RPD 10-K & 10-Q changes, risk factors and insider trading

•the timing and success of new product or service introductions by us or our competitors or any other changes in the competitive landscape of our industry, including consolidation among our competitors and initiatives that use artificial intelligence (“AI”);

•business disruptions in regions affecting our operations, stemming from actual, imminent or perceived outbreak or reemergence of contagious diseasediseases;

•the impact of climate change, natural disasters or manmade problems, including terrorism or war (such as the Russia- Ukraine war and the ongoing conflicts in the Middle East); and

Each factor above or discussed elsewhere herein or the cumulative effect of some of these factors may result in fluctuations in our operating results. This variability and unpredictability could result in our failure to meet expectations with respect to operating results, orincluding those of securities analysts or investors, for a particular period. If we fail to meet or exceed expectations for our operating results for these or any other reasons, the market price of our stock could fall and we could face costly lawsuits, including securities class action suits.

Our business and operations have experienced significant growth,growth in the past, and if we do not appropriately manage any future growth, or are unable to maintain and scale our infrastructure, systems and processes, our business and results of operations may be negatively affected. Although we have experienced rapid growth in the past, we cannot provide any assurance that our business will continue to grow at the same rate or at all.

From the year ended December 31, 20202021 to the year ended December 31, 2024,2025, our revenue grew from $411.5$535.4 million to $844.0$859.8 million and our headcount grew from 1,8472,353 to 2,4132,613 employees. Our future growth is dependent upon our ability to continue to meet the expanding needs of our customers and to attract new customers. Although we have experienced rapid growth historically,in the past, we cannot provide any assurance that our business will continue to grow at the same rate or at all.

We have not been profitable historically and may not maintain profitability in the future.

For the yearyears ended December 31, 2024,2025 and 2024 we have achieved net income of $23.4 million and $25.5 million.million, respectively. Prior to 2024, we had posted a net loss in each year since inception, including a net lossesloss of $152.8 million and $124.7 million infor the yearsyear ended December 31, 2023 and 2022, respectively.2023. As of December 31, 2024,2025, we had an accumulated deficit of $988.0$964.7 million. While we have experienced significant revenue growth in recentthe periodspast and achieved profitability, we may not obtain a high enough volume of sales of our products and service offerings to sustain or increase our growth or maintain profitability in the future. We also expect our costs to increase in future periods, which could negatively affect our future operating results if our revenue does not increase. In particular, we expect to continue to expend financial and other resources on:

Our subscription offerings are sold on a term basis. In order for us to improve our operating results, it is important that our existing customers renew their subscriptions with us when the existing subscription term expires, and renew on the same or more favorable terms. Our customers have no obligation to renew their subscriptions with us and we may not be able to accurately predict customer renewal rates. Our customers’ renewal rates may decline or fluctuate as a result of a number of factors, including their satisfaction or dissatisfaction with our new or current product offerings, our pricing, the effects of economic conditions, including due to a global economic slowdown, inflation, foreign currency exchange rate fluctuation, the Russia-Ukraine war, the ongoing conflicts in the Middle East and any global economic uncertainty and financial market disruptions, competitive offerings, our customers' perception of their exposure, or alterations or reductions in their spending levels. If our customers do not renew their agreements with us or renew on terms less favorable to us, our revenues and results of operations may be adversely impacted.

•real or perceived defect,defects, errors or failures;

•poor business conditions for our customers, causing them to delay IT purchases, including as a result of the COVID-19 pandemicpurchases; and

The market for SecOps solutions, including our Command Platform, is highly fragmented, intensely competitive and constantly evolving. We compete with an array of established and emerging security software and services vendors. With the introduction of new technologies and market entrants, we expect the competitive environment to remain intense going forward. The markets we operate in are highly competitive, fragmented, and subject to technology change and innovation. We primarily compete with established and emerging security product vendors, including the large companies that incorporate security products into their products;products, security platform providers, MDR service providers, XDR and SIEM vendors;vendors, cloud security vendors;vendors, exposure management vendors, vulnerability risk management vendors;vendors, application security vendors;vendors, threat intelligence vendors; and legacy security, systems management, MSSP, and other IT vendors.

Some of our actual and potential competitors have advantages over us, such as longer operating histories, significantly greater financial, technical, marketing or other resources, stronger brand and business user recognition, larger and more mature intellectual property portfolios and broader global distribution and presence. In addition, our industry is evolving rapidly and is becoming increasingly competitive. Larger and more established companies may focus on security operations and could directly compete with us. Smaller companies could also launch new products and services that we do not offer and that could gain market acceptance quickly.

Our competitors may be able to respond more quickly and effectively than we can to new or changing opportunities, technologies, standards or customer requirements. With the introduction of new technologies, the evolution of our offerings and new market entrants, we expect competition to intensify in the future. Conditions in our market could change rapidly and significantly as a result of technological advancements, including with respect to AI. Our competitors may more successfully incorporate AI into their products, gain or leverage superior access to certain AI technologies, and achieve higher market acceptance of their AI solutions. In addition, advancements in AI, automation, and related technologies may accelerate feature parity or commoditization of certain software capabilities across the industry, which could increase pricing pressure, reduce differentiation among offerings, or shorten product life cycles. For further discussion of the risks related to AI, please see below under “Risks Related to Intellectual Property, Litigation and Government Regulation”.

Furthermore, our current and potential competitors may establish cooperative relationships among themselves or with third parties that may further enhance their resources and product and services offerings in the markets we address. In addition, current or potential competitors may be acquired by third parties with greater available resources. As a result of such relationships and acquisitions, our current or potential competitors might be able to adapt more quickly to new technologies and customer needs, devote greater resources to the promotion or sale of their products and services, initiate or withstand substantial price competition, take advantage of other opportunities more readily or develop and expand their product and service offerings more quickly than we do. These competitive pressures in our market or our failure to compete effectively may result in price reductions, fewer orders, reduced renewals, reduced revenue and gross margins, and loss of market share. Any failure to address these factors could seriously harm our business and operating results.

We continue to be substantially dependent on our sales force to obtain new customers and increase sales with existing customers. Our ability to successfully pursue our growth strategy will also depend on our ability to attract, motivate and retain our personnel, especially those in sales, marketing and research and development. In addition, in recent years, recruiting, hiring and retaining employees with expertise in the cybersecurity industry has become increasingly difficult as the demand for cybersecurity professionals has increased as a result of the recent cybersecurity attacks on global corporations and governments. We face intense competition for these employees from numerous technology, software and other companies, especially in certain geographic areas in which we operate, and we cannot ensure that we will be able to attract, motivate and/or retain sufficient qualified employees in the future,future particularly in tight labor markets. In addition, the change by us and other companies to offer a remote or hybrid work environment may increase the competition for such employees from employers outside of our traditional office locations. Our workforce evolved to a hybrid-first model following the COVID-19 pandemic, which requires regular in-office attendance but utilizes a hybrid approach. While we intend to continue iterating our approach to ensure we are balancing the needs of the business with the desires of our people, we may face difficulty in hiring and retaining our workforce as a result of this shift to have greater in-office attendance. If we are unable to attract new employees and retain our current employees, we may not be able to adequately develop and maintain new products or service offerings or market our existing products or service offerings at the same levels as our competitors and we may, therefore, lose customers and market share. Our failure to attract and retain personnel, especially those in sales and marketing and research and development positions for which we have historically had a high turnover rate, could have an adverse effect on our ability to execute our business objectives and, as a result, our ability to compete could decrease, our operating results could suffer and our revenue could decrease. Even if we are able to identify and recruit a sufficient number of new hires, these new hires will require significant training before they achieve full productivity and they may not become productive as quickly as we would like or at all.

Our hybrid working model and use of service providers with remote working arrangements also subjectsubjects us to heightened operational risks. For example, technologies in our employees’ and service providers’ homes when they are working remotely may not be as robust as in our offices and could cause the networks, information systems, applications, and other tools available to employees and service providers to be more limited or less reliable than in our offices. Further, the security systems in place at our employees’ and service providers’ homes may be less secure than those used in our offices, and while we have implemented technical and administrative safeguards to help protect our systems as our employees and service providers work from home, we may be subject to increased cybersecurity risk, which could expose us to risks of data or financial loss, and could disrupt our business operations. There is no guarantee that the data security and privacy safeguards we have put in place will be completely effective or that we will not encounter risks associated with employees and service providers accessing company data and systems remotely.

We market and sell our products and service offerings throughout the world and have personnel in many parts of the world. For the years ended December 31, 2024,2025, 20232024 and 2022,2023, operations located outside of North America generated 24%,25%, 22%24% and 21%,22%, respectively, of our revenue. Our growth strategy is dependent, in part, on our continued international expansion. For example, in April 2025, we opened a new Global Capability Center in Pune, India, to serve as an innovation hub and SOC. We expect to conduct a significant amount of our business with organizations that are located outside the United States, particularly in Europe and Asia. We cannot assure you that our expansion efforts into international markets will be successful in creating further demand for our products and service offerings or in effectively selling our products and service offerings in the international markets that we enter. Our current international operations and future initiatives will involve a variety of risks, including:

•economic or political instability or uncertainty in foreign markets and around the worldworld, including in response to tariffs and retaliatory tariffs;

•increased exposure to climate change, natural disasters, acts of war (including the Russia-Ukraine war and the ongoing conflicts in the Middle East),war, terrorism, epidemics, or pandemics and other health crises; and

Achieving the anticipated benefits of past or future acquisitions will depend in part upon whether we can integrate acquired operations, products and technology in a timely and cost-effective manner and successfully market and sell these as new product offerings, or as new features within our existing offerings. For example, on July 3, 2024, we acquired Noetic Cyber, Inc. (“Noetic”), a provider of cyber attack surface management technology. The integration of any acquisition may prove to be difficult due to the necessity of coordinating geographically separate organizations and integrating personnel with disparate business backgrounds and accustomed to different corporate cultures and business operations and internal systems. We may need to implement or improve controls, procedures, and policies at a business that prior to the acquisition may have lacked sufficiently effective controls, procedures and policies. The acquisition and integration processes are complex, expensive and time consuming, and may cause an interruption of, or loss of momentum in, product development, sales activities and operations of both companies. Further, we may be unable to retain key personnel of an acquired company following the acquisition. If we are unable to effectively execute or integrate acquisitions, the anticipated benefits of such acquisition, including sales or growth opportunities or targeted synergies may not be realized, and our business, financial condition and operating results could be adversely affected.

Selling to government entities can be highly competitive, expensive and time consuming, and often requires significant upfront time and expense without any assurance that we will win a sale. Government demand and payment for our products and service offerings may also be impacted by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our offerings. Actual or threatened government shutdowns, continuing resolution, sequestration and other fiscal or budgetary disruptions may delay procurements, contract awards, renewals and payments, reduce spending on cybersecurity initiatives and otherwise adversely affect our public sector revenue and cash flows. Government entities also have heightened sensitivity surrounding the purchase of cybersecurity solutions due to the critical importance of their IT infrastructures, the nature of the information contained within those infrastructures and the fact that they are highly visiblehighly-visible targets for cyber attacks. For example, as the United States government has warned, the conflict in Ukraine andhas associatedled activitiesto inincreasingly Ukraine and Russia may increase the risk ofsophisticated cyberattacks on various types of infrastructure and operations, and the United States government has warned companies to be prepared for a significant increase in Russian cyberattacksoperations in response to the sanctions on Russia. Accordingly, increasing sales of our products and service offerings to government entities may be more challenging than selling to commercial organizations. Further, in the course of providing our products and service offerings to government entities, our employees and those of our channel partners may be exposed to sensitive government information. Any failure by us or our channel partners to safeguard and maintain the confidentiality of such information could subject us to liability and reputational harm, which could materially and adversely affect our results of operations and financial performance. Additionally, in the United States, federal government agencies may promulgate regulations, and the President may issue executive orders, requiring federal contractors to adhere to different or additional requirements after a contract is signed. If we do not meet applicable requirements of law or contract, we could be subject to significant liability from our customers or regulators.

There are significant risks involved in utilizing AI and no assurance can be provided that the usage of such AI will enhance our business or assist our business in being more efficient or profitable. Known risks of AI currently include accuracy, bias, toxicity, intellectual property infringement or misappropriation, data privacy and cybersecurity, and data provenance. In addition, AI may have errors or inadequacies that are not easily detectable. For example, certain AI may utilize historical data in its analytics. To the extent that such historical data is not indicative of the current or future conditions, or the AI fails to filter biases in the underlying data or collection methods, the usage of AI may lead us to make determinations on behalf of our business, recommendations to our clients, or developments to our products and services, in each case, that have an adverse effect on our business and financial results. AI may also be subject to data herding and interconnectedness (i.e., multiple market participants utilizing the same data), which may adversely impact our business. If the AI we utilize is incorrectly designed or utilizes training data that is overbroad, incomplete, inadequate or biased in some way, our use of AI may inadvertently reduce our efficiency or cause unintentional or unexpected outputs that are incorrect, do not match our business goals, do not comply with our policies or interfere with the performance of our products and services, business and reputation. In addition, employees may inadvertently input confidential, proprietary or personal information into unapproved AI tools, which could result in the loss of trade secrets, unauthorized disclosure of sensitive data, violations of privacy or confidentiality obligations, regulatory scrutiny, litigation or reputational harm.

Like other U.S.-based IT security products, our products are subject to U.S. export control and import laws and regulations, including the U.S. Export Administration Regulations and various economic and trade sanctions regulations administered by the U.S. Treasury Department’s Office of Foreign Assets Control. Exports of these products must be made in compliance with these laws and regulations. Although we take precautions to prevent our products from being provided in violation of these laws, our products could be provided inadvertently in violation of such laws, despite the precautions we take. Compliance with these laws and regulations is complex, and if we were to fail to comply with these laws and regulations, we and certain of our employees could be subject to substantial civil and criminal penalties, including fines for our company and responsible employees or managers, and, in extreme cases, incarceration of responsible employees and managers and the possible loss of export privileges. Complying with export control laws and regulations, including obtaining the necessary licenses or authorizations, for a particular sale may be time-consuming, is not guaranteed and may result in the delay or loss of sales opportunities. Changes in export or import laws and regulations, shifts in the enforcement or scope of existing laws and regulations, or changes in the countries, governments, persons, products or services targeted by such laws and regulations, could also result in decreased use of our products by, or in our decreased ability to export or sell our products to, existing or potential customers. For example, in response to the Russia-Ukraineconflict war,in Ukraine, countries and organizations such as Canada, the United Kingdom, the European Union, and the United States and other countries and organizations have implemented new and stricter sanctions and export controls against officials, individuals, regions, and industries in Russia, Ukraine and Belarus. Each country’s potential response to such sanctions, export controls, tensions, and military actions could damage or disrupt international commerce and the global economy and could have a material adverse effect on our business and results of operations or impact our ability to continue to operate in affected regions.

We are subject to U.S. federal, state, local and sales taxes in the United States and foreign income taxes, withholding taxes and transaction taxes in numerous foreign jurisdictions. We generally conduct our international operations through wholly-owned subsidiaries and report our taxable income in various jurisdictions worldwide based upon our business operations in those jurisdictions. Our intercompany relationships are and will continue to be subject to complex transfer pricing regulations administered by taxing authorities in various jurisdictions. Significant judgment is required in evaluating our tax positions and our worldwide provision for taxes. During the ordinary course of business, there are many activities and transactions for which the ultimate tax determination is uncertain and the relevant taxing authorities may disagree with our determinations as to the income and expenses attributable to specific jurisdictions. In addition, our tax obligations and effective tax rates could be adversely affected by changes in the relevant tax, accounting and other laws, regulations, principles and interpretations by recognizing tax losses or lower than anticipated earnings in jurisdictions where we have lower statutory rates and higher than anticipated earnings in jurisdictions where we have higher statutory rates, by changes in foreign currency exchange rates, or by changes in the valuation of our deferred tax assets and liabilities. We may be audited in various jurisdictions, and such jurisdictions may assess additional taxes, sales taxes, and value-added taxes against us. If we are unsuccessful in sustaining our tax positions, our financial condition and results of operations would be adversely affected. For example, during the quarter ended June 30, 2024, we received an initial assessment from the Israel Tax Authority of approximately 324 million Israeli New Shekels (approximately $88$102 million, based upon current exchange rates as of December 31, 2024 between the Israeli New Shekel and the US Dollar) in relation to the fiscal year 2021 operations of one of our subsidiaries in Israel. If we are unsuccessful in sustaining our tax position in this matter, our financial condition and results of operations will be adversely affected. See Note 16,15, Commitments and Contingencies, in the notes to the consolidated financial statements included in Part II, Item 8, of this Annual Report on Form 10-K for further information.

If our products or service offerings fail to detect vulnerabilities in our customers’ cybersecurity infrastructure, or if our products or service offerings fail to identify and respond to new and increasingly complex methods of cyber attacks, our business and reputation may suffer. There is no guarantee that our products or service offerings will detect all vulnerabilities and threats, especially in light of the rapidly changing security landscape to which we must respond, including the constantly evolving techniques used by attackers to access or sabotage data. For example, the conflict in Ukraine and associated activities in Ukraine and Russia may increase the risk of cyberattacks on various types of infrastructure and operations, and the United States government has warned companies to be prepared for a significant increase in Russian cyberattacks in response to the sanctions on Russia. If we fail to update our solutions in a timely or effective manner to respond to these threats, our customers could experience security breaches. Many federal, state and foreign governments have enacted laws requiring companies to notify individuals of data security breaches involving their personal data. These mandatory disclosures regarding a security breach often lead to widespread negative publicity, and any association of us with such publicity may cause our customers to lose confidence in the effectiveness of our solutions. An actual or perceived security breach or theft of sensitive data of one of our customers, regardless of whether the breach is attributable to the failure of our products or service offerings, could adversely affect the market’s perception of our offerings and subject us to legal claims.

Our products may also contain undetected errors or defects. Errors or defects may be more likely when a product is first introduced or as new versions are released, or when we introduce an acquired company's products. We have experienced these errors or defects in the past in connection with new products, acquired products and product upgrades and we expect that these errors or defects will be found from time to time in the future in new, acquired or enhanced products after commercial release. Defects may cause our products to be vulnerable to attacks, cause them to fail to detect vulnerabilities or threats, or temporarily interrupt customers’ networking traffic. Any errors, defects, disruptions in service or other performance problems with our products may damage our customers’ businesses and could hurt our reputation. If our products or service offerings fail to detect vulnerabilities or threats for any reason, we may incur significant costs, the attention of our key personnel could be diverted, our customers may delay or withhold payment to us or elect not to renew or other significant customer relations problems may arise. We may also be subject to liability claims for damages related to errors or defects in our products. A material liability claim or other occurrence that harms our reputation or decreases market acceptance of our products may harm our business and operating results. Limitation of liability provisions in our standard terms and conditions and our other agreements may not adequately or effectively protect us from any claims related to errors or defects in our solutions, including as a result of federal, state or local laws or ordinances or unfavorable judicial decisions in the United States or other countries.

We utilize third-party data centers located in North America, Europe, Australia and Asia, in addition to operating and maintaining certain elements of our own network infrastructure. Some elements of our complex infrastructure are operated by third parties that we do not control and that could require significant time to replace. We expect this dependence on third parties to continue. More specifically, certain of our products, in particular our cloud-based products, are hosted on cloud providers,providers such as Amazon Web Services, which provides us with computing and storage capacity. Interruptions in our systems or the third-party systems on which we rely, whether due to system failures, computer viruses, physical or electronic break-ins, or other factors, could affect the security or availability of our products, network infrastructure and website.

Computer malware, ransomware, cyber viruses, social engineering (phishing attacks), supply-chain attacks, denial of service or other attacks, employee theft or misuse and increasingly sophisticated network attacks have become more prevalent in our industry, particularly against cloud services. In particular, ransomware attacks, including by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, loss of data and income, reputational harm, and diversion of funds. While extortion payments may alleviate the negative impact of a ransomware attack, we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Similarly, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our information technology systems (including our products) or the third-party information technology systems that support us and our services. Such attacks may also include exploitation of vulnerabilities in third-partythird party or open source software code that may be incorporated into our own or our customers’ or supplier’s systems. Further, if our systems or those of our third-party service providers are breached as a result of third-party action, employee error or misconduct, attackers could learn critical information about how our products operate to help protect our customers’ IT infrastructures from cyber risk, thereby making our customers more vulnerable to cyber attacks. Additionally, the unauthorized use or misuse of AI by our employees or others may result in the release of customer data to unauthorized parties. While we maintain measures designed to protect the integrity, confidentiality and security of our data, our security measures could fail and those of our third-party service providers have failed and could fail, any of which could result in unauthorized access to or disclosure, modification, misuse, loss or destruction of such data or financial loss.

We, and our customers, are subject to a number of stringent and changing obligations in domestic and international laws, regulations, guidance, industry standards, external and internal policies and contracts and other obligations that address a range of issues including data privacy and cybersecurity, and restrictions or technological requirements regarding the collection, use, storage, protection, retention or transfer of data. The regulatory framework for online services, data privacy and cybersecurity issues worldwide can vary substantially from jurisdiction to jurisdiction, is rapidly evolving and is likely to remain uncertain for the foreseeable future. This creates some uncertainty as to the effective legal frameworks and our obligations may be subject to differing applications and interpretations, which may be inconsistent or in conflict among jurisdictions. Preparation for and compliance with these obligations requirerequires us to devote significant resources (including, without limitation, financial and time-related resources). These obligations may necessitate changes to our business including our information technologies, systems and practices and to those of any third parties that process personal data on our behalf. Although we strive to comply with all applicable data privacy and security obligations, we may at times fail (or be perceived to have failed) to do so. Moreover, despite our efforts, our personnel or third parties upon whom we rely may fail to comply with such obligations. If we (or third parties upon whom we rely) fail, or are perceived to have failed, to address and comply with data privacy and security obligations, we could face significant consequences. These consequences may include but are not limited to: government enforcement actions (e.g., investigations, fines, penalties, audits, inspections and similar consequences); litigation (including class-related claims); additional reporting requirements and oversight; bans on processing personal data; orders to destroy and not to use personal data; and imprisonment of company officials. Any of these events could have a material adverse effect on our reputation and our business, and financial condition, including but not limited to: loss of customers; interruptions or stoppages in our business or operations; inability to process personal data; inability to operate in specific jurisdictions; limitations in our ability to develop our products and service offerings; management's time and other resource expenditures; adverse publicity; and revisions to our operations.

In addition, certain jurisdictions have enacted data localization laws and cross-border personal data transfer laws. For example, the European Data Protection Laws impose strict rules on the transfer of personal data from the EEA, the UK and Switzerland (collectively, “Europe”), to so-called third countries, including the United States, unless the parties to the transfer have implemented specific safeguards to protect the transferred personal data. Although there are legal mechanisms to allow for the transfer of personal data from Europe to the United States, uncertainty remains about compliance and such mechanisms may not be available or applicable with respect to our personal data processing activities. For example, the “Standard Contractual Clauses” (“SCCs”) that are designed to be a valid mechanism by which parties can transfer personal data out of Europe to jurisdictions that are not found to provide an adequate level of protection, must be assessed on a case-by-case basis,basis taking into account the legal regime applicable in the destination country. Specifically, the parties to the cross-border personal data transfer must evaluate the importing jurisdiction’s laws and implement supplemental security measures as necessary to protect the at-issue personal data. Additionally, in July 2023, the European Commission adopted an adequacy decision concluding that the United States ensures an adequate level of protection for personal data transferred from Europe under the EU-U.S. Data Privacy Framework (followed on October 2023 with the adoption of an adequacy decision in the UK for the UK-U.S. Data Bridge). However, such adequacy decisions do not foreclose, and are likely to face, future legal challenges, and it is likely that there will continue to be some uncertainty regarding the mechanisms by which parties transfer personal data out of Europe to jurisdictions such as the United States. If we cannot implement and maintain a valid mechanism for cross-border personal data transfers, we may face increased exposure to regulatory actions, substantial fines and injunctions against processing (including prohibitions on transferring personal data out of the EU and UK). This may also reduce demand for our services from companies subject to European Data Protection Laws. Loss of our ability to import personal data from Europe may also require us to increase our data processing capabilities in Europe at significant expense.

Moreover, while we strive to publish and prominently display privacy policies that are accurate, comprehensive, and compliant with applicable laws, rulesrules, regulations and industry standards, we cannot ensure that our privacy policies and other statements regarding our practices will be sufficient to protect us from claims, proceedings, liability or adverse publicity relating to data privacy and security. Although we endeavor to comply with our privacy policies, we may at times fail to do so or be alleged to have failed to do so. If our public statements about our use, collection, disclosure and other processing of personal information, whether made through our privacy policies, information provided on our website, press statements or otherwise, are alleged to be deceptive, unfair or misrepresentative of our actual practices, we may be subject to potential government or legal investigation or action, including by the Federal Trade Commission or applicable state attorneys general.

Some organizations have been reluctant to use cloud solutions for cybersecurity, such as our InsightVM,vulnerability InsightIDR,management, InsightAppSec,next-generation InsightConnect,SIEM, InsightCloudSecapplication security, SOAR, cloud security and Threatthreat Intelligence,intelligence offerings, because they have concerns regarding the risks associated with the reliability or security of the technology delivery model associated with thisthese solution.solutions. If we or other cloud service providers experience security incidents, breaches of customer data, disruptions in service delivery or other problems, the market for cloud solutions as a whole may be negatively impacted, which could harm our business.

In the future, we may sell additional shares of our common stock or equity-linked securities to raise capital. In addition, a substantial number of shares of our common stock is reserved for issuance upon the exercise of stock options, settlement of other equity incentive awards and upon conversion of the 2025 Notes, 2027 Notes and 2029 Notes (the “Notes”). The indentures for the Notes do not restrict our ability to issue additional common stock or equity-linked securities in the future. We cannot predict the size of future issuances or the effect, if any, that they may have on the market price for our common stock. The issuance and sale of substantial amounts of common stock or equity-linked securities, or the perception that such issuances and sales may occur, could adversely affect the trading price of the Notes and the market price of our common stock and impair our ability to raise capital through the sale of additional equity or equity-linked securities.

In May 2020, we issued $230.0 million aggregate principal amount of 2025 Notes, in March 2021, we issued $600.0 million aggregate principal amount of 2027 Notes and in September 2023, we issued $300.0 million aggregate principal amount of 2029 Notes. In September 2023, concurrently with the issuance of the 2029 Notes, we used $201.0 million of the proceeds from the issuance of the 2029 Notes to repurchase and retire $184.0 million aggregate principal amount of the 2025 Notes. In addition, we may also incur indebtedness under our revolving credit facility. Our indebtedness may:

Further, the indentures governing the Notes do not restrict our ability to incur additional indebtedness, secure existing or future debt, recapitalize our existing or future debt or take a number of other actions that could intensify the risks discussed above and below. Further, we and our subsidiaries may incur substantial additional indebtedness in the future (some of which may be secured indebtedness),future, subject to the restrictions contained in our revolving credit facility and any future debt instruments existing at the time.time, some of which may be secured indebtedness. While our revolving credit facility restricts our ability to incur additional indebtedness, if our revolving credit facility is terminated, we may not be subject to such restrictions.

In the event the conditional conversion feature of the Notes is triggered, holders of the Notes will be entitled to convert their Notes at any time during specified periods at their option. If one or more holders elect to convert their Notes, unless we elect to satisfy our conversion obligation by delivering solely shares of our common stock (other than paying cash in lieu of delivering any fractional share), we would be required to settle a portion or all of our conversion obligation in cash, which could adversely affect our liquidity. As of December 31, 2024,2025, the 2027 Notes and the 2029 Notes were not convertible at the option of the holders. The 2025 Notes became convertible at the option of the holders effective November 1, 2024.holder. Whether the 2027 Notes or the 2029 Notes will be convertible following the year ended December 31, 20242025, will depend on the future satisfaction of a conversion condition. In addition, even if holders of Notes do not elect to convert their Notes, we could be required under applicable accounting rules to reclassify all or a portion of the outstanding principal of the Notes as a current rather than long-term liability, which would result in a material reduction of our net working capital.

In connection with the issuance of the 2025 Notes, the 2027 Notes and the 2029 Notes, weWe entered into capped call transactions with certain counterparties in connection with the issuance of the 2025 Notes (the “2025 Capped Calls”), the 2027 Notes (the “2027 Capped Calls”), and the 2029 Notes (the “2029 Capped Calls” and, together with the 2025 Capped Calls and the 2027 Capped Calls, the “Capped Calls”). The Capped Calls cover, subject to customary adjustments, the number of shares of our common stock initially underlying each of the 2025 Notes, the 2027 Notes and the 2029 Notes. The Capped Calls are expected to offset the potential dilution as a result of conversion of such Notes. In connection with establishing their initial hedge of the capped call transactions, the counterparties or their respective affiliates entered into various derivative transactions with respect to our common stock concurrently with or shortly after the pricings of the respective Notes, including with certain investors in the applicable Notes. The counterparties and/or or their respective affiliates may modify or unwind their hedge positions by entering into or unwinding various derivatives with respect to our common stock and/or purchasing or selling our common stock or other securities of ours in secondary market transactions prior to the maturity of the applicable Notes (and are likely to do so on each exercise date of the capped call transactions, which are scheduled to occur during the applicable observation period relating to any conversion of the 2025 Notes on or after November 1, 2024, relating to any conversion of the 2027 Notes on or after December 15, 2026 or relating to any conversion of the 2029 Notes on or after December 15, 2028, in each case that is not in connection with a redemption). The 2025 Capped Calls expired in full on April 29, 2025. We did not elect to exercise any portion of the 2025 Capped Calls prior to expiration. We cannot make any prediction as to the direction or magnitude of any potential effect that the transactions described above may have on the prices of the Notes or the shares of our common stock. Any of these activities could adversely affect the value of the Notes and our common stock.

The conversion of some or all of the Notes will dilute the ownership interests of existing stockholders to the extent we deliver shares of our common stock upon conversion of any of the Notes. As disclosed in Note 11,10, Debt, as of December 31, 2024,2025 the 2027 Notes and the 2029 Notes were not convertible at the option of the holder. Any sales in the public market of the common stock issuable upon such conversion could adversely affect prevailing market prices of our common stock. In addition, the existence of the Notes may encourage short selling by market participants because the conversion of the Notes could be used to satisfy short positions, or anticipated conversion of the Notes into shares of our common stock could depress the price of our common stock.

Our business is subject to regulation by various federal, state, local and foreign governments. In certain jurisdictions, these regulatory requirements may be more stringent than those in the United States. These laws and regulations may also impact our innovation and business drivers in developing new and emerging technologies, including those related to AI and machine learning.AI. Noncompliance with applicable regulations or requirements could subject us to investigations, sanctions, mandatory product recalls, enforcement actions, disgorgement of profits, fines, damages, civil and criminal penalties, injunctions or other collateral consequences. If any governmental sanctions are imposed, or if we do not prevail in any possible civil or criminal litigation, our business, results of operations, and financial condition could be materially adversely affected. In addition, responding to any action will likely result in a significant diversion of management’s attention and resources and an increase in professional fees. Enforcement actions and sanctions could harm our business, reputation, results of operations and financial condition.

Rapid7 is a global cybersecurity software and service provider on a mission to create a safer digital world by making cybersecurity simpler and more accessible. For more than twenty years, Rapid7 has partnered with customersenterprises across the globe representing a diverse range of industries and sizes to improve the efficacy and productivity of their security operations (“SecOps”). In today's rapidly evolving IT environment, customers are encountering escalating challenges due to the widening spectrum of attackers and techniques, including the proliferation of cyberattacks leveraging artificial intelligence (“AI”) and targeted automation. We empower security professionals to manage a modern attack surface through our best-in-classtrusted AI infused technology, leading-edge research, and broad, strategic expertise. Rapid7’s comprehensive security solutions help our global customers unite exposure management with threat detection and response to reduce attack surfaces and eliminate threats with speed and precision.

ThroughOur ourCommand securityPlatform operations platform,is anchored on our cloud security, security information and event management (“SIEM”), advanced detection and response, and vulnerability management offerings, we believe that Rapid7 is poised to expand the capabilities of today's SecOps teams.offerings. Rapid7 enables the Security Operations Center (“SOC”) to understand their fragmented attack surface with attacker perspective, allowing them to proactively secure their attack surface and better detect and respond to threats. Enriched by years of managed services expertise, our integrated security operations platform enables SecOps teams to move away from a reactive approach, reduce their attack surface, and enhance response efficiency with a deep contextual understanding of their environment.

•Cloud-based subscriptions, which provide our software capabilities to our customers through cloud access and on a subscription basis. Our InsightIDR,Incident InsightCloudSec,Command, InsightVM,Exposure InsightAppSec, InsightConnectCommand, and Threat Command products are offered as cloud-based subscriptions, with an option for a one or multi-year term.

•Licensed on-premise software, whichsoftware consists of term licenses. When licensed on-premise software is purchased, maintenance and support and content subscriptions, as applicable, are bundled with the license for the term period. Our Nexpose and Metasploit products are offered through term software licenses with an option for one or multi-year terms. Our maintenance and support provides our customers with telephone and web-based support and ongoing bug fixes and repairs during the term of the maintenance and support agreement, and our customers who purchase our Nexpose and Metasploit products also purchase content subscriptions, which provide them with real-time access to the latest vulnerabilities and exploits.

InFor the years ended December 31, 2024,2025, 20232024 and 2022,2023, recurring revenue, defined as revenue from term software licenses, content subscriptions, managed services, cloud-based subscriptions and maintenance and support, was 96%, 95%96%, and 94%,95% respectively, of total revenue.

During the fourth quarter of 2024, we identified an immaterial error related to stock-based compensation expense associated with certain restricted stock units (“RSUs”) and performance stock units (“PSUs”) granted during fiscal years 2023 and 2024 attributable to an improper valuation of the underlying awards, resulting in an understatement of stock-based compensation expense in 2023 and 2024. In accordance with Staff Accounting Bulletin (“SAB”) No. 99, Materiality, and SAB No. 108, Considering the Effects of Prior Year Misstatements when Quantifying Misstatements in Current Year Financial Statements, we evaluated the errors and determined that the related impactimpacts waswere not material to our consolidated financial statements for the prior periods when they occurred, but that correcting the cumulative errors in the period detected would have been material to our results of operations orfor that period. Accordingly, we revised previously reported comparative financial positioninformation presented herein for anysuch historicalimmaterial annual or interim period. As a result, we are correcting the errors by adjusting prior period financial statements in certain of the periods shown below.errors. Refer to Note 20,19, Immaterial Correction of an Error, in the notes to our Consolidatedconsolidated Financialfinancial Statementsstatements for further information.

We expect our cost of revenue to increase on an absolute dollar basis as we continue to grow our revenue.revenue over time.

Operating expenses consist of research and development, sales and marketing, general and administrative expenses, impairment of long-lived assets, and restructuring.restructuring costs. Operating expenses include overhead costs for depreciation, facilities, IT, information security and recruiting. Our IT overhead costs include IT personnel compensation costs and costs associated with our IT infrastructure. All overhead costs are allocated based on relative headcount. In the near term, we expect our operating expenses to increase as a percentage of revenue as we prioritize investments to drive growth.

Sales and marketing expense consists of personnel costs for our sales and marketing team, including salaries and other payroll related costs, commissions, including amortization of capitalizeddeferred commissions, bonuses and stock-based compensation. Additional expenses include marketing activities and promotional events, travel and entertainment, training costs, amortization of certain intangible assets and allocated overhead costs.

Interest expense consists primarily of contractual interest expense, amortization of debt issuance costs related to our convertible senior notes and our former revolving credit facility,facility and induced conversion expense. We expect interest expense in the near term to represent contractual interest expense and amortization of debt issuance costs related to our convertible senior notes.

Provision for (Benefit) from)for Income Taxes

Provision (Benefit) for (benefit from) income taxes consists of domestic and foreign taxes on income and withholding taxes. We maintain a substantially full valuation allowance for domestic and certain foreign deferred tax assets, including net operating loss carryforwards and tax credits. We determined as of December 31, 20242025 that it was more likely than not that these deferred tax assets will not be realized. However, we may release some of these valuation allowances in future periods if objective negative evidence of cumulative losses is no longer present and positive evidence, such as projection of sustained future growth, supports the realization of such deferred tax assets. Release of all or a portion of these valuation allowances would result in a decrease in the provision for income taxes in the period of the release. See Note 14, Income Taxes, in the accompanying consolidated financial statements for more information.

(1) Cost of revenue and operating expenses include stock-based compensation expense and depreciation and amortization expense as follows (in thousands):

Comparison of the YearYears Ended December 31, 20242025 and 20232024

TotalThe increase in total cost of revenue increasedfor bythe $19.0year millionended December 31, 2025 as compared to the same period in 2024 compared to 2023,was primarily duedriven toby a $21.7 millionan increase in cloud computing costs relatedof to$5.2 growing cloud-based subscription and managed services revenue,million and a $3.5$3.0 million increase in amortization expense for capitalized internally-developed software.software, Thesesoftware increasessubscriptions wereof $0.7 million, and royalties of $0.3 million. The increase was partially offset by a $5.4 million decrease in personnel costs resultingof from$5.8 million, driven by a decreaseshift in headcountthe nature of certain roles and responsibilities between product delivery and sales support functions of approximately $13.0 million, partially offset by an increase of $7.2 million in personnel costs primarily duerelated to ourexpanding Restructuring PlanD&R and amanaged $0.8product million decrease in other expenses.support.

General and administrative expenseexpenses increaseddecreased byfor $0.7the millionyear inended 2024December 31, 2025 as compared to 2023,the same period in 2024, primarily duedriven toby a $1.2decrease in hosting expenses of $1.8 million increaseassociated with enterprise softwares and cloud computing costs, a decrease in professional fees of $0.9 million from investor related to legalexpenses, and corporatea advisorydecrease services,in office related expenses of $0.9 million partially offset by aan $0.5 million decreaseincrease in otherpersonnel expenses.costs of $1.6 million.

ComparisonInterest ofexpense remained consistent in the Yearyear Endedended December 31, 20232025 andcompared 2022to the same period in 2024.

There have been no material changes to the risk factors disclosed in Part I, Item 1A. “Risk Factors” of our Annual Report on Form 10-K for the year ended December 31, 2025, filed with the Securities and Exchange Commission (the “SEC”) on February,February 19, 2026 (the “Annual Report”). Our operations and financial results are subject to various risks and uncertainties that, if they materialize, could adversely affect our business, financial condition and results of operations. In that event, the trading price of our common stock could decline. In addition to the other information set forth in this Quarterly Report on Form 10-Q, you should carefully consider the factors described in Part I, Item 1A. “Risk Factors” of our Annual Report. We may disclose additional changes to risk factors or disclose additional factors from time to time in our future filings with the SEC. Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, may also become important factors that adversely affect our business.

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with (1) our unaudited condensed consolidated financial statements and related notes appearing elsewhere in this Quarterly Report on Form 10-Q and (2) the audited consolidated financial statements and the related notes and Management’s Discussion and Analysis of Financial Condition and Results of Operations for the fiscal year ended December 31, 2025 included in our Annual Report on Form 10-K, filed with the SEC on February,February 19, 2026. Forward-looking statements in this review are qualified by the cautionary statement included under the next sub-heading, “Special Note Regarding Forward-Looking Statements”.

• our ability to capitalize on customer demand for consolidated security platforms and vendor consolidation trends, including outour ability to deliver an integrated, open security operations platform;

We market and sell our products and professional services to organizations of all sizes globally, including mid-market businesses, enterprises, non-profits, educational institutions and government agencies. Our customers span a wide variety of industries such as technology, energy, financial services, healthcare and life sciences, manufacturing, media and entertainment, retail, education, real estate, transportation, government and professional services. As of MarchJune 31,30, 2026, we had over 11,500 customers in 150149 countries, including 35%34% of the Fortune 100. Our revenue was not concentrated with any individual customer and no customer represented more than 1% of our revenue for the three and six months ended MarchJune 31,30, 2026 and 2025.

For each of the three and six months ended MarchJune 31,30, 2026 and 2025, recurring revenue, defined as revenue from term software licenses, content subscriptions, managed services, cloud-based subscriptions and maintenance and support, was 97% and 96%, respectively, of total revenue.

We expect our cost of revenue to increasefluctuate on an absolute dollar basis as we continue to grow our revenue over time.

Operating expenses consist of research and development, sales and marketing, general and administrative expenses, impairment of long-lived assets, and restructuring costs. Operating expenses include overhead costs for depreciation, facilities, IT, information security and recruiting. Our IT overhead costs include IT personnel compensation costs and costs associated with our IT infrastructure. All overhead costs are allocated based on relative headcount. In the near term, we expectare taking restructuring actions that are expected to reduce the absolute amount of our operating expenses while continuing to increase as a percentage of revenue as we prioritize investments to drive growth.

Provision for income taxes consists of domestic and foreign taxes on income and withholding taxes. We maintain a substantially full valuation allowance for domestic and certain foreign deferred tax assets, including net operating loss carryforwards and tax credits. We determined as of MarchJune 31,30, 2026 that it was more likely than not that these deferred tax assets will not be realized. However, we may release some of these valuation allowances in future periods if positive evidence, such as projection of sustained future growth,profitability, supports the realization of such deferred tax assets. Release of all or a portion of these valuation allowances would result in a decrease in the provision for income taxes in the period of the release.

Comparison of the Three and Six Months Ended MarchJune 31,30, 2026 and 2025

General and administrative expenses decreased for the threesix months ended MarchJune 31,30, 2026 as compared towith the samecorresponding period in 2025, primarily driven by a $5.8 million decrease of $3.2 millionin personnel costs, which included a $2.6$5.3 million decrease in stock-based compensation expense due to fewer awards granted and more recent grants valued at a lower grant price.price and fewer awards granted. Additionally, professional fees decreased by $1.7$2.7 million, primarily related to certainlegal consultingand accounting services, and a $1.2$0.9 million decrease in bad debt expense. The decrease was partially offset by an increase in hosting expenses of $0.6$0.8 million associated with enterprise software and cloud computing costs and $0.5 million of acquisition-related expenses associated with our acquisition of Kenzo.costs.

Interest income slightly decreased for the threesix months ended MarchJune 31,30, 2026 compared towith the samecorresponding period in 2025, primarily duedriven toby lower investment balances partially offset by interest income generated from higher cash and investmentcash equivalent balances this year compared to the prior year.

Interest expense slightly decreased inby $0.3 million for the threesix months ended MarchJune 31,30, 2026 compared towith the samecorresponding period in 2025 primarily because the prior-year period included interest on the 2025 Notes prior to their maturity in May 2025.

Other (expense) income, net decreased for the threesix months ended MarchJune 31,30, 2026 compared towith the samecorresponding period in 2025 primarily due to realized and unrealized losses on foreign currency transactions resultingprimarily related to transactions in anthe increaseBritish inPound unrealizedSterling, lossesthe Euro, and the Israeli Shekel during the six months ended June 30, 2026 as compared to unrealized gains in comparative periods primarily related to the Britishsame Poundperiod Sterlingin and Euro.2025.

Provision(Benefit) provision for income taxes

Provision for income taxes decreased for the threesix months ended MarchJune 31,30, 2026 compared towith the samecorresponding period in 2025. The decrease was primarily driven by a one-time$3.2 million net favorable change in foreign provisions primarily from foreign return to provision adjustments, $0.6 million discrete tax benefit infrom the firstKenzo quarter of 2026 for $0.6 million related to the acquisition of Kenzoacquisition, and ana increaselower todomestic tax expense in the first quarter of 2025 for $1.1 million relateddue to an unfavorable international return-to-provision expense of $1.1 million.OBBBA.

•Stock-based compensation expense. We exclude stock-based compensation expense because of varying available valuation methodologies, subjective assumptions and the variety of equity instruments that can impact our non-cash expense. We believe that providing non-GAAP financial measures that exclude stock-based compensation expense allows for more meaningful comparisons between our operating results from period to period.

The following tables reconcile GAAP gross profit to non-GAAP gross profit for the three and six months ended MarchJune 31,30, 2026 and 2025 (in thousands):

The following table reconciles GAAP lossincome from operations to non-GAAP income from operations for the three and six months ended MarchJune 31,30, 2026 and 2025 (in thousands):

(1) For the three and six months ended MarchJune 31,30, 2026 and 2025, acquisition-related expenses included $0.1 million and $0.2 million and $0.7 million and $0.4 million, respectively, of accretion expense related to contingent consideration recorded in connection with our July 2024 acquisition of Noetic.

The following table reconciles GAAP net income to non-GAAP net income for the three and six months ended MarchJune 31,30, 2026 and 2025 (in thousands):

(1) We use the if-converted method to compute diluted earnings per share with respect to our Notes. There was no add-back of interest expense or additional dilutive shares related to the Notes where the effect was anti-dilutive. On an if converted basis, for the three and six months ended MarchJune 31,30, 2026, the 2029 Notes and 2027 Notes were dilutive, for the threesix months ended MarchJune 31,30, 2025 the 2029 Notes, 2027 Notes and 2025 Notes were dilutive.

The following table reconciles GAAP net income to adjusted EBITDA for the three and six months ended MarchJune 31,30, 2026 and 2025 (in thousands):

The following table reconciles net cash provided by operating activities to free cash flow for the three and six months ended MarchJune 31,30, 2026 and 2025 (in thousands):

As of MarchJune 31,30, 2026, we had $343.3$425.6 million in cash and cash equivalents, $327.0$277.0 million in investments that have maturities ranging from one to eleveneight months and an accumulated deficit of $963.5$957.5 million. Our principal sources of liquidity are cash and cash equivalents, investments, cash flow provided by operating activities and our Credit Agreement. To date, we have financed our operations primarily through private and public equity financings, issuance of convertible senior notes and through cash generated by operating activities.

On June 25, 20252025, we entered into a credit agreement (the "Credit Agreement") that establishes a senior secured revolving credit facility and provides for borrowings in an aggregate principal amount of up to $200 million (the “Revolving Facility”, the loans thereunder, the “Revolving Loans” and the commitments thereunder, the “Revolving Commitments”).The. The Credit Agreement allows for incremental facilities up to the greater of $141 million or 75% of Consolidated EBITDA (as defined in the Credit Agreement). Additional incremental facilities may be incurred, subject to certain conditions. The proceeds of the Revolving Facility can be used to finance working capital needs, capital expenditures, permitted acquisitions and other general corporate purposes. As of MarchJune 31,30, 2026, we were in compliance with all applicable covenants and had sufficient capacity under the affirmative covenants. Refer to Note 9, Debt, for additional information related to the credit agreement.

We believe that our existing cash and cash equivalents, our investments, our cash generated by operating activities and our available borrowings under our Credit Agreement will be sufficient to meet our operating and capital requirements for at least the next 12 months. Our foreseeable cash needs, in addition to our recurring operating expenses, include our expected capital expenditures to support expansion of our infrastructure and workforce, office facilities lease obligations, purchase commitments, including our cloud infrastructure services, potential future acquisitions of technology businesses andbusinesses, any election we make to redeem our convertible senior notes.notes, and the repayment of the $600 million 2027 Notes . Further, in January 2025, we entered into a cloud-services agreement with a cloud services provider that contains minimum spend commitments. The agreement provides for an annual commitment of $125.0 million per year over the next five years, with an additional $35.0 million obligation over the five-year period of the agreement, for an aggregate total commitment of $660.0 million. As a result of the repayment of the 2027 Notes, we expect a reduction to cash received from interest income. For more information regarding this commitment, see Note 15, Commitments and Contingencies, in the Notes to our consolidated financial statements on Form 10-K for the year ended December 31, 2025, filed with the SEC on February,February 19, 2026 . In preparation for the repayment of the 2027 Notes, due on March 15, 2027, we implemented the following measures:

The following table shows a summary of our cash flows for the threesix months ended MarchJune 31,30, 2026 and 2025 (in thousands):

Operating activities provided $39.8$76.8 million of cash and cash equivalents for the threesix months ended MarchJune 31,30, 2026, which reflects theour ability to generate cash generating ability offrom our operations. Cash provided by operating activities was primarily driven by a net income of $1.1$7.2 million in addition to significant beneficial adjustments to reconcile net income to net cash provided from operating activities including $19.9$39.7 million in stock-based compensation, $11.2$22.4 million of depreciation,depreciation from our fixed assets, and amortization, primarily from our internally-developed software and acquired intangibles. Additionally, working capital contributed an additional $6.3$7.2 million of cash to operating activities primarily driven by significantincrease to operating cash flow from accounts receivable collections of $31.4$25.2 million, partially offset by decreases in deferred revenue of $19.6 million and accrued expenses of $14.8$8.3 million and $11.1 million of deferred revenue.million.

Operating activities provided $29.8$77.3 million of cash and cash equivalents for the threesix months ended MarchJune 31,30, 2025, which reflectsdemonstrates continuedour growthability into revenuegenerate cash from our operations partially offset by our continued investments in our operations and the timing of working capital adjustments. Cash provided by operating activities reflected our net income of $2.1$10.4 million and a decrease in our net operating assets and liabilities of $11.0$8.3 million, offset by non-cash charges of $38.7$75.1 million related primarily to depreciation and amortization, stock-based compensation expense, amortization of debt issuance costs and other non-cash charges. The change in our net operating assets and liabilities was primarily due to a $20.3$13.2 million decrease in accrued expenses, a $12.9$12.3 million decrease in deferred revenue, a $2.0$5.8 million increase in prepaid expenses, a $2.2$1.2 million decrease in other liabilities and a $6.6$3.0 million decrease in accounts payable, which each had a negative impact on operating cash flow. These factors were offset by a $27.7 million decrease in accounts receivable and a $5.3 million decrease in deferred contract acquisition and fulfillment costs, which each had a positive impact on operating cash flow.

Investing activities provided $55.3$100.1 million of cash for the threesix months ended MarchJune 31,30, 2026, primarily driven by $85.0$135.0 million of investment maturities, which was partially offset by $23.3 million in cash paid, net of cash acquired, in the acquisition of Kenzo to further strengthstrengthen our AI SOC capabilities and $4.3$8.2 million in capitalized internal-use software costs as we continue to invest and develop our product offering.