ZS

We have incurred net losses in all annual periods since our inception, and we expect we will continue to incur net losses for the foreseeable future. We experienced net losses of $41.5 million, $57.7 million and $202.3 million for fiscal 2025, fiscal 2024 and fiscal 2023, respectively. As of January 31, April 30, 2026, we had an accumulated deficit of $1,235.5 $1,249.4 million. Because the market for our cloud platform is rapidly evolving and cloud-based security solutions have not yet reached widespread adoption, are still in the process of being widely adopted, it is difficult for us to predict our future results of operations. We expect our operating expenses to increase significantly over the next several years as we continue to hire additional personnel, particularly in research and development and sales and marketing, expand our operations and infrastructure, both domestically and internationally, and continue to develop our platform. If we fail to increase our revenue to offset the increases in our operating expenses, we may not achieve or sustain profitability in the future.

Cloud security technologies are still evolving, and it remains difficult to predict customer demand and adoption rates for our solutions. We believe that our cloud platform offers superior protection to our customers, who are moving their applications and data to the cloud and embracing AI applications and agents. We also believe that our cloud platform represents a major shift from on-premises appliance-based security solutions. While cloud-based security solutions have seen increased adoption, traditional on-premises security appliances continue to be entrenched in the infrastructure of many of our potential customers, particularly large enterprises, because of their prior investment in and the familiarity of their IT personnel with on-premises appliance-based solutions. As a result, our sales process often involves extensive efforts to educate our customers on the benefits and capabilities of our cloud platform, particularly as we continue to pursue customer relationships with large organizations. Even with these efforts, we cannot predict long-term market acceptance of our cloud platform, or the adoption of competing products, services or technologies. If we fail to achieve or maintain broad market acceptance of our cloud platform or are unable to keep pace with industry changes, particularly as a result of artificial intelligence, AI, our ability to grow our business and our operating results will be materially and adversely affected.

As a result of challenging or and uncertain macroeconomic conditions, conditions and the other challenges described in these risk factors, we have experienced experienced, and may experience in the future future, increased scrutiny and a longer approval process for initial purchases by new customers, particularly for larger transactions. We cannot predict how challenging or and uncertain macroeconomic conditions or other challenges will impact potential customers' purchasing decisions and whether potential customers may decide to delay purchases, decrease the size of purchases or entirely forego purchasing our services.

In order for us to maintain or improve our results of operations, it is important that our customers renew their subscriptions for our services when existing contract terms expire, and that we expand our commercial relationships with our existing customers. Our customers have no obligation to renew their subscriptions for our services after the expiration of their contractual subscription period, which is typically one to three years, and in the normal course of business, some customers have elected not to renew. In addition, in certain cases, including under the EU Data Act, customers may cancel their subscriptions without cause either at any time or upon advance written notice (commonly ranging from 30 days to 60 days), typically subject to an early termination penalty for unused services. In addition, our customers may renew for fewer users, elect not to renew non-user based non-user-based services, renew for shorter contract lengths or switch to a lower-cost product suite. If our customers do not renew their subscription services, subscriptions, we could incur impairment losses related to our deferred contract acquisition costs. It is difficult to accurately predict long-term customer retention because of our varied customer base and given the length of our subscription contracts. Our customer retention and expansion may decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with our services, our prices and pricing plans, our customers’ spending levels, decreases in the number of services purchased and/or the users to which our customers deploy our solutions, new laws and regulations impacting service contract terms, mergers and acquisitions involving our customers, competition competition, our customers' increasing use of AI to automate tasks traditionally performed by human workers and deteriorating or uncertain general economic conditions, which may result in reductions in IT budgets and lower employee headcounts. conditions. Any of these factors may result in our customers and potential customers reducing their IT budgets or lowering employee headcounts, which could negatively impact our business.

Our future success also depends in part on the rate at which our current customers add additional users or services to their subscriptions, which is driven by a number of factors, including customer satisfaction with our services, customer security and networking issues and requirements, general economic conditions and customer reaction to the price per additional user or of additional services. In addition, as our customers increasingly deploy AI agents, our success will increasingly depend on our ability to monetize the increasing prevalence of non-user-based traffic. If our efforts to expand our relationships with our existing customers are not successful, our business may materially suffer.

We currently derive most of our revenue from sales through our channel partner network, and we expect for the foreseeable future most of our future revenue growth will also be driven through this network. Not only does our joint sales approach require additional investment to grow and train our sales force, but we believe that continued growth in our business is dependent upon identifying, developing and maintaining strategic relationships with our existing and potential channel partners, including global systems integrators and regional telecommunications service providers that will in turn drive substantial revenue and provide additional value-added services to our customers. Our agreements with our channel partners are generally non-exclusive, meaning our channel partners may offer customers the products of several different companies, including products that compete with our cloud platform. Our channel partners may also cease marketing or reselling our platform with limited or no notice and without penalty. If our channel partners do not effectively market and sell subscriptions to our cloud platform, choose to promote our competitors’ products or fail to meet the needs of our customers, our ability to grow our business and sell subscriptions to our cloud platform may be adversely affected. For example, sales through our top five channel partners and their affiliates, in aggregate, represented 28% of our revenue for fiscal 2025, 25% of our revenue for fiscal 2024 and 26% of our revenue for fiscal 2023, and 30% and 27% of our revenue for the six nine months ended January 31, April 30, 2026 and 2025, respectively. In addition, our channel partner structure could subject us to lawsuits or reputational harm if, for example, a channel partner misrepresents the functionality of our cloud platform to customers or violates applicable laws or our corporate policies. Moreover, our channel partners' operations may be negatively impacted by events including pandemics, international conflicts, trade regulations including tariffs, inflation and other events affecting the global economy in general. For example, these events could increase credit risk of end customers and create uncertainty in credit markets. Our ability to achieve revenue growth in the future will depend in large part on our success in maintaining successful relationships with our channel partners, identifying additional channel partners and training our channel partners to independently sell and deploy our platform. If we are unable to maintain our relationships with our existing channel partners or develop successful relationships with new channel partners or if our channel partners fail to perform, our business, financial position and results of operations could be materially and adversely affected.

Conditions in our market change rapidly and significantly as a result of technological advancements (particularly as a result of artificial intelligence), AI), partnering or acquisitions by our competitors or continuing market consolidation. Start-up companies that innovate and large competitors that are making significant investments in research and development may introduce similar or superior products, services and technologies that compete with our cloud platform. Large companies with substantial communications infrastructure, such as global telecommunications services providers or public cloud providers, have entered or could choose to enter the security solutions market. Some of our current or potential competitors have made or could make acquisitions of businesses or establish cooperative relationships that may allow them to offer more directly competitive and comprehensive solutions than were previously offered and adapt more quickly to new technologies and customer needs. In addition, AI technologies may lower barriers to entry for new competitors, including large AI providers, and enable faster development of alternative solutions. These competitive pressures in our market or our failure to compete effectively may result in price reductions, fewer orders, reduced revenue and gross margins, increased net losses and loss of market share. Any failure to meet and address these factors could materially harm our business and operating results.

•the occurrence of earthquakes, floods, fires, pandemics, power loss, system failures, physical or electronic break-ins, acts of war, international conflicts (such as the current conflicts between Russia and Ukraine and in the Middle East) East, including recent conflicts related to Iran) or terrorism, human error or interference (including by disgruntled or negligent, current or former employees or contractors) and other catastrophic events;

•the potential implementation of export controls, tariffs controls or tariffs, or retaliatory measures in response to such actions, on the sales of our products in countries where our customers or potential customers are located.

The occurrence of any of these factors, or if we are unable to efficiently and cost-effectively fix such errors or other problems that may be identified, could damage our reputation, negatively impact our relationship with our customers or otherwise materially harm our business, results of operations and financial condition. In addition, powerful new AI models have accelerated our ability to discover vulnerabilities in our software and third-party components we incorporate into our software. As a result, we are identifying more vulnerabilities, and any failure to timely remediate any significant vulnerability may result in issues that could disrupt the continuity or security of our services.

In addition, we We provide our services through a cloud-based inline proxy, and some governments, third-party products, websites or services may block proxy-based traffic under certain circumstances. For example, vendors may attempt to block traffic from our cloud platform or blacklist our IP addresses because they cannot identify the source of the proxy-based traffic. Our competitors may use this as an excuse to block traffic from their solutions or blacklist our IP addresses, which may result in our customers’ traffic being blocked from our platform. If our customers experience significant instances of traffic blockages, they will experience reduced functionality or other inefficiencies, which would reduce customer satisfaction with our services and likelihood of renewal.

If we fail to develop or introduce new enhancements to our cloud platform platform, including AI enhancements, on a timely basis, our ability to attract and retain customers, remain competitive and grow our business could be impaired.

If our global network of data centers, exchanges, which deliver our services, was damaged or otherwise failed to meet the requirements of our business, our ability to provide services to our customers and maintain the performance of our cloud platform could be negatively impacted, which could cause our business to suffer.

We currently host our cloud platform and serve our customers from a global network of over 160 public exchanges globally and thousands of private exchanges at the edge. While we have electronic access to the components and infrastructure of our cloud platform that are hosted by third parties, we do not control the operation of these facilities. Consequently, we may be subject to service disruptions as well as a lack of adequate support for our data center operations due to reasons that are outside of our control. Our exchanges are hosted in third-party data centers which are vulnerable to damage and connections to our data centers exchanges may be interrupted by a variety of sources, including earthquakes, floods, fires, power loss, system or infrastructure failures, computer viruses, physical or electronic break-ins, human error or interference (including by disgruntled or negligent, current or former employees or contractors) and other catastrophic events. Our data centers exchanges may also be subject to national or local administrative actions, changes in government regulations, including, for example, the impact of global economic and other sanctions like those levied in response to the current conflict between Russia and Ukraine, changes to legal or permitting requirements and litigation to stop, limit or delay operations. Despite precautions taken at these facilities, a decision to close the facilities without adequate notice or other unanticipated problems at these facilities could result in interruptions or delays in our services, impede our ability to scale our operations or have other adverse impacts upon our business. In addition, if we do not accurately plan for our infrastructure capacity requirements or experience significant strains on our data center resources, or if data center capacity is unavailable or unavailable at acceptable terms, we may experience delays and additional expenses in arranging new data centers, exchanges, and our customers could experience performance degradation or service outages that may subject us to financial liabilities, result in customer losses and materially harm our business.

It is virtually impossible for us to entirely mitigate the risk of breaches of our cloud platform or other security incidents affecting our cloud platform or our internal systems, networks or data. In addition, the functionality of our platform may be disrupted, either intentionally or due to negligence, including by disgruntled or negligent current or former employees or contractors. The security measures we use internally and have integrated into our cloud platform, which are designed to detect unauthorized activity and prevent or minimize security breaches, may not function as expected or may not be sufficient to identify or protect against certain attacks. Enterprises are subject to a wide variety of attacks on their networks and systems, and techniques used to sabotage or to obtain unauthorized access to networks in which data is stored or through which data is transmitted change frequently and generally are not recognized until launched against a target. The growth in state sponsored cyber activity, including those actions taken in connection with the current conflict between Russia recent global conflicts and Ukraine, geopolitical tensions, showcase the increasing sophistication of cyber threats. As a result, we may be unable to anticipate these techniques or implement adequate measures to prevent an electronic intrusion into our customers through our cloud platform or to prevent breaches and other security incidents affecting our cloud platform, internal networks, systems or data. Further, once identified, we may be unable to remediate or otherwise respond to a breach or other incident in a timely manner. Actual, perceived or purported security breaches of our cloud platform could result in actual, perceived or purported breaches of our customers’ networks and systems.

Further, our vendors and service providers have been, and may in the future be, the targets of cyberattacks, and their systems and networks have been, and may in the future be, breached or may contain exploitable defects or bugs that could result in a breach of or disruption to their or our systems and networks. Our ability to monitor our vendors’ and service providers’ data security is limited, and, in any event, third parties may be able to circumvent their security measures, resulting in the unauthorized access to, misuse, disclosure, loss, alteration, or destruction of our data, including confidential, sensitive, and other information about individuals. Geo-political factors including international conflicts, such as between Russia and Ukraine and in the Middle East, including recent conflicts related to Iran, may increase the risk of such cyberattacks.

Our future success is substantially dependent on our ability to attract, retain and motivate the members of our management team and other key employees throughout our organization. In particular, we are highly dependent on the services of Jay Chaudhry, our Chief Executive Officer and chairman of our board of directors, who is critical to our future vision and strategic direction. We rely on our leadership team in the areas of operations, security, marketing, sales, support and general and administrative functions, and on individual contributors on our research and development team. Although we have entered into employment agreements with our key personnel, these agreements have no specific duration and constitute at-will employment. We do not maintain key person life insurance policies on any of our employees. The loss of one or more of our executive officers or key employees could seriously harm our business. We have experienced, and may in the future experience, significant change in senior management. For example, two sales leaders recently departed the Company. Any significant leadership change or senior management transition involves risk, especially nearly simultaneous changes involving so many leaders and employees, risk and any failure to transition effectively or to retain these new leaders could hinder our strategic planning, business execution and future performance.

•political, economic and social uncertainty or international conflict, such as the current conflicts between Russia and Ukraine and in the Middle East; East, including recent conflicts related to Iran;

Our business strategy includes acquiring other complementary solutions, technologies or businesses. We have in the past acquired, and expect in the future to acquire, businesses that we believe will complement or augment our existing business. In order to To expand our security offerings and features, we also may enter into relationships with other businesses, which could involve preferred or exclusive licenses, additional channels of distribution or investments in other companies. Negotiating these transactions can be time-consuming, difficult and costly, and our ability to close these transactions may be subject to third-party approvals, such as government regulatory approvals, which are beyond our control. Consequently, we cannot assure you that these transactions, once undertaken and announced, will close.

We believe that our significant presence in India provides important advantages for our business, such as direct access to a large pool of skilled professionals. However, it also creates certain risks that we must effectively manage. As of July 31, 2025, 37% of our global work force is based in India and is comprised mostly of R&D, finance and operations professionals. Wage costs in India for skilled professionals are currently lower than in the United States for comparably skilled professionals. However, wages and benefit costs in India are increasing at a faster rate than in the United States, which could result in us incurring increased costs for technical professionals. There is intense competition in India for skilled technical professionals, and we expect such competition to increase. As a result, we may be unable to retain our current employee base in India or hire additional new talent or do so cost-effectively. In addition, India has experienced natural disasters, civil unrest and terrorism and, in the past, has been and may again be involved in conflicts with neighboring countries, such as the recent conflict with Pakistan. countries. If we are unable to effectively manage any of the foregoing risks related to our India operations, our development efforts and operations could be impaired, which could materially and negatively impact our growth and operating results.

In addition, the techniques used by cyber threat actors, including state sponsored actors, to access or sabotage networks and other systems change frequently, generally are not recognized until launched against a target and are becoming increasingly faster, more sophisticated, more prevalent and automated, more automated as a result of the exploitation availability and rapid commoditization of AI technology. AI-enabled cyberattack toolkits. While advanced adversaries continue to gain capabilities, less-sophisticated actors are increasingly able to plan, develop and deliver attacks at a scale, speed and degree of customization that has historically required specialized expertise. As a result, we expect the volume, speed and the per-incident impact of cyberattacks to increase and dramatically expand the global threat landscape. As a result, Further, there is a risk that a cyber threat could emerge that our services are unable to detect or prevent until after some of our customers are impacted.

Moreover, as As our services are adopted by an increasing number of enterprises, it is possible that the individuals and organizations behind cyber threats will focus on finding ways to defeat our services or to target our systems. If this happens, our cloud platform could be targeted by attacks specifically designed to disrupt our business and create the perception that our cloud platform is not capable of providing superior security, which, in turn, could have a serious impact on our reputation as a provider of security solutions. Further, high profile security breaches or incidents, in particular those of cloud-based service providers, may cause our customers and potential customers to lose trust in cloud solutions generally, and with respect to security in particular, which could materially and adversely impact our ability to retain existing customers or attract new customers.

We are increasingly utilizing AI and ML capabilities in our business operations and our product offerings. As with many developing technologies, AI and ML present risks and challenges, many of which may be unknown, that which could affect their further development, adoption and use and our ability to realize their anticipated benefits. The rapid evolution of AI and ML requires the application of significant financial, operational and human resources to develop, test test, maintain and maintain monitor our products and services and our internal applications, systems and process processes to help ensure that AI and ML are implemented responsibly to benefit our business, while also minimizing any unintended or harmful impact. effectively and responsibly. We may not accurately forecast the required resources or effectively deploy resources when and where needed to realize the benefits of AI and ML technologies. We are increasingly deploying AI agents, which may take actions that are erroneous, irreversible or misaligned with intended business outcomes, including interacting with unauthorized data sources and external tools. We are also enabling employees across our organization to design, build and deploy software applications. This decentralization of software development activity may increase the risk of security vulnerabilities, data exposure, regulatory non-compliance and operational failures that are difficult to detect or remediate through traditional oversight mechanisms.

Further, a quickly evolving legal and regulatory environment may cause us to incur increased research and development costs, or divert resources from other development efforts, to address social and ethical issues related to AI and ML. As the regulatory landscape for AI and ML evolves, including through new frameworks such as the EU AI Act, we must develop and maintain robust internal policies and standards that clarify functional roles and responsibilities for the responsible and compliant development, deployment and use of AI technologies in our internal operations and product offerings. The use of AI technologies presents ethical issues that could become controversial and failure, or perceived failure, to establish or enforce such policies and clear lines of accountability could increase our risk of noncompliance, operational errors or errors, reputational harm. harm and penalties.

We rely on a limited number of suppliers for several components of our cloud platform and the systems we use to operate our business and provide services to our customers, including sole or limited sourced hardware, software and SaaS services. Some of our suppliers also temporarily hold a portion of our assets for us. Our reliance on these suppliers exposes us to risks, including reduced control over production costs, constraints based on the then-current availability, terms and pricing of these components and potential loss of assets. For example, we generally purchase equipment or the components of equipment on a purchase order basis, and do not have long-term contracts guaranteeing supply. We also rely on sole or limited sourced SaaS vendors to provide critical services that we use to operate our business. As AI-enabled cyberattacks increase, these SaaS vendors may be compromised or suffer outages, which may disrupt their services on which our cloud platform depends.

Global economic conditions are increasing our supply chain costs and could result in further increased costs and disruptions and delays for components in the future. Additionally, changes to existing international trade agreements, tariffs, export controls or other trade measures and regulations that impact our sourcing partners or us may lead to increased costs to operate our business and to disruptions in our supply chain, which could limit our ability to support our customers. For instance, current geopolitical, diplomatic and other developments affecting the relationship between China and Taiwan may materially and negatively impact the availability of certain critical components that we use in our data centers, which we source from overseas. If our supply of certain components is disrupted, delayed or becomes significantly more expensive, there can be no assurance that available alternatives can serve as adequate replacements for the existing components or that alternatives will be available on terms that are favorable to us, if at all, as it may take several months or longer to identify, qualify and engage a new supplier or integrator. Any disruption or delay in access to components may materially increase our costs, require us to increase costs to our customers, delay opening new data centers, exchanges, delay increasing capacity or replacing defective equipment at existing data centers, cause other constraints on our operations that could damage our channel partner or customer relationships or otherwise have a material adverse impact on our business and operating results.

A number of companies in our industry hold a large number of patents and also protect their copyright, trade secret and other intellectual property rights, and companies in the networking and security industry frequently enter into litigation based on allegations of patent infringement or other violations of intellectual property rights. In addition, patent holding companies seek to monetize patents they previously developed, have purchased or otherwise obtained. Many companies, including our competitors, may now, and in the future, have significantly larger and more mature patent, copyright, trademark and trade secret portfolios than we have, which they may use to assert claims of infringement, misappropriation and other violations of intellectual property rights against us. In addition, intellectual property litigation may involve non-practicing entities or other patent owners who have no relevant product offerings or revenue and against whom our own patents may therefore provide little or no deterrence or protection. As we face increasing competition and gain an increasingly higher profile the possibility of intellectual property rights claims against us grows. Third parties have asserted in the past and may in the future assert claims of infringement of intellectual property rights against us and these claims, even without merit, could harm our business, including by increasing our costs, reducing our revenue, creating customer concerns that result in delayed or reduced sales, distracting our management from the running of our business and requiring us to cease use of important intellectual property. In addition, because patent applications can take years to issue and are often afforded confidentiality for some period of time, there may currently be pending applications, unknown to us, that later result in issued patents that could cover one or more of our services. Moreover, in In a patent infringement claim against us, we may assert, as a defense, that we do not infringe the relevant patent claims, that the patent is invalid or both. The strength of our defenses will depend on the patents asserted, the interpretation of these patents, and our ability to invalidate the asserted patents. However, we could be unsuccessful in advancing non-infringement and/or invalidity arguments in our defense. Furthermore, because of the substantial amount of discovery required in connection with patent and other intellectual property rights litigation, there is a risk that some of our confidential information could be compromised by the discovery process.

The United States and the global economy have recently experienced historically high levels of inflation. The existence of inflation in the U.S. and global economy, the pricing pressure created by rising inflation in prior periods and changes to trade regulations including tariffs may result in high interest rates and capital costs, high shipping costs, supply shortages, increased costs of labor, weakening exchange rates rates, reduced demand, and other similar effects. Elevated inflation rates can affect our expenses, especially employee compensation. In addition, rising interest rates could adversely affect the value of our investments and cash on hand and increase our borrowing costs. Further, the recent conflict in the Middle East has disrupted global energy markets, causing actual or perceived energy shortages and increased energy costs. Inflation and related increases in interest rates rates, elevated energy costs and energy shortages could also increase our customers' operating costs, costs and disrupt their operations, which could result in reduced IT budgets, less demand for our solutions or delays in new orders, renewals or payments due to us.

Artificial intelligence AI laws and regulations, such as the European Union's AI Act, impose compliance obligations on AI systems that process personal data. Such laws and regulations may, among other things, require risk assessments specific to AI, changes to data governance practices and enhancing transparency disclosures that supplement existing data protection requirements. The AI regulatory landscape is fragmented and uncertain, with various countries considering or enacting differing AI-specific laws and regulations to govern the emerging technology. This creates significant regulatory uncertainty about which compliance standards will ultimately govern our operations and solutions.

Our business activities are subject to various restrictions under U.S. export and similar laws and regulations, including the U.S. Department of Commerce's Export Administration Regulations and various economic and trade sanctions regulations administered by the U.S. Department of the Treasury's Office of Foreign Assets Control. U.S. export controls and trade and economic sanctions include restrictions or prohibitions on the sale or supply of certain products and services to U.S. embargoed or sanctioned countries and governments of these countries, as well as other persons and entities. For example, the U.S. and other countries have implemented continued to implement increased economic and other sanctions, as well as increased export controls in response to the current conflict between Russia and Ukraine. Ukraine and other geopolitical conflicts. These export controls and sanctions and any additional restrictions may impact our ability to operate in Russia and other affected regions. In addition, various countries regulate the import of certain technology and have enacted or could enact laws that could limit our ability to provide our services and software and operate our cloud platform or could limit our customers’ ability to access or use our services or software in those countries.

Although we take precautions to prevent our services and software from being provided in violation of such laws, our services and software may have been in the past, and could in the future be, provided inadvertently in violation of such laws, despite the precautions we take. If we fail to comply with these laws and regulations, we and certain of our employees could be subject to civil or criminal penalties, including the possible loss of export privileges and fines. We may also be materially and adversely affected through penalties, reputational harm, loss of access to certain markets or otherwise. Obtaining the necessary authorizations, including any required licenses, for a particular transaction may be costly or time-consuming, is not guaranteed and may result in the delay or loss of sales opportunities.

In addition, changes in our platform; export, sanctions and import laws and regulations regulations; or tariffs and other trade regulations could delay the introduction of our products and products, reduce the sale of subscriptions to our platform in international markets, prevent users in certain countries from accessing our services or, in some cases, prevent the provision of our services to certain countries, governments, persons or entities altogether. Any change or threatened change in export or import regulations, tariffs, economic sanctions or related laws, shift in the enforcement or scope of existing regulations or change in the countries, governments, persons or technologies targeted by such regulations could decrease or eliminate our ability to sell subscriptions to our platform or provide software to existing customers or potential new customers with international operations. Any decrease limitation in our ability to sell subscriptions to our platform or provide software could materially and adversely affect our business, results of operations and financial condition.

Many countries are beginning to implement legislation and other guidance to align their international tax rules with the OECD's Base Erosion and Profit Shifting recommendations and action plan that aim to standardize and modernize global corporate tax policy, including changes to cross-border tax, transfer pricing documentation rules and nexus-based tax incentive practices. The OECD is also continuing discussions surrounding fundamental changes in the allocation of profits among tax jurisdictions in which companies do business, as well as the implementation of a global minimum tax (namely the “Pillar One” and “Pillar Two” proposals). On January 5, 2026, the OECD announced a side-by-side elective safe harbor that would exempt electing U.S.-parented multinationals from certain provisions of Pillar Two for fiscal years beginning on or after January 1, 2026. Many However, this safe harbor does not provide an exemption from the "qualified domestic minimum top-up taxes" that many countries have enacted or begun the process of enacting laws based on Pillar Two proposals, which may adversely impact our provision for income taxes, net income and cash flows.

As of July 31, 2025, we also had U.S. federal, California, and foreign research and development and other tax credit carryforwards of $192.8 million, $102.6 million and $2.1 million, respectively. If not utilized, the federal research and development tax credit carryforwards will begin expiring at different periods beginning in 2037. Our California research and development tax credits may be carried forward indefinitely. Foreign tax credits will begin to expire in the fiscal year ending July 31, 2033. Realization of these net operating loss and research and development tax credit carryforwards depends on future income, and there is a risk that a portion of our existing carryforwards could expire unused and be unavailable to offset future income tax liabilities, which could materially and adversely affect our results of operations.

As of January 31, April 30, 2026, our executive officers, directors, current 5% or greater stockholders and affiliated entities together beneficially owned approximately 42.3% 34.9% of our common stock outstanding with Jay Chaudhry, our Chief Executive Officer and chairman of our board of directors, and his affiliates beneficially owning approximately 16.7% 16.6% of our common stock. As a result, these stockholders, acting together, will have significant control over most matters that require approval by our stockholders, including the election of directors and approval of significant corporate transactions. Corporate action might be taken even if other stockholders oppose them. This concentration of ownership might also have the effect of delaying or preventing a change of control of us that other stockholders may view as beneficial.

On July 3, 2025, we issued $1,725 million in aggregate principal amount of our 0.0% Convertible Senior Notes due 2028, which mature on July 15, 2028. Prior to April 15, 2028, the 2028 Notes are convertible at the option of the holders only under certain conditions or upon the occurrence of certain events. During the quarter ended July 31, 2025, April 30, 2026, the conditions allowing holders of the 2028 Notes to convert were not met. After April 15, 2028, holders may convert all or any portion of their 2028 Notes at their option at any time. If one or more holders elect to convert their 2028 Notes when eligible, unless we elect to deliver solely shares of our common stock to settle such conversion (other than paying cash in lieu of delivering any fractional share), we will be required to make cash payments in respect of the 2028 Notes being converted.

Our corporate headquarters are located in the San Francisco Bay Area, a region known for seismic activity. A significant natural disaster, such as an earthquake, fire, flood or public health emergency, occurring at our headquarters, in India, where we have significant facilities, or where a key channel partner, vendor or data center exchange is located could adversely affect our business, results of operations and financial condition. Further, if a natural disaster or man-made problem were to affect our component suppliers or other third-party providers, including our network bandwidth and SaaS solution providers, this could materially and adversely affect our ability to provide services in a timely or cost-effective manner.

In addition, natural disasters, acts of war, international conflicts, such as the current conflicts between Russia and Ukraine and in the Middle East, including recent conflicts related to Iran, terrorism and other geopolitical unrest or health issues, such as an outbreak of a pandemic or epidemic disease, or fear of such events, could cause disruptions in our or our customers’ businesses, national economies or the world economy as a whole. In addition, computer malware, viruses and computer hacking, fraudulent use attempts and phishing attacks have become more prevalent in our industry and may become more frequent and effective through the use of AI. As a result, our internal systems may be victimized by such attacks. Although we maintain incident management and disaster response plans, in the event of a major disruption caused by a natural disaster or man-made problem, we may be unable to continue our operations and may endure system interruptions, reputational harm, delays in our development activities, lengthy interruptions in service, security breaches and incidents and loss of critical data. Though it is difficult to determine what, if any, harm may directly result from any specific interruption or attack, any failure to maintain performance, reliability, security and availability of our platform to the satisfaction of our users may materially harm our reputation and our ability to retain existing customers and attract new customers.