Pure Storage Inc

Previous wording

•We expect sales of our Evergreen//One and Evergreen//Flex subscription and consumption offerings will continue to grow and represent a larger percentage of our total sales. With a traditional CapEx sale, a large portion of revenue is recognized as product revenue as the order is fulfilled. Revenue for our Evergreen//One and Evergreen//Flex offerings is recognized over a period of time, and the majority of revenue is included in subscription services revenue. As such, we expect the sales growth of our Evergreen//One and Evergreen//Flex offerings to have a near-term downward impact on both product and total revenue growth.

Current wording

•We expect sales of our Evergreen//One, Evergreen//Flex and Cloud Block Store subscription and consumption offerings will continue to grow and represent a larger percentage of our total sales. With a traditional CapEx sale, a large portion of revenue is recognized as product revenue as the order is fulfilled. Revenue for our subscription and consumption offerings is recognized over a period of time, and the majority of revenue is included in subscription services revenue. As such, we expect the sales growth of our Evergreen//One, Evergreen//Flexand Cloud Block Store offerings to have a near-term downward impact on both product and total revenue growth.

Previous wording

Our sales efforts involve educating our customers about the use and benefits of our data storage platform (Platform) and often involves an evaluation process that can result in a lengthy sales cycle, particularly for larger customers and especially in an economic slowdown. We spend substantial time and resources on our sales efforts without any assurance that our efforts will produce any sales. In addition, purchases are frequently subject to our customers' budget constraints, multiple approvals and unplanned administrative and other delays. Some of our customers make large concentrated purchases to complete or upgrade specific data storage deployments. As a result, our revenue and operating results have and may continue to fluctuate from quarter to quarter. A substantial portion of our quarterly sales typically occurs during the last several weeks of the quarter, which we believe largely reflects customer buying patterns of products similar to ours and other technology products generally.

Current wording

Our sales efforts involve educating our customers about the use and benefits of our data storage platform (Platform) and often involves an evaluation process that can result in a lengthy sales cycle, particularly for larger customers and especially in an economic slowdown. We spend substantial time and resources on our sales efforts without any assurance that our efforts will produce any sales. In addition, purchases are frequently subject to our customers' budget constraints, multiple approvals and unplanned administrative and other delays. These factors can lead to unpredictable and extended closing times of sales to our customers. For example, in the first half of fiscal 2025, we experienced extended closing times for larger Evergreen//One opportunities. Some of our customers make large concentrated purchases to complete or upgrade specific data storage deployments. A substantial portion of our quarterly sales typically occurs during the last several weeks of the quarter, which we believe largely reflects customer buying patterns of products similar to ours and other technology products generally. As a result, our revenue and operating results have and may continue to fluctuate from quarter to quarter.

Previous wording

Our ability to successfully market and sell our Platform is dependent in part on ease of use and the quality of our customer experience, and any failure to offer high-quality technical services and support could harm our business.

Current wording

Our ability to successfully market and sell our Platform depends in part on ease of use and the quality of our customer experience, and any failure to offer high-quality technical services and support could harm our business.

Previous wording

Once our customers, deploy our Platform, they depend on our customer experience organization to drive non-disruptive upgrades and resolve technical issues. Our ability to provide effective technical services is largely dependent on our ability to attract, train and retain qualified personnel, as well as to engage with qualified support partners that provide a similar level of customer support. In addition, our sales process is highly dependent on our reputation and on recommendations from our existing customers. We may need to provide customized installation and configuration services to our customers before our Platform is fully operational in their environments. Any failure to maintain, or a market perception that we do not maintain, high-quality technical services and support could harm our reputation, our ability to sell our Platform to existing and prospective customers and our business.

Current wording

Once our customers deploy our Platform, they depend on our customer experience organization to drive non-disruptive upgrades and resolve technical issues. Our ability to provide effective technical services largely depends on our ability to attract, train and retain qualified personnel, as well as engage with qualified support partners that provide a similar level of customer support. In addition, our sales process is highly dependent on our reputation and on recommendations from our existing customers. We may need to provide customized installation and configuration services to our customers before our Platform is fully operational in their environments. Any failure to maintain, or a market perception that we do not maintain, high-quality technical services and support could harm our reputation, our ability to sell our Platform to existing and prospective customers and our business.

Previous wording

We expect that sales from our Evergreen//One and Evergreen//Flex subscription and consumption offerings will increase as a percentage of our total sales over time and will have a near-term downward impact on both product and total revenue growth.

Current wording

We expect that sales from our Evergreen//One, Evergreen//Flex and Cloud Block Store subscription and consumption offerings will increase as a percentage of our total sales over time and will have a near-term downward impact on both product and total revenue growth.

Previous wording

Our sales from our Evergreen//One and Evergreen//Flex subscription and consumption offerings have been increasing as a percentage of total sales, and we expect this trend to continue. With a traditional CapEx sale, a large portion of revenue is recognized as product revenue when the order is fulfilled. By contrast, revenue for our Evergreen//One and Evergreen//Flex subscription and consumption offerings is recognized over the term of the relevant contract period and the majority of revenue is included in subscription services revenue. As sales from our our Evergreen//One and Evergreen//Flex subscription and consumption offerings grow it may negatively impact both quarter-over-quarter and year-over-year product and total revenue growth rate comparisons.

Current wording

Our sales from our Evergreen//One, Evergreen//Flex and Cloud Block Store subscription and consumption offerings have been increasing as a percentage of total sales, and we expect this trend to continue. With a traditional CapEx sale, a large portion of revenue is recognized as product revenue when the order is fulfilled. By contrast, revenue for our Evergreen//One, Evergreen//Flex and Cloud Block Store subscription and consumption offerings is recognized over the term of the relevant contract period and the majority of revenue is included in subscription services revenue. As sales from our our subscription and consumption offerings grow it may negatively impact both quarter-over-quarter and year-over-year product and total revenue growth rate comparisons.

Previous wording

In the ordinary course of our business, we collect, store, transmit and otherwise process proprietary, confidential and sensitive data, including by using our internal systems, networks and servers, which may include intellectual property, our proprietary business information and that of our customers, suppliers and business partners and sales data, which may, on occasion, include personally identifiable information. Additionally, we design and sell products that allow our customers to store their data. The security of our own networks and the intrusion protection features of our products are both critical to our operations and business strategy.

Current wording

In the ordinary course of our business, we collect, store, transmit and otherwise process proprietary, confidential and sensitive data, including by using our internal systems, networks and servers, which may include intellectual property, our proprietary business information and that of our customers, suppliers and business partners and sales data, which may, on occasion, include personally identifiable information. Additionally, we design and sell products that allow our customers to store their data. We also rely on third-party service providers and technologies to operate our business and elements of our infrastructure. The security of our networks and those of our third-party service providers, and the intrusion protection features of our products are critical to our operations and business strategy.

Previous wording

Cyberattacks, malicious internet-based activity and online and offline fraud are prevalent and continue to increase. We have been, and may in the future be, subject to attempts to gain unauthorized access to our systems. For example, in June 2024, we were the subject of a security incident involving a third party that temporarily gained unauthorized access to a single Snowflake data analytics workspace. The workspace did not include compromising information such as passwords for customer systems, or any of the data that is stored on the customer systems, but did contain telemetry information that we use to provide proactive customer support services. The threats to information systems and information may include traditional computer “hackers,” social engineering schemes (for example, attempts to induce fraudulent invoice payments or divert money from us), software bugs, malicious code (such as viruses and worms), personnel misconduct or error, faulty password management, theft, denial-of-service attacks (such as credential stuffing), advanced persistent threat intrusions, as well as attacks from nation-state and nation-state supported actors. These threats are also becoming increasingly more difficult to detect. We may also be the subject of phishing attacks, malware installation, server malfunction, software or hardware failures, loss of data or other computer assets, adware and other similar issues. AI technologies may also be used in connection with certain attacks, resulting in heightened risks of security breaches and incidents. Additionally, ransomware attacks, including those from organized criminal threat actors, nation-states and nation-state supported actors, are becoming increasingly prevalent and severe and could lead to significant interruptions, delays, or outages in our operations, disruptions in our services, loss of data, loss of income, significant extra expense to restore data or systems, reputational loss and the diversion of funds. To alleviate the financial, operational and reputational impact of a ransomware attack, it may be preferable to make extortion payments, but we may be unwilling or unable to do so (including, for example, if applicable laws or regulations prohibit such payments). Similarly, supply chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our platform, systems and network or the systems and networks of third parties that support us and our business.

Current wording

Cyberattacks, malicious internet-based activity and online and offline fraud are prevalent and continue to increase. We have been, and may in the future be, subject to attempts to gain unauthorized access to our systems. For example, in June 2024, we were the subject of a security incident involving a third party that temporarily gained unauthorized access to a single Snowflake data analytics workspace. The workspace did not include compromising information such as passwords for customer systems, or any of the data that is stored on the customer systems, but did contain telemetry information that we use to provide proactive customer support services. The threats to information systems and information may include traditional computer “hackers,” social engineering schemes (for example, attempts to induce fraudulent invoice payments or divert money from us), software bugs, malicious code (such as viruses and worms), personnel misconduct or error, faulty password management, theft, denial-of-service attacks (such as credential stuffing), advanced persistent threat intrusions, as well as attacks from nation-state and nation-state supported actors. These threats are also becoming increasingly more difficult to detect. We may also be the subject of phishing attacks, malware installation, server malfunction, software or hardware failures, loss of data or other computer assets, adware and other similar issues. AI technologies may also be used in connection with certain attacks, resulting in heightened risks of security breaches and incidents. Additionally, ransomware attacks, including those from organized criminal threat actors, nation-states and nation-state supported actors, are becoming increasingly prevalent and severe and could lead to significant interruptions, delays, or outages in our operations, disruptions in our services, loss of data, loss of income, significant extra expense to restore data or systems, reputational loss and the diversion of funds. To alleviate the financial, operational and reputational impact of a ransomware attack, it may be preferable to make extortion payments, but we may be unwilling or unable to do so (including, for example, if applicable laws or regulations prohibit such payments). Similarly, supply chain attacks have increased in frequency and severity, and there have been high-profile incidents of third-party service providers causing widespread disruptions to their customers' infrastructure due to errors in their SaaS offerings. We cannot guarantee that third parties and infrastructure in our supply chain have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our Platform, systems and network or the systems and networks of third parties that support us and our business. Moreover, we may have limited remedies against third-party providers in the event of a service disruption.

Previous wording

We devote significant resources to network security, authentication technologies, data encryption and other security measures designed to protect our systems and data, including to secure the transmission and storage of data and prevent third-party access to our data or accounts, but there can be no assurance that our security measures or those of our service providers, partners and other third parties upon whom we rely will be effective in protecting against a security incident or the materially adverse impacts that may arise from a security incident. Any destructive or intrusive breach of our internal systems could result in the information stored on our networks, including, without limitation, source code for our products and services or the networks and systems of third parties upon whom we rely being accessed, publicly disclosed, lost or stolen.

Current wording

We devote significant resources to network security, authentication technologies, data encryption and other security measures designed to protect our systems and data, including to secure the transmission and storage of data and prevent third-party access to our data or accounts, but there can be no assurance that our security measures or those of our service providers, partners and other third parties upon whom we rely will be effective in protecting against a security incident or the material adverse impacts that may arise from a security incident. Any destructive or intrusive breach of our internal systems could result in the information stored on our networks, including, without limitation, source code for our products and services or the networks and systems of third parties upon whom we rely being accessed, publicly disclosed, lost or stolen.

Previous wording

Additionally, an effective attack on our products could disrupt the proper functioning of our products, allow unauthorized access to sensitive, proprietary or confidential information of ours or our customers, disrupt or temporarily interrupt our and our customers’ operations or cause other destructive outcomes, including the theft of information sufficient to engage in fraudulent transactions.

Current wording

Additionally, an effective attack on our Platform could disrupt the proper functioning of our Platform, allow unauthorized access to sensitive, proprietary or confidential information of ours or our customers, disrupt or temporarily interrupt our and our customers’ operations or cause other destructive outcomes, including the theft of information sufficient to engage in fraudulent transactions.

Previous wording

The risk that these types of events could seriously harm our business is likely to increase as we expand our network of channel partners, resellers and authorized service providers and operate in more countries. The economic costs to us to eliminate or alleviate cybersecurity risks and vulnerabilities could be significant and may be difficult to anticipate or measure because the damage may differ based on the identity and motive of the programmer or hacker, which are often difficult to identify. If any of these types of security incidents occurs and we are unable to protect our products, systems and data, or if we are perceived to have such a security incident, our relationships with our business partners and customers could be materially damaged, our reputation and brand could be materially harmed, use of our products could decrease and we could be exposed to a risk of loss or litigation, including, without limitation, class action litigation, and other possible liabilities. A security incident could also result in government enforcement actions that could include investigations, fines, penalties, audits and inspections, additional reporting requirements and/or oversight, temporary or permanent bans on all or some processing of personal information.

Current wording

The risk that these types of events could seriously harm our business is likely to increase as we expand our network of channel partners, resellers and authorized service providers and operate in more countries. The economic costs to us to eliminate or alleviate cybersecurity risks and vulnerabilities could be significant and may be difficult to anticipate or measure because the damage may differ based on the identity and motive of the programmer or hacker, which are often difficult to identify. If any of these types of security incidents occurs and we are unable to protect our Platform, systems and data, or if we are perceived to have such a security incident, our relationships with our business partners and customers could be materially damaged, our reputation and brand could be materially harmed, use of our Platform could decrease and we could be exposed to a risk of loss or litigation, including, without limitation, class action litigation, and other possible liabilities. A security incident could also result in government enforcement actions that could include investigations, fines, penalties, audits and inspections, additional reporting requirements and/or oversight, temporary or permanent bans on all or some processing of personal information.

Previous wording

Moreover, applicable data protection laws, contracts, policies and other data protection obligations may require us to notify relevant stakeholders of security incidents, including affected individuals, customers, regulators, and credit reporting agencies. Such disclosures are costly and the disclosures or the failure to comply with such requirements could lead to material adverse impacts such as negative publicity, loss of customer confidence in our services our security measures, investigations and private or government claims. Security incidents that impact our information technology systems could also result in breaches of our contracts (some of which may not have liability limitations and/or require us to indemnify affected parties) and could lead to litigation with customers, partners or other relevant stakeholders. These proceedings could force us to spend money in defense or settlement, divert management’s time and attention, increase our costs of doing business and adversely affect our reputation or otherwise adversely affect our business.

Current wording

Moreover, applicable data protection laws, contracts, policies and other data protection obligations may require us to notify relevant stakeholders of security incidents, including affected individuals, customers, regulators, and credit reporting agencies. Such disclosures are costly and the disclosures or the failure to comply with such requirements could lead to material adverse impacts such as negative publicity, loss of customer confidence in our services or security measures, investigations and private or government claims. Security incidents that impact our information technology systems could also result in breaches of our contracts (some of which may not have liability limitations and/or require us to indemnify affected parties) and could lead to litigation with customers, partners or other relevant stakeholders. These proceedings could force us to spend money in defense or settlement, divert management’s time and attention, increase our costs of doing business and adversely affect our reputation or otherwise adversely affect our business.

Previous wording

Changes in applicable laws, regulations and standards could harm our business, operating results and financial condition. For example, in recent years we became subject to the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). Additionally, the California Privacy Rights Act (CPRA), which modifies the CCPA, became fully effective as of January 1, 2023. Other states have proposed, and in certain cases enacted, similar laws. These and potentially other future privacy regulations may require us to make further changes to our policies and procedures beyond what we have already done. Our business could be impacted, to some extent, by the United Kingdom's exit from the European Union and related changes in law and regulation. We have modified our data protection compliance program in response to data privacy regulations and will continue to monitor the implementation and evolution of global data protection regulations, but if we are not compliant with such privacy regulations, we may be subject to significant fines and our business may be harmed. The potential effects of new or modified privacy laws may be far-reaching and require us to modify our data processing practices and policies and to incur substantial costs and expenses. Customers may choose to implement technological solutions to comply with such laws that impact the performance and competitiveness of our Platform. Even the perception of privacy concerns, whether or not valid, may harm our reputation and inhibit competitiveness and adoption of our Platform by current and future customers.

Current wording

Changes in applicable laws, regulations and standards could harm our business, operating results and financial condition. For example, in recent years we have become subject to data privacy laws, including the EU General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and California Privacy Rights Act (CPRA). Other states have proposed, and in certain cases enacted, similar laws. These and potentially other future privacy regulations may require us to make further changes to our policies and procedures beyond what we have already done. Our business could be impacted, to some extent, by the United Kingdom's exit from the European Union and related changes in law and regulation. We have modified our data protection compliance program in response to data privacy regulations and will continue to monitor the implementation and evolution of global data protection regulations, but if we are not compliant with such privacy regulations, we may be subject to significant fines and our business may be harmed. The potential effects of new or modified privacy laws may be far-reaching and require us to modify our data processing practices and policies and to incur substantial costs and expenses. Customers may choose to implement technological solutions to comply with such laws that impact the performance and competitiveness of our Platform. Even the perception of privacy concerns, whether or not valid, may harm our reputation and inhibit competitiveness and adoption of our Platform by current and future customers.

Previous wording

The trading price of our common stock has been, and will likely continue to be, highly volatile. Since shares of our common stock were sold in our initial public offering in October 2015 at a price of $17.00 per share, our closing stock price has ranged from $8.76 to $63.48, through June 5, 2024. Some of the factors, many of which are beyond our control, affecting our volatility may include:

Current wording

The trading price of our common stock has been, and will likely continue to be, highly volatile. Since shares of our common stock were sold in our initial public offering in October 2015 at a price of $17.00 per share, our closing stock price has ranged from $8.76 to $68.35, through September 4, 2024. Some of the factors, many of which are beyond our control, affecting our volatility may include:

Previous wording

The following table summarizes the shares of restricted common stock that were delivered by certain employees upon vesting of equity awards to satisfy tax withholding requirements during the first quarter of fiscal 2025 (in thousands except for price per share):

Current wording

The following table summarizes the shares of restricted common stock that were delivered by certain employees upon vesting of equity awards to satisfy tax withholding requirements during the second quarter of fiscal 2025 (in thousands except for price per share):

Previous wording

During the first quarter of fiscal 2025, other than Messrs. Colgrove and FitzSimons, none of our directors or executive officers, as defined in Rule 16a-1(f), adopted, modified orterminated a “Rule 10b5-1 trading arrangement” or a “non-Rule 10b5-1 trading arrangement,” each as defined in Regulation S-K Item 408.

Current wording

During the second quarter of fiscal 2025, no director or officer, as defined in Rule 16a-1(f), adopted orterminated a “Rule 10b5-1 trading arrangement” or a “non-Rule 10b5-1 trading arrangement,” each as defined in Regulation S-K Item 408.