ZS

A description of the risks and uncertainties associated with our business is set forth below. You should carefully consider the risks and uncertainties described below, as well as the other information in this Annual Quarterly Report on Form 10-K, 10-Q, including the unaudited condensed consolidated financial statements and the related notes and "Management’s Discussion and Analysis of Financial Condition and Results of Operations." The occurrence of any of the events or developments described below, or of additional risks and uncertainties not presently known to us or that we currently deem immaterial, could materially and adversely affect our business, results of operations, financial condition and growth prospects. In such an event, the market price of our common stock could decline, and you could lose all or part of your investment.

•we have a history of annual net losses and may not be able to achieve or sustain profitability in the future;

•servicing •repayment of our debt may require a significant amount of cash, and we may not have sufficient cash flow from our business or the ability to raise funds to pay our substantial debt; and

We have a history of annual net losses and may not be able to achieve or sustain profitability in the future.

We have incurred net losses in all annual periods since our inception, and we expect we will continue to incur annual net losses for the foreseeable future. We experienced net losses of $41.5 million, $57.7 million and $202.3 million for fiscal 2025, fiscal 2024 and fiscal 2023, respectively. As of July October 31, 2025, we had an accumulated deficit of $1,189.6 $1,201.2 million. Because the market for our cloud platform is rapidly evolving and cloud-based security solutions have not yet reached widespread adoption, it is difficult for us to predict our future results of operations. We expect our operating expenses to increase significantly over the next several years as we continue to hire additional personnel, particularly in research and development and sales and marketing, expand our operations and infrastructure, both domestically and internationally, and continue to develop our platform. If we fail to increase our revenue to offset the increases in our operating expenses, we may not achieve or sustain profitability in the future.

We have experienced rapid growth in revenue, operations and employee headcount in recent periods. In addition, the number of customers, users and internet traffic on our cloud platform has increased rapidly in recent years, and we anticipate that the increasing adoption and deployment of AI technologies by our customers may result in significant increases in traffic and usage on our platform. Our growth may not be sustainable and may not be sufficient to achieve and sustain profitability, as we also expect our costs to increase in future periods as we expand our operations and significantly increase our headcount. In addition, we expect our recent revenue growth rates will decline in the future as the size of our revenue base increases. As a result, we believe that historical comparisons of our revenue may not be meaningful and should not be relied upon as an indication of future performance. Accordingly, you should not rely on our revenue and other growth for any prior quarter or fiscal year as an indication of our future revenue or revenue growth.

We currently derive most of our revenue from sales through our channel partner network, and we expect for the foreseeable future most of our future revenue growth will also be driven through this network. Not only does our joint sales approach require additional investment to grow and train our sales force, but we believe that continued growth in our business is dependent upon identifying, developing and maintaining strategic relationships with our existing and potential channel partners, including global systems integrators and regional telecommunications service providers that will in turn drive substantial revenue and provide additional value-added services to our customers. Our agreements with our channel partners are generally non-exclusive, meaning our channel partners may offer customers the products of several different companies, including products that compete with our cloud platform. Our channel partners may also cease marketing or reselling our platform with limited or no notice and without penalty. If our channel partners do not effectively market and sell subscriptions to our cloud platform, choose to promote our competitors’ products or fail to meet the needs of our customers, our ability to grow our business and sell subscriptions to our cloud platform may be adversely affected. For example, sales through our top five channel partners and their affiliates, in aggregate, represented 28% of our revenue for fiscal 2025, 25% of our revenue for fiscal 2024 and 26% of our revenue for fiscal 2023. 2023, and 30% and 26% of our revenue for the three months ended October 31, 2025 and 2024, respectively. In addition, our channel partner structure could subject us to lawsuits or reputational harm if, for example, a channel partner misrepresents the functionality of our cloud platform to customers or violates applicable laws or our corporate policies. Moreover, our channel partners' operations may be negatively impacted by events including pandemics, international conflicts, trade regulations including tariffs, inflation and other events affecting the global economy in general. For example, these events could increase credit risk of end customers and create uncertainty in credit markets. Our ability to achieve revenue growth in the future will depend in large part on our success in maintaining successful relationships with our channel partners, identifying additional channel partners and training our channel partners to independently sell and deploy our platform. If we are unable to maintain our relationships with our existing channel partners or develop successful relationships with new channel partners or if our channel partners fail to perform, our business, financial position and results of operations could be materially and adversely affected.

Our future success is substantially dependent on our ability to attract, retain and motivate the members of our management team and other key employees throughout our organization. In particular, we are highly dependent on the services of Jay Chaudhry, our Chief Executive Officer and chairman of our board of directors, who is critical to our future vision and strategic direction. We rely on our leadership team in the areas of operations, security, marketing, sales, support and general and administrative functions, and on individual contributors on our research and development team. Although we have entered into employment agreements with our key personnel, these agreements have no specific duration and constitute at-will employment. We do not maintain key person life insurance policies on any of our employees. The loss of one or more of our executive officers or key employees could seriously harm our business. We have experienced, and may in the future experience, significant change in senior management. Any significant leadership change or senior management transition involves risk, especially nearly simultaneous changes involving so many leaders and employees, and any failure to transition effectively or to retain these new leaders could hinder our strategic planning, business execution and future performance.

In addition, the techniques used by cyber threat actors, including state sponsored actors, to access or sabotage networks and other systems change frequently and frequently, generally are not recognized until launched against a target. target and are becoming increasingly sophisticated, prevalent and automated, as a result of the exploitation of AI technology. As a result, there is a risk that a cyber threat could emerge that our services are unable to detect or prevent until after some of our customers are impacted. The growth in state sponsored and AI enabled cyber activity showcases the increasing sophistication of cyber threats and dramatically expands the global threat landscape. Moreover, as our services are adopted by an increasing number of enterprises, it is possible that the individuals and organizations behind cyber threats will focus on finding ways to defeat our services or to target our systems. If this happens, our cloud platform could be targeted by attacks specifically designed to disrupt our business and create the perception that our cloud platform is not capable of providing superior security, which, in turn, could have a serious impact on our reputation as a provider of security solutions. Further, high profile security breaches or incidents, in particular those of cloud-based service providers, may cause our customers and potential customers to lose trust in cloud solutions generally, and with respect to security in particular, which could materially and adversely impact our ability to retain existing customers or attract new customers.

Increasingly, enterprises are subject to a wide variety of attacks on their networks and systems, including traditional threat actors, malicious code (such as viruses and worms), social engineering attacks (such as deep fakes), targeted phishing attacks, distributed denial-of-service attacks, advanced attacks conducted or sponsored by nation-states, AI enabled attacks or attacks targeting and exploiting AI and ML systems and applications, advanced persistent threat intrusions, ransomware and other malware, attacks on their vendors and supply chains, and theft or misuse of intellectual property or business or personal data, including by disgruntled or negligent, current or former employees or contractors. No security solution, including our cloud platform, can address all possible security threats, which are becoming increasingly frequent and sophisticated with the development of AI and ML, or block all methods of penetrating a network or otherwise perpetrating a security breach or incident. Our customers typically rely on complex network and security infrastructures, which include products and services from multiple vendors, to secure their networks. If any of our customers becomes infected with malware or experiences a security breach or incident, they could be disappointed with our services, regardless of whether our services are intended to block the attack or would have blocked the attack if the customer had properly configured our cloud platform. Additionally, if any enterprises that are publicly known to use our services are the subject of a cyberattack that becomes publicized, our current or potential customers may look to our competitors for alternatives to our services.

We are increasingly utilizing AI and ML capabilities, including, for example, those relating to generative AI and large language models, into in our business operations and our product offerings. The rapid evolution of AI and ML requires the application of resources to develop, test and maintain our products and services and our internal applications, systems and process to help ensure that AI and ML are implemented responsibly to benefit our business, while also minimizing any unintended or harmful impact. As with many developing technologies, AI and ML present risks and challenges, many of which may be unknown, that could affect their further development, adoption and use. use and the related risks to our business. These risks and challenges could undermine public confidence in AI and ML, which could slow or even halt its adoption and negatively affect our business. Further, a quickly evolving legal and regulatory environment may cause us to incur increased research and development costs, or divert resources from other development efforts, to address social and ethical issues related to AI and ML. In addition, as the regulatory landscape for AI and ML evolves, we must develop and maintain robust internal policies and standards that clarify functional roles and responsibilities for the responsible and compliant development development, deployment and deployment use of AI technologies. technologies in our internal operations and product offerings. The use of AI technologies presents emerging ethical issues that could become controversial and failure, or perceived failure, to establish or enforce such policies and clear lines of accountability could increase our risk of noncompliance, operational errors or reputational harm. As a result of these and other challenges associated with our use, implementation and training of AI and ML, or misunderstandings or misrepresentations by third parties about the type of data that we use to train AI or ML, we may in the future be subject to legal liability, competitive harm, negative media coverage or regulatory action, including new proposed, and in certain cases enacted, rules and legislation regulating AI in jurisdictions such as the European Union, new applications of existing data protection, privacy, cybersecurity, information security, intellectual property and other laws, and brand or reputational harm.

We rely on a limited number of suppliers for several components of our cloud platform and the systems we use to operate our business and provide services to our customers, including sole or limited sourced hardware, software and SaaS services. Some of our suppliers also temporarily hold a portion of our assets for us. Our reliance on these suppliers exposes us to risks, including reduced control over production costs, constraints based on the then-current availability, terms and pricing of these components and potential loss of assets. For example, we generally purchase equipment or the components of equipment on a purchase order basis, and do not have long-term contracts guaranteeing supply. We also rely on sole or limited sourced SaaS vendors to provide critical services that we use to operate our business. In addition, the technology industry has experienced component shortages, delivery delays, price increases and service interruptions in the past, and we may experience shortages, delays, materially increased costs or service interruptions in the future, including as a result of natural disasters, acts of war or international conflicts, epidemics or global pandemics, increased demand in the industry or if our suppliers do not have sufficient rights to supply the components in all jurisdictions in which we may host our services. While global economic conditions have not yet had a material impact on our supply chain, these conditions have increased our costs in the past and could result in disruptions and delays for components in the future. Additionally, changes to existing international trade agreements, tariffs, export controls or other trade measures and regulations that impact our sourcing partners or us could lead to increased costs to operate our business and to disruptions in our supply chain, which could limit our ability to support our customers. For instance, there is a risk that current geopolitical, diplomatic and other developments affecting the relationship between China and Taiwan may materially and negatively impact the availability of certain critical components that we use in our data centers, which we source from overseas. If our supply of certain components is disrupted disrupted, delayed or delayed, becomes significantly more expensive, there can be no assurance that available alternatives can serve as adequate replacements for the existing components or that alternatives will be available on terms that are favorable to us, if at all, as it may take several months or longer to identify, qualify and engage a new supplier or integrator. Any disruption or delay in access to components may materially increase our costs, delay opening new data centers, delay increasing capacity or replacing defective equipment at existing data centers, cause other constraints on our operations that could damage our channel partner or customer relationships or otherwise have a material adverse impact on our business.

We have numerous arrangements with financial institutions that include cash and investment deposits, and non-collateralized capped call contracts and non-collateralized contracts, interest rate swap contracts and foreign currency forward contracts. As a result, we are subject to the risk that the counterparty to one or more of these arrangements may default, on its performance under the terms of the arrangement. In times of market distress, a counterparty may default rapidly and without notice, and we may be unable to take action to cover our exposure, either because of lack of contractual ability to do so or because market conditions make it difficult to take effective action. If one of our counterparties becomes insolvent or files for bankruptcy, our ability eventually to recover any losses suffered as a result of that counterparty’s default may be limited by the impaired liquidity of the counterparty or the applicable legal regime governing the bankruptcy proceedings. In the event of such a default, we could incur significant losses, which could harm our business and adversely affect our results of operations and financial condition.

As of July October 31, 2025, our executive officers, directors, current 5% or greater stockholders and affiliated entities together beneficially owned approximately 41.4% 41.0% of our common stock outstanding with Jay Chaudhry, our Chief Executive Officer and chairman of our board of directors, and his affiliates beneficially owning approximately 17.0% 16.8% of our common stock. As a result, these stockholders, acting together, will have significant control over most matters that require approval by our stockholders, including the election of directors and approval of significant corporate transactions. Corporate action might be taken even if other stockholders oppose them. This concentration of ownership might also have the effect of delaying or preventing a change of control of us that other stockholders may view as beneficial.

We may also issue our shares of common stock or securities convertible or exercisable into shares of our common stock from time to time in connection with a financing, acquisition, investments or otherwise. Any such issuance could result in substantial dilution to our existing stockholders, cause the market price of our common stock to decline and dilute your voting power. For instance, prior to April 15, 2028, our 0.0% Convertible Senior Notes due 2028, or the 2028 Notes, are convertible at the option of the holders only under certain conditions or upon the occurrence of certain events. After April 15, 2028, holders may convert all or any portion of the 2028 Notes at their option at any time. If one or more holders elect to convert their 2028 Notes and we elect to settle all or any portion of such conversions in shares of our common stock, any sales in the public market of the common stock issuable upon such conversion could adversely affect prevailing market prices of our common stock. In addition, certain holders of the 2028 Notes may engage in short selling to hedge their position in the 2028 Notes. Any anticipated future issuances of shares of our common stock upon conversion of the 2028 Notes could also depress the price of our common stock.

Our amended and restated certificate of incorporation further provides that the federal district courts of the United States are the exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act of 1933, as amended. amended, or the Securities Act.

Servicing Repayment of our debt will require a significant amount of cash, which may impact our cash available for working capital, capital expenditures and other corporate purposes.

In connection with the pricing of the 2028 Notes, we entered into privately negotiated capped call transactions with certain of the initial purchasers and/or their respective affiliates and other financial institutions, or the Option Counterparties. The capped call transactions are expected generally to reduce the potential dilution to our common stock upon conversion of the 2028 Notes and/or offset any cash payments we are required to make in excess of the principal amount of converted 2028 Notes, as the case may be, with such reduction and/or offset subject to a cap.

The Option Counterparties or their respective affiliates may modify their hedge positions by entering into or unwinding various derivatives with respect to our common stock and/or purchasing or selling our common stock or other securities of ours in secondary market transactions prior to the maturity of the 2028 Notes (and are likely to do so during the observation period related to a conversion of the 2028 Notes, in connection with any fundamental change repurchase of the 2028 Notes and, to the extent we unwind a corresponding portion of the capped call transactions, following any other repurchase of the 2028 Notes). Notes. It is likely they will engage in such activity during the observation period related to a conversion of the 2028 Notes, in connection with any fundamental change repurchase of the 2028 Notes and, to the extent that we unwind a corresponding portion of the capped call transactions, following any other repurchase of the 2028 Notes. These activities could influence the market price of our common stock or the 2028 Notes, potentially causing or preventing an increase or decrease in their value.

The Option Counterparties are financial institutions, and we will be are subject to the risk that any or all of them might default under the capped call transactions. Our exposure to the credit risk of the Option Counterparties will is not be secured by any collateral. Past global economic conditions conditions, including in connection with increases in prevailing interest rates, have resulted in the actual or perceived failure or financial difficulties of many financial institutions. If an Option Counterparty becomes subject to insolvency proceedings, we will become an unsecured creditor in those proceedings with a claim equal to our exposure at that time under the capped call transactions with such Option Counterparty. Our exposure will depend on many factors but, generally, an increase in our exposure will be correlated to an increase in the market price and in the volatility of our common stock. In addition, upon a default by an Option Counterparty, we may suffer adverse tax consequences and/or more dilution than we currently anticipate with respect to our common stock. We can provide no assurance as to the financial stability or viability of any of the Option Counterparties.

As a public company, we are subject to the reporting requirements of the Securities Exchange Act of 1934, as amended, or the Exchange Act, the Sarbanes-Oxley Act of 2002, or the Sarbanes-Oxley Act, and the rules and regulations of The Nasdaq Global Select Market, or Nasdaq. The requirements of these rules and regulations will impose significant legal, accounting and financial compliance costs; make some activities more difficult, time-consuming and costly; and place significant strain on our personnel, systems and resources.