Risk Factors Dashboard

Once a year, publicly traded companies issue a comprehensive report of their business, called a 10-K. A component mandated in the 10-K is the ‘Risk Factors’ section, where companies disclose any major potential risks that they may face. This dashboard highlights all major changes and additions in new 10K reports, allowing investors to quickly identify new potential risks and opportunities.

View risk factors by ticker

Search filings by term

Risk Factors - PANW

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing

$PANW Risk Factor changes from 00/08/29/25/2025 to 00/09/10/26/2026

Item 1A. Risk FactorsOur operations and financial results are subject to various risks and uncertainties including those described below. The risks and uncertainties described below are not the only ones we face. Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, also may become important factors that affect us. If any of the following risks or others not specified below materialize, our business, financial condition, and operating results could be materially adversely affected, and the market price of our common stock could decline. In addition, the impacts of any worsening of the economic environment may exacerbate the risks described below, any of which could have a material impact on us.•Our revenue growth rate in recent periods may not be indicative of our future performance, and we may not be able to maintain profitability, which could cause our business, financial condition, and operating results to suffer.•We rely on revenue from subscription and support offerings, and because we recognize revenue from subscription and support over the term of the relevant service period, downturns or upturns in sales or renewals of these subscription and support offerings are not immediately reflected in full in our operating results.•Our consumption- or usage-based offerings may expose us to customer usage optimization behavior that could create revenue volatility.•We are exposed to the credit and liquidity risk of our customers, and to credit exposure in weakened markets, which could result in material losses.•A portion of our revenue is generated by sales to government entities, which are subject to a number of challenges and risks.•The “identity security” market lacks a universally accepted definition, which could lead to mischaracterization of our offerings and adverse evaluations by industry stakeholders.•Customer trends toward vendor consolidation in cybersecurity may favor competitors offering broader platforms.•Cloud infrastructure providers and advanced AI companies increasingly offer native security and observability capabilities that compete directly with our offerings.•If we do not accurately predict, prepare for, and respond promptly to rapidly evolving technological and market developments and successfully manage product and subscription introductions and transitions to meet changing end-customer needs in the enterprise security industry, our competitive position and prospects will be harmed.•The success of our strategy depends on maintaining a broad ecosystem of integrations with third-party technologies, which requires significant ongoing investment.- 17 -Table of Contents•Issues in the development, deployment, or use of AI may result in reputational harm, legal liability, and could adversely affect our business and operating results.•The emergence of AI agents as a new class of identity presents both opportunities and risks that could impact our identity security offerings.•A significant network or data security incident may materially impact our reputation, financial condition, and operating results.•Defects, errors, or vulnerabilities in our products, subscriptions, or support offerings, the failure of our products or subscriptions to block a virus or prevent a security breach or incident, misuse of our products, or risks of product liability claims could harm our reputation and adversely impact our operating results.•Our shared responsibility security model relies on customers to configure and use our products securely, and customer errors could harm our reputation even when we are not at fault.•Our ability to sell our products and subscriptions is dependent on the quality of our technical support services and those of our channel partners, and the failure to offer high-quality technical support services could have a material adverse effect on our end-customers’ satisfaction with our products and subscriptions, our sales, and our operating results.•Our subscription agreements typically contain service-level commitments, and failure to meet these commitments could reduce our revenue and harm our business.•We rely on data center facilities operated by third-party cloud service providers, and any limitations on capacity, or interference with our use could adversely affect our business, financial condition, and results of operations.•Claims by others that we infringe their intellectual property rights could harm our business.•Our proprietary rights may be difficult to enforce or protect, which could enable others to copy or use aspects of our products or subscriptions without compensating us.•Our use of open source software in our products and subscriptions could negatively affect our ability to sell our products and subscriptions and subject us to possible litigation.•We license technology from third parties, and our inability to maintain those licenses could harm our business.•If we are unable to attract, retain, and motivate our key technical, sales, and management personnel, our business could suffer.•Our products and subscriptions are subject to certification, testing, and regulatory approval requirements in foreign jurisdictions, and our failure to obtain or maintain such approvals could limit our ability to sell in those markets.•We are exposed to fluctuations in foreign currency exchange rates, which could negatively affect our financial condition and operating results.•We face risks associated with having operations and employees located in Israel.•We may incur significant costs to comply with privacy and data protection laws and other requirements, and, if we fail to comply, we could be subject to government enforcement actions, private litigation, and adverse publicity, which could materially adversely affect our business, financial condition, and operating results.•We may have exposure to tax liabilities that are greater than anticipated.•We are obligated to maintain proper and effective internal control over financial reporting. We may not complete our analysis of our internal control over financial reporting in a timely manner, or our internal control may not be determined to be effective, which may adversely affect investor confidence in our company and, as a result, the value of our common stock.•We may not have the ability to raise the funds necessary to settle conversions of the 2030 Notes, repurchase the 2030 Notes upon a fundamental change, or repay the 2030 Notes in cash at their maturity, and our other debt may contain limitations on our ability to pay cash upon conversion or repurchase of the 2030 Notes.•The Capped Calls may affect the value of the 2030 Notes and our common stock.- 18 -Table of ContentsRisks Related to Global Economic and Geopolitical ConditionsOur operating results may be adversely affected by unfavorable economic and market conditions and the uncertain geopolitical environment. Instability in global credit markets, inflation, changes in public policies, changes in domestic and international regulations, changes in interest rates, foreign currency exchange rate fluctuations, trade regulations and tariffs, international trade disputes and agreements, changes in tax laws, geopolitical turmoil, and other disruptions to global and regional economies and markets continue to add uncertainty to global economic conditions.U. We are subject to these governmental sanctions and export controls, which may subject us to liability if we are not in full compliance with applicable laws. In addition, government-mandated restrictions on technology access, including export controls, import restrictions, or requirements that certain technologies not be made available in particular countries or regions, could limit our ability to sell or support our products and subscriptions in affected markets, require us to modify or discontinue certain products or features, or require us to exit certain markets.Risks Related to Our BusinessRISKS RELATED TO OUR GROWTHOur business and operations have experienced growth in recent periods, and if we do not effectively manage our future growth or are unable to improve our systems, processes, and controls, our business and operating results could be adversely affected. As a result, our employee headcount has increased, and we expect it to continue to grow over the next year. For example, from the end of fiscal 2025 to the end of fiscal 2026, our headcount increased from 16,068 to 21,921 employees, including approximately 4,223 additional headcount as a result of the CyberArk acquisition. In addition, as we have grown, the number of end-customers has also increased, and we have managed more complex deployments of our products and subscriptions with larger end-customers. To manage any future growth effectively, we must continue to improve and expand our information technology and financial infrastructure, our operating and administrative systems and controls, and our ability to manage headcount, capital, and processes in an efficient manner. Our revenue growth rate in recent periods may not be indicative of our future performance, and we may not be able to maintain profitability, which could cause our business, financial condition, and operating results to suffer. Our revenue for any quarterly or annual period should not be relied upon as an indication of our future revenue or revenue growth for any future period. If we are unable to maintain consistent or increasing revenue or revenue growth, the market price of our common stock could be volatile, and it may be difficult for us to maintain profitability or maintain or increase cash flow on a consistent basis. In addition, we anticipate that our operating expenses will continue to increase as our business grows. Our growth efforts may prove more expensive than we currently anticipate, and we may not succeed in increasing our revenues sufficiently to offset increasing expenses. Revenue growth may slow or decline, including due to slowing or declining demand, increasing competition, market shifts, or a failure to capitalize on growth opportunities. For example, we have historically received a substantial portion of sales orders and generated a substantial portion of revenue during the last few weeks of each fiscal quarter. As we grow, these seasonal and cyclical variations may become more pronounced. If we fail to meet or exceed such expectations for these, or any other, reasons, the market price of our common stock could fall substantially, and we could face costly lawsuits, including securities class action suits. Any deterioration in general economic conditions, including as a result of the geopolitical or economic environment, may cause current and prospective customers to delay or cut their overall security and IT spending.Sales to large enterprise end-customers involve risks not typically present with smaller entities, including longer sales cycles, the risk that substantial resources may be spent on a potential end-customer that does not ultimately purchase our products, subscriptions, and support offerings, and increased purchasing power and leverage held by large end-customers in negotiating contractual arrangements. Failure to realize sales from large enterprise end-customers could materially and adversely affect our business, financial condition, and operating results.We rely on revenue from subscription and support offerings, and because we recognize revenue from subscription and support over the term of the relevant service period, downturns or upturns in sales or renewals of these subscription and support offerings are not immediately reflected in full in our operating results. Existing end-customers have no contractual obligation to renew their subscription and support contracts after their initial contract period and may renew for shorter contract terms or terms that are less economically beneficial to us, or not at all.Our consumption- or usage-based offerings may expose us to customer usage optimization behavior that could create revenue volatility.A growing portion of our revenue is generated from offerings priced on a consumption or usage basis, including certain of our observability and AI-related offerings. Pricing on this basis may result in significant near-term revenue growth as customers scale their usage but also creates exposure to customer optimization behavior, where customers who have rapidly increased usage subsequently seek to reduce, optimize, or reconfigure their consumption or usage to lower costs. This dynamic has been observed in the industry with cloud-native customers and, more recently, with AI-native - 20 -Table of Contentscustomers, whose data volumes and usage patterns can fluctuate significantly.The sales prices of our products, subscriptions, and support offerings may decrease, which may reduce our revenue and gross profits and adversely impact our financial results. We also anticipate that sales prices and gross profits for our products, subscriptions, and support offerings could decrease over product life cycles. Declining sales prices could reduce our revenue, gross profits, and profitability and adversely impact our financial and operational results. As of July 31, 2026, one distributor individually represented 19% of our gross accounts receivable.Training and programs provided to our channel partners to assist them in selling our products, subscriptions, and support offerings may not be effective or utilized. Our channel partners may be unsuccessful in marketing, selling, and supporting our products and subscriptions, and we may not be able to incentivize our channel partners to sell our products and subscriptions, or our channel partners may have incentives to promote our competitors' products and subscriptions. Our agreements with channel partners may generally be terminated for any reason by either party with advance notice prior to each annual renewal date, and we cannot be certain that we will retain them or secure additional or replacement channel partners. Any new channel partner requires extensive training and may take months to achieve productivity.We are exposed to the credit and liquidity risk of our customers, and to credit exposure in weakened markets, which could result in material losses. Increases in deferred payments negatively impact our short-term cash flows and subject us to risk of non-payment, including as a result of insolvency. Our efforts to monitor customer payment capability and maintain reserves adequate to cover exposure for doubtful accounts may not be effective. Our exposure to these credit risks may increase if our customers are adversely affected by an economic downturn. If credit market turmoil makes it more difficult for customers to obtain financing or affects their ability to pay, or if these losses increase, our business, financial condition, and operating results could be materially adversely affected.A portion of our revenue is generated by sales to government entities, which are subject to a number of challenges and risks.Sales to government entities are subject to a number of risks. Government certification and technical requirements may change, and if our products and subscriptions fail to achieve or are late in achieving compliance with these certifications and standards or technical requirements, we may be disqualified or restricted from selling to such entities or be at a competitive disadvantage. Government demand and payment for our products, subscriptions, and support offerings may be impacted by government shutdowns, changes in administrations, budgetary cycles, contracting policies, fiscal policies, and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our products, subscriptions, and support offerings. Additionally, the U.S. government may require certain products to be manufactured domestically or in other relatively high-cost manufacturing locations, and we may not manufacture all products in locations that meet such requirements, affecting our ability to sell our offerings to the U.S. government. Our main competitors fall into four categories:•large companies that incorporate security or observability features in their products, such as Alphabet Inc., Cisco Systems, Inc., and Microsoft Corporation, or those that have acquired, or may acquire, security vendors and have the technical and financial resources to bring competitive solutions to the market;•independent vendors that may offer a mix of security products, such as Check Point Software Technologies Ltd., CrowdStrike Holdings, Inc., Delinea, Inc., Fortinet, Inc., Okta, Inc., SailPoint Technologies, Inc., and Zscaler, Inc., vendors that may offer a mix of observability products, such as DataDog, Inc., Dynatrace, Inc., and elasticsearch B.V., or vendors that may offer a mix of security and observability products;•startups and point-product vendors that offer independent or emerging solutions across various areas of security; and•public cloud vendors and startups that offer solutions for cloud security (private, public, and hybrid cloud).Some of our competitors have or may attain greater financial, technical, marketing, sales, and other resources, greater name recognition, longer operating histories, and a larger base of customers than we do. We also face competition from companies with entrenched legacy offerings. End-user customers who have invested substantial resources in their existing infrastructure may prefer to continue purchasing from their existing suppliers rather than switch to our products and subscriptions. As our customers refresh security products, achieve efficiencies, or face budget constraints or economic downturns, they may seek to consolidate vendors or add solutions to their existing infrastructure rather than replacing it with our products and subscriptions.The maturity and expansion of the enterprise cybersecurity space may attract new players, including cloud hyperscalers, advance AI companies and enterprise software companies in adjacent industries, which may meaningfully enter or further expand into additional cybersecurity categories, including the identity security category. Our competitors may develop new or disruptive technologies, products, or services that are equal or superior to ours, more successfully incorporate AI into their products and achieve higher market acceptance of their AI solutions, or deliver products to market more quickly than we can. Our current and potential competitors may also establish cooperative relationships among themselves or with third parties that may further enhance their resources or offerings. If we are unable to compete successfully, or if competing successfully requires us to take aggressive pricing or other actions, our business, financial condition, and operating results would be adversely affected.The “identity security” market lacks a universally accepted definition, which could lead to mischaracterization of our offerings and adverse evaluations by industry stakeholders.We have significantly expanded our participation in what is commonly referred to as the “identity security” market. However, this market lacks a standardized definition and is subject to varying interpretations by industry analysts, customers, and competitors. This ambiguity could lead to mischaracterization of our identity security products or market positioning by industry stakeholders, resulting in unfavorable evaluations, reviews, or accreditations. Industry analyst reports and rankings can materially influence customer purchasing decisions in the security industry, and unfavorable reviews, downgrades in accreditation, or evolving definitions of the identity security category could negatively affect our reputation, competitive standing, and ability to attract and retain customers.Customer trends toward vendor consolidation in cybersecurity may favor competitors offering broader platforms.Enterprise cybersecurity buyers are increasingly seeking to consolidate their vendors to reduce costs, complexity, and integration challenges. If customers choose to consolidate with vendors offering more comprehensive suites, or if competitors more successfully utilize acquisitions or partnerships to combine capabilities, we may be at a competitive disadvantage. Furthermore, organizations continuously evaluate their information security priorities and may allocate budgets to solutions offered by our competitors, or may not adopt or expand the use of our solutions, which could adversely affect our business, financial condition, and operating results.- 22 -Table of ContentsCloud infrastructure providers and advanced AI companies increasingly offer native security and observability capabilities that compete directly with our offerings.The major public cloud infrastructure providers increasingly offer native security, identity, and observability capabilities that compete with our products and subscriptions. These providers have significant resources and may bundle native capabilities with their cloud infrastructure services at low or no incremental cost to customers, may leverage privileged access to their platforms and telemetry, and may design their native offerings to integrate more seamlessly with their infrastructure than third-party solutions can. As customers increasingly deploy workloads across multiple cloud environments, or as cloud providers expand the scope and depth of their native security and observability capabilities, demand for our offerings could be adversely affected. We may also face pricing pressure as competitors utilize cloud provider economics or offer bundled solutions at reduced total cost of ownership.In addition, frontier or foundational AI model providers, or similar companies with advanced large language model capabilities, have entered or may enter the cybersecurity and observability markets, whether directly, through partnerships, or by enabling third parties to build competing security applications on top of their models. These companies possess substantial capital, technical talent, and have developed, or proprietary access to, foundational or frontier AI models. Their ability to rapidly iterate on model capabilities, attract AI research talent, and leverage significant compute infrastructure may allow them to introduce competing security capabilities more quickly or at lower cost than we can. If these or other AI companies develop and commercialize security products or embed security functionality into their broader AI platforms, customers may choose to consolidate their security spend with such providers rather than purchase our solutions, which could adversely affect our revenue, market share, and competitive position.As part of our business strategy, we acquire and make investments in complementary companies, products, or technologies. The identification of suitable acquisition candidates is difficult, and we may not be able to complete such acquisitions on favorable terms, if at all. In addition, we may be subject to claims or liabilities assumed from an acquired company, product, or technology; acquisitions we complete could be viewed negatively by our end-customers, investors, and securities analysts; and we may incur costs and expenses necessary to address an acquired company’s failure to comply with laws and governmental rules and regulations. Additionally, we may be subject to litigation or other claims in connection with the acquired company, product, or technology, including claims from terminated employees, customers, former stockholders, or other third parties, which may differ from or be more significant than the risks our business faces. If we are unsuccessful at integrating past or future acquisitions in a timely manner or at all, our revenue and operating results could be adversely affected. However, integrating these businesses is a complex process that may disrupt our existing operations if not implemented efficiently.We have recorded, and may in the future record, liability for contingent consideration obligations from acquisitions that are to be settled in cash, the fair value of which is assessed on a quarterly basis. If changes are made in our assumptions used to determine the liability’s fair value or our assumptions are incorrect, adjustments could be made that may have a material impact, favorable or unfavorable, on our operating results. We may also be required to make cash payments of contingent consideration in excess of its initial fair value, or in excess of our expectations for a particular period, which could adversely impact cash flows. In addition, any acquisitions may be viewed negatively by our customers, financial markets, or investors and may not ultimately strengthen our competitive position or achieve our goals and business strategy. In addition, we will be required to devote significant attention and resources to successfully align our and CyberArk’s business practices and operations. This process may disrupt our business and, if ineffective, would limit the anticipated benefits and synergies of the acquisition. The identity security industry is characterized by constant innovation, evolving customer requirements, and rapid adoption of different technologies and services. These added competitive pressures could result in decreased sales, price reductions, increased operating costs, and lower revenues, margins, and net income for the combined company. These impacts could also result in a delay in realizing, or our failure to realize, expected synergies or cost savings from the CyberArk acquisition.If we do not accurately predict, prepare for, and respond promptly to rapidly evolving technological and market developments and successfully manage product and subscription introductions and transitions to meet changing end-customer needs in the enterprise security industry, our competitive position and prospects will be harmed.The enterprise security industry has grown quickly and continues to evolve rapidly. Moreover, many of our end-customers operate in markets characterized by rapidly changing technologies and business plans, which require them to add numerous network access points and adapt increasingly complex enterprise networks, incorporating a variety of hardware, software applications, operating systems, and networking protocols. If we fail to effectively anticipate, identify, and respond to rapidly evolving technological and market developments in a timely manner, our business will be harmed. In order to anticipate and respond effectively to rapid technological changes and market developments, as well as evolving security threats, we must invest effectively in research and development to increase the reliability, availability, and scalability of our existing products and subscriptions and introduce new products and subscriptions. Our investments in research and development, including investments in AI, may not result in design or performance improvements, marketable products, subscriptions, or features, or may not achieve the cost savings or additional revenue that we expect. In addition, new and evolving products and services, including those that use AI, require significant investment and raise ethical, technological, legal, regulatory, and other challenges, which may negatively affect our brands and demand for our products and services. Because all of these investment areas are inherently risky, no assurance can be given that such strategies and offerings will be successful or will not harm our reputation, financial condition, and operating results. The technology in our portfolio is especially complex because it needs to effectively identify and respond to new and increasingly sophisticated methods of attack while minimizing the impact on network performance. Some of our new features and enhancements may require us to develop new hardware architectures involving complex, expensive, and time-consuming research and development processes, and the timetable for commercial availability is uncertain. The success of new products depends on several factors, including appropriate product definition, differentiation from competitors, market acceptance, management of production ramp-up issues, availability of application software, effective management of purchase commitments and inventory, and the risk that new products may have quality defects in the early stages of introduction. If we fail to identify opportunities for new products and subscriptions, experience unanticipated delays in the availability of new products and subscriptions, or fail to meet customer expectations, our competitive position and business prospects will be harmed. Furthermore, we may require additional funds to respond to business challenges, including the need to develop new features to enhance our portfolio, improve our operating infrastructure, or acquire complementary businesses and technologies. In addition, we may be required to take other actions that would otherwise be in the interests of the debt holders and would require us to maintain specified liquidity or other ratios, any of which could harm our business, financial condition, and operating results. If we are unable to obtain adequate financing or financing on terms satisfactory to us when we require it, our ability to continue to support our business growth and to respond to business challenges could be significantly impaired, and our business may be adversely affected.The success of our strategy depends on maintaining a broad ecosystem of integrations with third-party technologies, which requires significant ongoing investment.- 24 -Table of ContentsThe success of our strategy depends in part on the breadth and depth of our integrations with third-party technologies, including cloud infrastructure providers, identity providers, security tools, and business applications. Maintaining and expanding these integrations requires continuous engineering, sales, and marketing investment, and we may not always be able to develop, maintain, or update integrations as quickly as customers or channel partners expect. Third-party technology vendors may modify their APIs, deprecate integrations, or introduce competing capabilities that reduce the need for our platform integrations. AI presents challenges, risks, and potentially unintended consequences. Our investments in AI ultimately may not be commercially viable or result in an adequate return of capital, and this could depress the market price of our stock or lead to us incurring unanticipated liabilities.Vulnerabilities within our AI systems may be identified by researchers or malicious actors before we detect or remediate them, which could result in security incidents, data privacy issues, reputational damage, or loss of customer confidence. Advances in AI have also increased the speed, scale, and sophistication of cybersecurity threat activity, including reducing the time between vulnerability discovery and exploitation. To the extent customers, investors, or other market participants perceive that AI can automate or commoditize aspects of cybersecurity functions, the perceived value of certain cybersecurity solutions could diminish, and customer buying patterns, competitive dynamics, and demand for our products, subscriptions, and support offerings could be adversely affected. The laws, rules, and regulations that have and continue to be adopted by policymakers, and the manner in which such requirements are interpreted or enforced, may require us to incur additional costs to comply with such requirements or make changes to our business practices, including our products and services that incorporate AI. Our efforts and investments regarding AI, and our failure or perceived failure to comply with applicable legal requirements, could damage our customer relationships, cause brand or reputational harm, or subject us to regulatory risk and legal liability, including under laws, rules, and regulations in jurisdictions such as the E.U.S. Developing, testing, and deploying AI systems may also increase the cost profile of our offerings due to the nature of the computing costs involved in such systems.The intellectual property ownership and license rights surrounding AI technologies, as well as data protection laws related to the use and development of AI, are currently not fully addressed by courts or regulators. The evolving legal, regulatory, and compliance framework for AI technologies may also impact our ability to protect our own data and intellectual property against infringement.The cybersecurity industry is undergoing a transformation as customers increasingly expect AI-native solutions that are designed from the ground up to leverage AI capabilities. If we fail to anticipate, invest in, or execute on the transition to AI-native platforms, or if our competitors develop AI-native offerings that achieve greater market acceptance, we may miss critical opportunities for growth and market leadership, and our business, including our gross margin, and competitive position could be materially harmed.The emergence of AI agents as a new class of identity presents both opportunities and risks that could impact our identity security offerings.The rapid deployment of generative AI systems and AI agents is creating a new class of identity that requires authenticated, secure access to sensitive resources at a scale and speed exceeding traditional identity models designed for human users. As AI agents gain capabilities and access within organizations, managing their identities and permissions is emerging as a significant operational and security challenge. The ability of our identity security solutions to evolve to effectively secure this new identity class will depend on continued investment in research and development, the availability of appropriate AI technologies, and market acceptance of our approach and products. If we fail to adequately address the security requirements associated with AI agents, or if our competitors more effectively secure AI identities, demand for our offerings could decline. Additionally, evolving standards, customer expectations, or regulatory requirements could require us to make significant changes to our offerings.- 25 -Table of ContentsA significant network or data security incident may materially impact our reputation, financial condition, and operating results.Like all companies, our systems, data, and products are subject to an increasingly wide variety of attacks on an ongoing basis from a variety of sources, including from traditional hackers, malicious code, phishing and ransomware attacks, employee theft or misuse, and sophisticated nation-state actors engaging in intrusions and attacks, including advanced persistent threat intrusions and supply chain attacks. Despite our efforts to prevent breaches, our data, products, corporate systems, and security measures, as well as those of our third-party service providers, remain vulnerable. Malicious actors are using AI to develop advanced cyberattacks and to exploit system vulnerabilities that are not known or remediated. We cannot guarantee that our security measures will provide adequate protection. As a well-known provider of security solutions, we and others in our industry are attractive targets for cyberattacks. The geopolitical environment, including the Russia-Ukraine war and other global events as described in "Risks Related to Global Economic and Geopolitical Conditions" above, increase the risk of cyberattacks on our infrastructure and operations. Because certain third-party service providers are critical to our business, such as cloud services that support various customer-facing operations, cyberattacks that compromise third-party systems could materially impact us. Information stored or otherwise processed on our networks or those of our third-party service providers has previously been, and could in the future be, accessed, disclosed, altered, lost, or stolen, or otherwise used or processed without authorization. We may also incur significant costs and expend significant resources to investigate, remediate, and prevent future incidents, as well as costs to comply with notification obligations resulting from any security incidents. We cannot guarantee that costs and liabilities incurred in relation to a breach or other incident will be covered by existing insurance policies or that applicable cybersecurity insurance will be available to us in the future on economically reasonable terms or at all. Defects, errors, or vulnerabilities in our products, subscriptions, or support offerings, the failure of our products or subscriptions to block a virus or prevent a security breach or incident, misuse of our products, or risks of product liability claims could harm our reputation and adversely impact our operating results. For example, end-customers have reported defects in our products related to performance, scalability, and compatibility. Defects or vulnerabilities may cause our products or subscriptions to become unavailable, to be vulnerable to security attacks, fail to secure networks, or interrupt end-customers’ networking traffic. For example, in May 2026, we became aware of an authentication bypass vulnerability in certain versions of our PAN-OS software and published a security advisory, provided software updates, and engaged in customer outreach, support, and remediation efforts. Because attack techniques change frequently and are generally not recognized until launched, we are unable to comprehensively anticipate, detect, or provide responsive solutions or remediation in all instances. As described in "Risks Related to Global Economic and Geopolitical Conditions" above, the geopolitical environment increases the risk of cyberattacks against us and our customers.Defects or errors in our products or software, or migrations or updates, could result in a failure to effectively update end-customers’ hardware, software, and products or otherwise cause problems in our customers’ hardware, networks, software, or IT infrastructure. Defects, errors, or a technical failure of our products may temporarily or permanently disable our end-customers’ networks, IT infrastructure, or other systems. Our products must interoperate with end-customers’ existing infrastructure, which often has varied specifications, multiple protocol standards, and products from multiple vendors. When problems occur, it may be difficult to identify the source. The data centers, networks, and cloud infrastructure we use to deliver our products, subscriptions, and support offerings may experience technical failures or downtime that could expose end-customers’ networks to security threats or attacks.The occurrence of any such problem in our products and subscriptions, or migrations or updates to those products or software, whether real or perceived, could result in:•expenditure of significant financial and product development resources in efforts to analyze, correct, eliminate, or work-around errors or defects or to address and eliminate vulnerabilities;•loss of existing or potential end-customers or channel partners;•delayed or lost revenue;•delay or failure to attain market acceptance;•an increase in warranty claims compared with our historical experience, or an increased cost of servicing warranty claims, either of which would adversely affect our gross margins; and- 26 -Table of Contents•litigation, regulatory inquiries, investigations, or other proceedings, each of which may be costly and harm our reputation.Our products and subscriptions may be misused by end-customers or third parties. Such misuse could result in negative press coverage and harm our reputation. The sale and support of our products and subscriptions also entails the risk of product liability claims. Indemnification by third-party manufacturers may not cover claims arising from design or manufacturing defects. Additionally, our insurance coverage may not adequately cover claims asserted against us, and even unsuccessful claims could result in litigation expenses, diversion of management's attention, and reputational harm. This risk is heightened by the inclusion of heuristics features in our products and subscriptions that identify threats based on characteristics or anomalies rather than known signatures. These false positives may impair the perceived reliability of our products and adversely impact market acceptance of our products and subscriptions, our reputation, and our sales, and result in loss of channel partners or end-customers.Our shared responsibility security model relies on customers to configure and use our products securely, and customer errors could harm our reputation even when we are not at fault.We deliver certain of our products under a model in which we are responsible for the security of the underlying platform and infrastructure and our customers are responsible for configuring, deploying, patching, and using our products and configuring and implementing the security controls and posture within their environments. Customers may fail to implement, or may misconfigure, security features made available in our products and subscriptions, or may fail to follow best practices, resulting in security incidents affecting their environments or data. Even if we are not the cause of a customer security incident, our reputation, brand, and customer relationships may nonetheless be adversely impacted. Enterprise customers, regulators, and the market generally may not consistently distinguish between security incidents caused by our products and those caused by a customer failing to implement or misconfiguring security features of our products, and we may face claims, negative publicity, or regulatory scrutiny in either case. Any such incidents could adversely affect market perception of our offerings and, correspondingly, our business, financial condition, and operating results.Our ability to sell our products and subscriptions is dependent on the quality of our technical support services and those of our channel partners, and the failure to offer high-quality technical support services could have a material adverse effect on our end-customers’ satisfaction with our products and subscriptions, our sales, and our operating results.After our products and subscriptions are deployed, our end-customers depend on our technical support services and those of our channel partners. Larger enterprise, service provider, and government entity end-customers have more complex networks and require higher levels of support. If our channel partners do not effectively provide support, we may need to provide direct support, requiring additional personnel and resources. If we cannot hire and deploy resources fast enough to meet demand, end-customer satisfaction will be adversely affected, and reliance on sales engineers for post-sales support would negatively impact our sales productivity. Failure by our company and our channel partners to provide high-quality support services could have a material adverse effect on our business, financial condition, and operating results.Our subscription agreements typically contain service-level commitments, and failure to meet these commitments could reduce our revenue and harm our business.Our subscription agreements for certain of our product offerings typically contain service-level commitments, including uptime and response time requirements. If we are unable to meet these commitments, we may be contractually obligated to provide service credits, refunds, or, in certain cases, permit customers to terminate their subscriptions. Any such credits or refunds could significantly affect our revenue in the periods in which they are applied. Service-level failures could also damage our reputation, reduce renewals, and expose us to litigation. As our SaaS-based revenues grow and our offerings expand to serve more mission-critical use cases, our exposure to service-level commitment obligations will continue to increase.We rely on data center facilities operated by third-party cloud service providers, and any limitations on capacity, or interference with our use could adversely affect our business, financial condition, and results of operations.We rely on data center facilities operated by third-party cloud service providers to host and operate our cloud-based products and services. Any limitation on the capacity of these third-party providers, or tightening availability of cloud computing resources and machine compute capacity due to increased demand from other customers, supply chain constraints, or allocation decisions by providers, could impede our ability to onboard new customers, expand usage by existing customers, or deliver our products and services with the performance and reliability our customers expect. Demand for cloud computing infrastructure and specialized computing resources, including for AI and machine - 27 -Table of Contentslearning workloads, has increased significantly across industries, and our third-party providers may prioritize other customers or uses, limit our access to capacity, or be unable to meet our requirements. In addition, decisions by the owners and operators of these data center facilities to terminate our contracts, discontinue services, shut down operations, increase prices, change service levels, limit bandwidth, or prioritize the traffic of other parties could have a material adverse effect on our operations.Companies in the enterprise security industry own large numbers of patents, copyrights, trademarks, domain names, and trade secrets and frequently enter into litigation based on allegations of infringement, misappropriation, or other violations of intellectual property rights. Non-practicing entities also frequently bring such claims against companies in the enterprise security industry. Third parties have asserted, and may in the future assert, claims of infringement against us. For example, on January 31, 2024, in the Centripetal Networks, Inc.

Commitments and Contingencies in Part II, Item 8 of this Annual Report on Form 10-K.Third parties may also assert such claims against our end-customers or channel partners, whom our standard license and other agreements obligate us to indemnify against claims that our products and subscriptions infringe the intellectual property rights of third parties. In addition, to the extent we hire personnel from competitors, we may be subject to allegations that they have been improperly solicited, that they have divulged proprietary or other confidential information, or that their former employers own their inventions or other work product. Furthermore, we may be unaware of the intellectual property rights of others that may cover some or all of our technology, products, subscriptions, and services. As we expand our footprint, both in our platforms, products, subscriptions, and services and geographically, more overlaps occur and we may face more infringement claims both in the United States and abroad. We have not registered our trademarks in all geographic markets, which could adversely affect our ability to enforce and defend our trademark rights. Any infringement claim, even without merit, could cause us to incur substantial defense costs, distract management, and could require us to cease use of such intellectual property. Furthermore, because of the substantial discovery required in IP litigation, there is a risk that our confidential information could be compromised. Any of these events could seriously harm our business, financial condition, and operating results.Our proprietary rights may be difficult to enforce or protect, which could enable others to copy or use aspects of our products or subscriptions without compensating us.We rely and expect to continue to rely on a combination of confidentiality and license agreements with our employees, consultants, and third parties with whom we have relationships, as well as trademark, copyright, patent, and trade secret protection laws, to protect our proprietary rights. We have filed various applications for certain aspects of our intellectual property. Valid patents may not issue from our pending applications, and the claims eventually allowed on any patents may not be sufficiently broad to comprehensively protect our technology or products and subscriptions. We cannot be certain that we were the first to make the inventions claimed in our pending patent applications or that we were the first to file for patent protection, which could prevent our patent applications from issuing as patents or invalidate our patents following issuance. Additionally, the process of obtaining patent protection is expensive and time-consuming, and we may not be able to prosecute all necessary or desirable patent applications at a reasonable cost or in a timely manner. Any issued patents may be challenged, invalidated or circumvented, and any rights granted under these patents may not actually provide adequate defensive protection or competitive advantages to us. Additional uncertainty may result from changes to patent-related laws and court rulings in the United States and other jurisdictions. As a result, we may not be able to obtain adequate patent protection or effectively enforce any issued patents.Unauthorized parties may attempt to copy aspects of our products or subscriptions or obtain and use information that we regard as proprietary. We enter into confidentiality or license agreements with employees, consultants, vendors, and end-customers and limit access to our proprietary information; however, these agreements may not be honored or our measures may not prevent misappropriation. As a well-known security provider, we may face a greater risk of unauthorized access to our proprietary information. In addition, the laws of some foreign countries do not protect proprietary rights to the same extent as U.S. laws. We may need to take legal action to enforce our intellectual property rights, which could result in substantial costs and diversion of resources, and could provoke counterclaims. If we are unable to protect our proprietary rights, we may find ourselves at a competitive disadvantage, which would have a material adverse effect on our business, financial condition, and operating results.Our products and subscriptions contain software modules licensed to us by third-party authors under “open source” licenses. Some open source licenses contain requirements that we make available applicable source code for modifications or derivative works we create based upon the type of open source software we use. If we combine our proprietary software with, or otherwise distribute or use open source software in a certain manner, we could, under certain open source licenses, be required to release the source code of our proprietary software to the public. This would allow our competitors to create similar products or subscriptions with lower development effort and time and ultimately could result in a loss of product sales for us.The terms of many open source licenses have not been interpreted by United States courts, and these licenses could be construed in a way that imposes unanticipated conditions or restrictions on our ability to commercialize our products and subscriptions. From time to time, there have been claims against companies that distribute or use open source software in their products and subscriptions, asserting that open source software infringes the claimants’ intellectual property rights. We could be subject to suits by parties claiming infringement of intellectual property rights in what we believe to be licensed open source software. If we are held to have breached the terms of an open source software license, we could be required to seek licenses from third parties to continue offering our products and subscriptions on terms that are not economically feasible, to reengineer our products and subscriptions, to discontinue the sale of our products and subscriptions if reengineering could not be accomplished on a timely basis, or to make generally available, in source code form, our proprietary code, any of which could adversely affect our business, financial condition, and operating results.In addition, usage of open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or assurance of title. Our processes to help alleviate these risks, including a review process for screening open source usage requests, may not be effective.We incorporate technology that we license from third parties, including software, into our products and subscriptions. We cannot be certain that our licensors are not infringing the intellectual property rights of third parties or that our licensors have sufficient rights to the licensed intellectual property in all jurisdictions in which we may sell our products and subscriptions. In addition, some licenses may be non-exclusive, and therefore our competitors may have access to the same technology licensed to us. Some of our agreements with our licensors may be terminated for convenience by them. We may also be subject to additional fees or be required to obtain new licenses if any of our licensors allege that we have not properly paid for such licenses or that we have improperly used the technologies under such licenses, and such licenses may not be available on terms acceptable to us or at all. If we are unable to continue to license any of this technology because of intellectual property infringement claims brought by third parties against our licensors or against us, or claims against us by our licensors, or if we are unable to continue our license agreements or enter into new licenses on commercially reasonable terms, our ability to develop and sell products and subscriptions containing such technology would be severely limited and our business could be harmed. Additionally, if we are unable to license necessary technology from third parties, we may be forced to acquire or develop alternative technology, which we may be unable to do in a commercially feasible manner or at all, and we may be required to use alternative technology of lower quality or performance standards. This would limit and delay our ability to offer new or competitive products and subscriptions and increase our costs of production. As a result, our margins, market share, and operating results could be significantly harmed.We depend on manufacturing partners, primarily our EMS provider, Flex, to manufacture our hardware product lines. Changes to international trade agreements, tariffs, or trade regulations could lead to sourcing or logistics disruptions and increased costs. For example, U.S. and Chinese import tariffs have impacted some of our components, increasing our costs and potentially requiring us to further raise prices on our hardware products. In the past, we experienced supply chain disruption and have incurred increased costs resulting from inflationary pressures and changes in U.S. trade policy. For example, we experienced supply chain disruption and inflationary pressures during our fourth quarter of fiscal 2026, resulting in increased costs for memory and other components, which have negatively affected our gross margin and could continue to affect our gross margin. Our manufacturing partners procure components and build products based on our forecasts, and from time to time, we - 29 -Table of Contentsissue non-cancelable, non-returnable forecasts. If we are required to change manufacturing partners, or if our forecasting and inventory management systems prove inadequate, our ability to meet scheduled deliveries could be adversely affected. If our forecasts overestimate demand, we may be obligated to purchase excess inventory that we cannot sell, resulting in write-downs, increased carrying costs, and lower gross margins. Conversely, if our forecasts underestimate demand, we may experience insufficient supply, leading to product shortages, delayed deliveries, lost sales opportunities, and potential damage to customer relationships. Any production interruptions, whether from natural disasters, epidemics or pandemics, capacity shortages, or quality problems, would negatively affect sales and our business and operating results. The manufacturing operations of some suppliers are geographically concentrated in Asia, making our supply chain vulnerable to regional disruptions and international regulations, including tariffs, sanctions, and export controls. We are also monitoring the tensions between China and Taiwan, and between the U.S. For example, there is currently a global shortage of memory-related components, and certain of our hardware appliances require higher memory content, which has led to and may continue to lead to increased production costs.If we are unable to attract, retain, and motivate our key technical, sales, and management personnel, our business could suffer.Our future success depends, in part, on our ability to continue to attract, retain, and motivate the members of our management team and other key employees. For example, we are substantially dependent on the continued service of our engineering personnel because of the complexity of our offerings. Competition for highly skilled personnel, particularly in engineering, including in the areas of AI and machine learning, is intense, especially in the San Francisco Bay Area, where we have a substantial presence and need for such personnel. In addition, the industry in which we operate generally experiences high employee attrition. Our future performance depends on the continuing services and contributions of our senior management to execute on our business plan and to identify and pursue new opportunities and product innovations. If we are unable to hire, integrate, train, or retain the qualified and highly skilled personnel required to fulfill our current or future needs, our business, financial condition, and operating results could be harmed. Moreover, our hybrid work environment may also create operational, security, and workplace culture challenges that could hinder execution of our business objectives and our ability to attract and retain qualified and highly skilled personnel.Further, we believe that a critical contributor to our success and our ability to retain highly skilled personnel has been our corporate culture, which we believe fosters innovation, inclusion, teamwork, passion for end-customers, focus on execution, and the facilitation of critical knowledge transfer and knowledge sharing. As we grow and change, and as we acquire and integrate other businesses, we may find it difficult to maintain these important aspects of our corporate culture. While we are taking steps to develop a more inclusive workforce, there is no guarantee that we will be able to do so. Any failure to preserve our culture as we grow could limit our ability to innovate and could negatively affect our ability to retain and recruit personnel, continue to perform at current levels, or execute on our business strategy. We may experience difficulties in attracting and retaining international personnel or strategic distributor relationships, and business practices in international markets may require non-standard end-customer contract terms related to payment, warranties, or performance obligations.S. and foreign laws, including antitrust regulations, anti-corruption laws, such as the U.S. Foreign Corrupt Practices Act and the United Kingdom (“U.K.”) Bribery Act, U.S. or foreign sanctions regimes and export or import control laws, and any trade regulations ensuring fair trade practices.These and other factors could harm our future international revenues and, consequently, materially impact our business, financial condition, and operating results.S. U.S. Various countries also regulate the import of encryption technology. Changes in export or import regulations, economic sanctions, or the countries and technologies targeted by such regulations could decrease use of our products internationally. Any failure by us or our channel partners to comply with trade regulations could subject us to substantial civil and criminal penalties. International trade laws continuously evolve, and monitoring and responding to these developments may require significant resources.Our products and subscriptions are subject to certification, testing, and regulatory approval requirements in foreign jurisdictions, and our failure to obtain or maintain such approvals could limit our ability to sell in those markets.Our products and subscriptions are subject to regulatory requirements in a number of foreign jurisdictions, and the scope and complexity of these requirements continue to expand. For example, in China, our products may be required to comply with cybersecurity and data security laws, including the Cybersecurity Law, the Data Security Law, and related regulations, and may be subject to network security review, critical information infrastructure protection requirements, and mandatory product certifications. Other jurisdictions impose similar requirements, including local testing and certification requirements, in-country data storage or processing mandates, source code review or escrow obligations, and restrictions on the use of foreign-developed encryption or security technologies. Compliance with these requirements is costly and time-consuming, and the regulatory landscape in many jurisdictions is evolving and subject to change with limited or no notice. If we are unable to obtain or maintain required certifications, approvals, or authorizations in a timely manner, or if new or revised requirements render our products or subscriptions non-compliant, we may be unable to sell, deploy, or support our products in affected markets, which could result in lost revenue opportunities, reputational harm, and a material adverse effect on our business, financial condition, and operating results.We are exposed to fluctuations in foreign currency exchange rates, which could negatively affect our financial condition and operating results.Our sales contracts are primarily denominated in U.S. dollars, and therefore, a predominant amount of our revenue is not subject to foreign currency risk.S. dollar could increase the cost of our products to end-customers outside the United States. Increased international sales in the future may result in greater foreign currency denominated sales, increasing our foreign currency risk. Our operating expenses incurred outside the United States and denominated in foreign currencies are generally increasing and are subject to fluctuations due to changes in exchange rates. We have entered into forward contracts to reduce our foreign currency exchange exposure. As of July 31, 2026, the total notional amount of our outstanding foreign currency forward contracts was $2.

Derivative Instruments in Part II, Item 8 of this Annual Report on Form 10-K. The effectiveness of our hedging transactions may be limited, and we may not be able to successfully hedge our exposure, which could adversely affect our financial condition and operating results.We face risks associated with having operations and employees located in Israel. The effects of such hostilities on the Israeli economy and our operations in Israel are unclear, and current or future tensions and conflicts in the Middle East, including any escalation involving Iran, could adversely affect our business, financial condition, operating results, and cash flows.Many of our employees in Israel are obligated to perform annual reserve duty in the Israeli military and are subject to being called for active duty under emergency circumstances, which has occurred as a result of regional hostilities.- 31 -Table of ContentsRISKS RELATED TO PRIVACY AND DATA PROTECTIONWe may incur significant costs to comply with privacy and data protection laws and other requirements, and, if we fail to comply, we could be subject to government enforcement actions, private litigation, and adverse publicity, which could materially adversely affect our business, financial condition, and operating results.A wide variety of laws, regulations, industry standards, contractual requirements, and other obligations apply to the collection, use, retention, protection, disclosure, transfer, and other processing of personal data in jurisdictions where we and our customers operate. Compliance with these laws and other obligations is difficult and costly, and they are subject to frequent and unexpected changes. For example, we are subject to the E.U. General Data Protection Regulation (“E.U. GDPR”) and the U.K. General Data Protection Regulation (“U.K.U. GDPR or £17.5 million under the U.K.The GDPR restricts transfers of personal data outside of the European Economic Area (“EEA”) (or, in the case of the U.K. GDPR, the U.K.) to non-EEA countries, such as the United States, unless adequate safeguards are implemented or a derogation applies. In addition, with respect to the personal data that we process on behalf of our customers, we self-certified to the E.U.-U.S. Data Privacy Framework (“E.U.-U.S. DPF”), the UK Extension to the E.U.-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (collectively, the "DPF") as set forth by the U.S. Department of Commerce for such transfers. However, the DPF may be subject to legal challenges that could invalidate its use. In addition, the U.K.K. We anticipate future legal challenges and developments to approved data transfer mechanisms, including to the E.U.-U.S. DPF, which could result in additional compliance costs and harm our business. Among other effects of these developments, we may also experience reduced demand for our products and subscriptions from current or prospective customers in the EEA, Switzerland, and the U.K. The regulatory environment applicable to the handling of European residents’ personal data and cross-border data transfers, and our actions taken in response, may cause us to assume additional liabilities or incur additional costs. We are also subject to U.S. privacy and data protection laws, including the California Consumer Privacy Act (the "CCPA"), which, among other requirements, requires enhanced disclosures, affords California residents with certain rights regarding their personal data, and creates a private right of action for data breaches caused by a lack of reasonable security. Over twenty other U.S. states have enacted similar privacy laws. Additionally, the U.S. Department of Justice has issued rules regarding access to or transfer of certain bulk sensitive personal data by countries of concern or covered persons, and we are subject to the Health Insurance Portability and Accountability Act ("HIPAA"), both of which carry significant enforcement penalties for non-compliance. These and other increasingly complex federal and state privacy laws and their enforcement may also require us to modify our data practices and incur additional substantial compliance costs.We are also subject to obligations relating to personal data and data protection by contract and self-regulatory and industry standards. Additionally, the Federal Trade Commission and state attorneys general are more regularly bringing enforcement actions for deceptive practices related to the collection and security of personal data. Our insurance may not cover all types of claims that may arise, and we cannot guarantee that applicable insurance will be available to us in the future on economically reasonable terms or at all. Moreover, new legislation affecting the scope of personal data and information, especially relating to IP addresses, machine identification, AI and machine learning, location data, health information, and other information, may limit or inhibit our ability to operate or expand our business and may require significant additional expenditures to comply. Data localization laws may mandate that personal data collected in a foreign country be processed and stored within that country, potentially requiring costly restructuring of our cloud infrastructure. Public perception of privacy or information security concerns, whether or not valid, may harm our reputation and inhibit adoption of our products and subscriptions. Additionally, existing laws and regulations, and any changes to them, or new laws and regulations, could impose significant limitations or require changes to our business model, which may increase our compliance costs.We are also subject to federal, state, provincial, and foreign laws regarding cybersecurity and the protection of our systems and confidential information. Many jurisdictions have enacted laws, such as the GDPR and the E.U. Network and Information Systems Directive II, requiring companies to adopt cybersecurity risk management measures and notify regulators (and individuals) of data breaches or cybersecurity incidents. If our data security measures fail to adequately protect our systems or confidential information, we could be liable to both our customers and their users for - 32 -Table of Contentsany related losses. Additionally, we could face regulatory action or face litigation, and our customers could terminate or materially change their relationships with us, any of which could harm our business, financial condition, or operating results.Our income tax obligations are based in part on our corporate structure and intercompany arrangements, including the manner in which we develop, value, and use our intellectual property and the valuations of our intercompany transactions. The tax laws applicable to our business, including the laws of the United States and various other jurisdictions, are subject to interpretation and certain jurisdictions may aggressively interpret their laws, regulations, and policies, including in an effort to raise additional tax revenue. The tax authorities of the jurisdictions in which we operate may challenge our methodologies for valuing developed or acquired technology or determining the proper charges for intercompany arrangements, which could increase our worldwide effective tax rate, harm our financial position and operating results, and have a negative effect on our cash flow. Some tax authorities of jurisdictions other than the United States may seek to assert extraterritorial taxing rights on our transactions or operations. Further, the determination of our worldwide provision for income taxes and other tax liabilities requires significant judgment by management, and there are transactions where the ultimate tax determination is uncertain. Although we believe that our estimates are reasonable, the ultimate tax outcome may differ from the amounts recorded on our consolidated financial statements and may materially affect our financial results in the period or periods for which such determination is made.In addition, our future income tax obligations and effective tax rates could be adversely affected by changes in, or interpretations of, tax laws, regulations, policies, or decisions in the United States or in the other jurisdictions in which we operate including as a result of the U.S. federal tax legislation commonly referred to as the One Big Beautiful Bill Act, which was signed into law on July 4, 2025. In addition, our effective tax rates could be affected by fluctuations in the market price of our common stock and changes in the fair value of CyberArk’s $1.25 billion aggregate principal amount of 0.00% Convertible Senior Notes due 2030 (the “2030 Notes”) and the fair value of the capped call transactions (the “Capped Calls”) we acquired in connection with the CyberArk acquisition. If our future tax obligations or effective tax rates increase as a result of these or other factors, it could have an adverse effect on our financial condition and operating results.Moreover, in October 2021, the Organization for Economic Co-operation and Development (“OECD”) issued model rules for a new global minimum tax framework, commonly referred to as “Pillar Two,” which included the introduction of a 15% global minimum tax effective beginning January 1, 2024. To date, approximately 140 countries have tentatively signed a framework agreeing in principle to this initiative. A number of countries in which we do business have implemented or may implement Pillar Two proposals into local tax legislation. On January 5, 2026, the OECD released a “side-by-side” package (the “SbS Package”) that generally establishes an exemption for U.S. multinationals from the 15% global minimum tax. However, the implementation of the SbS Package depends on domestic legislation and regulation in OECD member countries and is subject to subsequent review. Details around the proposals are still uncertain as the OECD and local jurisdictions continue to issue the technical guidance. Our effective tax rate and cash tax payments could increase in future years as a result of these changes.The preparation of consolidated financial statements in conformity with U.S. generally accepted accounting principles (“U.S. GAAP”) requires management to make estimates and assumptions that affect the amounts reported on our consolidated financial statements and accompanying notes. We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, the results of which form the basis for making judgments about the carrying amounts of assets, liabilities, equity, revenue, and expenses that are not readily apparent from other sources.

For more information relating to critical accounting policies, refer to the section entitled “Critical Accounting Estimates” in “Management’s Discussion and Analysis of Financial Condition and Results of Operations” in Part II, Item 7 of this Annual Report on Form 10-K.- 33 -Table of ContentsWe are obligated to maintain proper and effective internal control over financial reporting. We may not complete our analysis of our internal control over financial reporting in a timely manner, or our internal control may not be determined to be effective, which may adversely affect investor confidence in our company and, as a result, the value of our common stock.If we are unable to assert that our internal controls are effective, our independent registered public accounting firm may not be able to formally attest to the effectiveness of our internal control over financial reporting. If, in the future, our chief executive officer, chief financial officer, or independent registered public accounting firm determines that our internal control over financial reporting is not effective as defined under Section 404, we could be subject to one or more investigations or enforcement actions by state or federal regulatory agencies, stockholder lawsuits, or other adverse actions requiring us to incur defense costs and pay fines, settlements, or judgments, causing investor perceptions to be adversely affected and potentially resulting in a decline in the market price of our common stock.Governmental authorities, certain investors, and other stakeholders continue to focus on, set and revise, expectations relating to corporate responsibility matters, both in the United States and internationally. Such expectations are evolving and may be contradictory. We communicate corporate responsibility initiatives, goals, and commitments regarding sustainability, inclusion, responsible sourcing, and community impact in our annual Corporate Responsibility Report, on our website, in our SEC filings, and elsewhere. We could be criticized for their scope, nature, timing, or any revisions to them, and for the accuracy or completeness of our disclosures. Our actual or perceived failure to undertake these initiatives and achieve these goals, or the fact that we are undertaking these initiatives, could negatively impact our reputation or otherwise materially harm our business.U.’s Corporate Sustainability Reporting Directive.Failure to comply with governmental laws and regulations could harm our business.S. Foreign Corrupt Practices Act and the U.K. Responding to any action will likely result in significant diversion of management’s attention and resources. If any governmental sanctions are imposed, our business, financial condition, and operating results could be materially adversely affected.The market price of our common stock has historically been, and is likely to continue to be, volatile and could be subject to wide fluctuations in response to various factors, some of which are beyond our control and unrelated to our business, financial condition, or operating results. These fluctuations could cause a loss of all or part of an investment in our common stock.Securities class action litigation has often been brought against companies that experience periods of volatility in the market price of such company’s securities. Securities litigation could result in substantial costs, divert our management’s attention and resources from our business, and have a material adverse effect on our business, financial condition, and operating results. Our insurance may not cover all types of claims that may arise, and we cannot guarantee that applicable insurance will be available to us in the future on economically reasonable terms or at all.Our restated certificate of incorporation authorizes us to issue up to 2.0 billion shares of common stock and up to 100 million shares of preferred stock with such rights and preferences as may be determined by our board of directors. Any such issuance could result in substantial dilution to our existing stockholders and cause the market price of our common stock to decline.We cannot guarantee that our share repurchase program will be fully consummated or that it will enhance shareholder value, and share repurchases could affect the price of our common stock.As of July 31, 2026, we had $1.0 billion available under our share repurchase program which will expire on December 31, 2026 and may be suspended or discontinued at any time without prior notice. The share repurchase program could affect the price of our common stock, increase volatility, and diminish our cash reserves.We do not intend to pay dividends for the foreseeable future.We have never declared or paid any dividends on our common stock. We intend to retain any earnings to finance the operation and expansion of our business, and we do not anticipate paying any cash dividends in the future. As a result, stockholders may only receive a return on their investments in our common stock if the market price of our common stock increases.Our charter documents and Delaware law could discourage takeover attempts and lead to management entrenchment, which could also reduce the market price of our common stock.Provisions in our restated certificate of incorporation and amended and restated bylaws may have the effect of delaying or preventing a change in control of our company or changes in our management.These provisions may frustrate or prevent any attempts by our stockholders to replace or remove our current management by making it more difficult for our stockholders to replace members of our board of directors, which is responsible for appointing the members of management. In addition, as a Delaware corporation, we are subject to Section 203 of the Delaware General Corporation Law. These provisions may prohibit large stockholders, in particular those owning 15% or more of our outstanding voting stock, from merging or combining with us for a certain period of time. Any of these provisions could, under certain circumstances, depress the market price of our common stock.We may not have the ability to raise the funds necessary to settle conversions of the 2030 Notes, repurchase the 2030 Notes upon a fundamental change, or repay the 2030 Notes in cash at their maturity, and our other debt may contain limitations on our ability to pay cash upon conversion or repurchase of the 2030 Notes.In connection with the consummation of the CyberArk acquisition, we entered into a supplemental indenture (the “Supplemental Indenture”) to the Indenture, dated as of June 10, 2025 (as supplemented by the Supplemental Indenture, the “Indenture”), governing the 2030 Notes, and in the Supplemental Indenture we agreed to guarantee the 2030 Notes.Accordingly, we will need to make cash payments (a) if holders of the 2030 Notes require us to repurchase all, or a portion of, the 2030 Notes upon the occurrence of a fundamental change before the maturity date, (b) upon conversion of the 2030 Notes, or (c) to repay the 2030 Notes in cash at their maturity, unless earlier converted or repurchased. If our cash provided by operating activities, together with our existing cash, cash equivalents, and investments, and existing sources of financing, are inadequate to satisfy these obligations, we will need to obtain third-party financing, which may not be available to us on commercially reasonable terms or at all, to meet these payment obligations.In addition, our ability to repurchase or to pay cash upon conversion of the 2030 Notes may be limited by law, regulatory authority, or agreements governing our other indebtedness. Our failure to repurchase the 2030 Notes at a time when the repurchase is required by the Indenture, or to pay any cash amount due upon their maturity or conversion when required by the Indenture would constitute a default under the Indenture. A default under the Indenture could also lead to a default under agreements governing our other indebtedness. If the payment of the related indebtedness were to be accelerated after any applicable notice or grace periods, we may not have sufficient funds to satisfy all amounts due under our other indebtedness and the 2030 Notes.The Capped Calls may affect the value of the 2030 Notes and our common stock.In connection with the issuance of the 2030 Notes, CyberArk had previously entered into the Capped Calls, each with a financial institution (each, together with its affiliates, a “Dealer”). In connection with the CyberArk acquisition, we entered into substantially identical amended and restated letter agreements with respect to the Capped Calls, under which the Capped Calls were assigned to us and now reference our common stock. The Capped Calls are generally expected to reduce the potential dilution to our common stock upon conversion of the 2030 Notes and/or offset any potential cash payments we are required to make in excess of the principal amount of converted 2030 Notes, with such reduction and/or offset subject to a cap. Any Dealer may modify or unwind its hedge positions by entering into or unwinding various derivatives with respect to our common stock and/or purchasing or selling our common stock or other securities of ours in secondary market transactions prior to the maturity of the 2030 Notes (and is likely to do so following any conversion of the 2030 Notes, any repurchase of the 2030 Notes by us on any fundamental change repurchase date, any redemption date, or any other date on which the 2030 Notes are retired by us, in each case, if we exercise the relevant election under the Capped Calls and in connection with any negotiated unwind or modification of the Capped Calls). This activity could cause or prevent an increase or a decrease in the market price of our common stock or the 2030 Notes, which could affect a note holder’s ability to convert its 2030 Notes and, to the extent the activity occurs during any observation period related to a conversion of the 2030 Notes, it could affect the amount and value of the consideration that the note holder would receive upon conversion of the 2030 Notes.Our corporate headquarters are located in the San Francisco Bay Area, a region known for seismic activity. In addition, climate-related events, including drought, flooding, heat waves, wildfires, increased storm severity, and sea level rise, may increase in frequency and intensity and could disrupt our business operations and damage our facilities. In addition, the data centers and cloud infrastructure we and our third-party providers use to deliver our products, subscriptions, and support offerings are subject to risks from extreme weather events and power disruptions associated with climate change. We may be subject to increased regulations, reporting requirements, standards, or stakeholder expectations regarding climate change that may impact our business, increase compliance costs, and require additional investment in our operations and disclosures. These risks may be further increased if the disaster recovery plans for us and our suppliers prove to be inadequate. To the extent that any of the above should result in delays or cancellations of customer orders, the loss of customers, or the delay in the manufacture, deployment, or shipment of our products, our business, financial condition, and operating results would be adversely affected.Item 1B. Unresolved Staff CommentsNot applicable.Item 1C. CybersecurityAs a global cybersecurity provider, cybersecurity risk management is an integral part of our overall enterprise risk management program. We recognize the critical importance that a strong cybersecurity risk management program plays in maintaining the trust and confidence of our customers, end users, business partners, stockholders and employees. We have established processes and procedures for identifying, evaluating, and responding to risks from cybersecurity threats, including any potential unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or information.Cybersecurity Risk Management and StrategyOur cybersecurity risk management program includes written policies, standards, and procedures for maintaining data privacy, product security and information security to mitigate cybersecurity risks, and to identify, evaluate and respond to cybersecurity threats, vulnerabilities and incidents. Our cybersecurity risk management program and strategy is implemented across several areas, which include, but are not limited to, the following:•Information Security. We maintain a written information security program, which provides for policies, standards, guidelines, and administrative, technical and physical safeguards that we believe are reasonably designed, in light of the nature, size and complexity of our operations, to protect the resiliency of our operations and the confidentiality, integrity, and availability of our information systems and information. The program is assessed regularly and in light of new and emerging cybersecurity risks. •Technical Safeguards and Product Security. We conduct regular application security assessments, including our assessments for internet-facing applications that collect, transmit, or display end user data. We also employ tooling in certain areas to help prevent deviations from policy.- 37 -Table of Contents•Incident Response and Reporting. We maintain incident response and recovery protocols to enable prompt, effective and orderly identification, evaluation, management, and disposition of actual and potential security threats and incidents, including for purposes of escalation and internal and external-notification steps. We maintain a cross-functional incident response team, including senior representatives from information security, information technology, product, legal, privacy, communications, and finance, that is involved in assessing cybersecurity threats and incidents, assigning severity levels, and evaluating the potential impact, including the potential impact on our business strategy, results of operations and financial condition. Additionally, we utilize Unit 42 to support our response to threats. •Third-Party Risk Management. In addition, we maintain a security program designed to protect the security and integrity of our hardware products and data throughout the product design, development, manufacturing, delivery, and service and repair processes, which includes consideration of applicable supply chain risk management standards.•Risk and Readiness Assessments. We engage in at least quarterly assessments and testing of the effectiveness of our cybersecurity risk management program and incident response protocols that are designed to identify and evaluate vulnerabilities and weaknesses, address cybersecurity threats and test our readiness to respond to cybersecurity incidents. These efforts include, but are not limited to, threat modeling, vulnerability scans, penetration testing, audits, and/or tabletop exercises. We regularly engage third parties to perform assessments on our cybersecurity measures, such as audits and independent reviews of our compliance with various security compliance standards, including those established by the American Institute of Certified Public Accountants, operating effectiveness and penetration tests. The results of such assessments are reported to management and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews. •Awareness and Training. We provide regular training for educating employees about corporate policies and procedures and information security designed to provide our employees with knowledge of best practices and effective tools for safeguarding our data and assets and reducing security risks based on the human threat vector. Employees are also trained on the responsible use of AI and on the secure use of AI through regular trainings. We also deliver experiential training, including by periodically conducting simulated phishing exercises to test employee awareness and compliance with our security policies. •Governance. As discussed in more detail below under the heading, “Cybersecurity Governance,” our board of directors has delegated oversight of enterprise security risk management, including, but not limited to, cybersecurity risk management to the Security Committee. As part of our cybersecurity risk management procedures, senior members of management and the Security Committee are informed regarding security events based on established reporting thresholds, and are provided ongoing updates regarding any such meaningful threat or incident.As a global cybersecurity provider, we recognize that we may be a particularly attractive target for sophisticated threat actors. However, we face ongoing and increasing cybersecurity risks, including from threat actors that are becoming more sophisticated and effective over time, and we can provide no assurance that there will not be incidents in the future or that past or future threats or incidents will not materially affect us, including our business strategy, results of operations, or financial conditions. Despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident.

” - 38 -Table of ContentsCybersecurity GovernanceThe Security Committee, which is composed of our independent directors and chaired by our chief product and technology officer, facilitates our board of directors’ responsibility for oversight of security matters, including product security, data security, cybersecurity, security risk management, risk exposure and related controls and enterprise risk management related to these risks.” Our chief information security officer receives regular reports from our information security team and monitors the prevention, detection, and mitigation or remediation of cybersecurity risks, and works closely to keep the management team apprised of key risks, treats, and incidents. In addition, as described in further detail above under the heading “Cybersecurity Risk Management and Strategy,” a cross functional team is involved in assessing and managing the risks from cybersecurity threats and incidents, and reporting information about risks to the Security Committee.Our information security team consists of dedicated personnel who are experienced information systems security professionals and information security managers with many years of experience across a variety of technology sub-specialties..

Recently Filed

Click on a ticker to see risk factors

Ticker *	File Date
MBBC	7 hours ago
WSBK	20 hours ago
KARX	21 hours ago
TMGI	21 hours ago
ISPR	22 hours ago
LDXC	22 hours ago
LGVT	1 day ago
FPS	1 day, 8 hours ago
LRDC	1 day, 21 hours ago
RLGT	1 day, 21 hours ago
WEWA	1 day, 22 hours ago
BNTC	1 day, 22 hours ago
HAIN	1 day, 22 hours ago
VRDR	2 days, 5 hours ago
ABAT	2 days, 5 hours ago
UNFI	4 days, 17 hours ago
SMBC	4 days, 21 hours ago
GWRE	4 days, 22 hours ago
HWKE	4 days, 22 hours ago
RSSS	4 days, 22 hours ago
FLWS	5 days, 5 hours ago
ECXJ	5 days, 6 hours ago
LPTH	5 days, 20 hours ago
PLUR	5 days, 21 hours ago
EGAN	5 days, 22 hours ago
IBEX	5 days, 22 hours ago
PANW	5 days, 22 hours ago
AENT	5 days, 22 hours ago
CBKM	6 days, 1 hour ago
MCFT	6 days, 4 hours ago
GOLD	6 days, 19 hours ago
AUSI	6 days, 20 hours ago
LSAK	6 days, 22 hours ago
INM	6 days, 22 hours ago
INTU	6 days, 22 hours ago
GCBC	1 week ago
INNV	1 week ago
EVI	1 week, 1 day ago
PAXH	1 week, 4 days ago
TWIN	1 week, 4 days ago
BCCG	1 week, 5 days ago
PKTX	1 week, 5 days ago
MTRX	1 week, 5 days ago
LYTS	1 week, 5 days ago
ZS	1 week, 5 days ago
GROW	1 week, 5 days ago
PDEX	1 week, 5 days ago
LTCN	1 week, 5 days ago
GDLC	1 week, 5 days ago
BCHG	1 week, 5 days ago

OTHER DATASETS

House Trading

Dashboard

Corporate Flights

Dashboard

App Ratings

Dashboard

Strategies

Alerts

Browse Data

Risk Factors Dashboard

View risk factors by ticker

Search filings by term

Risk Factors - PANW

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing

$PANW Risk Factor changes from 00/08/29/25/2025 to 00/09/10/26/2026

Recently Filed

OTHER DATASETS

House Trading

Corporate Flights

App Ratings

TRADE SMARTER

TRADE SMARTER

Strategies

Alerts

Browse Data

Risk Factors Dashboard

View risk factors by ticker

Search filings by term

Risk Factors - PANW

-New additions in green-Changes in blue-Hover to see similar sentence in last filing

$PANW Risk Factor changes from 00/08/29/25/2025 to 00/09/10/26/2026

Recently Filed

OTHER DATASETS

House Trading

Corporate Flights

App Ratings

TRADE SMARTER

TRADE SMARTER

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing