FSLY 10-K & 10-Q changes, risk factors and insider trading

We currently serve our customers from our POPs located around the world. Our customers need to be able to access our platform at any time, without interruption or degradation of performance. However, we have not developed redundancies for all aspects of our platform. We depend, in part, on our third-party facility providers’ ability to protect these facilities against damage or interruption from natural disasters, extreme weather events, power or telecommunications failures, criminal acts, armed conflict, public health issues, such as a pandemic or epidemic, and similar events. In some cases, third-party cloud providers run their own platforms that we access, and we are, therefore, vulnerable to their service interruptions. In the event that there are any defects or errors in software, failures of hardware, damages to a facility, or misconfigurations of any of our services, we may have to divert resources away from other planned work, could experience lengthy interruptions in our platform, and also incur delays and additional expenses in arranging new facilities and services. Our customers may choose to divert their traffic away from our platform as a result of interruptions or delays. Business continuity arrangements, including the existence of redundant data centers that are designed to become active during certain lapses of service, may not function as intended, and any disruptions to our service could harm our business.

We design our system infrastructure and procure and own or lease the computer hardware used for our platform. Design and mechanical errors, spikes in usage volume, and failure to follow system protocols and procedures could cause our systems to fail, resulting in interruptions on our platform. Moreover, we have experienced and may in the future experience system failures or interruptions in our platform as a result of human error. These outages have resulted and may in the future result in service level agreement claims. Any interruptions or delays in our platform, whether caused by our products or our data centers, third-party error, our own error, natural disasters (such as drought, flooding, wildfires, and storms), or security breaches, whether accidental or willful, could harm our relationships with customers, reduce customers’ usage of our platform, cause our revenue to decrease and our expenses to increase, and divert resources away from product development. Climate change and other environmental or social pressures isare expected to increase the frequency and severity of certain events, as well as contribute to chronic changes (such as changes in meteorological and hydrological patterns) that may also result in similar or additional risks. Also, in the event of damage or interruption, our insurance policies may not adequately compensate us for any losses that we may incur. These factors in turn could further reduce our revenue, subject us to liability and cause us to issue service credits or cause customers to fail to renew their customer contracts, any of which could harm our business.

For some of our products, we charge our customers based on their usage of our platform. Most of our customers, including some of our largest enterprise customers, do not have long-term contractual financial commitments to us. Some of our customers, who generally do not include our enterprise customers, enter into “click-thoughclick-through” agreements with us via our self-service model, and agree to a minimum monthly fee by signing up online with a credit card, and can easily terminate their subscriptions, or switch to a less expensive plan, at will with little advance notice. In addition, most of our current customer contracts are only one year in duration and these customers may not use our platform in a subsequent year. In order for us to maintain or improve our results of operations, it is important that our customers, in particular, our enterprise customers, use our platform in excess of their commitment levels, if any, and continue to use our platform on the same or more favorable terms. Our ability to retain our largest customers and expand their usage could be impaired for a variety of reasons, including customer budget constraints, customer satisfaction, changes in our customers’ underlying businesses, changes in the type and size of our customers, pricing changes, competitive conditions (including customers building their own CDNs), the acquisition of our customers by other companies, governmental actions, or the possibility thereof, and general economic conditions. Because many of our largest customers’ minimum usage commitments for our platform are relatively low compared to their expected usage, it can be easy for certain customers to quickly reallocate usage or switch from our platform to an alternative platform altogether. In addition, theycertain customers may reduce or cease their use of our products at any time without penalty or termination charges, even after they have expanded usage in prior periods.

We receive a substantial portion of our revenues from a limited number of customers fromwithin a limited number of industries, and the loss of, or a significant reduction in usage by, one or more of our major customers would result in lower revenues and could harm our business.

Our future success depends on establishing and maintaining successful relationships with a diverse set of customers. We currently receive a substantial portion of our revenues from a limited number of customers and fromwithin a limited number of industries, such as media and entertainment. Our 10 largest customers generated an aggregate of 33%32% and 37%33% of our revenue in the trailing 12 months ended December 31, 20242025 and 2023,2024, respectively. Affiliated customers that are business units of a single company generated an aggregate of 10% of the Company’s revenue for the year ended December 31, 2025. No affiliated customers that are business units of a single company generated more than 10% of our revenue infor the trailing 12 monthsyear ended December 31, 2024. Affiliated customers that are business units of a single company in the streaming entertainment space generated an aggregate of 12% of our revenue in the trailing 12 months ended December 31, 2023. In addition, in April 2024, the former administration signed into law a bill that would effectively ban TikTok in the United States if ByteDance, its China-based parent company, doesdid not sell its stake in TikTok within a set time frame. TheFollowing currenta administrationseries signed anof executive orderorders in 2025 that suspended enforcement of this law, on January 20,22, 20252026, instructingByteDance announced the Attorneyestablishment Generalof notTikTok toUSDS enforceJoint Venture LLC in compliance with the law orto imposesecure anyUnited penaltiesStates againstuser anydata, entity for noncompliance for a period of 75 daysapps, and to provide written guidance as to how the lawalgorithm willthrough bedata implemented.privacy and cybersecurity measures. TikTok was one of our largest customers for the year ended December 31, 20242025 and remains a customer of ours. While the full impact of the legislation is unknown, it could eventually lead to a reduction in this customer’s United States traffic levels which could have a negative impact on our business. We do not know whether or how ByteDancethe might restructure its business and how thatrestructuring may impact our traffic levels. It is likely that we will continue to be dependent upon a limited number of customers for a significant portion of our revenues for the foreseeable future and, in some cases, the portion of our revenues attributable to individual customers may increase in the future. In addition, changes to our customers’ businesses may contribute to further customer concentration, including any impact from acquisition activities, internal business reorganizations leading to operational and decision making changes, and corporate structure changes such as subsidiary consolidation and reorganization that may arise in the future. The loss of one or more key customers or a reduction in usage by any major customers would reduce our revenues. If we fail to maintain existing customers or develop relationships with new customers and across different industries, our business would be harmed.

Component delays, shortagesshortages, or price increases could interrupt our ability to complete the construction of our servers or POPs and to meet the usage needs of our customers. Our operating results could be materially harmed if we are unable to adequately manage our serverinfrastructure needs.

Our business depends on the timely supply of certain parts and components to construct our servers.servers or POPs. We rely on a limited number of suppliers for several components of the equipment we use to operate our network and provide products to our customers. Our reliance on these suppliers exposes us to risks including reduced control over production costs and constraints based on the then current availability, terms, and pricing of these components, including pricing changes as a result of inflationary pressures. TheMoreover, COVID-19international pandemictrade causeddisputes disruptionsmay anddisrupt delaysor delay our supply chain for these components andor the delivery and installation of such components at our colocation facilities, in additionlead to pricing increases. For example, the United States has imposed or indicated an intention to impose tariffs on certain countries which may lead to retaliatory actions such as counter-tariffs and increase production costs and disruptions in our supply chain. The United States and other jurisdictions have also leveraged various trade and value chain requirements, including on environmental and social criteria, which may make sourcing more costly, require us to change suppliers, or otherwise adversely impact our operations. Further, it is possible that government policy changes, including policy changes made with little to no advance notice, and related uncertainty about policy changes could increase market volatility. If our supply of certain components is further disrupted or delayed, there can be no assurance that we will be able to obtain adequate replacements for the existing components or that supplies will be available on terms and prices that are favorable to us, if at all. Any disruption or delay in the supply of our hardware components has in the past and may in the future limit capacity expansion or replacement of defective or obsolete equipment,equipment or cause other constraints on our operations that could damage our customer relationships and harm our business.

We were founded in 2011 and have experienced net losses and negative cash flows from operations since inception. We have encountered and will continue to encounter risks and difficulties frequently experienced by growth companies in constantly evolving industries, including companies in the technology sector, including the risks described in this report.Annual Report on Form 10-K. If we do not address these risks successfully, our business may be harmed.

If our informationIT technology systemsSystems or data, or those of third parties upon which we rely, are compromisedcompromised, now,limited, or in the future, or the security, confidentiality, integrity or availability of our information technology, software, services, networks, communications or data is compromised, limited or fails,fail, our business could experience materially adverse consequences, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, loss of revenue or profits, loss of customers or sales, reputational harm, and other adverse consequences.

Our business depends on providing our customers with fast, efficient, and reliable distribution of applications and content over the Internet.Internet, and we rely on IT Systems to provide our products and services, including for internal and external operations that are critical to our business. “IT Systems” includes computer systems, hardware, software, technology infrastructure and websites and networks. In the ordinary course of our business, we and the third parties upon which we rely, collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share,share Sensitive Information. "Sensitive Information" includes our, our customers', and our customers' end users' proprietary, confidential, and sensitive data, including personal information, intellectual property, trade secrets, and encryption keys, including our data and data of our customers, including their end-users (collectively, “Sensitive Information”). Maintaining the security and availability of our platform, network, and internal information technology systems and the security of information we hold on behalf of our customers is a critical issue for us and our customers, and we expend significant resources, and may need to fundamentally change our business activities and continue to modify our practices and operations, in an effort to protect against security incidents and to mitigate, detect, and remediate actual and potential vulnerabilities.keys.

Cyber-attacks, malicious Internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our Sensitive Information and informationIT technology systems,Systems, and those of the third parties upon which we rely. Such threats are prevalent and continue to rise,become more so. They are difficult to detect, and come from a variety of sources,sources includingand threat actors, including “hacktivists,” personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors.

Some threat actors now engage, and are expected to continue to engage in cyber-attacks, including without limitation nation-state actorscyber-attacks for geopolitical reasons and in conjunction with military conflicts and defense activities. We have in the past been subject to cyber-attacks from third parties, including parties who we believe are sponsored by government actors. Since our customers share our multi-tenant architecture, cyber-attacks on any one of our customers could have a negative effect on our other customers. In the past, these attacks have significantly increased the bandwidth used on our platform and have strained our network. During times of war and other major conflicts, we, the third parties upon which we rely, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systemsIT Systems and operations, supply chain, and ability to produce, sell, and distribute our services.

We and the third parties upon which we rely are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code, malware (including as a result of advanced persistent threat intrusions), denial-of-serviceDDoS attacks (“DDoS”),attacks, account takeover attacks, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, attacks facilitated or enhanced by artificial intelligence (“AI”), such as prompt injection or AI model inversion attacks, loss of data or other information technology assets, adware, telecommunications failures, natural disasters, and other similar threats. For example, we have experienced DDoS attacks of significant size and severity that caused us to invest resources into improving our systems, and we expect to continue to be subject to DDoS and other forms of attacks in the future, particularly as they have become more prevalent in our industry. Similarly, we have been the target of phishing and social engineering schemes that may be designed to, among other things, improperly gain access to our confidentialSensitive informationInformation or fraudulently obtain payments or funds from us. Further, we are not immune from the possibility of a malicious insider compromising our informationIT systems and infrastructureSystems or misappropriating our confidentialSensitive information.Information.

In particular, severe ransomware attacks are becoming increasingly prevalent, and can lead to significant interruptions in our operations, compromise of our or our service providers’ IT Systems, loss of Sensitive Information and revenue, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to a number of factors, including applicable laws or regulations prohibiting such payments.

Future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systemsIT Systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our informationIT technology environmentSystems and security program.

We rely on third-party service providers and technologies to operate critical businessIT systemsSystems and to process Sensitive Information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, content delivery to customers, and other functions. Like many other companies, our ability to monitor third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy and data security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.

Any adverse impact to the availability, integrity, or confidentiality of our Sensitive Information or IT Systems, including as a result of the previously identified or similar threatsthreats, could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our Sensitive Information or our informationIT technology systems,Systems, or those of the third parties upon whom we rely. A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely) to provide our platform, products and services.

CertainMoreover, certain privacy and data security obligations may require us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our informationIT technology systemsSystems and Sensitive Information.Information, and a failure to do so could result in material financial penalties and other materially adverse consequences.

While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We take steps to detect and remediate vulnerabilities, butAdditionally, we may not be able to detect and remediate all vulnerabilities because the threats and techniques used to exploit the vulnerability change frequently and are often sophisticated in nature. Therefore, such vulnerabilities could be exploited but may not be detected until after a security incident has occurred. These vulnerabilities pose material risks to our business. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities.

Applicable privacy and data security obligations may require us to notify relevant stakeholders, including affected individuals, customers, regulators, and investors of security incidents. For example, SEC rules require disclosure on Form 8-K of the nature, scope and timing of any material cybersecurity incident and the reasonably likely impact of such incident. Compliance with such disclosure efforts is costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences. If we (or a third party upon whom we rely) experience aany securityadverse incidentimpact to the availability, integrity, or areconfidentiality perceivedof toour haveIT experiencedSystems aor securitySensitive incident,Information, we may experience adverse consequences, such as government enforcement actions (for example, investigations, finesfines, penalties, audits, and inspections); additional reporting requirements and/or oversight, restrictions on processing Sensitive Information (including personal data); litigation (including class action claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions or degradation of performance in our services (including availability of data); financial loss; and other similar harms. Security incidents and attendant consequences may also impact customers’ systems and data, and cause customers to stop using our platform, products, and services, cause us to offer pricing and other concessions, deter new customers from using our platform, products, and services, result in litigation, and negatively impact our ability to grow and operate our business.

The market in which we compete is relatively new and subject to rapid technological change, evolving industry standards and regulatory changes, as well as changing customer needs, requirements, and preferences. The success of our business will depend, in part, on our ability to adapt and respond effectively to these changes on a timely basis. If we are unable to develop and sell new products that satisfy and are adopted by our customers and provide enhancements, new features, and capabilities to our platform that keep pace with rapid technological and industry change, our revenue and operating results could be adversely affected. Further, some of our prospective customers may require custom development of features as part of their purchase decision, or our existing customers may require us to develop custom features. If we are unable to meet their requirements, they may look to our competitors or internal solutions that eliminate reliance on third-party providers, and our revenue and operating results could be adversely affected. Further, prioritizing such custom features can be difficult to adapt to other customers and may require significant engineering resources. If new technologies emerge that enable large Internet platform companies to utilize their own data centers and implement delivery approaches that limit or eliminate reliance on third-party providers like us, or that enable our competitors to deliver competitive products and applications at lower prices, more efficiently, more conveniently, or more securely, such technologies could adversely impact our ability to compete. If our platform does not allow us or our customers to comply with the latest regulatory requirements, our existing customers may decrease their usage on our platform or leave our platform and new customers will be less likely to adopt our platform.

Moreover, our platform is highly technical and complex. For example, our delivery products may rely on knowledge of the Varnish Configuration Language (“VCL”) to utilize manycertain features of this platform.features. Potential developers may be unfamiliar or opposed to working with VCL and therefore decide to not adopt our platform, which may harm our business.

We have historically benefited from word-of-mouth and other organic marketing to attract new customers. Through this word-of-mouth marketing, we have been able to build our brand with relatively low marketing and sales costs. This strategy has allowed us to build a substantial customer base and community of users who use our products and act as advocates for our brand and our platform, often within their own corporate organizations. However, our ability to further increase our customer base and achieve broader market acceptance of our products will significantly depend on our ability to expand our marketing and sales operations. We plan to continue expanding our sales force and strategic partners, both domestically and internationally. We also plan to continue to dedicate significant resources to sales, marketing, and demand-generation programs, including various online marketing activities as well as targeted account-based marketing. The effectiveness of our targeted account-based marketing has varied over time and may vary in the future. All of these efforts will require us to invest significant financial and other resources and if they fail to attract additional customers, our business will be harmed. We have also used a strategy of offering free trialaccounts versions ofon our platform in order to strengthen our relationship and reputation within the developer community by providing these developers with the ability to familiarize themselves with our platform without first becoming a paying customer. However, these developers may not perceive value in the additional benefits and services we offer beyond the free trial versions of our platformaccounts and may choose not to pay for those additional benefits. In addition, we may be subject to potential liabilities, including litigation, as a result of our free account users' use of our network. Moreover, some existing paying customers may choose not to renew their commitment with us in favor of relying on the free version of our platform. Most trialfree accounts do not convert to paid versions of our platform, and to date, only a few users who have converted to paying customers have gone on to generate meaningful revenue. If our other lead generation methods do not result in broader market acceptance of our platform and the users of trialfree versions of our platform do not become, or are unable to convince their organizations to become, paying customers, or if paying customers choose to convert to the free versions of our platform, we will not realize the intended benefits of this strategy, and our business will be harmed.

The market for cloud computing platforms, particularly enterprise grade products, is highly fragmented, competitive, and constantly evolving. With the introduction of new technologies and market entrants, we expect that the competitive environment in which we compete will remain intense going forward. ApplicationLegacy CDN platform solutions like Akamai, application and API security vendors like Akamai, Cloudflare, F5, and Thales (Imperva), and Point CDN players like Bunny CDN, CDNetworks, CDN77, and Qwilt offer products that compete with ours. We also compete with CDN providers,providers whichthat nowalso offer serverless edge compute functionality like Akamai (Linode) and Cloudflare, public cloud providers that have added CDN and WAF capabilities like Amazon Web Services (AWS), Google Cloud Platform,Platform (GCP), and Microsoft (Azure), legacy CDNs, such as Akamai, point CDN players like Bunny CDN, CDNetworks, CDN77, and Qwilt, and traditional on-premise data center appliance vendors for load balancing, WAF, and/or DDoS like F5, Thales (Imperva), and Radware. Some of our competitors have made or may make acquisitions or may enter into partnerships or other strategic relationships that may provide more comprehensive offerings than they individually had offered. Such acquisitions or partnerships may help competitors achieve greater economies of scale than us. In addition, new entrants not currently considered to be competitors may enter the market through acquisitions, partnerships, or strategic relationships. We compete on the basis of a number of factors, including:

We face substantial competition from legacy CDNs, small business-focused CDNs, cloud providers, and traditional data center,center and appliance vendors. In addition, existing customers have transitioned or notified us of their intent to transition, and existing and potential customers may in the future transition, off of our platform, or may limit their use, because they pursue a “do-it-yourself” approach to develop their own CDN by putting in place equipment, software, and other technology products for content and application delivery within their internal systems; enter into relationships directly with network providers instead of relying on an overlay network like ours; or implement multi-vendor policies to reduce reliance on external providers like us.

We have in the past acquired, and we may in the future seek to acquire or invest in, businesses, products, or technologies that we believe could complement or expand our platform, enhance our technical capabilities, or otherwise offer growth opportunities. Our acquisitions of Glitch and Signal Sciences reflect this strategy. The pursuit of potential acquisitions may divert the attention of management and cause us to incur various expenses in identifying, investigating, and pursuing acquisitions, whether or not such acquisitions are completed. In addition, we have limited experience in acquiring other businessesbusinesses, and we may not successfully identify desirable acquisition targets or, when we acquire additional businesses, we may not be able to integrate them effectively following the acquisition. Acquisitions could also result in dilutive issuances of equity securities or the incurrence of debt, which could adversely affect our operating results, may cause unfavorable accounting treatment, may expose us to claims and disputes by third parties, including intellectual property claims, and may not generate sufficient financial returns to offset additional costs and expenses related to the acquisitions. We may also incur significant, and sometimes unanticipated costs in connection with these acquisitions or in integration with our business. In addition, if an acquired business fails to meet our expectations or we do not realize sufficient value, our business may be harmed.

We are, and may in the future be, subject to litigation such as putative class action and stockholder derivative lawsuits brought by stockholders. For example, on May 24, 2024, we and certain of our officers were named as defendants in putative securities class action filed in the United States District Court for the Northern District of California purportedly brought on behalf of holders of our common stock. On November 1, 2024, the lead plaintiff filed an amended complaint. On June 12, 2024 and July 1, 2024, stockholder derivative complaints were filed in the United States District Court for the Northern District of California against certain of our officers and directors based on substantially similar allegations as those in the putative securities class action. These two shareholder derivative actions have been consolidated and stayed pending resolution of our motion(s) to dismiss in the securities class action. On August 23, 2024 and December 20, 2024, substantially similar stockholder derivative complaints were filed against certain of our officers and directors in the United States District Court for the District of Delaware and the Court of Chancery for the State of Delaware. These two shareholder derivative actions have also been stayed pending resolution of our motion(s) to dismiss in the above-referenced putative securities class action. Defendants filed a motion to dismiss the putative securities class action on January 15, 2025. We anticipate that we may be a target for lawsuits in the future, as we have been in the past. Any litigation to which we are a party may result in an onerous or unfavorable judgment that may not be reversed on appeal, or we may decide to settle lawsuits on similarly unfavorable terms. Any such negative outcome could result in payments of substantial monetary damages and accordingly our business could be seriously harmed. The results of lawsuits and claims cannot be predicted with certainty. Regardless of the final outcome, defending these claims, and associated indemnification obligations, are costly and can impose a significant burden on management and employees, and we may receive unfavorable preliminary, interim, or final rulings in the course of litigation, which could seriously harm our business.

We have taken, and may continue to take, actions that we believe are in the best interests of our customers, our employees, and our business, even if those actions do not maximize financial results in the short term. For instance, we do not knowingly allow our platform to be used by organizations with a primary objective to deliver content from groups that promote violence or hate,hate speech, and that conflict with our valuesvalues, like strong ethicalincluding principles of integrity and trustworthiness, among others. In the past, we have removed customers from our platform who we believed took positions conflicting with these values, and we may continue to do so in the future. While we believe this is beneficial to the long term performance of our business, this approach may not result in the benefits that we expect, and our employees or third parties may disagree with our interpretation of our values, or take issue with how we execute on our values, which may result in us becoming a target for negative publicity, increased scrutiny, lawsuits, or network attacks, in which case our business could be harmed.

We maintain a partner ecosystem of companies who build edge applications to integrate with our platform. We are dependent on these partner relationships to amplify our reach and provide our customers with enhanced value from our platform. Our future growth willmay be increasingly dependent on the success of our partner relationships, including their development of useful applications for our platform. If those partnerships do not provide these benefits or if our partners are unable to serve our customers effectively, we may need to allocate resources internally to provide these services or our customers may not realize the full value of our platform, which could harm our business.

The market for edge computing is still developing. There is considerable uncertainty over the size and rate at which this market will grow, as well as whether our platform will be widely adopted. Our success will depend, to a substantial extent, on the widespread adoption of our platform as an alternative to other solutions, such as legacy CDNs, and CDNs focused on enterprise data centers, central cloud, and small businesses. Some organizations may be reluctant or unwilling to use our platform for a number of reasons, including concerns about additional costs, uncertainty regarding the reliability, and security of cloud-based offerings or lack of awareness of the benefits of our platform. Moreover, many organizations have invested substantial personnel and financial resources to integrate traditional on-premise services into their businesses, and therefore may be reluctant or unwilling to migrate to cloud-based services. Our ability to expand sales of our product into new and existing markets depends on several factors, including potential customer awareness of our platform; the timely completion of data centers in those markets; introduction and market acceptance of enhancements to our platform or new applications that we may introduce; our ability to attract, retain and effectively train sales and marketing personnel; our ability to develop relationships with partners; the effectiveness of our marketing programs; the pricing of our services; and the success of our competitors. If we are unsuccessful in developing and marketing our productproducts intoin new and existing markets, or if organizations do not perceive or value the benefits of our platform, the market for our productproducts might not continue to develop or might develop more slowly than we expect, either of which may harm our business.

Third-party market opportunity estimates and our growth forecasts are subject to significant uncertainty and are based on assumptions and estimates that may not prove to be accurate. The variables that go into the calculation of our market opportunity are subject to change over time, and there is no guarantee that any particular number or percentage of addressable companies or end-usersend users covered by our market opportunity estimates will purchase our products at all or generate any particular level of revenues for us. Even if the market in which we compete meets the size estimates and growth forecasted, our business could fail to grow for a variety of reasons, including reasons outside of our control, such as competition in our industry.

In addition, because substantially all of our usage-based revenue from usage is recognized at the time of use during the term of the relevant contract upon usage,contract, downturns or upturns in sales contracts are not immediately reflected in full in our operating results.

•the ability to maintain our key partnerships;

We have limited experience with respect to determining the optimal prices for our products and, as a result, we have in the past changed our pricing model and expect that we may need to do so in the future, including as a result of inflationary pressures. In addition, during 2023 we introduced the option for customers to purchase product packages with single price points and set limits on usage. We generally do not charge for overages on these single price point product packages. This pricing model has been in place for a limited amount of time, and we do not know the impact it will have on our usage-based pricing model over time. As the market for our products matures, or as new competitors introduce new products or services that compete with ours, we may be unable to attract new customers at the same price or based on the same pricing models as we have used historically. Pricing decisions may also impact the mix of adoption among our customers and negatively impact our overall revenue. Moreover, larger organizations may demand substantial price concessions. As a result, in the future we may be required to reduce our prices or develop new pricing models, which could adversely affect our revenue, gross margin, profitability, financial position, and cash flow.

The timing of our sales with our enterprise customers and related revenue recognition is difficult to predict because of the length and unpredictability of the sales cycle for these customers. In addition, for our enterprise customers, the lengthy sales cycle for the evaluation and implementation of our products may also cause us to experience a delay between expenses for such sales efforts and the generation of corresponding revenue. The length of our sales cycle for these customers, from initial evaluation to payment, can range from several months to well over a year and can vary substantially from customer to customer. Similarly, the onboarding and ramping process with new enterprise customers, or with existing customers that are moving additional traffic onto our platform, can take several months. As the purchase of our products can be dependent upon customer initiatives, our sales cycle can extend to even longer periods of time. Customers often view a switch to our platform as a strategic decision requiring significant investment and, as a result, frequently require considerable time to evaluate, test, and qualify our product offeringproducts prior to entering into or expanding a contract commitment. During the sales cycle, we expend significant time and money on sales and marketing and contract negotiation activities, which may not result in a completed sale. Additional factors that may influence the length and variability of our sales cycle include:

•failure to predict market demand accurately in terms offor functionality accurately and a failure to supply products that meet this demand in a timely fashion;

We rely on third-party hosting providers that may be difficult to replace.

We rely on third-party hosting services such as AWS,Amazon Web Services (AWS), Google Cloud Platform,Platform (GCP), Microsoft (Azure), and other cloud providers such as object storage providers, that facilitate the offering of our platform. Some of these third-party hosting services offer competing products to ours and therefore may not continue to be available on commercially reasonable terms, or at all. These providers may be unwilling to do business with us if they view our platform as a threat. Any loss of the right to use any of thethese hostingthird-party providers could impair our ability to offer our platform and harm our business until we are able to obtain alternative hosting providers.

Because our customers choose to integrate our products with certain capabilities provided by third-party providers, theThe functionality and popularity of our platform depends, in part, on our ability to integrate our platform and applications with third-party applications.applications our customers choose to use with our platform. These third parties may change the features of their technologies, restrict our access to their applications, or alter the terms governing use of their applications in a manner that is adverse to our business. Such changes could functionally limit or prevent our ability to use these third-party technologies in conjunction with our platform, which would negatively affect adoption of our platform and harm our business. If we fail to integrate our platform with new third-party applications that our customers use, we may not be able to offer the functionality that our customers need, which would harm our business.

There is an increasingongoing focus from certain investors, employees, customers, policymakers, and other stakeholders concerning companies' management of various environmental, social, and governance matters (“ESG”), such as climate change and human capital. Any initiatives, including disclosures, that we engage in to improve our ESG profile and respond to stakeholder expectations may be costly and may not have the desired effect. For example, while we have established a sustainability program focused on emissions quantification, disclosure and reduction initiatives, as climate-related regulatory regimes and stakeholder expectations continue to evolve, we may need to undertake additional measures to comply with new regulations and expectations, which could adversely affect our operating results in future periods. In addition, many ESG initiatives leverage methodologies and data that continue to evolve. As with other companies, our approach to such matters also evolves, and we cannot guarantee that our approach will align with any particular stakeholder’s expectations or preferences. Moreover, various stakeholders have different, and at times conflicting expectations. For example, while some policymakers (such as the State of California and the European Union) have adopted requirements for various disclosures or actions on environmental and social matters, policymakers in other jurisdictions have sought to constrain companies’ consideration of such matters in certain circumstances. Proponents and opponents of such matters are increasingly resorting to activism, including litigation, to advance their perspectives. Various capital providers and customers also incorporate ESG matters into their investment and procurement considerations. Addressing stakeholder expectations or requirements entails costs and any failure to successfully navigate such expectations, as well as evolving interpretations of any existing governmental laws or requirements, may result in reputational harm, loss of customers or contracts, regulatory or investor engagement, or other adverse impacts to our business. Such risks may also be augmented based on relative performance, both against any initiatives or goals we communicate as well as in comparison to our competitors. Various of our stakeholders are also subject to similar pressures, which may result in additional or novel risks.

To execute our business strategy, we must attract and retain highly qualified personnel. Competition for executive officers, software developers, sales personnel, product managers, and other key employees in our industry is intense. In particular, we compete with many other companies for software developers with high levels of experience in designing, developing, and managing cloud-based software, including products with AI capabilities, as well as for skilled sales, operations, and security professionals. In addition, we believe that the success of our business and corporate culture depends on employing people with a variety of backgrounds and experiences, and the competition for such diverse personnel is significant. The market for such talented personnel is competitive. Many of the companies with which we compete for experienced personnel have greater resources than we do and can frequently offer such personnel substantially greater compensation than we can offer, including, in some cases, large equity packages and cash incentive bonuses. In addition, prospective and existing employees often consider the value of the equity awards they receive in connection with their employment. If the perceived value of our equity awards declines, experiences significant volatility, or increases such that prospective employees believe there is limited upside to the value of our equity awards, it may adversely affect our ability to recruit and retain key employees. In order to manage attrition, including as a result of stock price decreases and market volatility on the perceived value of our equity awards, we have issued, and may continue to issue, additional equity awards and increased cash compensation to attract and retain employees, which may impact our results of operations or be dilutive to stockholders. Moreover, the increase in the number of equity awards has reduced the number of shares available for us to grant under our equity incentive plan. We also face significant competition in hiring and attracting qualified employees in all aspects of our business, and the move by companies to offer a remote or hybrid work environment has increased the competition for such employees. If we fail to attract new personnel or fail to retain and motivate our current personnel, our ability to maintain and enhance our platform, develop and deliver new products, fix bugs, support our existing customers, attract new customers, respond to competitive pressures, and otherwise execute our business plan would be harmed.

We believe that our success has depended, and continues to depend, on the efforts and talents of senior management and key employees, including Artur Bergman, our Chief Technology Officer and Todd Nightingale, our Chief Executive Officer. There have been, and from time to time, there may continue to be, changes in our management team resulting from the hiring or departure of executives and key employees, or the transition of executives within our business, which could disrupt our business. For example, Charles Compton began serving as our new Chief Executive Officer, replacing Todd Nightingale, effective June 16, 2025. Such changes in our executive management team may be disruptive to our business. Some of our executive officers and members of our management team have been with us for a short period of time and we continue to develop key functions within various aspects of our business. We are also dependent on the continued service of our existing software engineers because of the complexity of our platform. Our senior management, including Mr. NightingaleCompton and Mr. Bergman, and key employees are employed on an at-will basis. We cannot ensure that we will be able to retain the services of any member of our senior management or other key employees or that we would be able to timely replace members of our senior management or other key employees should any of them depart. The loss of one or more of our senior management or other key employees could harm our business.

We have experienced growth in various aspects of our business in prior periods. For example, for the years ended December 31, 2025, 2024, 2023, and 2022,2023, our revenue was $624.0 million, $543.7 million, $506.0 million and $432.7$506.0 million, respectively. In addition, we are expanding, and expect to continue to expand in the future, our international operations. We have also experienced growth in the number of customers, usage, and amount of data delivered across our platform. This growth has placed, and may continue to place, significant demands on our corporate culture, operational infrastructure, and management. Although our business has experienced growth in the past, we cannot provide any assurance that our business will continue to grow at the same rate, or at all. Overall growth of our business depends on a number of factors, including our ability to:

We may need to engage in equity or debt financings to secure additional funds, in particular if we are required to repay our outstanding convertible notes in cash. Additional financing may not be available on favorable terms, if at all, and the terms of our existing Senior Secured Credit Facilities Credit Agreement, dated as of February 16, 2021, with the lenders from time to time party thereto and Silicon Valley Bank, a division of First-Citizens Bank & Trust Company (as amended, restated, amended and restated, supplemented, restructured, or otherwise modified from time to time, the “Credit Agreement”) may limitlimits our ability to pursueincur additional financings.debt.

We have experienced, and expect to continue to experience in the future, seasonality in our business, and our operating results and financial condition may be affected by such trends in the future. We generally experience seasonal fluctuations in demand for our platform. For example, we have some customers who increase their usage and requests when they need more capacity during busy periods, especially in the fourth quarter of the year, and then subsequently scale back. Some of our customers host certain large-scale events, such as sporting events or coverage of major elections, increasing their usage on a seasonal or one-time basis which can cause revenue to fluctuate between the periods in which these events occur and subsequent periods. Since we have built our network to handle seasonal capacity fluctuations, we may not be able to reduce our capacity in a timely manner, and as such sustain more costs.costs that may not be tied to traffic demand. We believe that the seasonal trends that we have experienced in the past may continue for the foreseeable future, particularly as we expand our sales to larger enterprises. To the extent we experience this seasonality, it may cause fluctuations in our operating results and financial metrics, and make forecasting our future operating results and financial metrics difficult. Additionally, we do not have sufficient experience in selling certain of our products to determine if demand for these products is, or will be, subject to material seasonality.

•increased travel, real estate, infrastructure, and legal compliance costs associated with international operations;

•limited or insufficient scope, strengthstrength, and enforcement of intellectual property rights;

•political instability, economic sanctions, terrorist activities, or internationalglobal conflicts,conflicts includingand developments, including, but not limited to, ongoing conflicts between Russia and Ukraine and Hamasin andthe Israel,Middle East, which may impact the operations of our business or the businesses of our customers;

•inflationary pressures, such as those the global market is currently experiencing, labor shortagesshortages, and supply chain disruptions, which may increase costs for certain services;

The preparation of financial statements in conformity with generally accepted accounting principles in the United States (“U.S. GAAP”) requires management to make estimates and assumptions that affect the amounts reported in the consolidated financial statements and accompanying notes. We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as provided in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Critical Accounting Estimates.” The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities, and equity and the amount of revenue and expenses that are not readily apparent from other sources. Significant assumptions and estimates used in preparing our consolidated financial statements include, but are not limited to, those related to revenue, accounts receivable and related reserves, fair value of assets acquired and liabilities assumed for business combinations, useful lives and realizability of long-lived assets including our goodwill and intangible assets, income tax reserves, and accounting for stock-based compensation. Our results of operations may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our results of operations to fall below the expectations of securities analysts and investors, resulting in a decline in the trading price of our common stock.

ForIn example,addition asto acertain resultinterim ofgoodwill a sustained decrease in our stock price and market capitalization, weassessments performed anduring interim qualitative impairment assessment of our goodwill as of September 30, 2024 and concluded it is not more likely than not that the fair value of our one single reporting unit is less than its carrying amount. Therefore, we determined that goodwill was not impaired and no impairment charge was recorded. In addition,2025, we performed our annual goodwill assessment as of October 31,1, 2024,2025, and in each such case concluded it is not more likely than not that the fair value of our one single reporting unit is less than its carrying amount. Therefore, we determined that goodwill was not impaired and no impairment charge was recorded. Further declines in our market capitalization increase the risk that we may be required to perform a quantitative impairment analysis in subsequent periods, which could result in an impairment of up to the entire balance of our goodwill and other intangible assets. Any such impairment charge or write-off may have an adverse effect on our business, financial condition, and results of operation.

Our Credit Agreement contains, and any future indebtedness would likely contain, a number of restrictive covenants that impose significant operating and financial restrictions on us, including restrictions on our ability to incur additional indebtedness, grant liens, pay dividends and make distributions, transfer property, make investments, and take other actions that may otherwise be in our best interests. In addition, our Credit Agreement contains a financial covenant that requires us to maintain a consolidated adjusted quick ratio of at least 1:251.25 to 1:00 tested on a quarterly basis as well as a springing revenue growth covenant not to be less than 5% on a quarterly basis for certain periods if our consolidated adjusted quick ratio falls below 1:75 to 1:00 on the last day of any fiscal quarter. Our ability to meet these financial covenants can be affected by events beyond our control, and we may not be able to continue to meet those covenants. In addition, a breach of a covenant under our Credit Agreement or any other current or future indebtedness above certain thresholds may result in a cross-default under any such indebtedness. If we seek to incur additional indebtedness in the future, we may not be able to obtain debt or equity financing on terms that are favorable to us, if at all. Holders of our existing debt have, and holders of any future debt we may incur would have, rights senior to holders of common stock to make claims on our assets. In addition, the terms of our existing debt do, and the terms of any future debt could, restrict our operations, including our ability to pay dividends on our common stock. If we are unable to obtain adequate financing or financing on terms that are satisfactory to us when we require it, our ability to continue to support our business growth and to respond to business challenges could be significantly impaired, and our business may be harmed.

We have identified a material weakness in our internal control over financial reporting, and ifIf we are unable to remediate and maintain effective internal control over financial reporting in the future, investors may lose confidence in the accuracy and completeness of our financial reports, and the market price of our common stock may be seriously harmed.

As a public company, we are required to maintain internal control over financial reporting and to report any material weaknesses in those internal controls. For example, we are required to perform system and process evaluation and testing of our internal control over financial reporting to allow management to report on the effectiveness of our internal control over financial reporting, as required by Section 404 of the Sarbanes-Oxley Act 9 (“Section 404”). Our independent registered public accounting firm also needs to attest to the effectiveness of our internal control over financial reporting. We designed, implemented, and tested internal control over financial reporting required to comply with this obligation. That process is time-consuming, costly, and complicated.

The edge cloud is a category of Infrastructure as a Service (“IaaS”) that enables developerssoftware engineers to build, secure, and deliver digital experiences,experiences at the edge of the Internet. ThisOur serviceplatform represents the convergence of the Content Delivery Network (“CDN”) with functionality that has traditionally been traditionally delivered by hardware-centric appliances such as Application Delivery Controllers (“ADC”), Web Application Firewalls (“WAF”), API Management, Bot Detection, Distributed Denial of Service (“DDoS”), Web Application and ObservabilityAPI solutions.Protection It also includes the emergence of a new, but growing, edge computing market which aims to move compute power(“WAAP”), and logicinfrastructure as close to the end user as possible. When milliseconds matter, processing at the edge is an ideal way to handle highly dynamic and time-sensitive data. This has led to its acceptance and adoption by organizations who monetize or grow their user base with every millisecond saved. Organizations that want to improve their user experience, whether it’s faster loading websites or reduced shopping cart abandonment, can benefit from processing at the edge. The edge cloud complements data center, central cloud, and hybrid solutions.protection.

Organizations must keep up with a complex and ever-evolving end-userlandscape. requirements. We help them surpass their end users’ expectations by powering fast, safe, and engaging digital experiences. WeWe’ve built a powerful unified edge cloud platform,platform designed from the ground up to be programmable and support agile software development.development, and we continuously drive innovation to meet the ever changing needs of our customers. We believe that our platform gives our customers a significant competitive advantage,advantage – whether they were born into the AI-centric digital age or are just embarking on their digital transformation journey.

We generate substantially all of our revenue from charging our customers based on their usage of our platform, and we generate a substantial majority of our revenue from customers that have negotiated contracts with us. Initially, customersCustomers typically choose to becomeutilize our platform customers,for Network Services, for which we charge fees based on their committed or actual use of our platform, as measured in gigabytes and requests. Many of our customers generate billings in excess of their minimum commitment. We also generate revenue from additionalSecurity productsand Other product lines, including Compute and Observability, as well as professional and other services, such as implementation, account management and enhanced customer support. We charge a flat one-time or recurring monthly fee depending on the additional products and services selected. Typically, the term of our contracts with customers is 12 months and includes a minimum monthly billing commitment in exchange for more favorable pricing terms. In addition, customers can sign up online by providing their credit card information and agreeing to a minimum monthly fee. We also offer subscriptions to access a unified security web application and application programming interface at a fixed rate.

We are focused on continuing to bringattract anew durable, consistent,customers and predictableexpanding pipelineour ofrelationship with existing customers by enhancing our product experience, investing in technology, and leveraging our partner ecosystem. Our customer base ranges from emerging companies to large enterprises undergoing digital transformation across diverse industries and verticals. Utilizing our direct sales force, we have multiple selling points within organizations to acquire new innovations to our edge cloud platformcustomers and software-definedincrease modern network architecture, and are seeing interestusage from customers in our existing product lines like Network Services and Security, and newer product lines like Compute and Observability.customers. We will continue to increase our discretionary marketing spend, including account-based, targeted demand generation and brand spend, to drive the effectiveness of our sales teams. As a result, we expect our total operating expenses to increase as we continue to expand. A key component of our cost-efficient customer acquisition strategy is developer outreach, as developers often advocate for the adoption and promotion of our platform within their organizations and across the broader developer community. We will also continue to build out a single, unified platform, simplify customer onboarding and service usage, and simplify our pricing and packaging. This will require us to dedicate significant resources to further develop the market for our platform and differentiate our platform from competitive products and services. We will also need to expand, retain, and motivate our sales and marketing personnel in order to target our sales efforts at larger enterprises and senior management of these potential customers.

We emphasize retaining our customers and expanding their usage of our platform and adoption of our other products. Customers often begin with smaller deployments of one of our products and then expand their usage over time. Our platform includes a variety of offerings across Network Services, Security, and Other product lines, including Compute and Observability product lines.Observability. As our customers mature, we assist them in expanding their use of our platform, including the use of additional offerings beyond content delivery or security. As enterprises grow and experience increased traffic, their needs evolve, leading them to find additional use cases for our platform and expand their usage accordingly. In addition, given that customer acquisition costs are incurred largely for acquiring and initial onboarding, we may gain operating leverage to the extent that existing customers expand their use of our platform and products. Our ability to retain customers and expand their usage could be impaired for a variety of reasons, including a customer moving to another provider or reducing usage within the term of their contract. Even if our customers expand their usage of our platform, we cannot guarantee that they will maintain those usage levels for any meaningful period of time or that they will renew their commitments.

We intend to continue expanding our efforts to attract customers outside of the United States by augmenting our sales teams and strategically increasing our presence in the number of markets in select international locations. Our international expansion, including our global sales efforts, continues to add increased complexity and cost to our business. This requires us to continue to expand our sales and marketing capabilities outside of the United States, increase the number of markets we have a presence in around the world to support our customers, and manage the administrative aspects of a global organization, each of which place a strain on our business and culture. In addition, our bandwidth costs are higher in markets outside of the United States and Europe, which may impact our gross margins.

We are closely monitoring thevarious unfoldingglobal eventsconflicts ofand developments, including, but not limited to, the Russianconflict invasionbetween ofRussia and Ukraine, as well as the more recent hostilities in Israel,the Middle East, and their global impacts. While the conflicts are still evolving and the outcomes remain highly uncertain, we do not believe the Russia-UkraineRussia-Ukraine, Israel-Hamas, or Israel-Hamasother conflicts will have a material impact on our business and results of operations. We do not have Points of Presence (“POPs”) in Russia, Ukraine, or Israel. However, some threat actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we, the third parties upon which we rely, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our goods and services. If eithersuch conflictconflicts continuescontinue or worsens,worsen, leading to greater global economic disruptions and uncertainty, our business and results of operations could be materially impacted. Our customers operating in Russia, Ukraine, and Israel represented an immaterial portion of our consolidated revenue as of December 31, 2024 and 2023, respectively.

We must continue to invest in our platform and network infrastructure to maintain our position in the market. We expect our revenue growth to be dependent on an expanding customer base and continued adoption of our edge cloud delivery, security, and other products and services. In anticipation of winning new customers and staying ahead of our customers’ needs, we plan to continue to invest in order to expand the scale and capacity of our software-defined modern network. This could result in increased network service provider fees, which could adversely affect our gross margins if we are unable to offset these costs with revenue from new customers and increase revenue from existing customers. Our customers require constant innovation within their own organizations and expect the same from us. Therefore, we will continue to invest in resources to enhance our development capabilities and introduce new products and features on our platform. We believe that investment in research and development will contribute to our long-term growth but may also negatively impact our short-term profitability. For the years ended December 31, 20242025 and 2023,2024, our research and development expenses as a percentage of revenue were 25%26% and 30%,25%, respectively. Our research and development expenses in each period isare impacted by the amount of software development costs that meet the criteria for capitalization. We may also seek to acquire or invest in businesses, products, or technologies that we believe could complement or expand our platform, enhance our technical capabilities, or otherwise offer growth opportunities. For example, in May 2022, we acquired Glitch, a software company specializing in developer project management tools to bolster our existing product offerings, by making it easier to innovate at a layer in the Fastly software stack.

In addition, international trade disputes may further disrupt or delay our supply chain for these components or lead to pricing increases. For example, the United States has imposed or indicated an intention to impose tariffs on certain countries which may lead to retaliatory actions such as counter-tariffs and increase production costs and disruptions in our supply chain. The United States and other jurisdictions have also leveraged various trade and value chain requirements, including on environmental and social criteria, which may make sourcing more costly, require us to change suppliers, or otherwise adversely impact our operations. Further, it is possible that government policy changes, including policy changes made with little to no advance notice, and related uncertainty about policy changes could increase market volatility. If our supply of certain components is further disrupted or delayed, there can be no assurance that we will be able to obtain adequate replacements for the existing components or that supplies will be available on terms and prices that are favorable to us, if at all. In the event that there are errors in software, failures of hardware, damages to a facility or misconfigurations of any of our services, whether caused by our own error, security breaches, third-party error, or natural disasters, we could experience lengthy interruptions in our platform availability as well as delays and additional expenses in arranging new facilities and services. In addition, there can be no assurance that we are adequately prepared for unexpected increases in bandwidth demands by our customers, particularly when we or our customers experience cyber-attacks. The bandwidth we have contracted to purchase may become unavailable for a variety of reasons, including service outages, payment disputes, network providers going out of business, natural disasters, networks imposing traffic limits, or governments adopting regulations that impact network operations.

Historically our revenue has been driven primarily by a subset of our customers, our enterprise customers, who have leveraged our platform substantially from a usage standpoint. We believe that the recruitment and cultivation of enterprise customers is critical to our long-term success. Our enterprise customer count is defined as customers with annualized current quarter revenue in excess of $100,000. This is calculated by taking the revenue we recognized for each customer in the current quarter and multiplying it by four. As of December 31, 2025, we had 628 enterprise customers which generated 94% of the total annualized current quarter revenue for our total customers for the period ended December 31, 2025. As of December 31, 2024, we had 596 of such enterprise customers which generated 93% of the total annualized current quarter revenue for our total customers for the period ended December 31, 2024. As of December 31, 2023, we had 578 of such enterprise customers which generated 92% of the total annualized current quarter revenue for our total customers for the period ended December 31, 2023.

We reportpresent our disaggregated revenue by three product lines: Network Services, SecuritySecurity, and Other. Network Services include solutions designed to improve performance of websites, apps, application programming interfaces (“APIs”), and digital media. Security includes products designed to protect websites, apps, APIs and users. Other includes Compute solutions that allow developers to build and deploy modern web applications on our edge cloud platform, and Observability solutions that provide real-time logs, data and metrics streamed from our edge platform for actionable insights.

General and administrative expenses consist primarily of personnel costs, including salaries, benefits, bonuses, and stock-based compensation for our administrative support personnel. General and administrative expenses also include costs related to legal and other professional services fees, SaaS costs, an allocation of our general overhead expenses, credit losseslosses, and acquisition-related costs.

Our impairment expense relates to write-offnon-recurring charges for certainour long-lived assets.

Our restructuring charges relate to a 2024 restructuring plan to reduce expenses including a reduction of ourthe Company’s workforce. The charges incurred consist primarily of employee-related severance and termination benefits.benefits in connection with such 2024 workforce reduction.

Our net gain on extinguishment of debt relates to the partial retirement of our outstanding senior convertible notes during the years ended December 31, 2024, 2023, and 2022.notes.

Our interest income consists primarily of interest earned on our cash, cash equivalentsequivalents, and investments. Our interest expense consists primarily of the interest expense on our finance leases andleases, amortization of discountdiscount, coupon interest expense, and debt issuance costs associated with our debt obligations. Our other income (expense),expense, net, consists primarily of foreign currency transaction gains and losses.

Network Services revenue was $477.8 million for the year ended December 31, 2025, compared to $427.7 million for the year ended December 31, 2024, compared to $405.1 million for the year ended December 31, 2023, an increase of $22.6$50.1 million, or 6%.12%. The increase in Network Services revenue was primarily driven by growth in usage from existing customers. Security revenue was $125.1 million for the year ended December 31, 2025, compared to $103.0 million for the year ended December 31, 2024, compared to $92.9 million for the year ended December 31, 2023, an increase of $10.2$22.0 million, or 11%.21%. The increase in Security revenue was primarily driven by an increase in Next-Gen WAF revenue, partially offset by a decrease in Fastly legacy WAF revenue. Other revenue was $21.2 million for the year ended December 31, 2025, compared to $12.9 million for the year ended December 31, 2024, compared to $8.0 million for the year ended December 31, 2023, an increase of $4.9$8.2 million, or 61%.64%. The increase in Other revenue was primarily driven by further adoption of our Compute solutions.

Research and development expenses were $162.7 million for the year ended December 31, 2025 compared to $138.0 million for the year ended December 31, 20242024, comparedan to $152.2 million for the year ended December 31, 2023, a decreaseincrease of $14.2$24.7 million, or 9%.18%. This decreaseincrease was primarily due to a decrease of $12.2$10.8 million increase in stock-based compensation expense, a $6.0 million increase in capitalized software costs, a $2.8$9.2 million decrease in executivecapitalized transitionsoftware, an increase of $5.7 million of personnel-related costs, as well as a $0.5 million decrease in colocation costs. This decrease was partially offset by an increase of $5.8 million of personnel-related costs, such as salaries and benefits as well as a $1.5$1.0 million increase in software costs. This increase was partially offset by a $1.4 million decrease in travel and entertainment expense, as well as a $0.6 million decrease in corporate costs.

Sales and marketing expenses were $201.4 million for the year ended December 31, 2025 compared to $198.6 million for the year ended December 31, 2024 compared to $191.8 million for the year ended December 31, 2023,2024, an increase of $6.8$2.8 million, or 4%.1%. This increase was primarily due to a $14.4$3.9 million increase in personnelstock-based relatedcompensation costs,expenses, sucha as$0.7 salaries,million salesincrease commissionsin marketing expenses, and benefits. The increase was also due to a $1.7$0.5 million increase in third party commissions as well as a $1.4 million increase in professional fees.commissions. The increase was partially offset by a $4.6 million decrease in stock-based compensation expenses, a $4.4 million decrease in marketing expenses, a $0.8 million decrease in amortizationpersonnel expenserelated ascosts wellincluding assales commissions, a $0.6 million decrease in travelsoftware andcosts, entertainmentas expenses.well as a $0.5 million decrease in corporate costs.

General and administrative costs were $110.7 million for the year ended December 31, 2025 compared to $113.4 million for the year ended December 31, 2024 compared to $116.1 million for the year ended December 31, 2023,2024, a decrease of $2.7 million, or 2%. The decrease was primarily due to a $6.5$6.9 million decrease in stock-based compensation expenses as well as a $1.6$1.4 million decrease in professionalpersonnel fees. The decrease was also due to a $0.8 million decrease in insurance expense as well as a $0.8 million increase in capitalized softwarerelated costs. This decrease was partially offset by an increase of $4.0 million in uncollected sales taxes, primarily due to a sales tax refund received in the prior year, a $1.8$2.8 million increase in badprofessional debtservice expense andfees, a $0.8$1.3 million increase in personnelcorporate relatedcosts, as well as a $1.0 million increase in executive transition costs.

•We receive a substantial portion of our revenues from a limited number of customers within a limited number of industries, and the loss of, or a significant reduction in usage by, one or more of our major customers would result in lower revenues and could harm our business.*

We receive a substantial portion of our revenues from a limited number of customers within a limited number of industries, and the loss of, or a significant reduction in usage by, one or more of our major customers would result in lower revenues and could harm our business.*

Our future success depends on establishing and maintaining successful relationships with a diverse set of customers. We currently receive a substantial portion of our revenues from a limited number of customers and within a limited number of industries, such as media and entertainment. Our 10 largest customers generatedaccounted anfor aggregate37% and 31% of 32% of our revenue for each of the trailing 12 month periods ended March 31, 2026 and 2025. Affiliated customers that are business units of a single company generated an aggregate of 10% and 9% of our revenue for the trailing 12 month periods ended March 31, 2026 and 2025, respectively. In addition, in April 2024, the former U.S. administration signed into law a bill that would effectively ban TikTok in the United States if ByteDance, its China-based parent company, did not sell its stake in TikTok within a set time frame. Following a series of executive orders in 2025 that suspended enforcement of this law, on January 22, 2026, ByteDance announced the establishment of TikTok USDS Joint Venture LLC in compliance with the law to secure United States user data, apps, and the algorithm through data privacy and cybersecurity measures. TikTok was one of our largest customers for the three months ended MarchJune 31,30, 2026 and remains2025, arespectively. For the three months ended June 30, 2026, there was one customer who accounted for 11% of ours.our Werevenue. do not know howFor the restructuringsix maymonths impactended June 30, 2026, there was one customer who accounted for 10% of our traffic levels.revenue. It is likely that we will continue to be dependent upon a limited number of customers for a significant portion of our revenues for the foreseeable future and, in some cases, the portion of our revenues attributable to individual customers may increase in the future. In addition, changes to our customers’ businesses may contribute to further customer concentration, including any impact from acquisition activities, internal business reorganizations leading to operational and decision making changes, and corporate structure changes such as subsidiary consolidation and reorganization that may arise in the future. The loss of one or more key customers or a reduction in usage by any major customers would reduce our revenues. If we fail to maintain existing customers or develop relationships with new customers and across different industries, our business would be harmed.

We generated a net loss of $20.5$36.1 million for the threesix months ended MarchJune 31,30, 2026 and we had an accumulated deficit of $1,135.0$1,150.6 million. We will need to generate and sustain increased revenue levels and manage costs in future periods in order to become profitable; even if we achieve profitability, we may not be able to maintain or increase our level of profitability. We intend to continue to expend significant funds to support further growth and further develop our platform, including expanding the functionality of our platform, expanding our technology infrastructure and business systems to meet the needs of our customers, expanding our direct sales force and partner ecosystem, increasing our marketing activities, and growing our international operations. We have in the past faced, and will continue to face, increased compliance costs associated with growth and expansion of our customer base. Our efforts to grow our business may be costlier than we expect, and we may not be able to increase our revenue enough to offset our increased operating expenses. We may incur significant losses in the future for a number of reasons, including the other risks described herein, and unforeseen expenses, difficulties, complications and delays, and other unknown events. If we are unable to achieve and sustain profitability, our business may be harmed.

We are incorporated into the supply chain of a number of companies worldwide and, as a result, if our services are compromised, a significant number or, in some instances, all of our customers and their data could be simultaneously affected. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised. The potential liability and associated consequences we could suffer as a result of such a large-scale event could be catastrophic and result in irreparable harm.

Moreover, our platform is highly technical and complex. For example, our delivery products may rely on knowledge of Varnish Configuration Language (“VCL”) to utilize certain features. Potential developerscustomers may be unfamiliar or opposed to working with VCL and therefore decide to not adopt our platform, which may harm our business.

We are, and may in the future be, subject to litigation such as putative class action and stockholder derivative lawsuits brought by stockholders. For example, on May 24, 2024, we and certain of our officers were named as defendants in putative securities class action filed in the United States District Court for the Northern District of California purportedly brought on behalf of holders of our common stock. On November 1, 2024, the lead plaintiff filed an amended complaint. On June 12, 2024 and2024, July 1, 2024, and June 29, 2026, stockholder derivative complaints were filed in the United States District Court for the Northern District of California against certain of our officers and directors based on substantially similar allegations as those in the putative securities class action. TheseThe twoCourt ordered that the June 12 and July 1, 2024 shareholder derivative actions, including any subsequently filed shareholder derivative actions havebased beenon substantially similar allegations, be consolidated and stayed pending resolution of our motion(s) to dismiss in the securities class action. On August 23, 2024 and December 20, 2024, substantially similar stockholder derivative complaints were filed against certain of our officers and directors in the United States District Court for the District of Delaware and the Court of Chancery for the State of Delaware. These two shareholder derivative actions have also been stayed pending resolution of our motion(s) to dismiss in the above-referenced putative securities class action.

We have experienced growth in various aspects of our business in prior periods. For example, our revenue was $183.3 million, and $148.7 million, for the three months ended MarchJune 31,30, 2026 and 2025, our revenue was $173.0 million, and $144.5 million, respectively. In addition, we are expanding, and expect to continue to expand in the future, our international operations. We have also experienced growth in the number of customers, usage, and amount of data delivered across our platform. This growth has placed, and may continue to place, significant demands on our corporate culture, operational infrastructure, and management. Although our business has experienced growth in the past, we cannot provide any assurance that our business will continue to grow at the same rate, or at all. Overall growth of our business depends on a number of factors, including our ability to:

•recruit, hire, train, retain, and manage additional qualified engineers and product managers;

•recruit, hire, train, retain, and manage additional sales and marketing personnel;

A component of our growth strategy involves the further expansion of our operations and customer base internationally. For both the three and six months ended MarchJune 31,30, 2026, the percentage of revenue generated from customers outside the United States was 29%approximately 30% of our total revenue. We continue to adapt to and develop strategies to address international markets but there is no guarantee that such efforts will have the desired effect. As of MarchJune 31,30, 2026, approximately 23.2%24.6% of our full-time employees were located outside of the United States. We expect that our international activities will grow over the foreseeable future as we continue to pursue opportunities in existing and new international markets, which will require significant management attention and financial resources. In connection with such expansion, we may face difficulties including costs associated with varying seasonality patterns, potential adverse movement of currency exchange rates, longer payment cycles, difficulties in collecting accounts receivable in some countries, tariffs and trade barriers, a variety of regulatory or contractual limitations on our ability to operate, adverse tax events, reduced protection of intellectual property rights in some countries, and a geographically and culturally diverse workforce and customer base. Failure to overcome any of these difficulties could harm our business. Our current and future international business and operations involve a variety of risks, including:

The preparation of financial statements in conformity with generally accepted accounting principles in the United States (“U.S. GAAP”) requires management to make estimates and assumptions that affect the amounts reported in the condensed consolidated financial statements and accompanying notes. We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as provided in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Critical Accounting Estimates.” The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities, and equity and the amount of revenue and expenses that are not readily apparent from other sources. Our results of operations may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our results of operations to fall below the expectations of securities analysts and investors, resulting in a decline in the trading price of our common stock.

Our Credit Agreement contains, and any future indebtedness would likely contain, a number of restrictive covenants that impose significant operating and financial restrictions on us, including restrictions on our ability to incur additional indebtedness, grant liens, pay dividends and make distributions, transfer property, make investments, and take other actions that may otherwise be in our best interests. In addition, our Credit Agreement contains a financial covenant that requires us to maintain a consolidated adjusted quick ratio of at least 1.25 to 1:001.00 tested on a quarterly basis as well as a springing revenue growth covenant not to be less than 5% on a quarterly basis for certain periods if our consolidated adjusted quick ratio falls below 1:751.75 to 1:001.00 on the last day of any fiscal quarter. Our ability to meet these financial covenants can be affected by events beyond our control, and we may not be able to continue to meet those covenants. In addition, a breach of a covenant under our Credit Agreement or any other current or future indebtedness above certain thresholds may result in a cross-default under any such indebtedness. If we seek to incur additional indebtedness in the future, we may not be able to obtain debt or equity financing on terms that are favorable to us, if at all. Holders of our existing debt have, and holders of any future debt we may incur would have, rights senior to holders of common stock to make claims on our assets. In addition, the terms of our existing debt do, and the terms of any future debt could, restrict our operations, including our ability to pay dividends on our common stock. If we are unable to obtain adequate financing or financing on terms that are satisfactory to us when we require it, our ability to continue to support our business growth and to respond to business challenges could be significantly impaired, and our business may be harmed.

As detailed in Item 9A in our Annual Report on Form 10-K filed February 26, 2025, we and our independent registered public accounting firm identified a material weakness in our internal control related over financial reporting for the year ended December 31, 2024. This material weakness related to deficiencies in the design and operating effectiveness of controls within the revenue process. During the year ended December 31, 2025, we implemented remediation actions to address the material weakness in our internal controls, and as of December 31, 2025, this material weakness has been deemed remediated.

U.S. GAAP are subject to interpretation by the Financial Accounting Standards Board, the SEC, and other various bodies formed to promulgate and interpret appropriate accounting principles. A change in these principles or interpretations could have a significant effect on our reported financial results for periods prior to and subsequent to such change, and could affect the reporting of transactions completed before the announcement of a change.

Failure to comply with United States and foreign governmental laws and regulations could harm our business.*

If the United States government prohibits our current or potential customers from doing business with us, whether through policy, regulations or laws, we could face direct liability or our delivery of content by our platform may be blocked. For example, in the current environment of economic trade negotiations and tensions between the Chinese and the United States governments, the United States government has expressed concerns about the ability of companies operating in China to do business in the United States or with United States companies. As a result, we could lose the ability to contract with current or potential customers and usage of our platform may decrease by affected customers, which could harm our business and reputation. Even in the absence of new restrictions or trade actions imposed by the United States or other governments, our customers that operate in China, target China as a market, or that have strong business ties to China, may take actions to reduce dependence on our platform, which could harm our business. In April 2024, under the prior administration, a bill was signed into law that would effectively ban TikTok in the United States if ByteDance, its China-based parent company, did not sell its stake in TikTok within a set time frame. Following a series of executive orders in 2025 that suspended enforcement of this law, on January 22, 2026, ByteDance announced the establishment of TikTok USDS Joint Venture LLC in compliance with the law to secure United States user data, apps, and the algorithm through data privacy and cybersecurity measures. TikTok was one of our largest customers for the three months ended March 31, 2026 and remains a customer of ours. We do not know how the restructuring may impact our traffic levels or our ongoing relationship with TikTok.

We receive, store, process, collect, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share information that relates to individuals and/or constitutes “personal data,” “personal information,” “personally identifiable information,” or similar terms under applicable data privacy laws (collectively, “Personal Information”). Our handling of Personal Information is subject to a variety of obligations related to privacy and data security, including laws and regulations, contractual obligations, internal and external privacy policies, guidance, industry standards, and other obligations that govern the processing of Personal Information. Additionally, we are or may become subject to other laws and regulations around the world with respect to the Internet related to, among other things, content moderation, security requirements, critical infrastructure designations, Internet resiliency, law enforcement access to information, net neutrality, data localization or data sovereignty requirements, and restrictions on social media or other content.

Regulatory and legislative developments on the development and deployment of AI technologies could adversely affect our use of such technologies in our business operations or our products and services.*

Our employees and personnel may increasingly use AI to perform their work, and our customers may deploy AI models or technologies using our platform, including because we develop products that supportenable AI.AI workloads for our customers. However, the regulatory framework for AI is rapidly evolving as many federal, state, and foreign governments have passed and are likely to pass additional laws regulating the development and deployment of AI. For example, in the United States, the current executive administration’s approach to investment in, and regulation of, AI technologies has and is expected to continue to deviate from that of the previous administrationadministration, and we will need to adapt to any changes that may result from such approach, including as the result of new or changing executive orders. For instance, theThe current administration issued an AI-focused Executive Order on December 11, 2025 entitled “Ensuring a National Policy Framework for Artificial Intelligence”. This orderExecutive Order establishes a federal policy favoring a uniform national AI regulatory framework and calls for developing federal standards and legislation that would preempt conflicting state AI regulations and create a federal litigation task force focused on challenging state AI laws in court.court Thus,if theimplemented. The current administration may continue to rescind other existing federal orders or administrative policies relating to AI, or may implement new executive orders or other rule making relating to AI in the futurefuture, or challenge state laws regulating AI.

Additionally, several jurisdictions around the globe,world, including in Europe and certain U.S. states, have proposed, enacted, or are considering laws governing the development and deployment of AI. For example, California enacted several new laws in 2024 and 2025 that regulate the use of AI technologies and provide consumers with additional protections around companies’ use of AI technologies, such as requiring companies to disclose certain uses of generative AI and provide further transparency about how such AI was developed. Other states have also passed AI-focused legislation, such as Colorado’s ArtificialAutomated IntelligenceDecision-Making Technology Act, which willrepealed requireand replaced its Artificial Intelligence Act with a narrower framework focused on imposing disclosure and transparency requirements on the developers and deployers of “high-risk” AI systems to implement certain safeguards against algorithmic discrimination, andtechnologies; Utah’s Artificial Intelligence Policy Act, which establishes disclosure requirements and accountability measures for the use of generative AI in certain consumer interactions.interactions; and the Texas Responsible Artificial Intelligence Governance Act, which prohibits the development and deployment of AI systems for certain purposes while establishing a regulatory sandbox. Such additional regulations, the manner in which such new laws are interpreted, and uncertainty around whether they will survive legal challenges or how they will be enforced, may impact our ability to develop, use, procure and commercialize AI and machine learning technologies in the future.

Further, jurisdictions around the globe,world, including the European UnionUnion, are considering or have enacted their own AI-focused regulations. The EU Artificial Intelligence Act (“EU AI Act”), which establishes a risk-based governance framework for AI in the EU market, entered into force on August 1, 2024, and the majority of the substantive requirements are expected to apply from August 2, 2026, and though the European Commission has proposed an extension to December 2, 2027, such extension is not yet finalized or effective.2024. This framework categorizes AI applications into risk categories such as “unacceptable”, “high”, “limited”, and “minimal”. In June 2026, amendments to the EU AI Act were formally adopted as part of the EU’s digital “omnibus” simplification package, which, among other things, extend the compliance deadlines for “high” risk AI systems to December 2, 2027 (for stand-alone “high” risk AI systems). AI applications in the “high” risk category arewill be subject to new ex ante conformity assessments and other new requirements related to risk management, testing, technical documentation and robustness, data training and data governance and log recording, transparency, human oversight, and cybersecurity, while AI applications in the “limited” risk category are expected to becomebecame subject to the new transparency andobligations on August 2, 2026, with output labelling obligations.obligations for certain generative AI systems placed on the market before that date applying from December 2, 2026. Fines for breaches of the EU AI Act can be up to the greater of €35 million or 7% of worldwide annual turnover. The EU AI Act, together with developing guidance and/or decisions in this area, may affect our use of AI technologies and our ability to provide, improve or commercialize our services, require additional compliance measures and changes to our operations and processes, result in increased compliance costs and potential increases in civil claims against us, and could adversely affect our business, operations and financial condition. If our current or future AI applications fall within the “high” or “limited” risk categories, the increased cost and complexity to comply could adversely affect our business, financial condition and results of operations. We expect other jurisdictions will adopt similar laws.

Additionally,It is possible that further new laws and regulations will be adopted in the United States and in other non-U.S. jurisdictions, or that, existing laws and regulationsregulations, including competition, antitrust, data privacy and consumer protection laws, have been and may continue to be interpreted in ways that could affect ourthe use of AI,AI in our operations or couldrequire be rescinded or amended as new administrations take differing approachesus to AI.change the way we use AI technologies in a manner that negatively affects the performance of our products, services, and business. As a result, implementation standards and enforcement practices are likely to remain uncertainuncertain, or may be inconsistent across jurisdictions, for the foreseeable future,future. and weWe cannot yet completely determine the impact that existing or future laws, regulations, standards, decisions, or market perception of their requirements may have on our business. We may not always be able to anticipate how to respond to these laws or regulations, and this uncertainty may make it harder for us to conduct our business using AI, or could lead to increased costs, legal claims or proceedings, regulatory fines or penalties, require us to change our business practices,practices or comply with additional reporting obligations, retrain AI, or prevent or limit our use of AI. In addition, due to inaccuracies or flaws in the inputs, outputs, or logic of AI, AI models could be biased and could lead us to make decisions that could bias certain individuals (or classes of individuals), and adversely impact their rights, employment, and ability to obtain certain pricing, products, services, or benefits, which could expose us to reputational and competitive harm, customer loss, or legal liability. Furthermore, because AI models are highly complex and their internal logic often lacks transparency, our use of these technologies could result in unintended consequences or outcomes that differ significantly from our expectations or those of our customers. If we cannot use or are restricted in using AI technologies, or deployment of AI by our customers using our platform is affected, our business and results of operations may be harmed, and we may be at a competitive disadvantage.

The success of our business depends on customers’ continued and unimpeded access to our platform on the Internet.*

In January 2018, the Federal Communications Commission (the “FCC”), repealed the “network neutrality” rules adopted during the Obama Administration, which barred Internet service providers from blocking or slowing down access to online content, protecting services like ours from such interference. The 2018 decision was largely affirmed by the United States Court of Appeals for the District of Columbia Circuit, subject to a remand to consider several issues raised by parties that supported network neutrality, and in November 2020 the FCC affirmed its decision to repeal the rules. On October 19, 2023, the FCC adopted a notice of proposed rulemaking that would reinstate the network neutrality rules, and asked for commentand, on that proposal and on potential changes to those rules. On April 25, 2024, the FCC voted to restoreadopt thean networkorder neutralityrestoring rulesthose which bring back a national standard for broadband reliability, security, and consumer protection.rules. On August 1, 2024, the United States Court of Appeals for the Sixth Circuit granted a stay of thethose network neutrality rules.rules Onand on January 2, 2025, the Unitedsame States Court of Appeals for the Sixth Circuitcourt struck down the FCC’s network neutralitythose rules, ruling that the FCC lacks statutory authority under Title II of the Communications Act to impose its proposed net neutrality policies and therefore exceeded its authority in imposing the net neutrality regulations. WeThe cannotFCC predictdid not seek further review of that decision, and no federal network neutrality rules are currently in effect. Following the impactSixth Circuit’s decision, state laws remain the primary source of suchnetwork rulesneutrality orregulation, theand outcomeadditional ofstates anymay legaladopt challengessimilar to such rules on our operations or business.requirements. A number of states have adopted or are adopting or considering legislation or executive actions that would regulate the conduct of broadband providers. For example, California, Vermont, and Maine have state-specific network neutrality laws in effect. In addition, the status of state regimes may be affected by the FCC’s action in its new network neutrality proceeding. We cannot predict whether anyfederal network neutrality requirements will be reinstated through legislation or future FCC orderaction, or otherwhether state initiatives will be enforced, modified, overturned, or vacated by legal action ofby the court,courts, federal legislation, or the FCC.

Historically, our stock price has been volatile. During the year ended December 31, 2025, our stock traded as high as $12.59 per share and as low as $4.65 per share, and from January 1, 2026 to MayJuly 1,31, 2026, our stock price has ranged from $34.82 per share to $7.87 per share. The market price of our common stock may continue to be highly volatile and may fluctuate or decline substantially as a result of a variety of factors, some of which are beyond our control or are related in complex ways, including:

In March 2021, we entered into a purchase agreement for the sale of an aggregate of $948.8 million principal amount of our 0% convertible senior notes due 2026 (the “2026 Notes”). During the year ended December 31, 2022, we entered into separate, privately negotiated transactions with certain holders of the 2026 Notes to repurchase approximately $235.0 million aggregate outstanding principal amount of the 2026 Notes for an aggregate cash repurchase price of approximately $176.4 million. During the year ended December 31, 2024, we entered into several separate, privately negotiated transactions with certain holders of the 2026 Notes to exchange $157.9 million of aggregate principal amount of the 2026 Notes for $150.0 million aggregate principal amount of 7.75% convertible senior unsecured notes due in 2028 (the “2028 Notes”). In December 2025, we entered into a purchase agreement for the sale (the “Offering”) of $160.0 million principal amount of our 0% convertible senior unsecured senior notes due 2030 (the “2030 Notes”, together with the 2028 Notes, the “Notes”). In connection with the Offering, the initial purchasers exercised in full their option to purchase an additional $20.0 million principal amount of the 2030 Notes, resulting in the issuance of an aggregate principal amount of $180.0 million of the 2030 Notes. We used a portion of the net proceeds from the offering of the 2030 Notes to repurchase approximately $150.0 million aggregate principal amount of the 2026 Notes for an aggregate cash repurchase price of approximately $148.9 million. During the quarter ended March 31, 2026, the 2026 Notes matured and were repaid in full. The 2030 Notes incurred transaction costs of $6.7 million which were recorded as contra-liability and represent the difference between the principal and carrying amount of the 2030 Notes. The 2028 Notes and the 2030 Notes will mature on June 1, 2028 and December 15, 2030, respectively, unless earlier converted or repurchased. Holders of the Notes will have the right, subject to certain conditions and limited exceptions, to require us to repurchase all or a portion of their Notes upon the occurrence of a fundamental change at a fundamental change repurchase price equal to 100% of the principal amount of the Notes to be repurchased, plus accrued and unpaid special interest, if any, as described in the indenture governing the Notes. If our stock price is lower than the conversion price of the Notes on maturity, the holders of our Notes will likely not convert and we will have to repay those Notes in cash. In addition, upon conversion of the Notes, unless we elect to deliver solely shares of our common stock to settle such conversion (other than paying cash in lieu of delivering any fractional share), we will be required to make cash payments in respect of the Notes being converted as described in the indenture governing the Notes. However, we may not have enough available cash or be able to obtain financing at the time we are required to repay or make repurchases of Notes surrendered therefor or pay cash with respect to Notes being converted. In addition, our ability to repurchase the Notes or to pay cash upon conversions of the Notes may be limited by law, by regulatory authority or by agreements governing our future indebtedness. Our failure to repurchase notes at a time when the repurchase is required by the indenture or to pay any cash payable on future conversions of the Notes as required by the indenture would constitute a default under the indenture. A default under the indenture governing the Notes or the fundamental change itself could also lead to a default under agreements governing our future indebtedness. If the repayment of the related indebtedness were to be accelerated after any applicable notice or grace periods, we may not have sufficient funds to repay the indebtedness and repurchase the Notes or make cash payments upon conversions thereof. Such acceleration could result in our bankruptcy. In a bankruptcy, the holders of the Notes would have a claim to our assets that is senior to the claims of our equity holders.

As of MarchJune 31,30, 2026, we have outstanding a total of 156.4159.1 million shares of common stock. All of our outstanding shares are eligible for sale in the public market, other than shares and options held by directors, executive officers, and other affiliates that are subject to volume limitations under Rule 144 of the Securities Act, various vesting agreements, and shares that must be sold under an effective registration statement. Additionally, the shares of common stock subject to outstanding options and restricted stock unit awards under our equity incentive plans and the shares reserved for future issuance under our equity incentive plans will become eligible for sale in the public market upon issuance, subject to applicable insider trading policies. The 20282030 Notes are convertible at the option of the holders from July 1, 2026 until September 30, 2026, and the 20302028 Notes will also become convertible at the option of the holders, subject to certain limitations and restrictions, prior to June 1, 2028 and December 15, 2030, respectively.2028.

•provide that our directors may be removed for cause only upon the vote of the holders of a66 majority2/3% or more of the voting power of all our outstanding shares of common stock; and

You should read the following discussion and analysis of our financial condition and results of operations together with the condensed consolidated financial statements and related notes that are included elsewhere in this Quarterly Report on Form 10-Q.10-Q Thisand our Annual Report on Form 10-K for the year ended December 31, 2025, filed with the SEC. Some of the information contained in this discussion containsand analysis or set forth elsewhere in this Quarterly Report on Form 10-Q includes forward-looking statements based upon current plans, expectations, and beliefs that involve risks and uncertainties.uncertainties as described under the heading Special Note Regarding Forward-Looking Statements following the Table of Contents of this Quarterly Report on Form 10-Q. Actual results may differ materially from those anticipated in these forward-looking statements as a result of various factors, including those set forth under “Risk Factors” and in other parts of this Quarterly Report on Form 10-Q. Our fiscal year ends on December 31.

Many jurisdictions have enacted laws on data localizationlocalization, data sovereignty, and cross-border data transfers, and the evolving enforcement and interpretation of such laws has created uncertainty regarding data stored abroad and transferred across borders, which could impact customer growth and acquisition for customers and potential customers conducting business in Europe and elsewhere outside of the United States. In addition, we cannot be certain what actions the United States or another country’s government may take with respect to certain of our customers that may adversely affect our ability to do business with our customers that operate in China, target China as a market or that have strong business ties to China, and any such governmental action could have a negative impact on our business. In April 2024, under the prior administration, a bill was signed into law that would effectively ban TikTok in the United States if ByteDance, its China-based parent company, does not sell its stake in TikTok within a set time frame. Following a series of executive orders in 2025 that suspended enforcement of this law, on January 22, 2026, ByteDance announced the establishment of TikTok USDS Joint Venture LLC in compliance with the law to secure United States user data, apps, and the algorithm through data privacy and cybersecurity measures. TikTok was one of our largest customers for the three months ended March 31, 2026 and remains a customer of ours. We do not know how the restructuring may impact our traffic levels. For additional details, refer to the section titled “Risk Factors.”

We are closely monitoring various global conflicts and developments, including, but not limited to, the conflict between Russia and Ukraine, conflicts in the Middle East, including the recent military conflict involving Iran, the United States, and Israel, as well as other conflicts in the Middle East, and their global impacts. While the conflicts are still evolving and the outcomes remain highly uncertain, we do not believe these or other conflicts will have a material impact on our business and results of operations. We do not have Points of Presence (“POPs”) in Russia, Ukraine, Iran, or Israel. However, some threat actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we, the third parties upon which we rely, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our goods and services. If such conflicts continue or worsen, leading to greater global economic disruptions and uncertainty, our business and results of operations could be materially impacted.

We must continue to invest in our platform and network infrastructure to maintain our position in the market. We expect our revenue growth to be dependent on an expanding customer base and continued adoption of our edge cloud delivery, security, and other products and services. In anticipation of winning new customers and staying ahead of our customers’ needs, we plan to continue to invest in order to expand the scale and capacity of our software-defined modern network. This could result in increased network service provider fees, which could adversely affect our gross margins if we are unable to offset these costs with revenue from new customers and increase revenue from existing customers. Our customers require constant innovation within their own organizations and expect the same from us. Therefore, we will continue to invest in resources to enhance our development capabilities and introduce new products and features on our platform. We believe that investment in research and development will contribute to our long-term growth but may also negatively impact our short-term profitability. For the three months ended March 31, 2026 and 2025, our research and development expenses as a percentage of revenue were 24% and 26%, respectively. Our research and development expenses in each period are impacted by the amount of software development costs that meet the criteria for capitalization. We may also seek to acquire or invest in businesses, products, or technologies that we believe could complement or expand our platform, enhance our technical capabilities, or otherwise offer growth opportunities.

Our definition of a customer consists of identifiable operating entities with which we have a billing relationship in good standing and which we have recognized revenue from during the reporting period.period, which differs from the definition used for purposes of assessing concentration of credit risk. An identifiable operating entity is defined as a company, a government entity, or a distinct business unit of a larger company that has a relationship with us through direct sales or through one of our reseller partners where charges are identified on an end-customer basis. We may treat separate subsidiaries, segments, divisions, or business units of a single organization that use our platform as unique customers where they have distinct account identifiers. In cases where charges are identified through a reseller partner rather than on an end-customer basis, we would count the reseller as a single customer in our customer count. Our customer groupings may be impacted by changes to our customers’ business, including any impact from acquisition activities, internal business reorganizations leading to operational and decision-making changes, and corporate structure changes such as subsidiary consolidation and reorganization that may arise in the future.

Historically our revenue has been driven primarily by a subset of our customers, our large customers, who have leveraged our platform substantially from a usage standpoint. We believe that the recruitment and cultivation of large customers is critical to our long-term success. Our large customer count is defined as customers with annualized current quarter revenue in excess of $100,000. This is calculated by taking the revenue we recognized for each customer in the current quarter and multiplying it by four. As of MarchJune 31,30, 2026, we had 634624 of such large customers which generated 94% of the total annualized current quarter revenue for our total customers for the three months ended MarchJune 31,30, 2026. As of MarchJune 31,30, 2025, we had 595622 of such large customers which generated 93%94% of the total annualized current quarter revenue for our total customers for the three months ended MarchJune 31,30, 2025.

Our LTM NRR removes some of the volatility that is inherent in a usage-based business model from the measurement of the NRR metric. We calculate LTM NRR by dividing the total customer revenue for the prior twelve-month period (“prior 12-month period”) ending at the beginning of the last twelve-month period (“LTM period”) minus revenue contraction due to billing decreases or customer churn, plus revenue expansion due to billing increases during the LTM period from the same customers by the total prior 12-month period revenue. For the trailing twelve months ended MarchJune 31,30, 2026 and 20252025, our LTM NRR was 113.0%117.2% and 100.0%,104.4%, respectively.

RPO represent future committed revenue for periods within current contracts with customers, as well as deferred revenue arising from consideration invoiced for which the related performance obligations have not been satisfied. As of MarchJune 31,30, 2026, the aggregate amount of the transaction price in our contracts allocated to RPO that were unsatisfied or partially unsatisfied was $368.7$340.9 million.

We presentreport our disaggregated revenue by three product lines: Network Services, Security, and Other. Network Services include solutions designed to improve performance of websites, apps, application programming interfaces (“APIs”), and digital media. Security includes products designed to protect websites, apps, APIs and users. Other includes Compute solutions that allow developers to build and deploy modern web applications on our edge cloud platform, and Observability solutions that provide real-time logs, data and metrics streamed from our edge platform for actionable insights.

Sales and marketing expenses consist primarily of personnel costs, including commissions for our sales employees, salaries, benefits, bonuses, and stock-based compensation. Sales and marketing expenses also include third-party commission costs, expenditures related to advertising, marketing, our brand awareness activities, bandwidth and co-location costs for free trial users, costs related to our customer events, including our customer conferences, professional services fees, amortization of our intangible assets, and an allocation of our general overhead expenses.

Our interest income consists primarily of interest earned on our cash, cash equivalents, and investments. Our interest expense consists primarily of the interest expense on our finance leases, amortization of discount, coupon interest expense, and debt issuance costs associated with our debt obligations. Our other expense, net, consists primarily of foreign currency transaction gains and losses.

Revenue was $173.0$183.3 million for the three months ended MarchJune 31,30, 2026, compared to $144.5$148.7 million for the three months ended MarchJune 31,30, 2025, an increase of $28.5$34.6 million, or 20%.23%. Revenue was $356.3 million for the six months ended June 30, 2026, compared to $293.2 million for the six months ended June 30, 2025, an increase of $63.1 million, or 22%.

InDuring the three and six months ended MarchJune 31,30, 2026 and 2025, our revenue was primarily generated from transactions with existing customers, as revenue from new customers contributed less than 10% of our revenue. The proportion of the revenue contribution between new and existing customers is consistent with prior periods and typical customer behavior as customers tend to contribute more revenue over time as their use of the platform increases. The remainder of our revenue was generated by our other products and services, including support and professional services.

Network Services revenue was $126.2$133.9 million for the three months ended MarchJune 31,30, 2026, compared to $113.3$114.9 million for the three months ended MarchJune 31,30, 2025, an increase of $12.9$19.0 million, or 11%.17%. The increase in Network Services revenue was primarily driven by growth in usage from existing customers. Security revenue was $38.8$41.7 million for the three months ended MarchJune 31,30, 2026, compared to $26.4$29.3 million for the three months ended MarchJune 31,30, 2025, an increase of $12.4 million, or 47%.43%. The increase in Security revenue was primarily driven by an increase in Next-Gen WAF revenue. Other revenue was $8.0$7.7 million for the three months ended MarchJune 31,30, 2026, compared to $4.8$4.5 million for the three months ended MarchJune 31,30, 2025, an increase of $3.2 million, or 67%.69%. The increase in Other revenue was primarily driven by further adoption of our Compute solutions.

Cost of revenue was $64.8$67.4 million for the three months ended MarchJune 31,30, 2026 compared to $67.7$67.6 million for the three months ended MarchJune 31,30, 2025, a decrease of $2.9$0.2 million, or 4%.0.3%. The decrease was primarily due to a $6.0$2.6 million decrease in depreciation andexpense amortizationprimarily due to a change in the useful life of our servers as well as a $1.5$2.5 million decrease in bandwidthintangible cost.asset amortization expense due to fully amortized assets. The decrease was partially offset by a $1.8$2.6 million increase in colocation costs, a $1.2$1.4 million increase in software costs, and a $1.1$0.9 million increase in personnel-related costs, as well as a $0.6 million increase in stock-based compensation expense.costs.

Gross profit was $108.2$116.0 million for the three months ended MarchJune 31,30, 2026 compared to $76.8$81.1 million for the three months ended MarchJune 31,30, 2025, an increase of $31.4$34.9 million, or 41%.43%. Gross margin was 63% for the three months ended MarchJune 31,30, 2026 and 53%55% for the three months ended MarchJune 31,30, 2025.2025, an increase of 8 percentage points. The increase in gross margin was driven by revenue growth during the three months ended MarchJune 31,30, 2026 combined with therelatively decreases inflat cost of revenue.

Research and development expenses were $42.0$42.1 million for the three months ended MarchJune 31,30, 2026 compared to $37.4$42.2 million for the three months ended MarchJune 31,30, 2025, ana increasedecrease of $4.6$0.1 million, or 12%.0.4%. The increasedecrease was primarily due to a $3.1$0.7 million increasedecrease in personnel-relatedsoftware costs,costs. The decrease was partially offset by a $1.1 million increase in stock-based compensation expenses, and a $1.1$0.3 million decrease in capitalized software developmentand costs.a The$0.3 million increase was partially offset by a $0.8 million decrease in softwarepersonnel-related costs.

Sales and marketing expenses were $55.1$56.7 million for the three months ended MarchJune 31,30, 2026 compared to $49.3$51.1 million for the three months ended MarchJune 31,30, 2025, an increase of $5.8$5.6 million, or 12%.11%. The increase was primarily due to a $3.0$2.2 million increase in stock-based compensation expense, a $1.7 million increase in third-party commission costs, a $1.6 million increase in personnel-related costs including commission expense, and a $2.7$0.6 million increase in stock-based compensation expenses, as well as a $0.7 million increase in third-party commissionmarketing-related expenses. The increase was partially offset by a $0.7$0.3 million decrease of corporate costs as well as a $0.3 million decrease in software costs.

General and administrative costsexpenses were $35.0$31.6 million for the three months ended MarchJune 31,30, 2026 compared to $28.2$24.3 million for the three months ended MarchJune 31,30, 2025, an increase of $6.8$7.3 million, or 24%.30%. The increase was primarily due to a $5.0$6.3 million increase in stock-based compensation expenses,expense, a $0.8$1.2 million increase in personnel-related costs, and a $0.7$1.0 million increase in executivecorporate transitioncosts. costsThe increase is partially offset by $0.6 million of tax-related benefits during the three months ended June 30, 2026 and a $0.2 million decrease in tax-related expenses, as well as a $0.6$0.4 million increasedecrease in badprofessional debt costs.fees.

Income tax benefitexpense was $4.1$0.3 million for the three months ended MarchJune 31,30, 2026 compared to income tax expense of $0.7$0.6 million for the three months ended MarchJune 31,30, 2025, a decrease of $4.8$0.3 million. The decrease was primarily due to the recognition of a previously unrecognized tax benefit of $4.3 million resulting from the lapse of the applicable statute of limitations in the UK. The Company continues to maintain a full valuation allowance in the U.S.U.S., and the tax expense/(benefit) for the periods were primarily due to foreign tax expense/(benefit).expense.

As of MarchJune 31,30, 2026, we had cash, cash equivalents, and marketable securities totaling $330.5$337.5 million. Our cash, cash equivalents, and marketable securities primarily consisted of U.S. government money market funds, investment-grade commercial paper, corporate notes and bonds, U.S. treasury securities, municipal bonds, agency bonds, and certificates of deposit. As of MarchJune 31,30, 2026, we did not have any marketable securities classified as non-current.

In 2021, we entered into the Credit Agreement (as defined in Note 8 in our condensed consolidated financial statements). As of MarchJune 31,30, 2026, we were in compliance with the covenants described in Note 8 to the condensed consolidated financial statements in Part I, Item 1 of this Quarterly Report on Form 10-Q, and we expect to continue to be in compliance for at least the next 12 months. During the threesix months ended MarchJune 31,30, 2026 and 2025, no amounts were drawn down on the Credit Agreement.

During the year ended December 31, 2024, we entered into separate, privately negotiated transactions with certain holders of the 2026 Notes to exchange $157.9 million aggregate principal amount of the 2026 Notes for $150.0 million aggregate principal amount of 7.75% convertible senior unsecured notes due 2028 (the “2028 Notes”) and aggregate transaction costs of $5.8 million.

During the quartersix months ended MarchJune 31,30, 2026, the 2026 Notes matured and were repaid in full.

In connection with the pricing of the issuance of the 2030 Notes, the Company entered into privately negotiated capped call transactions with certain counterparties (the “Capped Calls”). The Capped Calls resulted in an $18.2 million outflow of cash.cash in the three months ended December 31, 2025. Refer to Note 8 to the condensed consolidated financial statements in Part I, Item 1 of this Quarterly Report on Form 10-Q.

For the threesix months ended MarchJune 31,30, 2026, cash provided by operating activities was $28.9$68.2 million, consisting primarily of our net loss of $20.5$36.1 million, adjusted for non-cash items of $57.0$120.0 million, and net cash flows used in operating assets and liabilities of $7.6$15.7 million. The main drivers of the changes in operating assets and liabilities were $12.9 million in operating lease payments, a decrease in other liabilities of $10.9 million, an increase in accountsother receivableassets of $13.5$1.8 million,million and a $5.8$0.4 million operating lease payment, and an increase in prepaid expenses and other current assets of $2.6 million.assets. This was partially offset by a decrease in accounts receivable of $1.3 million, primarily due to the timing of cash receipts from our customers, an increase in accounts payable of $6.8$8.3 million,million due to timing of payments, and an increase in accrued expenses of $3.5 million, an increase in other liabilities of $2.7 million, and a decrease in other assets of $1.4$0.9 million.

For the threesix months ended MarchJune 31,30, 2025, cash provided by operating activities was $17.3$43.1 million, consisting primarily of our net loss of $39.1$76.7 million, adjusted for non-cash items of $57.5$115.7 million, and net cash flows usedprovided inby operating assets and liabilities of $1.1$4.1 million. The main drivers of the changes in operating assets and liabilities were $5.6 million of operating lease payments, a net decrease of accounts receivable of $4.0 million, primarily due to the timing of cash receipts from our customers, a $3.4 million decrease in accrued expenses due to timing of payments and a $2.1 million decrease in other assets. This was offset by a $9.2$16.9 million increase in other liabilities, a $2.6$6.0 million increase in accounts payable due to timing of payments, and a $2.2$2.3 million increasedecrease in prepaid expenses and other current assets. This was offset by a $8.2 million increase in other assets, $7.9 million of net operating lease payments, a net increase of accounts receivable of $3.3 million, primarily due to the timing of cash receipts from our customers and a $1.8 million decrease in accrued expenses due to timing of payments.

For the threesix months ended MarchJune 31,30, 2026, cash used in investing activities was $27.0$125.6 million, primarily consisting of $179.3$266.6 million purchases of marketable securities, $21.0$52.6 million of payments related to purchases of property and equipment to expand our network, and $3.7$7.9 million of additions to capitalized internal-use software. The cash outflow was partially offset by $177.1$201.5 million of maturities of marketable securities.

For the threesix months ended MarchJune 31,30, 2025, cash used in investing activities was $178.9$248.8 million, primarily consisting of $179.5$272.9 million purchases of marketable securities, $4.8 million of additions to capitalized internal-use software, and $2.6$12.5 million of payments related to purchases of property and equipment to expand our network.network, and $9.3 million of additions to capitalized internal-use software. The cash outflow was partially offset by $8.0$45.8 million of maturities of marketable securities.

For the threesix months ended MarchJune 31,30, 2026, cash used in financing activities was $35.8$33.3 million, primarily consisting of a $38.6 million repayment of the remaining balance of 2026 Notes and $0.5 million from payment of 2030 Notes issuance cost that was unpaid as of December 31, 2025. This was partially offset by $2.3$4.7 million in proceeds from the employee stock purchase plan and $1.0$1.1 million in proceeds from stock option exercises by our employees.

For the threesix months ended MarchJune 31,30, 2025, cash provided by financing activities was $0.8$1.8 million, primarily consisting of $2.1$3.4 million in proceeds from the employee stock purchase plan (“ESPP”) and $0.4$0.7 million in proceeds from stock option exercises by our employees. The cash inflow was partially offset by $1.7$2.2 million of finance lease payments.

We prepare our condensed consolidated financial statements in accordance with U.S. GAAP. The preparation of our condensed consolidated financial statements requires us to make estimates, judgments, and assumptions that affect the reported amounts of assets, liabilities, revenue, costs, expenses, and related disclosures. Actual results and outcomes could differ significantly from our estimates, judgments, and assumptions. To the extent that there are material differences between these estimates and actual results, our future financial statement presentation, financial condition, results of operations, and cash flows will be affected.