PROCORE TECHNOLOGIES, INC.

Previous wording

We have experienced rapid growth in prior periods. Our revenue was $1,151.7 million in 2024, $950.0 million in 2023, and $720.2 million in 2022. Our results of operations may fluctuate significantly, which could make our future results difficult to predict and could cause our results of operations to fall below expectations. You should not rely on the revenue growth of any prior period as an indication of our future performance. While our revenue has continued to increase, our revenue growth rate has declined and may continue to decline in the future as a result of a variety of factors, including our ability to effectively manage our growth and investments (including through the evolution of our GTM operating model), macroeconomic conditions, and the maturation of our business. Our overall revenue growth and results of operations depend on a number of factors, including many that are out of our control. These factors include our ability to do the following: attract new customers and retain and expand sales of subscriptions to our existing customers; increase sales to owners and specialty contractors, as well as monetize new stakeholders; develop new products and services, further improve our existing products, services, and platform, and expand our App Marketplace with additional integrations; provide our customers and collaborators with support that meets their needs; invest financial and operational resources to support future growth in our customer, collaborator, and third-party relationships; expand our operations domestically and internationally; and retain and motivate existing personnel, and attract, integrate, and retain new personnel, particularly with respect to our sales and marketing and engineering and product development teams.

Current wording

We have experienced rapid growth in prior periods. Our revenue was $1.3 billion in 2025, $1.2 billion in 2024, and $1.0 billion in 2023. Our results of operations may fluctuate significantly, which could make our future results difficult to predict and could cause our results of operations to fall below expectations. You should not rely on the revenue growth of any prior period as an indication of our future performance. While our revenue has continued to increase, our revenue growth rate has declined and may continue to decline in the future as a result of a variety of factors, including our ability to effectively manage our growth and investments (including through our evolved GTM operating model), macroeconomic conditions, and the maturation of our business. Our overall revenue growth and results of operations depend on a number of factors, including many that are out of our control. These factors include our ability to do the following: attract new customers and retain and expand sales of subscriptions to our existing customers; increase sales to owners and specialty contractors, as well as monetize new stakeholders; develop new products and services, further improve our existing products, services, and platform, and evolve our App Marketplace with new offerings and purpose-built APIs; provide our customers and collaborators with support that meets their needs; invest financial and operational resources to support future growth in our customer, collaborator, and third-party relationships; expand our operations domestically and internationally; and retain and motivate existing personnel, and attract, integrate, and retain new personnel, particularly with respect to our sales and marketing and engineering and product development teams.

Previous wording

We have a history of losses, and we may not achieve or maintain profitability in the future. We incurred net losses of $106.0 million in 2024, $189.7 million in 2023, and $286.9 million in 2022. As of December 31, 2024, we had an accumulated deficit of $1.2 billion. We are not certain whether or when we will be able to achieve or sustain profitability in the future. We also expect our expenses to increase in future periods as we continue to invest in growth, which could negatively affect our future results of operations if our revenue does not correspondingly increase. In particular, we intend to continue to expend substantial financial and other resources on the following: expanding our sales and marketing and customer success teams, including as part of evolving our GTM operating model, to drive new subscriptions, increase the use of our products, services, and platform by existing customers, and support our international growth; developing our technology infrastructure, including systems architecture, scalability, availability, performance, and data security and privacy; investing in our engineering and product development teams and developing new products, services, and platform functionality; and pursuing strategic acquisition and investment opportunities.

Current wording

We have a history of losses, and we may not achieve or maintain profitability in the future. We incurred net losses of $100.8 million in 2025, $106.0 million in 2024, and $189.7 million in 2023. As of December 31, 2025, we had an accumulated deficit of $1.3 billion. We are not certain whether or when we will be able to achieve or sustain profitability in the future. We also expect our expenses to increase in future periods as we continue to invest in growth, which could negatively affect our future results of operations if our revenue does not correspondingly increase. In particular, we intend to continue to expend substantial financial and other resources on the following: expanding our sales and marketing and customer success teams to drive new subscriptions, increase the use of our products, services, and platform by existing customers, and support our international growth; developing our technology infrastructure, including systems architecture, scalability, availability, performance, and data security and privacy; investing in our engineering and product development teams and developing new products, services, and platform functionality; and pursuing strategic acquisition and investment opportunities.

Previous wording

Demand for construction management software in general, and for our products, services, and platform in particular, is affected by a number of factors, some of which are beyond our control. Some of these factors include: general awareness of construction management software; availability, functionality, and pricing and packaging of products and services that compete with ours; ease of adoption and use; the reliability, performance, or perceived performance of our products and platform, including interruptions to the use of our products and platform; and the development and awareness of our brand. Even though we use internal data to assess the likelihood of success of introducing new products and services or changes to existing products and services, we may incorrectly calculate such risks or assume undue risks with respect to such products. Competitors may also develop and introduce new products or entirely new technologies to replace our existing products, including through the use of AI, which could make our platform obsolete or otherwise adversely affect our business. If our investments in engineering and product development do not accurately anticipate user demand or if we fail to develop our products, features, or capabilities in a manner that satisfies customer needs in a timely and cost-effective manner, we may fail to retain our existing customers or increase demand for our products, which could materially adversely affect our business, financial condition, results of operations, and prospects.

Current wording

Demand for construction management software in general, and for our products, services, and platform in particular, is affected by a number of factors, some of which are beyond our control. Some of these factors include: general awareness of construction management software; availability, functionality, and pricing and packaging of products and services that compete with ours; ease of adoption and use; the reliability, performance, or perceived performance of our products and platform, including interruptions to the use of our products and platform; the development and awareness of our brand; and how we sell our products, services, and platform. Even though we use internal data to assess the likelihood of success of introducing new products, services, pricing, and packaging or changes to existing products, services, pricing, and packaging, we may incorrectly calculate such risks or assume undue risks with respect to such products, services, pricing, and packaging. Competitors may also develop and introduce new products or entirely new technologies to replace our existing products, including through the use of AI, which could make our platform and products obsolete or otherwise materially adversely affect our business, financial condition, results of operations, and prospects. If our investments in engineering and product development do not accurately anticipate user demand or if we fail to develop products, features, or capabilities in a manner that satisfies customer needs in a timely and cost-effective manner, we may fail to retain our existing customers or increase demand for our products, which could materially adversely affect our business, financial condition, results of operations, and prospects.

Previous wording

Furthermore, our ability to grow our customer base and retain and increase revenue from customers depends on our ability to enhance and improve our products, services, and platform in response to changes in the construction management software industry and customer demand. In response to such shifts, we may introduce changes to our existing products and services or introduce new products and services, which may require significant expenditures in research and development and customer support, which may harm our results of operations. While we have designed our existing products for easy adoption, our customers depend on our customer success teams to provide implementation, training, and support services, especially when it comes to new products and features. If we do not provide effective ongoing support, our ability to sell additional products to existing and prospective customers could be adversely affected. As part of the evolution of our GTM operating model, we are introducing new technical roles to help our customers realize the full value of our platform and thereby create deeper relationships with our customers. If these investments do not result in increased revenue from both new and existing customers, our business, financial condition, results of operations, and prospects could be materially adversely affected.

Current wording

Furthermore, our ability to grow our customer base and retain and increase revenue from customers depends on our ability to enhance and improve our products, services, and platform in response to changes in the construction management software industry and customer demand. In response to such shifts, we may introduce changes to our existing products and services or introduce new products and services, which may require significant expenditures in research and development and customer support, which may harm our results of operations. While we have designed our existing products for easy adoption, our customers depend on our customer success teams to provide implementation, training, and support services, especially when it comes to new products and features. If we do not provide effective ongoing support, our ability to sell additional products to existing and prospective customers could be adversely affected.

Previous wording

Additionally, we may experience difficulties with software development, design, or marketing that could delay or prevent our development, introduction, or implementation of new products, features, or capabilities. We have in the past experienced delays in our internally planned release dates of new products, features, and capabilities, and there can be no assurance that new products, features, or capabilities will be released according to schedule. Any delays could result in adverse publicity, loss of revenue or market acceptance, or claims by customers brought against us, all of which could harm our business.

Current wording

Additionally, we may experience difficulties with software development, design, or marketing that could delay or prevent our development, introduction, or implementation of new products, features, or capabilities. We have in the past experienced delays in our internally planned release dates of new products, features, and capabilities, and there can be no assurance that new products, features, or capabilities will be released according to schedule. Any delays could result in adverse publicity, loss of revenue or market acceptance, or claims by customers brought against us, all of which could materially adversely affect our business, financial condition, results of operations, and prospects.

Previous wording

Our business depends on a strong brand, and if we are not able to maintain and enhance our brand, our ability to retain and expand our customer base, attract investors, and recruit and retain qualified personnel may be impaired, and our business may be harmed.

Current wording

Our business depends on a strong brand, and if we are not able to maintain and enhance our brand, our ability to retain and expand our customer base, attract investors, and recruit and retain qualified personnel may be impaired, and our business, financial conditions, results of operations, and prospects could be materially adversely affected.

Previous wording

In July 2024, we began to evolve our GTM operating model by, among other things, transitioning to a general manager model. As a part of this process, we are hiring new product and technical specialists into our GTM teams. While we believe this transition will result in a more effective GTM organization, we have seen and may continue to see some disruptions and adverse impacts to our financial and operating results in the near-term as we invest in and implement the evolved GTM operating model. If we fail to successfully implement the evolved GTM operating model, our ability to serve our customers and effectively address their concerns will be adversely impacted, which may result in unfavorable publicity or a negative perception of our products, services, or platform. Any unfavorable publicity or negative perception of our products, services, or platform or the providers of construction management software generally, could adversely affect our reputation and our ability to attract and retain customers. If we fail to promote and maintain our brand, or if we incur increased expenses in this effort, our business, financial condition, results of operations, and prospects could be materially adversely affected.

Current wording

Any unfavorable publicity or negative perception of our products, services, or platform or the providers of construction management software generally, could adversely affect our reputation and our ability to attract and retain customers. If we fail to promote and maintain our brand, or if we incur increased expenses in this effort, our business, financial condition, results of operations, and prospects could be materially adversely affected.

Previous wording

Our ability to increase our customer base, expand existing customers' use of our platform, and achieve broader market acceptance of our products, services, and platform will significantly depend on our ability to develop and expand our sales and marketing capabilities, including through the evolution of our GTM operating model. Any failure to do so could materially adversely affect our business, financial condition, results of operations, and prospects.

Current wording

Our ability to increase our customer base, expand existing customers’ use of our platform, and achieve broader market acceptance of our products, services, and platform will significantly depend on our ability to develop and expand our sales and marketing capabilities. Any failure to do so could materially adversely affect our business, financial condition, results of operations, and prospects.

Previous wording

Continuing and increasing sales of our products and services depends to a significant extent on our ability to expand our sales and marketing capabilities, including through the evolution of our GTM operating model. It is difficult to predict customer demand, customer retention, and expansion rates, the size and growth rate of the market, the entry of competitive products and services, or the success of existing competitive products and services. Our sales efforts involve educating prospective customers about the uses and benefits of our products, services, and platform. We spend substantial time and resources on our sales efforts without any assurance that our efforts will result in a sale. We expect that we will continue to need intensive sales efforts to educate prospective customers about the uses and benefits of our construction management software and services, and we may have difficulty convincing prospective customers of the value of adopting our products and services. We plan to continue expanding our sales force, both domestically and internationally. Identifying, recruiting, and training qualified sales representatives is time-consuming and resource-intensive, and they may not be fully trained and productive for a significant amount of time following their hiring, if ever. In addition, the cost to acquire customers is high due to these considerable sales and marketing efforts. Our business will be harmed if our efforts do not generate a corresponding increase in revenue. Even if we are successful in convincing prospective customers of the value of our products and services, they may decide not to purchase our products and services for a variety of reasons, some of which are out of our control. The failure of our efforts to secure sales after investing resources in a lengthy sales process could materially adversely affect our business, financial condition, results of operations, and prospects.

Current wording

Continuing and increasing sales of our products and services depends to a significant extent on our ability to expand our sales and marketing capabilities. It is difficult to predict customer demand, customer retention, and expansion rates, the size and growth rate of the market, the entry of competitive products and services, or the success of existing competitive products and services. Our sales and marketing efforts involve educating prospective customers about the uses and benefits of our products, services, and platform. We spend substantial time and resources on our sales and marketing efforts without any assurance that our efforts will result in a sale. We expect that we will continue to need intensive sales and marketing efforts to educate prospective customers about the uses and benefits of our construction management software and services, and we may have difficulty convincing prospective customers of the value of adopting our products and services. We plan to continue expanding our sales force, both domestically and internationally. Identifying, recruiting, and training qualified sales representatives is time-consuming and resource-intensive, and they may not be fully trained and productive for a significant amount of time following their hiring, if ever. In addition, the cost to acquire customers is high due to these considerable sales and marketing efforts. Our business will be harmed if our efforts do not generate a corresponding increase in revenue. Even if we are successful in convincing prospective customers of the value of our products and services, they may decide not to purchase our products and services for a variety of reasons, some of which are out of our control. The failure of our efforts to secure sales after investing resources in a lengthy sales process could materially adversely affect our business, financial condition, results of operations, and prospects.

Previous wording

We have experienced, and may continue to experience, headwinds with respect to our sales productivity. These headwinds have resulted in a decline in revenue growth and current remaining performance obligations (“cRPO”) growth. In July 2024, we began to evolve our GTM operating model, by, among other things, transitioning to a general manager model, in order to deepen customer relationships and improve our operating efficiency by building nimble customer-focused teams under empowered general managers. We have experienced, and may continue to experience, disruptions and adverse impacts to our financial and operating results in the near-term as we continue to invest in and implement our evolved GTM operating model. It is difficult to predict whether these changes will achieve their desired effects, and there is no guarantee we will achieve the growth or operational improvements and efficiencies that we are anticipating as a result of our GTM operating model evolution. Further, even if we do achieve such growth or efficiencies, there is no guarantee that we will be able to continue to increase productivity under the evolved GTM operating model once it is in place. Implementing any operating model change presents additional potential risks including, among others, customer and partner confusion as their account teams are updated, diversion of management’s attention from core ongoing business activities, and failure to onboard and ramp new hires efficiently or at all. If we are unable to manage the resulting short-term adverse impacts to our business, fail to successfully implement, or realize the full benefits of, our evolved GTM operating model over the long term, or otherwise fail to acquire new customers, retain existing customers, or expand existing customers’ use of our products, services, and platform, our business, financial condition, results of operations, and prospects could be materially adversely affected.

Current wording

In July 2024, we began to evolve our GTM operating model, by, among other things, transitioning to a general manager model, in order to deepen customer relationships and improve our operating efficiency by building nimble, customer-focused teams under empowered general managers. If we fail to realize the full benefits of our evolved GTM operating model over the long term or otherwise fail to acquire new customers, retain existing customers, or expand existing customers’ use of our products, services, and platform, our business, financial condition, results of operations, and prospects could be materially adversely affected.

Previous wording

In certain limited applications or situations, we use AI (including generative AI) in our products, services, and business operations. AI presents risks, challenges, and unintended consequences that could affect our business operations and our customers’ adoption and use of our products. Moreover, AI models may create flawed, incomplete, or inaccurate outputs, some of which may appear to be correct. This may happen if the inputs that an AI model relied on were inaccurate, incomplete, or flawed (including if a bad actor “poisons” an AI model with bad inputs or logic), or if the logic of the AI model is flawed (a so-called “hallucination”). We, our customers, or other third parties may rely on or use such outputs to our or their detriment, or it may lead to adverse outcomes, which may negatively impact our ability to attract and retain customers and expose us to brand or reputational harm, competitive harm, and/or legal liability.

Current wording

AI models may create flawed, inaccurate, or incomplete outputs, some of which may appear to be correct. This may happen if the inputs that an AI model relied on were flawed, inaccurate, incomplete (including if a bad actor “poisons” an AI model with bad inputs or logic), or if the logic of the AI model is flawed (a so-called hallucination). We, our customers or partners, or other third parties may use or rely on such outputs to our or their detriment, or such outputs may lead to adverse outcomes, including delays and errors, any of which may negatively impact our ability to attract and retain customers and to expand the use of our products, services, and platform, and expose us to brand or reputational harm, competitive risk, and legal liability. Social or ethical concerns about the use of AI, such as the risk of AI models creating discriminatory outcomes using biased information, may also hinder the use and adoption of AI by our customers, partners, and employees. As we expand the use of AI in our own business operations, there is a risk that we will experience such outcomes, which would harm our business and reputation.

Previous wording

Several jurisdictions around the globe, including Europe and certain U.S. states, have proposed, enacted, or are considering laws governing AI, including the EU’s AI Act, and we expect other jurisdictions will adopt similar laws. Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal data) and regulate automated decision-making, which may complicate our use of AI, lead to regulatory fines or penalties, be incompatible with our use of AI, require us to change our business practices, retrain our AI, or prevent our use of AI. For example, the Federal Trade Commission has required other companies to turn over or disgorge valuable insights or trainings generated through the use of AI where they allege the company has violated privacy and consumer protection laws. Our use of this technology could also result in additional compliance costs, regulatory investigations and actions, and consumer lawsuits.

Current wording

The legal and regulatory landscape surrounding AI is rapidly evolving and uncertain. Several jurisdictions around the world, as well as several states and localities, have proposed, enacted, or are considering laws governing AI, including the European Union’s (“EU”) AI Act and the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the “CCPA”) regulations on automated decision-making technology, and we expect that lawmakers and regulators will continue to maintain a heightened focus on AI and promulgate new legislation and regulations, which could impact our business and our actual or planned use of AI. Laws and regulations governing AI may apply in new, unpredictable ways, and differences in how jurisdictions choose to address issues related to AI may require us to navigate a complex web of different obligations. For example, the EU’s AI Act sets out a risk-based framework, subjecting certain AI technologies to numerous compliance obligations, including transparency, conformity, risk assessment, monitoring, and human oversight requirements. Under the EU’s AI Act, non-compliant companies may be subject to administrative fines of up to 35 million euros or 7% of such company’s total worldwide annual revenue for the preceding financial year, whichever is greater. We are subject to the EU’s AI Act. Depending on how the EU’s AI Act is implemented and interpreted, we may have to adapt our business practices, contractual arrangements, and current or planned products or services to comply with obligations imposed by the EU’s AI Act. Our use of AI technologies could also lead to regulatory investigations and consumer lawsuits. Certain privacy laws extend rights to consumers (such as the right to delete certain personal data) and regulate automated decision-making, which may complicate our use of AI, lead to regulatory fines or penalties, be incompatible with our use of AI, require us to change our business practices, retrain our AI, or prevent our use of AI. For example, the Federal Trade Commission has required other companies to turn over or disgorge valuable insights or trainings generated through the use of AI where they allege the company has violated privacy and consumer protection laws. Complying with applicable laws, rules, and regulations governing AI could increase our operating costs, require significant resources or technical modifications to our systems, change the way that we operate in certain jurisdictions, and impede our ability to offer AI in certain products or use AI in our business operations. Any of the above risks could materially adversely affect our business, financial condition, results of operations, and prospects.

Previous wording

We generate substantially all of our revenue from subscriptions to access our products. We recognize revenue ratably over the term of the subscription, beginning on the date that access to our products is made available to our customer. Our subscriptions generally have annual or multi-year terms. As a result, the significant majority of our revenue is generated from subscriptions entered into during prior periods. Consequently, a decline in new or renewed subscriptions in any one quarter may not significantly reduce our revenue for that quarter, but could negatively affect our revenue in future periods. Accordingly, the effect of downturns or upturns in new sales and potential changes in our rate of renewals may not be fully reflected in our results of operations until future periods. Our revenue recognition model also makes it difficult for us to rapidly increase our revenue through new subscriptions in any period.

Current wording

We generate substantially all of our revenue from subscriptions to access our products. We recognize revenue ratably over the term of the subscription, beginning on the date that access to our products is made available to the customer. Our subscriptions generally have annual or multi-year terms. As a result, the significant majority of our revenue is generated from subscriptions entered into during prior periods. Consequently, a decline in new or renewed subscriptions in any one quarter may not significantly reduce our revenue for that quarter, but could negatively affect our revenue in future periods. Accordingly, the effect of downturns or upturns in new sales and potential changes in our rate of renewals may not be fully reflected in our results of operations until future periods. Our revenue recognition model also makes it difficult for us to rapidly increase our revenue through new subscriptions in any period.

Previous wording

We had customers running projects in approximately 150 countries as of December 31, 2024, and 15% of our revenue in 2024 was generated from customers outside the U.S. We expect to continue to expand our international presence, which may include opening offices in new jurisdictions and providing our products, services, and platform in additional languages. Any new markets or countries into which we attempt to sell our products or services may not be receptive to our efforts. For example, we may not be able to further expand our operations in some countries if we are not able to adapt our products, services, and platform to fit the needs of prospective customers in those countries or if we are unable to satisfy certain government- and industry-specific laws or regulations. In addition, our international operations and expansion efforts require considerable management attention and the investment of significant resources, while subjecting us to new risks and increasing certain risks that we already face, including risks associated with:

Current wording

We had customers running projects in approximately 160 countries as of December 31, 2025, and 15% of our revenue in 2025 was generated from customers outside the U.S. We expect to continue to expand our international presence, which may include opening offices in new jurisdictions and providing our products, services, and platform in additional languages. Any new markets or countries into which we attempt to sell our products or services may not be receptive to our efforts. For example, we may not be able to further expand our operations in some countries if we are not able to adapt our products, services, and platform to fit the needs of prospective customers in those countries or if we are unable to satisfy certain government- and industry-specific laws or regulations. In addition, our international operations and expansion efforts require considerable management attention and the investment of significant resources, while subjecting us to new risks and increasing certain risks that we already face, including risks associated with:

Previous wording

•compliance by us and our partners with applicable international laws and regulations, including laws and regulations with respect to anti-corruption, competition, import and export controls, tariffs, trade barriers, economic sanctions, employment, construction, privacy, data protection and sovereignty, consumer protection, and unsolicited email, and the risk of penalties and fines against us and individual members of management or employees if our practices are deemed to be out of compliance;

Current wording

•compliance by us and our partners with applicable international laws and regulations, including laws and regulations with respect to anti-corruption, competition, import and export controls, tariffs, trade barriers, economic sanctions, employment, construction, privacy, data protection and sovereignty, consumer protection, and unsolicited communications, and the risk of penalties and fines against us and individual members of management or employees if our practices are deemed to be out of compliance;

Previous wording

•political and economic instability, including as a result of the Russia-Ukraine war and the Israel-Hamas war, and a shifting and uncertain geopolitical landscape;

Current wording

•political and economic instability, including as a result of the Russia-Ukraine war and other international conflicts, and a shifting and uncertain geopolitical landscape;

Previous wording

With the introduction of new products, services, and technologies by competitors, including through the use of AI, and the emergence of new market entrants in the construction management software industry, we expect competition to continue and intensify. Other companies may incorporate AI into their products more quickly or more successfully than us, which could impair our ability to compete effectively. Many of our competitors have competitive advantages over us, such as better name recognition, longer operating histories, larger marketing budgets, existing or more established relationships, greater third-party integrations, access to larger customer bases, greater financial, technical, pricing, packaging, and marketing strategies, and other resources. Some of our competitors may make acquisitions or enter into strategic relationships with third parties to offer a broader range of products and services than we do; others may have more effective sales and marketing strategies or may deploy those strategies in ways that enable them to acquire customers at a lower cost than we can. These combinations may make it more difficult for us to effectively compete. Our market and the technology landscape in general will also be impacted by the continued adoption of AI in ways that are currently unforeseeable and that could have significant benefits for our competitors. Additionally, as we introduce new products and services in the market, we may face new or different competitors who may similarly have competitive advantages over us. Such competitive pressures may erode our market share and may hinder or slow our expansion into new markets. We expect these competitive dynamics to continue as competitors attempt to strengthen or maintain their market positions.

Current wording

With the introduction of new products, services, and technologies by competitors, including through the use of AI, and the emergence of new market entrants in the construction management software industry, we expect competition to continue and intensify. Other companies may incorporate AI into their products more quickly or more successfully than us, which could impair our ability to compete effectively. Many of our competitors have competitive advantages over us, such as better name recognition, longer operating histories, larger marketing budgets, existing or more established relationships, greater third-party integrations, access to larger customer bases, greater financial, technical, pricing, packaging, and marketing strategies, and other resources. Some of our competitors may make acquisitions or enter into strategic relationships with third parties to offer a broader range of products and services than we do; others may have more effective sales and marketing strategies or may deploy those strategies in ways that enable them to acquire customers at a lower cost than we can. These combinations may make it more difficult for us to effectively compete. Further, the challenges and costs of recruiting and retaining qualified candidates with AI experience may negatively affect our ability to effectively develop and leverage AI technologies. Our market and the technology landscape in general will also be impacted by the continued adoption of AI in ways that are currently unforeseeable and that could have significant benefits for our competitors. Additionally, as we introduce new products and services in the market, we may face new or different competitors who may similarly have competitive advantages over us. Such competitive pressures may erode our market share and may hinder or slow our expansion into new markets. We expect these competitive dynamics to continue as competitors attempt to strengthen or maintain their market positions.

Previous wording

One of the most important features of our platform is its broad interoperability with a range of devices, web browsers, operating systems, and integrations. Accessibility across this range is oftentimes out of our control, including as a result of reliance on third-party service providers or applications. For example, in July 2024, a software update by a cybersecurity technology company caused widespread crashes of Windows systems into which it was integrated around the globe, including certain Windows systems that were used by a limited number of our employees and may have been used by our third-party service providers, vendors, and customers. Even though we did not deem the crashes to be a material cybersecurity incident, in the future, we may be impacted by similar third-party software-induced interruptions to our operations, which could materially adversely affect our business, financial condition, results of operations, and prospects.

Current wording

One of the most important features of our platform is its broad interoperability with a range of devices, web browsers, operating systems, and integrations. Accessibility across this range is oftentimes out of our control, including as a result of reliance on third-party service providers or applications. Any third-party software-induced interruptions to our operations, such as software issues that affect our operating systems, could materially adversely affect our business, financial condition, results of operations, and prospects.

Previous wording

If we lose key management personnel or if we are unable to retain or hire additional qualified personnel, we may not be able to achieve our strategic objectives and our business, financial condition, results of operations, and prospects could be materially adversely affected.

Current wording

If we lose key management personnel or if we are unable to retain or hire qualified personnel, we may not be able to achieve our strategic objectives and our business, financial condition, results of operations, and prospects could be materially adversely affected.

Previous wording

Our U.S. employees, including our executive officers, work for us on an “at-will” basis, which means they may terminate their employment with us at any time. If Mr. Courtemanche or one or more of our key personnel or members of our management team resign or otherwise cease to provide us with their services, our business, financial condition, results of operations, and prospects could be materially adversely affected.

Current wording

Our future success is substantially dependent on our ability to attract, retain, and motivate our executive officers, other members of our management team and other key personnel throughout our organization. Our U.S. employees, including our executive officers, the members of our management team, and other key personnel, work for us on an “at-will” basis, which means they may terminate their employment with us at any time. As previously disclosed, effective November 10, 2025, Craig F. Courtemanche, Jr., our founder, and former President and Chief Executive Officer, resigned as President and Chief Executive Officer of the Company, and Dr. Ajei S. Gopal was appointed as President and Chief Executive Officer. If Dr. Gopal or one or more other members of our management team or other key personnel resign or otherwise cease to provide us with their services, our business, financial condition, results of operations, and prospects could be materially adversely affected.

Previous wording

Our continued success is also dependent on our ability to attract and retain other qualified personnel possessing a broad range of skills and expertise. There is significant competition for personnel with the skills and technical knowledge that we require. To continue to enhance our products, services, and platform, develop new products and services, and add new and innovative functionality, it will be critical for us to continue to grow our research and development teams. We have in the past hired, and may in the future hire, employees from competitors or other companies. Their former employers have in the past, and may in the future, assert that we or these employees have breached such employee’s legal obligations, resulting in a diversion of our time and resources. If we fail to meet our hiring needs, at all or on the timeframes we expect, including in connection with the evolution of our GTM operating model, or if we fail to successfully integrate our new hires, our efficiency and ability to meet our forecasts and our employee morale, productivity, and retention could all suffer. Any of these factors could materially adversely affect our business, financial condition, results of operations, and prospects.

Current wording

Our continued success is also dependent on our ability to attract and retain other qualified personnel possessing a broad range of skills and expertise. There is significant competition for personnel with the skills and technical knowledge that we require. To continue to enhance our products, services, and platform, develop new products and services, and add new and innovative functionality, it will be critical for us to continue to grow our research and development teams. We have in the past hired, and may in the future hire, employees from competitors or other companies. Their former employers have in the past, and may in the future, assert that we or these employees have breached such employee’s legal obligations, resulting in a diversion of our time and resources. If we fail to meet our hiring needs, at all or on the timeframes we expect, or if we fail to successfully integrate our new hires, our efficiency and ability to meet our forecasts and our employee morale, productivity, and retention could all suffer. Any of these factors could materially adversely affect our business, financial condition, results of operations, and prospects.

Previous wording

We believe that our corporate culture fosters innovation, teamwork, passion, and focus on execution and has contributed to our success. As we grow, we may find it difficult to maintain our corporate culture. In addition, many of our employees work remotely and there is no guarantee that we will be able to maintain our corporate culture when much of our team is dispersed. Any failure to preserve our culture could harm our future success, including our ability to recruit and retain qualified personnel, innovate and operate effectively, and execute on our business strategies. In addition, in the past we have carried out, and we may in the future carry out, reductions in our workforce to ensure that our resources are aligned to our business strategy. Such reductions in our workforce could negatively impact our reputation as an employer and harm our company culture. If we experience any of these risks, our ability to attract new employees and retain existing employees could be impaired, which could materially adversely affect our business, financial condition, results of operations, and prospects.

Current wording

We believe that our corporate culture fosters innovation, teamwork, passion, and focus on execution and has contributed to our success. As we grow, we may find it difficult to maintain our corporate culture. Further, recent leadership changes may create uncertainty or shifts in priorities that could make it more challenging to preserve our culture. In addition, many of our employees work remotely and there is no guarantee that we will be able to maintain our corporate culture when much of our team is dispersed. Any failure to preserve our culture could harm our future success, including our ability to recruit and retain qualified personnel, innovate and operate effectively, and execute on our business strategies. In the past we have carried out, and we may in the future carry out, reductions in our workforce to ensure that our resources are aligned to our business strategy. Such reductions in our workforce could negatively impact our reputation as an employer and harm our company culture. If we experience any of these risks, our ability to attract new employees and retain existing employees could be impaired, which could materially adversely affect our business, financial condition, results of operations, and prospects.

Previous wording

In the U.S., federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws).

Current wording

In the U.S., federal, state, and local governments have enacted, and may in the future enact, numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws).

Previous wording

For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the “CCPA”), applies to personal data of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain privacy rights. The CCPA provides for administrative fines and allows private litigants affected by certain data breaches to recover significant statutory damages. Additionally, several states and localities have enacted measures related to the use of AI in products and services. Moreover, under various privacy laws and other obligations, we may be required to obtain certain consents to process personal data. Our data processing practices are subject to increased challenges by class action plaintiffs. Our inability or failure to obtain consent for these practices could result in adverse consequences, including class action litigation and mass arbitration demands. Additional data privacy and security laws have also been proposed at the federal, state, and local levels in recent years, which could further complicate compliance efforts.

Current wording

Numerous U.S. states, including California, have enacted, and may in the future enact, comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices, affording residents with certain rights concerning their personal data, and stricter requirements for processing certain personal data. Such rights may include the right to access, correct, or delete personal data, and to opt out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. For example, the CCPA requires businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain privacy rights. The CCPA provides for administrative fines and allows private litigants affected by certain data breaches to recover significant statutory damages. Moreover, under various privacy laws and other obligations, we may be required to obtain certain consents to process personal data. Our inability or failure to obtain such consents could result in adverse consequences, including class action litigation and mass arbitration demands. Additional data privacy and security laws have also been proposed at the federal, state, and local levels in recent years, which could complicate compliance efforts.

Previous wording

As we continue to expand globally, our obligations related to data protection will increase. Outside the U.S., an increasing number of laws, regulations, and industry standards apply to data privacy and security. For example, the European Union’s (“EU”) General Data Protection Regulation (the “EU’s GDPR”) and the United Kingdom’s (“U.K.”) General Data Protection Regulation (the “U.K.’s GDPR”) impose strict requirements for processing personal data. Under the EU’s GDPR, government regulators may impose temporary or definitive bans on data processing, as well as fines of up to 20 million euros or 4% of annual global revenue, whichever is greater, for certain violations. Similarly, under the U.K.’s GDPR, government regulators may impose fines of up to 17.5 million pounds sterling or 4% of annual global turnover, whichever is greater, for certain violations. The application of the EU’s GDPR alongside the U.K.’s GDPR exposes us to two parallel regimes, each of which potentially authorizes similar fines and other potentially divergent enforcement actions for certain violations. In addition, data subject or consumer protection organizations (which are authorized by law to represent data subjects' interests) may initiate litigation to represent their interests. There are also stringent local data protection requirements in Germany and cloud-server initiatives in France which may impact our operations in these countries. Furthermore, as our business continues to expand and evolve, the EU’s GDPR, the U.K.’s GDPR, and similar data protection regulations may apply additional obligations on us to further secure personal data, provide further rights to data subjects, and require additional reporting to regulators.

Current wording

As we continue to expand globally, our obligations related to data protection will increase. Outside the U.S., an increasing number of laws, regulations, and industry standards apply to data privacy and security. For example, the EU’s General Data Protection Regulation (the “EU’s GDPR”) and the United Kingdom’s (“U.K.”) General Data Protection Regulation (the “U.K.’s GDPR”) impose strict requirements for processing personal data. Under the EU’s GDPR and the U.K.’s GDPR, government regulators may impose temporary or definitive bans on data processing, as well as fines of up to the greater of (1) 20 million euros or 17.5 million pounds sterling, respectively, or (2) 4% of annual revenue. The application of the EU’s GDPR alongside the U.K.’s GDPR exposes us to two parallel regimes, each of which potentially authorizes similar fines and other potentially divergent enforcement actions for certain violations. In addition, data subject or consumer protection organizations (which are authorized by law to represent data subjects’ interests) may initiate litigation to represent their interests. There are also stringent local data protection requirements in Germany and cloud-server initiatives in France which may impact our operations in these countries. Furthermore, as our business continues to expand and evolve, the EU’s GDPR, the U.K.’s GDPR, and similar data protection regulations may apply additional obligations on us to further secure personal data, provide further rights to data subjects, and require additional reporting to regulators.

Previous wording

In Canada, the Personal Information Protection and Electronic Documents Act and various related provincial laws, as well as Canada’s Anti-Spam Legislation, applies to our operations, as does Australia’s Privacy Act 1988. We also have operations in Singapore and the UAE, which means that we may be subject to Singapore’s Personal Data Protection Act and the UAE’s Federal Data Protection Law No. 45 of 2021, respectively. In addition, Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais) (Law No. 13,709/2018), which applies to our operations, broadly regulates processing personal data of individuals in Brazil and imposes compliance obligations and penalties comparable to those of the EU’s GDPR. India’s new privacy legislation, the Digital Personal Data Protection Act, may also apply to our operations.

Current wording

Singapore’s Personal Data Protection Act, the UAE’s Federal Data Protection Law No. 45 of 2021, and Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais) (Law No. 13,709/2018), which also apply to our operations, impose compliance obligations and penalties that are comparable to those of the EU’s GDPR. In addition, India’s Digital Personal Data Protection Act and its implementing regulations, which provide for penalties of up to 2.5 billion Indian rupees for violations, may also apply to our operations.

Previous wording

In the ordinary course of business, we transfer personal data from Europe and other jurisdictions to the U.S. or other countries. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the European Economic Area (“EEA”) and the U.K. have significantly restricted the transfer of personal data to the U.S. and other countries whose privacy laws it generally believes are inadequate. Other jurisdictions may adopt or have already adopted similarly stringent data localization and cross-border data transfer laws. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and the U.K. to the U.S. in compliance with law, such as the EEA and U.K.’s standard contractual clauses, the U.K.’s International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework (which allows for transfers of personal data to relevant U.S.-based organizations that participate in and self-certify compliance with the framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the U.S.

Current wording

In the ordinary course of business, we transfer personal data from Europe and other jurisdictions to the U.S. or other countries. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the EEA and the U.K. have significantly restricted the transfer of personal data to the U.S. and other countries whose privacy laws it generally believes are inadequate. Other jurisdictions may adopt or have already adopted similarly stringent data localization and cross-border data transfer laws. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and the U.K. to the U.S. in compliance with law, these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy these mechanisms to lawfully transfer personal data to the U.S.

Previous wording

If there is no lawful manner for us to transfer personal data from the EEA, the U.K., or other jurisdictions to the U.S., or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part or all of our business or data processing activities to other jurisdictions at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors, and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Additionally, companies that transfer personal data out of the EEA and the U.K. to other jurisdictions, particularly to the U.S., are subject to increased scrutiny from regulators, individual litigants, and activist groups. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of Europe for allegedly violating the cross-border data transfer limitations of the EU’s GDPR. For example, in May 2023, the Irish Data Protection Commission determined that a major social media company’s use of standard contractual clauses to transfer personal data from Europe to the U.S. was insufficient and levied a 1.2 billion euro fine against the company and prohibited it from transferring personal data to the U.S.

Current wording

If there is no lawful manner for us to transfer personal data from the EEA, the U.K., or other jurisdictions to the U.S., or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part or all of our business or data processing activities to other jurisdictions at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors, and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. For example, in May 2023, the Irish Data Protection Commission determined that a major social media company’s use of standard contractual clauses to transfer personal data from Europe to the U.S. was insufficient and levied a 1.2 billion euro fine against the company and prohibited it from transferring personal data to the U.S.

Previous wording

Although we endeavor to comply with all applicable data privacy and security obligations, we may at times fail, or be perceived to have failed, to do so. Moreover, despite our efforts, our personnel or third parties with which we work, such as vendors or developers, may fail to comply with such obligations, which could negatively impact our business operations and compliance posture. For example, any failure by a third-party processor to comply with applicable law, regulations, or contractual obligations could result in adverse consequences for us, including our inability to, or interruption in our ability to, operate our business and proceedings against us by governmental entities or others.

Current wording

Our obligations related to data privacy and security (and consumers’ data privacy and security expectations) are quickly changing in an increasingly stringent fashion. Although we endeavor to comply with all applicable data privacy and security obligations, we may at times fail, or be perceived to have failed, to do so.

Previous wording

If we or the third parties on which we rely fail, or are perceived to have failed, to address or comply with data privacy and security obligations, we could face significant consequences, including, but not limited to, government enforcement actions (e.g., investigations, audits, inspections, fines, and penalties), litigation (including class-related claims), additional reporting requirements and oversight, restrictions or bans on processing personal data, orders to destroy or not use personal data, the imprisonment of company officials, the inability to operate in certain jurisdictions, limited ability to develop or commercialize our products and services, loss of revenue or profits, loss of customers or sales (including a decline in customer subscription renewals), interruptions or stoppages in or modifications to our operations, negative publicity (including public statements against us by consumer advocacy groups or others), and reputational harm, any of which could materially adversely affect our business, financial condition, results of operations, and prospects.

Current wording

Moreover, despite our efforts, our personnel or third parties with which we work, such as vendors or developers, may fail to comply with such obligations, which could negatively impact our business operations and compliance posture. For example, any failure by a third-party processor to comply with applicable law, regulations or contractual obligations could result in adverse consequences for us, including our ability to, or interruption in our ability to, operate our business and proceedings against us by governmental entities or others. If we or the third parties with whom we work fail, or are perceived to have failed, to address or comply with data privacy and security obligations, we could face significant consequences, including government enforcement actions (e.g., investigations, audits, inspections, fines, and penalties), litigation (including class-related claims), additional reporting requirements and oversight, restrictions or bans on processing personal data, orders to destroy or not use personal data, the imprisonment of company officials, the inability to operate in certain jurisdictions, limited ability to develop or commercialize our products and services, loss of revenue or profits, loss of customers or sales (including a decline in customer subscription renewals), interruptions or stoppages in or modifications to our operations, negative publicity (including public statements against us by consumer advocacy groups or others), and reputational harm, any of which could materially adversely affect our business, financial condition, results of operations, and prospects.

Previous wording

If our IT systems or data, or those of third parties with which we work, are or were compromised, we could experience adverse consequences resulting from such compromise, including, but not limited to, regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, loss of customers or sales, and other adverse consequences, any of which could materially adversely affect our business, financial condition, results of operations, and prospects.

Current wording

If our IT systems or data, or those of third parties with which we work, are or were compromised, we could experience adverse consequences resulting from such compromise, including regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, loss of customers or sales, and other adverse consequences, any of which could materially adversely affect our business, financial condition, results of operations, and prospects.

Previous wording

Cyberattacks, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of such sensitive information and IT systems, and those of the third parties on which we rely. Cloud-based platform providers of products and services have been targeted by such activities and are expected to continue to be targeted. The threats posed by such activities are prevalent and continue to grow, are increasingly difficult to detect, and come from a variety of sources, including traditional computer “hackers,” threat actors, “hacktivists,” organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation-states, and nation-state-supported actors.

Current wording

Cyberattacks, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of such sensitive information and IT systems, and those of the third parties on which we rely. Cloud-based platform providers of products and services have been targeted by such activities and are expected to continue to be targeted. The threats posed by such activities are prevalent and continue to grow, are increasingly difficult to detect, and come from a variety of sources, including traditional computer “hackers,” threat actors, “hacktivists,” organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation-states, and nation-state-supported actors. Further, our achievement of FedRAMP Moderate authorization for our Procore for Government solution, and heightened visibility as a provider of products and services to U.S. federal government customers and contractors, may increase the risk of threats from nation-state, and nation-state supported, and other threat actors.

Previous wording

We, the third parties with which we work, and our customers are subject to a variety of evolving threats, including, but not limited to, social-engineering attacks (including through deep fakes, which may be increasingly difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), credential harvesting, personnel misconduct or error, break-ins, ransomware attacks, supply chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other IT assets, adware, telecommunications failures, attacks enhanced or facilitated by AI, and other similar threats. Our products and services may also be subject to fraudulent usage and schemes, including from third parties accessing customer accounts or viewing data from our platform. In addition, remote work has become more common and has increased risks to our IT systems and data, as more of our employees utilize network connections, computers, and devices outside our premises or network, including working at home, while in transit, and in public locations.

Current wording

We, the third parties with which we work, and our customers are subject to a variety of evolving threats, including social-engineering attacks (including through deep fakes, which may be increasingly difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), credential harvesting, personnel misconduct or error, break-ins, ransomware attacks, supply chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other IT assets, adware, telecommunications failures, attacks enhanced or facilitated by AI, and other similar threats. Our products and services may also be subject to fraudulent usage and schemes, including from third parties accessing customer accounts or viewing data from our platform. In addition, remote work has become more common and has increased risks to our IT systems and data, as more of our employees utilize network connections, computers, and devices outside our premises or network, including working at home, while in transit, and in public locations.

Previous wording

Some actors now engage and are expected to continue to engage in cyberattacks including, without limitation, nation-states and nation-state-supported actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we, the third parties with which we work, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyberattacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell, and maintain the availability of our products, services, and platform.

Current wording

Some actors, including, without limitation, organized criminal threat actors and nation-state-supported actors, now engage and are expected to continue to engage in cyberattacks for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we, the third parties with which we work, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyberattacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell, and maintain the availability of our products, services, and platform. For example, individuals from sanctioned jurisdictions such as North Korea have illicitly and fraudulently sought employment at U.S. companies to get access to those companies’ sensitive information. If we were found to have willfully or knowingly employed any such individuals, we could face criminal liability.

Previous wording

Severe ransomware attacks, including by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, loss of sensitive information and income, reputational harm, and diversion of funds. While extortion payments have the potential to alleviate the negative impact of a ransomware attack, we may be unwilling or unable to make such payments for a variety of reasons, including, but not limited to, applicable laws or regulations prohibiting such payments.

Current wording

Ransomware attacks are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, loss of sensitive information and income, reputational harm, and diversion of funds. While extortion payments have the potential to alleviate the negative impact of a ransomware attack, we may be unwilling or unable to make such payments for a variety of reasons.

Previous wording

We employ a shared responsibility model where our customers are responsible for using, configuring, and otherwise implementing security measures related to our products, services, and platform, and products in a manner that meets applicable cybersecurity standards, complies with laws, and addresses their information security risk. As part of this model, we make certain security features available to our customers that can be implemented at our customers' discretion, or identify security areas or measures for which our customers are responsible. For example, depending on the product implementation, our customers are responsible for adding and enforcing multi-factor authentication to access their accounts. In certain cases where our customers choose not to implement, or incorrectly implement, such features or measures, misuse our services, or otherwise experience their own vulnerabilities, policy violations, credential exposure or security incidents, even if we or our platform are not the cause of any customer security issue or incident that may result, our customer relationships, reputation, and operating results may be adversely impacted.

Current wording

We employ a shared responsibility model where our customers are responsible for using, configuring, and otherwise implementing security measures related to our products, services, and platform in a manner that meets applicable cybersecurity standards, complies with laws, and addresses their information security risk. As part of this model, we make certain security features available to our customers that can be implemented at our customers’ discretion, or identify security areas or measures for which our customers are responsible. For example, depending on the product implementation, our customers are responsible for adding and enforcing multi-factor authentication to access their accounts. In certain cases where our customers choose not to implement, or incorrectly implement, such features or measures, misuse our services, or otherwise experience their own vulnerabilities, policy violations, credential exposure or security incidents, even if we or our platform are not the cause of any customer security issue or incident that may result, our customer relationships, reputation, and operating results may be adversely impacted.

Previous wording

It may be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident. Our efforts to do so may not be successful. Actions taken by us, or the third parties with which we work, to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems.

Current wording

It may be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident. Our efforts to do so may not be successful. Actions taken by us, or the third parties with which we work, to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. For example, threat actors may use an initial compromise of one part of our environment to gain access to other parts of our environment, or leverage a compromise of our networks or systems to gain access to the networks or systems of third parties with whom we work, such as through phishing or supply chain attacks.

Previous wording

For several reasons, including the introduction of new vulnerabilities, resource constraints, competing business demands, dependence on third parties, and technological challenges, a large number of high and critical unremediated vulnerabilities exist in our IT systems and will exist until our remediation efforts are completed. We have taken, and are taking, steps designed to mitigate these vulnerabilities in a prioritized manner based on our assessment of the risk posed by such vulnerabilities. Despite our efforts, there can be no assurance that these vulnerability mitigation measures will be effective. Moreover, we have experienced delays in developing and deploying remedial measures and patches designed to address any identified vulnerabilities. Vulnerabilities could be exploited and result in a security incident.

Current wording

For several reasons, including the introduction of new vulnerabilities, resource constraints, competing business demands, dependence on third parties, and technological challenges, a large number of high unremediated vulnerabilities exist in our IT systems and will exist until our remediation efforts are completed. We have taken, and are taking, steps designed to mitigate these vulnerabilities in a prioritized manner based on our assessment of the risk posed by such vulnerabilities. Despite our efforts, there can be no assurance that these vulnerability mitigation measures will be effective. Moreover, we have experienced delays in developing and deploying remedial measures and patches designed to address any identified vulnerabilities. Vulnerabilities could be exploited and result in a security incident.

Previous wording

If we or third parties with which we work experience a security incident or are perceived to have experienced a security incident, we could experience significant consequences, including, but not limited to, government enforcement actions (e.g., investigations, audits, inspections, fines, and penalties), litigation (including class-related claims), additional reporting requirements and oversight, restrictions or bans on processing sensitive information (including personal data and sensitive third-party and customer data), loss of revenue or profits, loss of customers or sales, interruptions or stoppages in or modifications to our operations (including availability of data), indemnification obligations, negative publicity, and reputational harm. Security incidents and attendant consequences may also cause customers to stop using our products, services, and platform (including by declining to renew their subscriptions), deter new customers from using our products, services, and platform, and negatively impact our ability to grow and operate our business. In addition, security incidents experienced by others, such as competitors or customers, may lead to widespread negative publicity for us, our customers, or the construction software industry generally.

Current wording

Any of the previously identified or similar threats could cause a security incident or other interruption. A security incident or other interruption could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or IT systems, or those of the third parties with which we work (including our customers). If we or third parties with which we work experience a security incident or are perceived to have experienced a security incident, which has previously occurred, we could experience significant consequences, including government enforcement actions (e.g., investigations, audits, inspections, fines, and penalties), litigation (including class-related claims), additional reporting requirements and oversight, restrictions or bans on processing sensitive information (including personal data and sensitive third-party and customer data), loss of revenue or profits, loss of customers or sales, interruptions or stoppages in or modifications to our operations (including availability of data), indemnification obligations, negative publicity, and reputational harm. Security incidents and attendant consequences may also cause customers to stop using our products, services, and platform (including by declining to renew their subscriptions), deter new customers from using our products, services, and platform, and negatively impact our ability to grow and operate our business.

Previous wording

In addition, business transactions, such as acquisitions or integrations, have exposed us to these same or additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. Furthermore, we have discovered security issues that were not found during due diligence of such acquired or integrated entities, and it has been and may continue to be difficult to integrate companies into our IT environment and security program.

Current wording

In addition, business transactions, such as acquisitions or integrations, have exposed us to these same or additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. Furthermore, in the past, we have discovered security issues that were not found during due diligence of such acquired or integrated entities, and it has been, and may continue to be, difficult to integrate companies into our IT environment and security program.