the short-term, including cash expenditures for employee transition, severance payments, employee benefits, and related facilitation costs as well as non-cash expenditures related to acceleration of vesting of share-based awards. These additional cash and non-cash expenditures could reduce our operating margins. Our Restructuring Plan may result in other unintended consequences, including employee attrition beyond our intended reduction in force; damage to our corporate culture and decreased employee morale among our remaining employees; diversion of management attention; damage to our reputation as an employer; and the loss of institutional knowledge and expertise of departing employees. If we experience any of these adverse consequences, our Restructuring Plan may not achieve or sustain its intended benefits, or the benefits, even if achieved, may not be adequate to meet our long-term profitability and operational expectations, which could adversely affect our business, results of operations and financial condition.

Previous wording

In addition, our Restructuring Plan could lead us to fail to meet, or cause delays in meeting, our operational and growth targets. While positions have been eliminated, functions that they performed remain necessary to our operations, and we may be unsuccessful in effectively and efficiently distributing the duties and obligations of departed employees among our remaining employees. The Restructuring Plan could also prevent us from pursuing new opportunities and initiatives or require us to adjust our growth strategy. As we continue to identify areas of cost savings and operating efficiencies, we may consider implementing further measures to reduce operating costs and improve operating margins. We may not be successful in implementing such initiatives, including as a result of factors beyond our control. If we are unable to realize the anticipated savings and efficiencies from our Restructuring Plan and/or accomplish our business and strategic initiatives, our business, results of operations and financial condition could be materially and adversely affected.

Current wording

As we continue to identify areas of cost savings and operating efficiencies, we may consider implementing further measures to reduce operating costs and improve operating margins. We may not be successful in implementing such initiatives, including as a result of factors beyond our control. If we are unable to realize the anticipated savings and efficiencies from our Restructuring Plan and/or accomplish our business and strategic initiatives, our business, results of operations and financial condition could be materially and adversely affected.

Previous wording

We may not be successful in our initiatives that utilize AI, which could adversely affect our business, reputation,

Current wording

We may not be successful in our initiatives that utilize AI, which could adversely affect our business, reputation, or financial results.

Previous wording

There are significant risks involved in utilizing AI and no assurance can be provided that the usage of such AI will enhance our business or assist our business in being more efficient or profitable. Known risks of AI currently include accuracy, bias, toxicity, intellectual property infringement or misappropriation, data privacy and cybersecurity, and data provenance. In addition, AI may have errors or inadequacies that are not easily detectable. For example, certain AI may utilize historical data in its analytics. To the extent that such historical data is not indicative of the current or future conditions, or the AI fails to filter biases in the underlying data or collection methods, the usage of AI may lead us to make determinations on behalf of our business, recommendations to our clients, or developments to our products and services, in each case, that have an adverse effect on our business and financial results. AI may also be subject to data herding and interconnectedness (i.e., multiple market participants utilizing the same data), which may adversely impact our business. If the AI we utilize is incorrectly designed or utilizes training data that is overbroad, incomplete, inadequate or biased in some way, our use of AI may inadvertently reduce our efficiency or cause unintentional or unexpected outputs that are incorrect, do not match our business goals, do not comply with our policies or interfere with the performance of our products and services, business and reputation.

Current wording

There are significant risks involved in utilizing AI and no assurance can be provided that the usage of such AI will enhance our business or assist our business in being more efficient or profitable. Known risks of AI currently include accuracy, bias, toxicity, intellectual property infringement or misappropriation, data privacy and cybersecurity, and data provenance. In addition, AI may have errors or inadequacies that are not easily detectable. For example, certain AI may utilize historical data in its analytics. To the extent that such historical data is not indicative of the current or future conditions, or the AI fails to filter biases in the underlying data or collection methods, the usage of AI may lead us to make determinations on behalf of our business, recommendations to our clients, or developments to our products and services, in each case, that have an adverse effect on our business and financial results. AI may also be subject to data herding and interconnectedness (i.e., multiple market participants utilizing the same data), which may adversely impact our business. If the AI we utilize is incorrectly designed or utilizes training data that is overbroad, incomplete, inadequate or biased in some way, our use of AI may inadvertently reduce our efficiency or cause unintentional or unexpected outputs that are incorrect, do not match our business goals, do not comply with our policies or interfere with the performance of our products and services, business and reputation. In addition, employees may inadvertently input confidential, proprietary or personal information into unapproved AI tools, which could result in the loss of trade secrets, unauthorized disclosure of sensitive data, violations of privacy or confidentiality obligations, regulatory scrutiny, litigation or reputational harm.

Previous wording

Like other U.S.-based IT security products, our products are subject to U.S. export control and import laws and regulations, including the U.S. Export Administration Regulations and various economic and trade sanctions regulations administered by the U.S. Treasury Department’s Office of Foreign Assets Control. Exports of these products must be made in compliance with these laws and regulations. Although we take precautions to prevent our products from being provided in violation of these laws, our products could be provided inadvertently in violation of such laws, despite the precautions we take. Compliance with these laws and regulations is complex, and if we were to fail to comply with these laws and regulations, we and certain of our employees could be subject to substantial civil and criminal penalties, including fines for our company and responsible employees or managers, and, in extreme cases, incarceration of responsible employees and managers and the possible loss of export privileges. Complying with export control laws and regulations, including obtaining the necessary licenses or authorizations, for a particular sale may be time-consuming, is not guaranteed and may result in the delay or loss of sales opportunities. Changes in export or import laws and regulations, shifts in the enforcement or scope of existing laws and regulations, or changes in the countries, governments, persons, products or services targeted by such laws and regulations, could also result in decreased use of our products by, or in our decreased ability to export or sell our products to, existing or potential customers. For example, in response to the Russia-Ukraine war, countries such as Canada, the United Kingdom, the European Union, the United States and other countries and organizations have implemented new and stricter sanctions and export controls against officials, individuals, regions, and industries in Russia, Ukraine and Belarus. Each country’s potential response to such sanctions, export controls, tensions, and military actions could damage or disrupt international commerce and the global economy and could have a material adverse effect on our business and results of operations or impact our ability to continue to operate in affected regions.

Current wording

Like other U.S.-based IT security products, our products are subject to U.S. export control and import laws and regulations, including the U.S. Export Administration Regulations and various economic and trade sanctions regulations administered by the U.S. Treasury Department’s Office of Foreign Assets Control. Exports of these products must be made in compliance with these laws and regulations. Although we take precautions to prevent our products from being provided in violation of these laws, our products could be provided inadvertently in violation of such laws, despite the precautions we take. Compliance with these laws and regulations is complex, and if we were to fail to comply with these laws and regulations, we and certain of our employees could be subject to substantial civil and criminal penalties, including fines for our company and responsible employees or managers, and, in extreme cases, incarceration of responsible employees and managers and the possible loss of export privileges. Complying with export control laws and regulations, including obtaining the necessary licenses or authorizations, for a particular sale may be time-consuming, is not guaranteed and may result in the delay or loss of sales opportunities. Changes in export or import laws and regulations, shifts in the enforcement or scope of existing laws and regulations, or changes in the countries, governments, persons, products or services targeted by such laws and regulations, could also result in decreased use of our products by, or in our decreased ability to export or sell our products to, existing or potential customers. For example, in response to the conflict in Ukraine, countries and organizations such as Canada, the United Kingdom, the European Union, and the United States and other countries and organizations have implemented new and stricter sanctions and export controls against officials, individuals, regions, and industries in Russia, Ukraine and Belarus. Each country’s potential response to such sanctions, export controls, tensions, and military actions could damage or disrupt international commerce and the global economy and could have a material adverse effect on our business and results of operations or impact our ability to continue to operate in affected regions.

Previous wording

As of December 31, 2024, we had federal and state net operating loss carryforwards (“NOLs”) of$265.6 million and $306.0 million, respectively, available to offset future taxable income, a portion of which expires in various years beginning in 2024 if not utilized. A lack of future taxable income would adversely affect our ability to utilize these NOLs before they expire. Under the provisions of the Internal Revenue Code (the “IRC”), substantial changes in our ownership may limit the amount of pre-change NOLs that can be utilized annually in the future to offset taxable income. IRC Section 382 imposes limitations on a company’s ability to use NOLs if a company experiences a more-than-50-percentage point ownership change over a three-year testing period. Based upon our historical analysis, we determined that although a limitation on our historical NOLs exists, we do not expect this limitation to impair our ability to use our NOLs prior to expiration. However, if changes in our ownership occur in the future, our ability to use our NOLs may be further limited. For these reasons, we may not be able to utilize a material portion of the NOLs. If we are limited in our ability to use our NOLs in future years in which we have taxable income, we will pay more taxes than if we were able to fully utilize our NOLs. This could adversely affect our operating results, cash balances and the market price of our common stock.

Current wording

As of December 31, 2025, we had federal and state net operating loss carryforwards (“NOLs”) of $222.6 million and $240.3 million, respectively, available to offset future taxable income, a portion of which expires in various years beginning in 2033 if not utilized. A lack of future taxable income would adversely affect our ability to utilize these NOLs before they expire. Under the provisions of the Internal Revenue Code (the “IRC”), substantial changes in our ownership may limit the amount of pre-change NOLs that can be utilized annually in the future to offset taxable income. IRC Section 382 imposes limitations on a company’s ability to use NOLs if a company experiences a more-than-50-percentage point ownership change over a three-year testing period. Based upon our historical analysis, we determined that although a limitation on our historical NOLs exists, we do not expect this limitation to impair our ability to use our NOLs prior to expiration. However, if changes in our ownership occur in the future, our ability to use our NOLs may be further limited. For these reasons, we may not be able to utilize a material portion of the NOLs. If we are limited in our ability to use our NOLs in future years in which we have taxable income, we will pay more taxes than if we were able to fully utilize our NOLs. This could adversely affect our operating results, cash balances and the market price of our common stock.

Previous wording

We are subject to U.S. federal, state, local and sales taxes in the United States and foreign income taxes, withholding taxes and transaction taxes in numerous foreign jurisdictions. We generally conduct our international operations through wholly-owned subsidiaries and report our taxable income in various jurisdictions worldwide based upon our business operations in those jurisdictions. Our intercompany relationships are and will continue to be subject to complex transfer pricing regulations administered by taxing authorities in various jurisdictions. Significant judgment is required in evaluating our tax positions and our worldwide provision for taxes. During the ordinary course of business, there are many activities and transactions for which the ultimate tax determination is uncertain and the relevant taxing authorities may disagree with our determinations as to the income and expenses attributable to specific jurisdictions. In addition, our tax obligations and effective tax rates could be adversely affected by changes in the relevant tax, accounting and other laws, regulations, principles and interpretations by recognizing tax losses or lower than anticipated earnings in jurisdictions where we have lower statutory rates and higher than anticipated earnings in jurisdictions where we have higher statutory rates, by changes in foreign currency exchange rates, or by changes in the valuation of our deferred tax assets and liabilities. We may be audited in various jurisdictions, and such jurisdictions may assess additional taxes, sales taxes, and value-added taxes against us. If we are unsuccessful in sustaining our tax positions, our financial condition and results of operations would be adversely affected. For example, during the quarter ended June 30, 2024, we received an initial assessment from the Israel Tax Authority of approximately 324 million Israeli New Shekels (approximately $88 million, based upon exchange rates as of December 31, 2024 between the Israeli New Shekel and the US Dollar) in relation to the fiscal year 2021 operations of one of our subsidiaries in Israel. If we are unsuccessful in sustaining our tax position in this matter, our financial condition and results of operations will be adversely affected. See Note 16, Commitments and Contingencies, in the notes to the consolidated financial statements included in Part II, Item 8, of this Annual Report on Form 10-K for further information.

Current wording

We are subject to U.S. federal, state, local and sales taxes in the United States and foreign income taxes, withholding taxes and transaction taxes in numerous foreign jurisdictions. We generally conduct our international operations through wholly-owned subsidiaries and report our taxable income in various jurisdictions worldwide based upon our business operations in those jurisdictions. Our intercompany relationships are and will continue to be subject to complex transfer pricing regulations administered by taxing authorities in various jurisdictions. Significant judgment is required in evaluating our tax positions and our worldwide provision for taxes. During the ordinary course of business, there are many activities and transactions for which the ultimate tax determination is uncertain and the relevant taxing authorities may disagree with our determinations as to the income and expenses attributable to specific jurisdictions. In addition, our tax obligations and effective tax rates could be adversely affected by changes in the relevant tax, accounting and other laws, regulations, principles and interpretations by recognizing tax losses or lower than anticipated earnings in jurisdictions where we have lower statutory rates and higher than anticipated earnings in jurisdictions where we have higher statutory rates, by changes in foreign currency exchange rates, or by changes in the valuation of our deferred tax assets and liabilities. We may be audited in various jurisdictions, and such jurisdictions may assess additional taxes, sales taxes, and value-added taxes against us. If we are unsuccessful in sustaining our tax positions, our financial condition and results of operations would be adversely affected. For example, during the quarter ended June 30, 2024, we received an initial assessment from the Israel Tax Authority of approximately 324 million Israeli New Shekels (approximately $102 million, based upon current exchange rates between the Israeli New Shekel and the US Dollar) in relation to the fiscal year 2021 operations of one of our subsidiaries in Israel. If we are unsuccessful in sustaining our tax position in this matter, our financial condition and results of operations will be adversely affected. See Note 15, Commitments and Contingencies, in the notes to the consolidated financial statements included in Part II, Item 8, of this Annual Report on Form 10-K for further information.

Previous wording

If our products or service offerings fail to detect vulnerabilities in our customers’ cybersecurity infrastructure, or if our products or service offerings fail to identify and respond to new and increasingly complex methods of cyber attacks, our business and reputation may suffer. There is no guarantee that our products or service offerings will detect all vulnerabilities and threats, especially in light of the rapidly changing security landscape to which we must respond, including the constantly evolving techniques used by attackers to access or sabotage data. For example, the conflict in Ukraine and associated activities in Ukraine and Russia may increase the risk of cyberattacks on various types of infrastructure and operations, and the United States government has warned companies to be prepared for a significant increase in Russian cyberattacks in response to the sanctions on Russia. If we fail to update our solutions in a timely or effective manner to respond to these threats, our customers could experience security breaches. Many federal, state and foreign governments have enacted laws requiring companies to notify individuals of data security breaches involving their personal data. These mandatory disclosures regarding a security breach often lead to widespread negative publicity, and any association of us with such publicity may cause our customers to lose confidence in the effectiveness of our solutions. An actual or perceived security breach or theft of sensitive data of one of our customers, regardless of whether the breach is attributable to the failure of our products or service offerings, could adversely affect the market’s perception of our offerings and subject us to legal claims.

Current wording

If our products or service offerings fail to detect vulnerabilities in our customers’ cybersecurity infrastructure, or if our products or service offerings fail to identify and respond to new and increasingly complex methods of cyber attacks, our business and reputation may suffer. There is no guarantee that our products or service offerings will detect all vulnerabilities and threats, especially in light of the rapidly changing security landscape to which we must respond, including the constantly evolving techniques used by attackers to access or sabotage data. If we fail to update our solutions in a timely or effective manner to respond to these threats, our customers could experience security breaches. Many federal, state and foreign governments have enacted laws requiring companies to notify individuals of data security breaches involving their personal data. These mandatory disclosures regarding a security breach often lead to widespread negative publicity, and any association of us with such publicity may cause our customers to lose confidence in the effectiveness of our solutions. An actual or perceived security breach or theft of sensitive data of one of our customers, regardless of whether the breach is attributable to the failure of our products or service offerings, could adversely affect the market’s perception of our offerings and subject us to legal claims.

Previous wording

Our products may also contain undetected errors or defects. Errors or defects may be more likely when a product is first introduced or as new versions are released, or when we introduce an acquired company's products. We have experienced these errors or defects in the past in connection with new products, acquired products and product upgrades and we expect that these errors or defects will be found from time to time in the future in new, acquired or enhanced products after commercial release. Defects may cause our products to be vulnerable to attacks, fail to detect vulnerabilities or threats, or temporarily interrupt customers’ networking traffic. Any errors, defects, disruptions in service or other performance problems with our products may damage our customers’ businesses and could hurt our reputation. If our products or service offerings fail to detect vulnerabilities or threats for any reason, we may incur significant costs, the attention of our key personnel could be diverted, our customers may delay or withhold payment to us or elect not to renew or other significant customer relations problems may arise. We may also be subject to liability claims for damages related to errors or defects in our products. A material liability claim or other occurrence that harms our reputation or decreases market acceptance of our products may harm our business and operating results. Limitation of liability provisions in our standard terms and conditions and our other agreements may not adequately or effectively protect us from any claims related to errors or defects in our solutions, including as a result of federal, state or local laws or ordinances or unfavorable judicial decisions in the United States or other countries.

Current wording

Our products may also contain undetected errors or defects. Errors or defects may be more likely when a product is first introduced or as new versions are released, or when we introduce an acquired company's products. We have experienced these errors or defects in the past in connection with new products, acquired products and product upgrades and we expect that these errors or defects will be found from time to time in the future in new, acquired or enhanced products after commercial release. Defects may cause our products to be vulnerable to attacks, cause them to fail to detect vulnerabilities or threats, or temporarily interrupt customers’ networking traffic. Any errors, defects, disruptions in service or other performance problems with our products may damage our customers’ businesses and could hurt our reputation. If our products or service offerings fail to detect vulnerabilities or threats for any reason, we may incur significant costs, the attention of our key personnel could be diverted, our customers may delay or withhold payment to us or elect not to renew or other significant customer relations problems may arise. We may also be subject to liability claims for damages related to errors or defects in our products. A material liability claim or other occurrence that harms our reputation or decreases market acceptance of our products may harm our business and operating results. Limitation of liability provisions in our standard terms and conditions and our other agreements may not adequately or effectively protect us from any claims related to errors or defects in our solutions, including as a result of federal, state or local laws or ordinances or unfavorable judicial decisions in the United States or other countries.

Previous wording

We utilize third-party data centers located in North America, Europe, Australia and Asia, in addition to operating and maintaining certain elements of our own network infrastructure. Some elements of our complex infrastructure are operated by third parties that we do not control and that could require significant time to replace. We expect this dependence on third parties to continue. More specifically, certain of our products, in particular our cloud-based products, are hosted on cloud providers, which provides us with computing and storage capacity. Interruptions in our systems or the third-party systems on which we rely, whether due to system failures, computer viruses, physical or electronic break-ins, or other factors, could affect the security or availability of our products, network infrastructure and website.

Current wording

We utilize third-party data centers located in North America, Europe, Australia and Asia, in addition to operating and maintaining certain elements of our own network infrastructure. Some elements of our complex infrastructure are operated by third parties that we do not control and that could require significant time to replace. We expect this dependence on third parties to continue. More specifically, certain of our products, in particular our cloud-based products, are hosted on cloud providers such as Amazon Web Services, which provides us with computing and storage capacity. Interruptions in our systems or the third-party systems on which we rely, whether due to system failures, computer viruses, physical or electronic break-ins, or other factors, could affect the security or availability of our products, network infrastructure and website.

Previous wording

Computer malware, ransomware, cyber viruses, social engineering (phishing attacks), supply-chain attacks, denial of service or other attacks, employee theft or misuse and increasingly sophisticated network attacks have become more prevalent in our industry, particularly against cloud services. In particular, ransomware attacks, including by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, loss of data and income, reputational harm, and diversion of funds. While extortion payments may alleviate the negative impact of a ransomware attack, we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Similarly, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our information technology systems (including our products) or the third-party information technology systems that support us and our services. Such attacks may also include exploitation of vulnerabilities in third-party or open source software code that may be incorporated into our own or our customers’ or supplier’s systems. Further, if our systems or those of our third-party service providers are breached as a result of third-party action, employee error or misconduct, attackers could learn critical information about how our products operate to help protect our customers’ IT infrastructures from cyber risk, thereby making our customers more vulnerable to cyber attacks. Additionally, the unauthorized use or misuse of AI by our employees or others may result in the release of customer data to unauthorized parties. While we maintain measures designed to protect the integrity, confidentiality and security of our data, our security measures could fail and those of our third-party service providers have failed and could fail, any of which could result in unauthorized access to or disclosure, modification, misuse, loss or destruction of such data or financial loss.

Current wording

Computer malware, ransomware, cyber viruses, social engineering (phishing attacks), supply-chain attacks, denial of service or other attacks, employee theft or misuse and increasingly sophisticated network attacks have become more prevalent in our industry, particularly against cloud services. In particular, ransomware attacks, including by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, loss of data and income, reputational harm, and diversion of funds. While extortion payments may alleviate the negative impact of a ransomware attack, we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Similarly, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our information technology systems (including our products) or the third-party information technology systems that support us and our services. Such attacks may also include exploitation of vulnerabilities in third party or open source software code that may be incorporated into our own or our customers’ or supplier’s systems. Further, if our systems or those of our third-party service providers are breached as a result of third-party action, employee error or misconduct, attackers could learn critical information about how our products operate to help protect our customers’ IT infrastructures from cyber risk, thereby making our customers more vulnerable to cyber attacks. While we maintain measures designed to protect the integrity, confidentiality and security of our data, our security measures could fail and those of our third-party service providers have failed and could fail, any of which could result in unauthorized access to or disclosure, modification, misuse, loss or destruction of such data or financial loss.

Previous wording

We, and our customers, are subject to a number of stringent and changing obligations in domestic and international laws, regulations, guidance, industry standards, external and internal policies and contracts and other obligations that address a range of issues including data privacy and cybersecurity, and restrictions or technological requirements regarding the collection, use, storage, protection, retention or transfer of data. The regulatory framework for online services, data privacy and cybersecurity issues worldwide can vary substantially from jurisdiction to jurisdiction, is rapidly evolving and is likely to remain uncertain for the foreseeable future. This creates some uncertainty as to the effective legal frameworks and our obligations may be subject to differing applications and interpretations, which may be inconsistent or in conflict among jurisdictions. Preparation for and compliance with these obligations require us to devote significant resources (including, without limitation, financial and time- related resources). These obligations may necessitate changes to our business including our information technologies, systems and practices and to those of any third parties that process personal data on our behalf. Although we strive to comply with all applicable data privacy and security obligations, we may at times fail (or be perceived to have failed) to do so. Moreover, despite our efforts, our personnel or third parties upon whom we rely may fail to comply with such obligations. If we (or third parties upon whom we rely) fail, or are perceived to have failed, to address and comply with data privacy and security obligations, we could face significant consequences. These consequences may include but are not limited to: government enforcement actions (e.g., investigations, fines, penalties, audits, inspections and similar consequences); litigation (including class-related claims); additional reporting requirements and oversight; bans on processing personal data; orders to destroy and not to use personal data; and imprisonment of company officials. Any of these events could have a material adverse effect on our reputation and our business, and financial condition, including but not limited to: loss of customers; interruptions or stoppages in our business or operations; inability to process personal data; inability to operate in specific jurisdictions; limitations in our ability to develop our products and service offerings; management's time and other resource expenditures; adverse publicity; and revisions to our operations.

Current wording

We, and our customers, are subject to a number of stringent and changing obligations in domestic and international laws, regulations, guidance, industry standards, external and internal policies and contracts and other obligations that address a range of issues including data privacy and cybersecurity, and restrictions or technological requirements regarding the collection, use, storage, protection, retention or transfer of data. The regulatory framework for online services, data privacy and cybersecurity issues worldwide can vary substantially from jurisdiction to jurisdiction, is rapidly evolving and is likely to remain uncertain for the foreseeable future. This creates some uncertainty as to the effective legal frameworks and our obligations may be subject to differing applications and interpretations, which may be inconsistent or in conflict among jurisdictions. Preparation for and compliance with these obligations requires us to devote significant resources (including, without limitation, financial and time-related resources). These obligations may necessitate changes to our business including our information technologies, systems and practices and to those of any third parties that process personal data on our behalf. Although we strive to comply with all applicable data privacy and security obligations, we may at times fail (or be perceived to have failed) to do so. Moreover, despite our efforts, our personnel or third parties upon whom we rely may fail to comply with such obligations. If we (or third parties upon whom we rely) fail, or are perceived to have failed, to address and comply with data privacy and security obligations, we could face significant consequences. These consequences may include but are not limited to: government enforcement actions (e.g., investigations, fines, penalties, audits, inspections and similar consequences); litigation (including class-related claims); additional reporting requirements and oversight; bans on processing personal data; orders to destroy and not to use personal data; and imprisonment of company officials. Any of these events could have a material adverse effect on our reputation and our business, and financial condition, including but not limited to: loss of customers; interruptions or stoppages in our business or operations; inability to process personal data; inability to operate in specific jurisdictions; limitations in our ability to develop our products and service offerings; management's time and other resource expenditures; adverse publicity; and revisions to our operations.

Previous wording

In addition, certain jurisdictions have enacted data localization laws and cross-border personal data transfer laws. For example, the European Data Protection Laws impose strict rules on the transfer of personal data from the EEA, the UK and Switzerland (collectively, “Europe”), to so-called third countries, including the United States, unless the parties to the transfer have implemented specific safeguards to protect the transferred personal data. Although there are legal mechanisms to allow for the transfer of personal data from Europe to the United States, uncertainty remains about compliance and such mechanisms may not be available or applicable with respect to our personal data processing activities. For example, the “Standard Contractual Clauses” (“SCCs”) that are designed to be a valid mechanism by which parties can transfer personal data out of Europe to jurisdictions that are not found to provide an adequate level of protection, must be assessed on a case-by-case basis, taking into account the legal regime applicable in the destination country. Specifically, the parties to the cross-border personal data transfer must evaluate the importing jurisdiction’s laws and implement supplemental security measures as necessary to protect the at-issue personal data. Additionally, in July 2023, the European Commission adopted an adequacy decision concluding that the United States ensures an adequate level of protection for personal data transferred from Europe under the EU-U.S. Data Privacy

Current wording

In addition, certain jurisdictions have enacted data localization laws and cross-border personal data transfer laws. For example, the European Data Protection Laws impose strict rules on the transfer of personal data from the EEA, the UK and Switzerland (collectively, “Europe”), to so-called third countries, including the United States, unless the parties to the transfer have implemented specific safeguards to protect the transferred personal data. Although there are legal mechanisms to allow for the transfer of personal data from Europe to the United States, uncertainty remains about compliance and such mechanisms may not be available or applicable with respect to our personal data processing activities. For example, the “Standard Contractual Clauses” (“SCCs”) that are designed to be a valid mechanism by which parties can transfer personal data out of Europe to jurisdictions that are not found to provide an adequate level of protection, must be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country. Specifically, the parties to the cross-border personal data transfer must evaluate the importing jurisdiction’s laws and implement supplemental security measures as necessary to protect the at-issue personal data. Additionally, in July 2023, the European Commission adopted an adequacy decision concluding that the United States ensures an adequate level of protection for personal data transferred from Europe under the EU-U.S. Data Privacy Framework (followed on October 2023 with the adoption of an adequacy decision in the UK for the UK-U.S. Data Bridge). However, such adequacy decisions do not foreclose, and are likely to face, future legal challenges, and it is likely that there will continue to be some uncertainty regarding the mechanisms by which parties transfer personal data out of Europe to jurisdictions such as the United States. If we cannot implement and maintain a valid mechanism for cross-border personal data transfers, we may face increased exposure to regulatory actions, substantial fines and injunctions against processing (including prohibitions on transferring personal data out of the EU and UK). This may also reduce demand for our services from companies subject to