Tenable Holdings, Inc.

Previous wording

We have historically incurred net losses, including net losses of $36.3 million, $78.3 million and $92.2 million in 2024, 2023 and 2022, respectively. At December 31, 2024, we had an accumulated deficit of $861.3 million. Because the market for our offerings is highly competitive and rapidly evolving and these solutions have not yet reached widespread adoption, it is difficult for us to predict our future results of operations.

Current wording

We have historically incurred net losses, including net losses of $36.1 million, $36.3 million and $78.3 million in 2025, 2024 and 2023, respectively. At December 31, 2025, we had an accumulated deficit of $897.5 million. Because the market for our offerings is highly competitive and rapidly evolving and these solutions have not yet reached widespread adoption, it is difficult for us to predict our future results of operations.

Previous wording

Furthermore, our research and development teams for Tenable OT Security and for Tenable Cloud Security are primarily located in Tel Aviv, Israel. Recent and ongoing hostilities in the region may have a material impact on our ability to deliver on our product roadmaps for these solutions.

Current wording

Furthermore, our research and development teams maintain a significant presence in Tel Aviv, Israel. Recent and ongoing hostilities in the region may have a material impact on our ability to deliver on our product roadmaps for these solutions.

Previous wording

Some of our actual and potential competitors have significant advantages over us, such as longer operating histories, significantly greater financial, technical, marketing or other resources, stronger brand and business user recognition, larger intellectual property portfolios, government certifications and broader global distribution and presence. In addition, our industry is evolving rapidly and is becoming increasingly competitive. Companies that are larger and more established than us are focusing on cybersecurity and could directly compete with us. For example, Microsoft has a vulnerability management offering and has continued to acquire security solutions for their cybersecurity platform. Smaller companies could also launch new products and services that we do not offer and that could gain market acceptance quickly.

Current wording

Some of our actual and potential competitors have significant advantages over us, such as longer operating histories, significantly greater financial, technical, marketing or other resources, stronger brand and business user recognition, larger intellectual property portfolios, government certifications and broader global distribution and presence. In addition, our industry is evolving rapidly and is becoming increasingly competitive. Companies that are larger and more established than us are focusing on cybersecurity and could directly compete with us. For example, Microsoft has a vulnerability management offering and has continued to acquire security solutions for its cybersecurity platform. Smaller companies could also launch new products and services that we do not offer and that could gain market acceptance quickly.

Previous wording

From 2023 to 2024, our revenue grew from $798.7 million to $900.0 million, representing year over year growth of 13%. This growth was primarily from an increase in subscription revenue. Although we have experienced rapid growth historically and currently have high customer renewal rates, we may not continue to grow as rapidly in the future due to a decline in our renewal rates, failure to attract new customers or other factors. Any success that we may experience in the future will depend in large part on our ability to, among other things:

Current wording

From 2024 to 2025, our revenue grew from $900.0 million to $999.4 million, representing year over year growth of 11%. This growth was primarily from an increase in subscription revenue. Although we have experienced rapid growth historically and currently have high customer renewal rates, we may not continue to grow as rapidly in the future due to a decline in our renewal rates, failure to attract new customers or other factors. Any success that we may experience in the future will depend in large part on our ability to, among other things:

Previous wording

We sell cybersecurity products and, as a result, may be at increased risk of being a target of cyberattacks designed to penetrate our platform or internal systems, to compromise our data, alter or modify our source code, or to otherwise impede the performance of our products. Threats to information systems and data come from a variety of sources. In addition to computer “hackers,” threat actors, personnel (such as through theft or misuse, or other insider threat listed below), "hacktivists," organized criminal threat actors, sophisticated nation-states and nation-state-supported actors now engage and are expected to continue to engage in cyber-attacks. Nation-state actors and nation-state-supported actors may engage in such attacks for geopolitical reasons and in conjunction with military conflicts and defense activities, including the ongoing conflict between Ukraine and Russia, the ongoing conflict in the Middle East, and rising tensions between China and Taiwan. During times of war and other major conflicts, we, third parties upon which we may rely, and our customers may be vulnerable to a heightened risk of these threats, including retaliatory cyber-attacks that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our goods and services. We, our customers, and the third parties upon which we rely are subject to a variety of evolving threats, which are prevalent, continue to rise, and increasingly difficult to detect. These threats include but are not limited to: social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks); credential harvesting; malicious code (such as viruses and worms); malware (including as a result of advanced persistent threat intrusions); denial-of-service attacks, credential stuffing; insider threats (including due to personnel misconduct, error or malicious activity); ransomware attacks; supply-chain attacks; software bugs; server malfunctions; software or hardware failures; loss of data or other information technology assets; adware; telecommunications failures; attacks enhanced or facilitated by artificial intelligence and other similar threats. In particular, ransomware attacks, including those from organized criminal threat actors, nation-states and nation-state supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions, delays, or outages in our operations, loss of data, loss of income, significant extra expenses to restore data or systems, reputational loss and the diversion of funds. To alleviate the financial, operational and reputational impact of a ransomware attack, it may be prudent to make extortion payments, but we may be unable to do so if, for example, applicable laws prohibit such payments.

Current wording

We sell cybersecurity products and, as a result, may be at increased risk of being a target of cyberattacks designed to penetrate our platform or internal systems, to compromise our data, alter or modify our source code, or to otherwise impede the performance of our products. Threats to information systems and data come from a variety of sources. In addition to computer “hackers,” threat actors, personnel (such as through theft or misuse, or other insider threat listed below), "hacktivists," organized criminal threat actors, sophisticated nation-states and nation-state-supported actors now engage and are expected to continue to engage in cyber-attacks. Nation-state actors and nation-state-supported actors may engage in such attacks for geopolitical reasons and in conjunction with military conflicts and defense activities, around the world. During times of war and other major conflicts, we, third parties upon which we may rely, and our customers may be vulnerable to a heightened risk of these threats, including retaliatory cyber-attacks that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our goods and services. We, our customers, and the third parties upon which we rely are subject to a variety of evolving threats, which are prevalent, continue to rise, and are increasingly difficult to detect. These threats include but are not limited to: social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks); credential harvesting; malicious code (such as viruses, worms, and, increasingly, code injection in open source software); malware (including as a result of advanced persistent threat intrusions); denial-of-service attacks, credential stuffing; insider threats (including due to personnel misconduct, error or malicious activity); ransomware attacks; supply-chain attacks; software bugs; server malfunctions; software or hardware failures; loss of data or other information technology assets; adware; telecommunications failures; attacks enhanced or facilitated by artificial intelligence and other similar threats. In particular, ransomware attacks, including those from organized criminal threat actors, nation-states and nation-state supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions, delays, or outages in our operations, loss of data, loss of income, significant extra expenses to restore data or systems, reputational loss and the diversion of funds. To alleviate the financial, operational and reputational impact of a ransomware attack, it may be prudent to make extortion payments, but we may be unable to do so if, for example, applicable laws prohibit such payments.

Previous wording

If our third-party service providers or partners experience a security incident or other interruption or cause an extended outage or disruption to our systems, we could experience adverse consequences. It is possible that our customers and potential customers would hold us accountable for any security incident affecting our third-party service providers’ or partners' infrastructure or other interruption caused by our third-party service providers or partners that impacts our infrastructure. We may incur significant liability from those customers and from other third parties with respect to any such incident. Because our agreements with certain third-party service providers, such as AWS and Snowflake, limit their liability for damages, we may not be able to recover a material portion of our liabilities to our customers and third parties arising from issues with such third-party service providers, such as AWS and Snowflake, in the event of an incident affecting the third parties’ systems. Moreover, while we may be entitled to damages from third-party service providers if they fail to satisfy their privacy or security-related obligations to us or if they cause a disruption in our infrastructure, any award may be insufficient to cover our damages, or we may be unable to recover such reward. In addition, supply-chain attacks have increased in frequency and severity and there have been high-profile incidents of third-party service providers causing widespread disruptions in their customers' infrastructures due to errors in their SaaS offerings, such as the Windows outage caused by a flawed CrowdStrike software update that occurred in July 2024. We cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised or that errors by our third-party service providers won’t cause disruptions in our infrastructure.

Current wording

If our third-party service providers or partners experience a security incident or other interruption or cause an extended outage or disruption to our systems, we could experience adverse consequences. It is possible that our customers and potential customers would hold us accountable for any security incident affecting our third-party service providers’ or partners' infrastructure or other interruption caused by our third-party service providers or partners that impacts our infrastructure. We may incur significant liability from those customers and from other third parties with respect to any such incident. Because our agreements with certain third-party service providers, such as AWS and Snowflake, limit their liability for damages, we may not be able to recover a material portion of our liabilities to our customers and third parties arising from issues with such third-party service providers, such as AWS and Snowflake, in the event of an incident affecting the third parties’ systems. Moreover, while we may be entitled to damages from third-party service providers if they fail to satisfy their privacy or security-related obligations to us or if they cause a disruption in our infrastructure, any award may be insufficient to cover our damages, or we may be unable to recover such reward. In addition, supply-chain attacks have increased in frequency and severity and there have been high-profile incidents of third-party service providers causing widespread disruptions in their customers' infrastructures due to errors in their SaaS offerings. We cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised or that errors by our third-party service providers won’t cause disruptions in our infrastructure.

Previous wording

The reliability and continuous availability of our solutions is critical to our success. We have experienced errors or defects in the past in connection with the release of new solutions and product upgrades, and we expect that these errors or defects will be found from time to time in the future in new or enhanced solutions after commercial release. For example, on December 31, 2024, we identified Nessus agents versions 10.8.0 and 10.8.1 going offline under certain conditions which impacted the availability of our Vulnerability Management and Security Center solutions for certain customers. Upon discovery of the incident, we developed and released a version 10.8.2 of our Nessus agent on January 2, 2025, which enabled affected customers to resolve the issue. Although the financial impacts of this incident have not been significant, similar incidents in the future could result in costs associated with service-level credits and loss of customer trust, which could have a material adverse effect on our business and financial performance. In addition, we use third parties to assist in the development of our products and these third parties could be a source of errors or defects. Some defects may cause our solutions to be vulnerable to attacks, cause them to fail to detect vulnerabilities, or temporarily interrupt customers’ networking traffic or operational technology environments, any of which may damage our customers’ business and could hurt our reputation.

Current wording

The reliability and continuous availability of our solutions is critical to our success. We have experienced errors or defects in the past in connection with the release of new solutions and product upgrades, and we expect that these errors or defects will be found from time to time in the future in new or enhanced solutions after commercial release. For example, on December 31, 2024, we identified Nessus agents versions 10.8.0 and 10.8.1 going offline under certain conditions which impacted the availability of our Vulnerability Management and Security Center solutions for certain customers. Upon discovery of the incident, we developed and released a version 10.8.2 of our Nessus agent on January 2, 2025, which enabled affected customers to resolve the issue. Although the financial impacts of this incident have not been significant, similar incidents in the future could result in costs associated with service-level credits and loss of customer trust, which could have a material adverse effect on our business and financial performance. In addition, we use third parties to assist in the development of our products and these third parties could be a source of errors or defects.

Previous wording

We have incorporated and may in the future further incorporate generative and other types of AI processes, algorithms, and technologies into certain of our products and services. This technology is new and developing, and may generate output that is inaccurate or flawed or may not achieve market acceptance, which could result in operational, financial, regulatory, and reputational harm and other adverse consequences to our business.

Current wording

We have incorporated and may in the future further incorporate AI technologies, including generative AI, into certain of our products and services. These technologies are subject to new and developing regulatory frameworks and may create operational, financial, regulatory, and reputational risks based on development practices or reliance on AI outputs that are inaccurate or flawed. These technologies may not achieve market acceptance and may pose other adverse consequences to our business, some of which we may not know or be able to quantify at this time.

Previous wording

We have incorporated and may in the future further incorporate AI features in certain of our products and services, including ExposureAI and Tenable AI Assistant. The use of generative AI processes at scale is relatively new, and may lead to challenges, concerns and risks, including various privacy and security risks that are significant or that we may not be able to predict, especially if our use of these technologies in our products and services becomes more important to our operations over time. The technologies underpinning these features are in the early stages of commercial use and exist in an emerging regulatory environment, which presents regulatory, litigation, ethical, reputational, operational and financial risks. AI in our products and services may be difficult to deploy successfully due to operational issues inherent to the nature of such technologies, including the development, maintenance and operation of deep learning datasets. Additionally, if we do not have adequate rights to utilize the data or other materials and content that our AI technologies depend on, we may face legal consequences for violating applicable laws, third-party intellectual property, privacy or other rights, or contracts to which we are a party.

Current wording

We have incorporated and may in the future further incorporate AI features in certain of our products and services, including ExposureAI and Tenable AI Assistant and within Tenable One. The use of AI technologies, including generative AI processes, at scale is relatively new, and may lead to challenges, concerns and risks, including various privacy and security risks that are significant or that we may not be able to predict, especially if our use of these technologies in our products and services becomes more important to our operations over time. The technologies underpinning these features are in the early stages of commercial use and exist in an emerging regulatory environment with heightened regulatory scrutiny, which presents regulatory, litigation, ethical, safety, reputational, operational and financial risks. AI in our products and services may be complex to deploy successfully due to operational issues inherent to the nature of such technologies, including the availability, development, maintenance and operation of deep learning datasets and third-party dependencies.

Previous wording

Uncertainty in the legal regulatory regime relating to AI and emerging ethical issues surrounding the use of AI may require significant resources to modify and maintain business practices to comply with U.S. and non-U.S. laws, the nature of which cannot be determined at this time. Existing laws and regulations may apply to us or our suppliers, vendors, partners and customers in new ways, and new laws and regulations may be instituted. Many U.S. and international governmental bodies and regulators have proposed, enacted or are in the process of developing, new regulations related to the use of AI and machine learning technologies. For example, the European Union authorities recently adopted a legal framework on AI regulation, the Artificial Intelligence Act, which applies beyond the European Union’s borders and establishes obligations for AI providers and those deploying AI systems. Other jurisdictions may adopt similar or potentially more restrictive laws, which may render the use of such technologies challenging. The final form of these may impose obligations related to our development, offering and use of AI technologies and expose us to increased risk of regulatory enforcement and litigation.

Current wording

Uncertainty in the legal regulatory regime relating to AI and emerging ethical issues surrounding the use of AI may require significant resources to modify and maintain business practices to comply with U.S. and non-U.S. laws, the nature of which cannot be determined at this time. Existing laws and regulations may apply to us or our suppliers, vendors, partners and customers in new ways, and new laws and regulations may be instituted. Many U.S. and international governmental bodies and regulators have proposed, enacted or are in the process of developing, new regulations related to the use of AI and machine learning technologies, including the EU AI Act, Colorado AI Act, California Bot Disclosure Law, and Utah AI Policy Act, as well as regulations on certain high-risk automated decisions, such as those in the employment context. For example, the EU AI Act, which applies beyond the European Union’s borders and establishes obligations for AI providers and those deploying AI systems, sets out a risk-based framework that subjects certain AI technologies to numerous compliance obligations, such as transparency, conformity and risk assessment, monitoring and human oversight requirements. Under the EU AI Act, non-compliant companies may be subject to administrative fines of up to 35 million Euros or 7% of a company's total worldwide annual turnover for the preceding financial year, whichever is higher. Certain of our activities subject us to the EU AI Act and other U.S. and non-U.S. laws governing AI or data processed in connection with AI. We expect other jurisdictions may adopt similar or potentially more restrictive laws, which may render the use of such technologies challenging. The final form of these may impose obligations related to our development, offering and use of AI technologies and expose us to increased risk of regulatory enforcement and litigation. We may have to amend our business practices, contractual arrangements, and services to comply with such obligations.

Previous wording

Any sensitive information (including confidential, competitive, proprietary, or personal data) that we input into a third-party generative AI platform could be leaked or disclosed to others, including if sensitive information is used to train the third parties’ AI model. Additionally, where an AI model ingests personal data and makes connections using such data, those technologies may reveal other personal or sensitive information generated by the model.

Current wording

Our customers deploy AI technologies in their environments where the AI technologies may encounter sensitive information (including confidential, competitive, proprietary, or personal data) or our customers may input sensitive information into our AI-powered offerings, regardless of any prohibitions in our terms of service. Any sensitive information that our AI technologies ingest could be leaked or disclosed to others. Additionally, many of our AI technologies are powered by third-party AI providers, which may heighten the risk of inadvertent or unwanted disclosure of sensitive information, including if sensitive information is used to train the third party's AI model. Additionally, where an AI model ingests personal data and makes connections using such data, those technologies may reveal other personal or sensitive information generated by the model. This could create legal or contractual liability for us in light of the model's ability to output sensitive information.

Previous wording

Our AI technology features may also generate output that is misleading, insecure, inaccurate, harmful or otherwise flawed. Our customers or others may rely on or use such misleading, insecure, harmful or otherwise flawed content to their detriment, which may harm our brand, reputation, business or customers, cause competitive harm or expose us to legal liability. For example, AI algorithms use machine learning and predictive analytics which may be insufficient or of poor quality and reflect inherent biases and could lead to flawed, biased, and inaccurate results. Deficient or inaccurate recommendations, forecasts, or analyses that generative AI applications assist in producing could lead to customer rejection or skepticism of our products, affect our reputation or brand, and negatively affect our financial results. Further, unauthorized use or misuse of AI by our employees or others may result in disclosure of confidential company and customer data, reputational harm, privacy law violations and legal liability. Our use of generative AI may also lead to novel and urgent cybersecurity risks, including related to personal data, which may adversely affect our operations and reputation.

Current wording

Our AI technology features may also generate output that is misleading, insecure, inaccurate, harmful or otherwise flawed. Agentic AI solutions may compound those risks by taking or implementing actions or outputs, which themselves may be based on flawed outputs, that further increase the risk of misleading, insecure, inaccurate, harmful or otherwise flawed outcomes. This risk extends to our enterprise operations, as employee use of unvetted third-party agentic AI solutions, such as browser plug-ins or other automated applications, could result in actions being taken without adequate human review or monitoring. Such unauthorized automated actions could, for example, lead to the inadvertent disclosure or modification of corporate data or other sensitive information, flawed communications to customers or partners, or the creation of unintended legal or financial obligations on behalf of the company. Our customers or others may rely on or use such misleading, insecure, harmful or otherwise flawed content to their detriment, which may harm our brand, reputation, business or customers, cause competitive harm or expose us to legal liability. For example, AI algorithms use machine learning and predictive analytics which may be insufficient or of poor quality and reflect inherent biases and could lead to flawed, biased, and inaccurate results. Deficient or inaccurate recommendations, forecasts, or analyses that generative AI applications assist in producing could lead to customer rejection or skepticism of our products, affect our reputation or brand, and negatively affect our financial results. Further, unauthorized use or misuse of AI by our employees or others may result in disclosure of confidential company and customer data, reputational harm, privacy law violations and legal liability. Our use of generative AI may also lead to novel and urgent cybersecurity risks, including those related to personal data, which may adversely affect our operations and reputation, and these risks likely are compounded by our use of agentic AI.

Previous wording

Our subscription offerings are term-based and a majority of our subscription contracts are for one year in duration. In order for us to maintain or improve our results of operations, it is important that a high percentage of our customers renew their subscriptions with us when the existing subscription term expires, and renew on the same or more favorable terms. Our customers have no obligation to renew their subscriptions, and we may not be able to accurately predict customer renewal rates. In addition, the growth of our business depends in part on our customers expanding their use of subscription offerings and related services. Historically, some of our customers have elected not to renew their subscriptions with us for a variety of reasons, including as a result of changes in their strategic IT priorities, budgets, costs and, in some instances, due to competing solutions. Our retention rate may also decline or fluctuate if our existing customers choose to reduce or delay technology spending in response to economic conditions, including those resulting from exchange rate fluctuations relative to the U.S. dollar that make our products more expensive to existing customers, high rates of inflation and interest rates or concerns of an economic recession in the United States or other major markets, that could lead to decreased spending, as well as a result of a number of other factors, including our customers’ satisfaction or dissatisfaction with our software, the increase in the contract value of subscription and support contracts from new customers, the effectiveness of our customer support services, our pricing, the prices of competing products or services, mergers and acquisitions affecting our customer base, global economic conditions, and the other risk factors described in this Annual Report on Form 10-K. We cannot assure you that customers will maintain their agreements with us, renew subscriptions or increase their usage of our software. If our customers do not maintain or renew their subscriptions or renew on less favorable terms, or if we are unable to expand our customers’ use of our software, our business, results of operations, and financial condition may be harmed.

Current wording

Our subscription offerings are term-based and a majority of our subscription contracts are for one year in duration, although we have recently experienced an increase in larger, multi-year deals, which has increased our overall contract duration. However, we have simultaneously experienced a shift to annual installment billing for these multi-year deals, which is reducing our billing duration. In order for us to maintain or improve our results of operations, it is important that a high percentage of our customers renew their subscriptions with us when the existing subscription term expires, and renew on the same or more favorable terms. Our customers have no obligation to renew their subscriptions, and we may not be able to accurately predict customer renewal rates. In addition, the growth of our business depends in part on our customers expanding their use of subscription offerings and related services. Historically, some of our customers have elected not to renew their subscriptions with us for a variety of reasons, including as a result of changes in their strategic IT priorities, budgets, costs and, in some instances, due to competing solutions. Our retention rate may also decline or fluctuate if our existing customers choose to reduce or delay technology spending in response to economic conditions, including those resulting from exchange rate fluctuations relative to the U.S. dollar that make our products more expensive to existing customers, high rates of inflation and interest rates or concerns of an economic recession in the United States or other major markets, that could lead to decreased spending, as well as a result of a number of other factors, including our customers’ satisfaction or dissatisfaction with our software, the increase in the contract value of subscription and support contracts from new customers, the effectiveness of our customer support services, our pricing, the prices of competing products or services, mergers and acquisitions affecting our customer base, global economic conditions, and the other risk factors described in this Annual Report on Form 10-K. We cannot assure you that customers will maintain their agreements with us, renew subscriptions or increase their usage of our software. If our customers do not maintain or renew their subscriptions or renew on less favorable terms, or if we are unable to expand our customers’ use of our software, our business, results of operations, and financial condition may be harmed.

Previous wording

We believe that developing and maintaining widespread awareness of our brand in a cost-effective manner is critical to achieving widespread acceptance of our enterprise platform and attracting new customers. Brand promotion activities may not generate customer awareness or increase revenue and, even if they do, any increase in revenue may not offset the expenses we incur in maintaining and promoting our brand. If we fail to successfully promote and maintain our brand, or incur substantial expenses, we may fail to attract or retain customers necessary to realize a sufficient return on our brand-building efforts, or to achieve the widespread brand awareness that is critical for broad customer adoption of our solutions.

Current wording

We believe that developing and maintaining widespread awareness of our brand in a cost-effective manner is critical to achieving widespread acceptance of our enterprise platform and attracting new customers. Brand promotion activities may not generate customer awareness or increase revenue and, even if they do, any increase in revenue may not offset the expenses we incur in maintaining and promoting our brand. If we fail to successfully promote and maintain our brand, or if we incur substantial expenses, we may fail to attract or retain customers necessary to realize a sufficient return on our brand-building efforts, or to achieve the widespread brand awareness that is critical for broad customer adoption of our solutions.

Previous wording

We believe our success has depended, and continues to depend, on the efforts and talents of our senior management team and our highly skilled team members, including our sales personnel, professional services personnel and software engineers. We do not maintain key person insurance on any of our executive officers or key employees. Our senior management and key employees are employed on an at-will basis, which means that they could terminate their employment with us at any time. The loss of any of our senior management or key employees, including the recent passing of our former CEO, Mr. Yoran, could adversely affect our ability to execute our business plan, and we may not be able to find adequate replacements. We cannot ensure that we will be able to retain the services of any members of our senior management or other key employees.

Current wording

We believe our success has depended, and continues to depend, on the efforts and talents of our senior management team and our highly skilled team members, including our sales personnel, professional services personnel and software engineers. We do not maintain key person insurance on any of our executive officers or key employees. Our senior management and key employees are employed on an at-will basis, which means that they could terminate their employment with us at any time. The loss of any of our senior management or key employees could adversely affect our ability to execute our business plan, and we may not be able to find adequate replacements. We cannot ensure that we will be able to retain the services of any members of our senior management or other key employees.

Previous wording

Our ability to successfully pursue our growth strategy also depends on our ability to attract, motivate and retain our personnel. Competition for well-qualified employees in all aspects of our business is intense. The move by companies to offer a remote or hybrid work environment may increase competition for such employees outside of our traditional office locations. In addition, employee turnover rates in the broader global economy and inflationary pressures in the labor market have increased and may continue to be elevated, which has led, and could continue to lead to increased recruiting, training and retention costs. If we do not succeed in attracting well-qualified employees, retaining and motivating existing employees or maintaining our corporate culture in a hybrid or remote work environment, our business would be adversely affected.

Current wording

Our ability to successfully pursue our growth strategy also depends on our ability to attract, motivate and retain our personnel. Competition for well-qualified employees in all aspects of our business is intense. The move by companies to offer a remote or hybrid work environment may increase competition for such employees outside of our traditional office locations. In addition, employee turnover rates in the broader global economy and inflationary pressures in the labor market have increased and may continue to be elevated, which has led, and could continue to lead to increased recruiting, training and retention costs. If we do not succeed in attracting well-qualified employees, retaining and motivating existing employees or maintaining our corporate culture in a hybrid or remote work environment, our business will be adversely affected.

Previous wording

The timing of sales of our offerings is difficult to forecast because of the length and unpredictability of our sales cycle, particularly with large enterprises and with respect to certain of our solutions. We sell our solutions primarily to IT departments that are managing a growing set of user and compliance demands, which has increased the complexity of customer requirements to be met and confirmed during the sales cycle and prolonged our sales cycle. Our average sales cycle with an enterprise customer is approximately four months, although unfavorable macroeconomic conditions and the extent to which we continue to enter into larger deals, could result in longer average sales cycles. Further, the length of time that potential customers devote to their testing and evaluation, contract negotiation and budgeting processes varies significantly, depending on the size of the organization and nature of the product or service under consideration. Macroeconomic uncertainty, including foreign exchange rates, inflation, disruptions in access to bank deposits or lending commitments due to bank failures and uncertainty about economic stability, and concerns about economic recessions in the United States or other major markets, have and could continue to impact the budgets and purchasing decisions and processes of certain of our customers and prospective customers, some of whom have added additional controls on expenditures and require additional internal approvals of expenditures, even if relatively small in dollar amount, all of which could lengthen our average sales cycle. In addition, we might devote substantial time and effort to a particular unsuccessful sales effort, and as a result, we could lose other sales opportunities or incur expenses that are not offset by an increase in revenue, which could harm our business.

Current wording

The timing of sales of our offerings is difficult to forecast because of the length and unpredictability of our sales cycle, particularly with large enterprises and with respect to certain of our solutions. We sell our solutions primarily to IT departments that are managing a growing set of user and compliance demands, including with respect to AI, which has increased the complexity of customer requirements to be met and confirmed during the sales cycle and prolonged our sales cycle. Our average sales cycle with an enterprise customer is approximately four months, although unfavorable macroeconomic conditions and the extent to which we continue to enter into larger deals, could result in longer average sales cycles. Further, the length of time that potential customers devote to their testing and evaluation, contract negotiation and budgeting processes varies significantly, depending on the size of the organization and nature of the product or service under consideration. Macroeconomic uncertainty, including foreign exchange rates, inflation, disruptions in access to bank deposits or lending commitments due to bank failures and uncertainty about economic stability, and concerns about economic recessions in the United States or other major markets, have and could continue to impact the budgets and purchasing decisions and processes of certain of our customers and prospective customers, some of whom have added additional controls on expenditures and require additional internal approvals of expenditures, even if relatively small in dollar amount, all of which could lengthen our average sales cycle. In addition, we might devote substantial time and effort to a particular unsuccessful sales effort, and as a result, we could lose other sales opportunities or incur expenses that are not offset by an increase in revenue, which could harm our business.

Previous wording

In the United States, federal, state, and local governments have enacted numerous data privacy security laws, including data breach notification laws, data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). Numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, or collectively, the CCPA, imposes obligations on covered businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain rights related to their personal data. The CCPA applies to personal data of consumers, business representatives and employees who are California residents and provides for fines for noncompliance (up to $7,500 per intentional violations. Further, the CCPA allows private litigants affected by certain data breaches to recover significant statutory damages. Similar laws have been passed or are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future. These developments may further complicate compliance efforts and may increase legal risk and compliance costs for us, the third parties with whom we work, and our customers.

Current wording

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). Numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, or collectively, the CCPA, imposes obligations on covered businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain rights related to their personal data. The CCPA applies to personal data of consumers, business representatives and employees who are California residents and provides for fines for noncompliance (up to $7,500 per intentional violation). Further, the CCPA allows private litigants affected by certain data breaches to recover significant statutory damages. Similar laws have been passed or are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future. These developments may further complicate compliance efforts and may increase legal risk and compliance costs for us, the third parties with whom we work, and our customers.

Previous wording

Our employees and personnel use generative AI technologies to perform their work, and the disclosure and use of personal data in generative AI technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating generative AI. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages.

Current wording

Our employees and personnel use generative AI technologies to perform their work, and the disclosure and use of personal data in generative AI technologies are subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating generative AI. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages.

Previous wording

Additionally, under various privacy laws and other obligations, we may be required to provide certain notices and obtain consents to process certain types of personal data. For example, some of our data processing practices may be challenged including in relation to our use of chatbot and session replay providers. These practices may be subject to increased challenges by class action plaintiffs. Our inability or failure to obtain consent for these practices could result in adverse consequences.

Current wording

Additionally, under various privacy laws and other obligations, we may be required to provide certain notices and obtain consents to process certain types of personal data. For example, some of our data processing practices may be subject to challenges or lawsuits under data privacy and communications laws, including wiretapping laws, if we share consumer information with third parties through various methods, such as chatbot and session replay providers, or via third-party marketing pixels. These practices may be subject to increased challenges by class action plaintiffs. Our inability or failure to obtain consent for these practices could result in adverse consequences, including class action litigation and mass arbitration demands.

Previous wording

Outside the United States, an increasing number of laws, regulations, and industry standards govern data privacy and security. For example, the European Union’s General Data Protection Regulation, or EU GDPR, and the United Kingdom’s GDPR, or UK GDPR, impose strict requirements for processing the personal data of individuals. Violations of these obligations carry significant potential consequences. For example, under the EU GDPR, government regulators may impose temporary or definitive bans on processing, as well as fines of up to €20 million or 4% of the annual global revenue, whichever is greater. In addition, new EU and UK regulations or legislative actions regarding data privacy and security (together with applicable industry standards) may be proposed or enacted, such as the EU's Digital Operational Resilience Act and its second Network and Information Security Directive, which may increase our costs of doing business, and non-compliance with such laws and regulations, as applicable to us, may lead to significant administrative fines. We have an internal data privacy function that oversees and supervises our compliance with data privacy laws, including EU and UK data protection regulations but, despite our efforts, we may fail, or be perceived to have failed, to comply. Canada's Personal Information Protection and Electronic Documents Act, or PIPEDA, and various related provincial laws, Canada's Anti-Spam Legislation, or CASL, and Brazil's General Data Protection Law (Law No. 13,709/2018), or Lei Geral de Proteção de Dados Pessaois, or LGPD, may apply to our operations. The LGPD broadly regulates processing personal data of individuals in Brazil and imposes compliance obligations and penalties comparable to those of the EU GDPR. Additionally, we also target customers in Asia and may be subject to new and emerging data privacy regimes in Asia, including China's Personal Information Protection Law, Japan's Act on the Protection of Personal Information, and Singapore's Personal Data Protection Act.

Current wording

Outside the United States, an increasing number of laws, regulations, and industry standards govern data privacy and security. For example, the European Union’s General Data Protection Regulation, or EU GDPR, and the United Kingdom’s GDPR, or UK GDPR, impose strict requirements for processing the personal data of individuals. Violations of these obligations carry significant potential consequences. For example, under the EU GDPR, government regulators may impose temporary or definitive bans on processing, as well as fines of up to €20 million or 4% of the annual global revenue, whichever is greater. In addition, new EU and UK regulations or legislative actions regarding data privacy and security (together with applicable industry standards) may be proposed or enacted, such as the EU's Digital Operational Resilience Act and its second Network and Information Security Directive, which may increase our costs of doing business, and non-compliance with such laws and regulations, as applicable to us, may lead to significant administrative fines. We have an internal data privacy function that oversees and supervises our compliance with data privacy laws, including EU and UK data protection regulations, but despite our efforts, we may fail, or be perceived to have failed, to comply. Canada's Personal Information Protection and Electronic Documents Act, or PIPEDA, and various related provincial laws, Canada's Anti-Spam Legislation, or CASL, and Brazil's General Data Protection Law (Law No. 13,709/2018), or Lei Geral de Proteção de Dados Pessoais, or LGPD, may apply to our operations. The LGPD broadly regulates processing personal data of individuals in Brazil and imposes compliance obligations and penalties comparable to those of the EU GDPR. Additionally, we also target customers in Asia and may be subject to new and emerging data privacy regimes in Asia, including China's Personal Information Protection Law, Japan's Act on the Protection of Personal Information, and Singapore's Personal Data Protection Act.

Previous wording

Our success is dependent in part upon establishing and maintaining relationships with a variety of channel partners that we utilize to extend our geographic reach and market penetration. We typically use a two-tiered, channel model whereby we sell our products and services to our distributors, who in turn sell to our resellers, who then sell to our end users, who we call customers. We anticipate that we will continue to rely on this two-tiered sales model in order to help facilitate sales of our offerings as part of larger purchases in the United States and to grow our business internationally. In 2024, 2023 and 2022, we derived 94%, 93% and 92%, respectively, of our revenue from sales through channel partners, and the percentage of revenue derived from channel partners may continue to increase in future periods. Ingram Micro, Inc., a distributor, accounted for 34%, 36% and 38% of our revenue in 2024, 2023 and 2022, respectively, and 29% of our accounts receivable at December 31, 2024 and 32% at December 31, 2023. Our agreements with our channel partners, including our agreement with Ingram Micro, are non-exclusive and do not prohibit them from working with our competitors or offering competing solutions, and some of our channel partners may have more established relationships with our competitors. Similarly, our channel partners have no obligations to renew their agreements with us on commercially reasonable terms or at all, and certain of the agreements governing these relationships may be terminated by either party at any time, with no or limited notice. For example, our agreement with Ingram Micro allows Ingram Micro to terminate the agreement in their discretion upon 30 days’ written notice to us. If our channel partners choose to place greater emphasis on products of their own or those offered by our competitors or as a result of an acquisition, competitive factors or other reasons do not continue to market and sell our solutions in an effective manner or at all, our ability to grow our business and sell our solutions, particularly in key international markets, may be adversely affected. In addition, our failure to recruit additional channel partners, or any reduction or delay in their sales of our solutions and professional services, including as a result of economic uncertainty, legal or regulatory actions, such as government investigations or law enforcement activities, impacting their business, or conflicts between channel sales and our direct sales and marketing activities may harm our results of operations. Finally, even if we are successful, our relationships with channel partners may not result in greater customer usage of our solutions and professional services or increased revenue.

Current wording

Our agreements with our channel partners, including our agreement with Ingram Micro, are non-exclusive and do not prohibit them from working with our competitors or offering competing solutions, and some of our channel partners may have more established relationships with our competitors. Similarly, our channel partners have no obligations to renew their agreements with us on commercially reasonable terms or at all, and certain of the agreements governing these relationships may be terminated by either party at any time, with no or limited notice. For example, our agreement with Ingram Micro allows Ingram Micro to terminate the agreement at their discretion upon 30 days’ written notice to us. If our channel partners choose to place greater emphasis on products of their own or those offered by our competitors or as a result of an acquisition, competitive factors or other reasons do not continue to market and sell our solutions in an effective manner or at all, our ability to grow our business and sell our solutions, particularly in key international markets, may be adversely affected. In addition, our failure to recruit additional channel partners, or any reduction or delay in their sales of our solutions and professional services, including as a result of economic uncertainty, legal or regulatory actions, such as government investigations or law enforcement activities, impacting their business, or conflicts between channel sales and our direct sales and marketing activities may harm our results of operations. Finally, even if we are successful, our relationships with channel partners may not result in greater customer usage of our solutions and professional services or increased revenue.

Previous wording

A portion of our revenue is generated from subscriptions and perpetual licenses sold to governmental entities in the United States. Additionally, many of our current and prospective customers, such as those in the financial services, energy, insurance and healthcare industries, are highly regulated and may be required to comply with more stringent regulations in connection with subscribing to and implementing our enterprise platform. Selling licenses to these entities can be highly competitive, expensive and time-consuming, often requiring significant upfront time and expense without any assurance that we will successfully complete a sale. Governmental demand and payment for our enterprise platform may also be impacted by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our enterprise platform. In addition, governmental entities have the authority to terminate contracts at any time for the convenience of the government, which creates risk regarding revenue anticipated under our existing government contracts.

Current wording

A portion of our revenue is generated from subscriptions and perpetual licenses sold to governmental entities in the United States. Additionally, many of our current and prospective customers, such as those in the financial services, energy, insurance and healthcare industries, are highly regulated and may be required to comply with more stringent regulations in connection with subscribing to and implementing our enterprise platform. Selling licenses to these entities can be highly competitive, expensive and time-consuming, often requiring significant upfront time and expense without any assurance that we will successfully complete a sale. Governmental demand and payment for our enterprise platform may also be impacted by public sector budgetary cycles and funding authorizations, the operational stability of federal agencies, and the prioritization of cybersecurity and digital infrastructure initiatives. Funding reductions or delays, including those resulting from a U.S. government shutdown, reductions or eliminations of agency operating budgets or deprioritization of cybersecurity digital infrastructure related initiatives would adversely affect public sector demand for our enterprise platform. For example, the U.S. presidential administration's priorities and actions to reduce government spending, including, but not limited to, those previously driven by the Department of Government Efficiency, may impact the availability of funding for U.S. government customers as a result of the elimination of departments and personnel. These actions may lead to elongated sales cycles and procurement decisions and could result in fewer contract opportunities or reduced funding for existing initiatives, all of which would adversely affect our business and financial performance. In addition, governmental entities have the authority to terminate contracts at any time for the convenience of the government, which creates risk regarding revenue anticipated under our existing government contracts.

Previous wording

Some of our revenue is derived from contracts with U.S. government entities, as well as subcontracts with higher-tier contractors and customers who receive government funding. As a result, we are subject to federal contracting regulations, including the Federal Acquisition Regulation, or the FAR. Under the FAR, certain types of contracts require pricing that is based on estimated direct and indirect costs, which are subject to change. The new U.S. presidential administration’s commitment to reduce government spending, may impact availability of funding for U.S. government customers, generally, as well as eliminate departments and/or personnel who rely on our products which could adversely affect our business and financial performance.

Current wording

Some of our revenue is derived from contracts with U.S. government entities, as well as subcontracts with higher-tier contractors and customers who receive government funding. As a result, we are subject to federal contracting regulations, including the Federal Acquisition Regulation, or the FAR. Under the FAR, certain types of contracts require pricing that is based on estimated direct and indirect costs, which are subject to change.

Previous wording

In connection with our U.S. government contracts, we may be subject to government audits and review of our policies, procedures, and internal controls for compliance with contract terms, procurement regulations, and applicable laws. In certain circumstances, if we do not comply with the terms of a contract or with regulations or statutes, we could be subject to contract termination or downward contract price adjustments or refund obligations, could be assessed civil or criminal penalties, or could be debarred or suspended from obtaining future government contracts for a specified period of time.

Current wording

In connection with our U.S. government contracts, we may be subject to government audits and review of our policies, procedures, and internal controls for compliance with contract terms, procurement regulations, and applicable laws. In certain circumstances, if we do not comply with the terms of a contract or with regulations or statutes, we could be subject to contract termination or downward contract price adjustments or refund obligations, could be assessed civil or criminal penalties, or could be debarred or suspended from obtaining future government contracts for a specified period of time. Any such termination, adjustment, sanction, debarment or suspension could have an adverse effect on our business.

Previous wording

Any such termination, adjustment, sanction, debarment or suspension could have an adverse effect on our business. Moreover, as a U.S. government contractor, we maintain plans to ensure compliance with nondiscrimination and regulatory requirements for qualified employees on the basis of gender, race, disability and veteran status. Consequently, we may be subject to executive orders and regulatory changes affecting various aspects of our operations, including compliance with nondiscrimination plans. Any required elimination or modification of such plans in response to new executive orders could pose challenges in hiring or retaining employees and may lead to other adverse operational impacts. Failure to comply with these requirements could expose us to administrative, civil, or criminal liabilities, including fines, penalties, repayments or suspension or debarment from eligibility from future U.S. government contracts. Further, as a U.S. government contractor, we are subject to an increased risk of investigations, criminal prosecution, civil fraud, whistleblower lawsuits and other legal actions and liabilities as compared to solely private sector commercial companies.

Current wording

Moreover, as a U.S. government contractor, we maintain plans to ensure compliance with applicable legal and contractual requirements related to nondiscrimination. Consequently, we may be subject to executive orders and regulatory changes affecting various aspects of our operations. Any required elimination or modification of such plans in response to new or changes to existing executive orders or legal or contractual requirements could pose challenges in hiring or retaining employees and may lead to other adverse operational impacts. Failure to comply with these requirements could expose us to administrative, civil, or criminal liabilities, including fines, penalties, repayments or suspension or debarment from eligibility for future U.S. government contracts. Further, as a U.S. government contractor, we are subject to an increased risk of investigations, criminal prosecution, civil fraud claims, whistleblower lawsuits and other legal actions and liabilities as compared to solely private sector commercial companies.

Previous wording

•failure to predict market demand accurately, including changes in demand as a result of macroeconomic trends, in terms of functionality and to supply offerings that meets this demand in a timely fashion;

Current wording

•failure to predict market demand accurately, including changes in demand as a result of macroeconomic trends, in terms of functionality and to supply offerings that meet this demand in a timely fashion;

Previous wording

We market and sell our solutions and professional services throughout the world and have personnel in many parts of the world. International operations generated 46% and 45% of our revenue in 2024 and 2023, respectively. Our growth strategy is dependent, in part, on our continued international expansion. We expect to conduct a significant amount of our business with organizations that are located outside the United States, particularly in Europe and Asia. We cannot assure that our expansion efforts into international markets will be successful in creating further demand for our solutions and professional services outside of the United States or in effectively selling our solutions and professional services in the international markets that we enter. Our current international operations and future initiatives will involve a variety of risks, including:

Current wording

We market and sell our solutions and professional services throughout the world and have personnel in many parts of the world. International operations generated 47% and 46% of our revenue in 2025 and 2024, respectively. Our growth strategy is dependent, in part, on our continued international expansion. We expect to conduct a significant amount of our business with organizations that are located outside the United States, particularly in Europe and Asia. We cannot assure that our expansion efforts into international markets will be successful in creating further demand for our solutions and professional services outside of the United States or in effectively selling our solutions and professional services in the international markets that we enter. Our current international operations and future initiatives will involve a variety of risks, including:

Previous wording

We have acquired products, technologies and businesses from other parties, such as our acquisition of Vulcan Cyber Ltd., or Vulcan Cyber, which we announced in January 2025, our June 2024 acquisition of Eureka Security, Inc., or Eureka, and our October 2023 acquisition of Ermetic, Ltd., or Ermetic, and we expect to expand our current business by acquiring additional businesses or technologies in the future. Acquisitions involve many risks, including the following:

Current wording

We have acquired products, technologies and businesses from other parties, such as recent acquisitions discussed in Note 6 of our consolidated financial statements, and we expect to expand our current business by acquiring additional businesses or technologies in the future. Acquisitions involve many risks, including the following:

Previous wording

In addition, Vulcan Cyber, Eureka and Ermetic and other companies we have acquired principally operate in Israel and the Regional conflict in the Middle East may also have the effect of heightening the risks identified above.

Current wording

In addition, companies we have recently acquired principally operate in Israel and the regional conflict in the Middle East may also have the effect of heightening the risks identified above.

Previous wording

We are subject to risks associated with our investments in private companies, including partial or complete loss of invested capital, and significant changes in the fair value of this portfolio could adversely impact our financial results.

Current wording

We are subject to risks associated with our investments in private companies and private equity funds, including partial or complete loss of invested capital, and significant changes in the fair value of this portfolio could adversely impact our financial results.

Previous wording

We have invested, and may continue to invest, in private companies where we do not have the ability to exercise significant influence over results. Investments in private companies are inherently risky. The companies in which we invest are early stage private companies focused on cybersecurity innovation, and such companies may still be developing technologies or products with limited cash to support the development, marketing and sales of their technologies or products. These companies may have no or limited revenues, may not be or ever become profitable, may not be able to secure additional private financing to fund their operations, or their technologies, services, or products may not be successfully developed or introduced to the market. If any company in which we invest fails, we could lose all or part of our investment in that company. In addition, if we determine that any of our investments in such companies have experienced a decline in value, we will recognize an expense to adjust the carrying value to its estimated fair value. For example, in 2023 we recognized $5.6 million of impairment loss related to our investments. Negative changes in the estimated fair value of our investments in private companies could have an adverse effect on our results of operations and financial condition.

Current wording

We have invested, and may continue to invest, in private companies and private equity or venture capital funds, where we do not have the ability to exercise significant influence over results or investment decisions. Investments in private companies and limited partnerships are inherently risky. The companies in which we invest, or the companies held within the portfolios of funds in which we are a limited partner, are often early stage private companies focused on cybersecurity innovation, artificial intelligence, and other emerging technologies. Such companies may still be developing technologies or products with limited cash to support the development, marketing and sales of their technologies or products. These companies may have no or limited revenues, may not be or ever become profitable, may not be able to secure additional private financing to fund their operations, or their technologies, services, or products may not be successfully developed or introduced to the market. If any company in which we invest, or the funds in which we participate, fails, we could lose all or part of our investment in that company. In addition, if we determine that any of our investments in such companies or funds have experienced a decline in value, we will recognize an expense to adjust the carrying value to its estimated fair value. For example, in 2023 we recognized $5.6 million of impairment loss related to our investments. Negative changes in the estimated fair value of our investments in private companies and funds could have an adverse effect on our results of operations and financial condition.

Previous wording

Furthermore, our ability to liquidate an investment in a private company will typically depend on a liquidity event, such as a private equity financing, a public offering or acquisition, as no public market currently exists for such securities. We may not be able to dispose of these investments on favorable terms or at all.

Current wording

Furthermore, our ability to liquidate an investment in a private company or an interest in a private equity fund will typically depend on a liquidity event, such as a private equity financing, a public offering or acquisition, as no public market currently exists for such securities. Our interests in private funds are generally subject to significant transfer restrictions and may require us to remain invested for the life of the fund, which may extend for ten years or more. We may not be able to dispose of these investments on favorable terms or at all.

Previous wording

To service our indebtedness, we will require a significant amount of cash. Our ability to generate cash, make scheduled payments or to refinance our debt obligations depends on our successful financial and operating performance, which may be affected by a range of economic, competitive and business factors, many of which are outside of our control and some of which are described elsewhere in the “Risk Factors” section of this report.

Current wording

To service our indebtedness, we will require a significant amount of cash. Our ability to generate cash, make scheduled payments or refinance our debt obligations depends on our successful financial and operating performance, which may be affected by a range of economic, competitive and business factors, many of which are outside of our control and some of which are described elsewhere in the “Risk Factors” section of this report.

Previous wording

The global economy, including credit and financial markets, recently experienced extreme volatility and disruptions, including severely diminished liquidity and credit availability, declines in consumer confidence, declines in economic growth, increases in unemployment rates, inflation, interest rate fluctuations and uncertainty about economic stability. For example, in recent years the high rates of inflation, high interest rates and concerns about an economic recession in the United States or other major markets resulted in widespread unemployment, economic slowdown and extreme volatility in the capital markets. In 2022 and 2023, the Federal Reserve raised interest rates multiple times in response to concerns about inflation. While the Federal Reserve decreased interest rates in 2024, interest rates remain high and the Federal Reserve is not expected to significantly decrease interest rates in the immediate future. Higher interest rates, coupled with reduced government spending and volatility in financial markets, including with respect to foreign exchange, may increase economic uncertainty and affect consumer spending. For example, during periods with a relatively strong U.S. dollar, our products are more expensive for existing and prospective international customers, which has impacted, and could in the future impact, the budgets and purchasing decisions of certain of our existing and prospective international customers.

Current wording

The global economy, including credit and financial markets, recently experienced extreme volatility and disruptions, including severely diminished liquidity and credit availability, declines in consumer confidence, declines in economic growth, increases in unemployment rates, inflation, interest rate fluctuations, increased global trade barriers, and uncertainty about economic stability. For example, in recent years the high rates of inflation, high interest rates and concerns about an economic recession in the United States or other major markets resulted in widespread unemployment, economic slowdown and extreme volatility in the capital markets. In 2022 and 2023, the Federal Reserve raised interest rates multiple times in response to concerns about inflation and maintained those levels throughout 2024. While the Federal Reserve decreased interest rates in 2025, interest rates remain elevated relative to recent historical lows. Higher interest rates, coupled with reduced government spending and volatility in financial markets, including with respect to foreign exchange, may increase economic uncertainty and affect consumer spending. For example, during periods with a relatively strong U.S. dollar, our products are more expensive for existing and prospective international customers, which has impacted, and in the future could impact, the budgets and purchasing decisions of certain of our existing and prospective international customers.

Previous wording

If the equity and credit markets deteriorate, including as a result of political unrest or war, it may make any necessary debt or equity financing more difficult to obtain in a timely manner or on favorable terms, more costly or more dilutive. Increased inflation rates can adversely affect us by increasing our costs, including labor and employee benefit costs. In addition, higher inflation also could increase our customers’ operating costs, which could result in reduced budgets for our customers, longer sales cycles and potentially less demand for our products. Any significant increases in inflation and related increase in interest rates could have a material adverse effect on our business, results of operations and financial condition.

Current wording

Increased inflation rates can adversely affect us by increasing our costs, including labor and employee benefit costs. In addition, higher inflation could also increase our customers’ operating costs, which could result in reduced budgets for our customers, longer sales cycles and potentially less demand for our products. Any significant increases in inflation and related increases in interest rates could have a material adverse effect on our business, results of operations and financial condition.

Previous wording

Certain U.S. government contracts may require our employees to maintain various levels of security clearances, and may require us to maintain a facility security clearance, to comply with Department of Defense, or DoD, requirements. The DoD has strict security clearance requirements for personnel who perform work in support of classified programs. Obtaining and maintaining a facility clearance and security clearances for employees can be a difficult, sometimes lengthy process. If we do not have employees with the appropriate security clearances, then a customer requiring classified work could terminate an existing contract or decide not to renew the contract upon its expiration. To the extent we are not able to obtain or maintain a facility security clearance, we may not be able to bid on or win new classified contracts, and existing contracts requiring a facility security clearance could be terminated.

Current wording

Obtaining and maintaining a facility clearance and security clearances for employees can be a difficult, sometimes lengthy process. If we do not have employees with the appropriate security clearances, then a customer requiring classified work could terminate an existing contract or decide not to renew the contract upon its expiration. To the extent we are not able to obtain or maintain a facility security clearance, we may not be able to bid on or win new classified contracts, and existing contracts requiring a facility security clearance could be terminated.

Previous wording

At December 31, 2024, we had 47 issued patents and 22 patent applications pending in the United States relating to our technology. We cannot assure you that any patents will issue from any patent applications, that patents that issue from such applications will give us the protection that we seek or that any such patents will not be challenged, invalidated or circumvented. Any patents that may issue in the future from our pending or future patent applications may not provide sufficiently broad protection and may not be enforceable in actions against alleged infringers. Obtaining and enforcing software patents in the United States is becoming increasingly challenging. Any patents we have obtained or may obtain in the future may be found to be invalid or unenforceable in light of recent and future changes in the law. We have registered the “Tenable” and “Nessus,” and our Tenable logo in the United States and certain other countries. We have registrations and/or pending applications for additional trademarks; however, we cannot assure you that any future trademark registrations will be issued for pending or future applications or that any registered trademarks will be enforceable or provide adequate protection of our proprietary rights. While we have copyrights in our software, we do not typically register such copyrights with the Copyright Office. This failure to register the copyrights in our software may preclude us from obtaining statutory damages for infringement under certain circumstances. We also license software from third parties for integration into our software, including open source software and other software available on commercially reasonable terms. We cannot assure you that such third parties will maintain such software or continue to make it available.

Current wording

At December 31, 2025, we had 53 issued patents and 22 patent applications pending in the United States relating to our technology. We cannot assure you that any patents will issue from any patent applications, that patents that issue from such applications will give us the protection that we seek or that any such patents will not be challenged, invalidated or circumvented. Any patents that may issue in the future from our pending or future patent applications may not provide sufficiently broad protection and may not be enforceable in actions against alleged infringers. Obtaining and enforcing software patents in the United States is becoming increasingly challenging. Any patents we have obtained or may obtain in the future may be found to be invalid or unenforceable in light of recent and future changes in the law. We have registered the “Tenable” and “Nessus,” and our Tenable logo in the United States and certain other countries. We have registrations and/or pending applications for additional trademarks; however, we cannot assure you that any future trademark registrations will be issued for pending or future applications or that any registered trademarks will be enforceable or provide adequate protection of our proprietary rights. While we have copyrights in our software, we do not typically register such copyrights with the Copyright Office. This failure to register the copyrights in our software may preclude us from obtaining statutory damages for infringement under certain circumstances. We also license software from third parties for integration into our software, including open source software and other software available on commercially reasonable terms. We cannot assure you that such third parties will maintain such software or continue to make it available.

Previous wording

Recently, the stock markets have experienced extreme price and volume fluctuations that have affected and continue to affect the market prices of equity securities of many companies, high rates of inflation and interest rates, disruptions in access to bank deposits or lending commitments due to bank failures and uncertainty about economic stability and concerns about an economic recession in the United States or other major markets, the ongoing military conflict between Ukraine and Russia, the ongoing conflict in the Middle East, increasing tensions between China and Taiwan and macroeconomic conditions. These fluctuations have often been unrelated or disproportionate to the operating performance of those companies. Broad market and industry fluctuations, as well as general economic, political, regulatory and market conditions, may negatively impact the market price of our common stock. In the past, companies that have experienced volatility in the market price of their securities have been subject to securities class action litigation. We may be the target of this type of litigation in the future, which could result in substantial costs and divert our management’s attention.

Current wording

Recently, the stock markets have experienced extreme price and volume fluctuations that have affected and continue to affect the market prices of equity securities of many companies. These fluctuations have often been unrelated or disproportionate to the operating performance of those companies. Broad market and industry fluctuations, as well as general economic, political, geopolitical, regulatory and market conditions, may negatively impact the market price of our common stock. In the past, companies that have experienced volatility in the market price of their securities have been subject to securities class action litigation. We may be the target of this type of litigation in the future, which could result in substantial costs and divert our management’s attention.

Previous wording

Future sales of substantial amounts of our common stock in the public markets by us or our stockholders, or the perception such sales might occur, could reduce the price that our common stock might otherwise attain.

Current wording

Future sales of substantial amounts of our common stock in the public markets by us or our stockholders, or the perception that such sales might occur, could reduce the price that our common stock might otherwise attain.