SAIL 10-K & 10-Q changes, risk factors and insider trading

The nature of the business activities conducted by the Company subjects it to certain hazards and risks. A description of some of the material risksrisk relatingfactors tothat make an investment in the Company’sCompany businessspeculative activitiesor risky is set forth below. OtherSuch description reflects the Company's beliefs and opinions as to factors that could materially harm the Company's business, financial condition, or results of operations and impair the Company's ability to implement business plans. References to past events are provided by way of example only and are not intended to be a complete listing or a representation as to whether or not such factors have occurred in the past or their likelihood of occurring in the future. In addition, other risks are described in Part I, Item 1. “Business—Competition,” Part II, Item 7. “Management’s Discussion and Analysis of Financial Condition and Results of Operations.—Liquidity and Capital Resources” and Part II, Item 7A. “Quantitative and Qualitative Disclosures About Market Risk.” These risks and those described below are not the only risks facing the Company. The Company’s business could also be affected by additional risks and uncertainties not currently known to the Company or that it currently deems to be immaterial. If any of these risks actually occurs, it could materially harm the Company’s business, financial condition or results of operations and impair the Company’s ability to implement business plans. In that case, the market price of the Company’s common stock could decline.

We have experienced rapid growth in recent years. Our revenue grew from $365.3$699.6 million to $793.9$1.1 millionbillion from the fiscal year ended DecemberJanuary 31, 20202024 to the fiscal year ended January 31, 2025.2026. Our revenue growth may not continue at a level consistent with historical performance. We believe our revenue growth depends on a number of factors, including, but not limited to:

We believe our future success will depend in large part on the growth, if any, in the market for identity security solutions. The market for identity security solutions, including our platform and identity security solutions, is rapidly evolving. Rapid advancement in AI technologies and capabilities further add to this state of evolution. As such, it is difficult to predict this market’s potential growth, if any, customer adoption and retention rates, customer demand for identity security platforms, or the success of competitive products. Any expansion in this market depends on a number of factors, including the cost, performance, and perceived value associated with our platform and identity security solutions and similar solutions of our competitors, including preference to manage security with existing infrastructure security tools alone, rather than investing in a platform-based identity security solution. The markets for some of our solutions are new, unproven, and evolving, and our future success depends on growth and expansion of these markets. If our platform and identity security solutions do not achieve widespread adoption or there is a reduction in demand for our platform and identity security solutions due to a lack of customer acceptance, technological challenges, competing products or solutions, privacy concerns, decreases in corporate spending, weakening economic conditions or otherwise, it could result in early terminations, reduced customer retention rates, or decreased revenue, any of which would adversely affect our business, financial condition, and results of operations.

•foreign exchange gains and losses related to expenses and sales (including operating metrics such as ARR) denominated in currencies other than the U.S. dollar or the functional currencies of our subsidiaries;

We face intense competition in our market, both from larger, well-established companies and from emerging companies,companies and technologies, and we may lack sufficient financial and other resources to maintain and improve our competitive position.

The market for identity security solutions is intensely competitive and is characterized by constant change and innovation. We face competition from large, well-known enterprise software vendors that offer identity solutions within their product portfolios, pure play identity vendors (including new market entrants), and vendors with whom we have not traditionally competed but who may either introduce new products or incorporate features into existing products that compete with our solutions.solutions, and various offerings utilizing AI and agentic AI. For example, our competitors include large public companies, such as IBM, Microsoft, and Oracle that offer identity solutions within their product portfolios, and identity centric solution providers, including CyberArk,Palo Alto Networks (CyberArk), Okta, and One Identity.

New start-up companies that innovate and competitors that are making significant investments in research and development may invent similar or superior products and technologies that compete with our solutions, including technologies that heavily utilize AI and agentic AI, and our business could be materially and adversely affected if such technologies or products are widely adopted. Conditions in our market could change rapidly and significantly as a result of technological advancements, partnering by our competitors, or continuing market consolidation. The development process for competitive offerings that leverage AI and agentic AI technologies in particular may be more condensed than ours, accelerating the time that it takes for such offerings to become available in the market to compete with existing offerings. These competitive pressures in our market or our failure to compete effectively may result in price reductions, fewer orders, reduced revenue, and gross margins, increased net losses, and loss of market share. Any failure to meet and address these factors would adversely affect our business, financial condition, and operating results.

Our business has experienced significant growth and is becoming increasingly complex. We increased the number of our employees from 1,394 at December 31, 2020 to 2,7382,379 at January 31, 20252024 to 3,229 at January 31, 2026 and the number of countries in which we have employees from 18 at December 31, 2020 to 22 at January 31, 2025.2024 to 24 at January 31, 2026. We have also experienced growth in the number of our customers from over 1,700 at December 31, 2020 to approximately 2,9752,760 at January 31, 2025 and the number of countries in which we have customers from over 50 at December 31, 20202024 to overapproximately 603,235 at January 31, 2025.2026. We expect this growth to continue and for our operations to become increasingly complex. To effectively manage this growth, we have made, and plan to continue to make, substantial investments to improve our operational, financial, and management controls, as well as our reporting systems and procedures. Our success will depend in part on our ability to manage this complexity effectively without undermining our corporate culture, which we believe has been central to our success. If we are unable to manage this complexity, our business, operations, operating results, and financial condition may suffer.

As a public company, we are subject to the reporting requirements of the Exchange Act, the Sarbanes-Oxley Act of 2002 (the “Sarbanes-Oxley Act”), and the rules and regulations of the applicable listing standards of the Nasdaq Global Select Market (“Nasdaq"). The requirements of these rules and regulations have increased our legal, accounting, and financial compliance costs, could make some activities more difficult, time-consuming, and costly, and could place significant strain on our personnel, systems, and resources. The Sarbanes-Oxley Act requires, among other things, that we maintain effective disclosure controls and procedures and internal control over financial reporting. In order to maintain and improve the effectiveness of our disclosure controls and procedures and internal control over financial reporting, we have expended, and anticipate that we will continue to expend, significant resources, including accounting-relatedaccounting- and technology-related costs and significant management oversight.

Our internal resources and personnel may in the future be insufficient to avoid accounting errors, and there can be no assurance that we will not have material weaknesses in the future. Any failure to develop or maintain effective controls or any difficulties encountered implementing required new or improved controls could harm our operating results or cause us to fail to meet our reporting obligations and may result in a restatement of our financial statements for prior periods. Any failure to implement and maintain effective internal control over financial reporting also could adversely affect the results of periodic management evaluations and annual independent registered public accounting firm attestation reports regarding the effectiveness of our internal control over financial reporting that we will eventually be required to include in our periodic reports that will be filed with the SEC. Ineffective disclosure controls and procedures and internal control over financial reporting could also cause investors to lose confidence in our reported financial and other information, which would likely have a negative effect on the trading price of our common stock. In addition, if we are unable to continue to meet these requirements, we may not be able to remain listed on Nasdaq. We are not currently required to comply with the SEC rules that implement Section 404 of the Sarbanes-Oxley Act and are therefore not required to make a formal assessment of the effectiveness of our internal control over financial reporting for that purpose. We will be required to provide an annual management report on the effectiveness of our internal control over financial reporting commencing with our second annual report on Form 10-K. This assessment will need to include disclosure of any material weaknesses identified by our management in our internal control over financial reporting. Our independent registered public accounting firm will not be required to report on the effectiveness of our internal control over financial reporting pursuant to Section 404 of the Sarbanes-Oxley Act until our second annual report required to be filed with the SEC. At such time, our independent registered public accounting firm may issue a report that is adverse in the event it is not satisfied with the level at which our controls are documented, designed, or operating.

We believe that maintaining and enhancing our reputation as a leader and innovator in the market for identity security solutions is critical to our relationship with our existing customers and our ability to attract new customers. The successful promotion of our brand attributes will depend on a number of factors, including our marketing efforts, our ability to continue to develop high-quality solutions, and our ability to successfully differentiate our platform and solutions from competitive products and services. Our brand promotion activities may not be successful or yield increased revenue. In addition, independent industry analysts often provide reports ofon our solutions, as well as those of our competitors, and perception of our solutions in the marketplace may be significantly influenced by these reports. If these reports are negative, or less positive as compared to those of our competitors, our reputation may be adversely affected. Our reputation may also be harmed by negative publicity, unfavorable social media commentary, misinformation, or other third-party statements, whether or not accurate, which can spread rapidly and be difficult to counteract. Additionally, the performance of our channel partners may affect our brand and reputation if customers do not have a positive experience with our solutions as implemented by our channel partners or with the implementation generally. The promotion of our brand requires us to make substantial expenditures, and we anticipate that the expenditures will increase as our market becomes more competitive, as we expand into new geographies and vertical markets, and as more sales are generated through our channel partners. To the extent that these activities yield increased revenue, this revenue may not offset the increased expenses we incur. If we do not successfully maintain and enhance our brand and reputation, our business and operating results may be adversely affected.

At January 31, 2025,2026, we had customers in over 6065 countries and employees in over 2024 countries, and we intend to continue expanding our international sales and marketing operations.

•global and domestic political instability, economic sanctions, terrorist activities, or international conflicts, including the conflictconflicts in Israelthe Middle East (e.g., in Iran, Israel, and the surrounding areaareas) and the ongoing conflict between Russia and Ukraine, for example, which have in the past and may in the future impact the operations of our business or the businesses of our customers;

Global business activities face widespread macroeconomic uncertainties, and our results of operations may vary based on the impact of changes in our industry or the global economy on us or our customers and potential customers. Negative conditions in the general economy in the United States, Europe, or Asia and in the global economy, including conditions resulting from changes in gross domestic product growth, financial and credit market fluctuations, inflation and efforts to control further inflation, rising interest rates, bank failures, international trade relations, political turmoil (such as the conflictconflicts in Israelthe Middle East (e.g., in Iran, Israel, and the surrounding areaareas) and the ongoing conflict between Russia and UkraineUkraine, for example), potential U.S. federal government shutdowns, natural catastrophes, warfare, and terrorist attacks could cause a decrease in business investments by existing or potential customers, including spending on technology, and negatively affect the growth of our business. As an example, in the United States, capital markets have experienced and continue to experience volatility and disruption. Furthermore, inflation rates in the United States have recently increased to levels not seen in decades. Global economic and global and domestic political uncertainty may cause some of our customers or potential customers to curtail spending generally, or IT and identity security spending specifically, and may ultimately result in new regulatory and cost challenges to our international operations.

We have employees and contractors in locations throughout the Middle East, Europe, and Asia, including in Israel. If the global effect of the ongoing conflict in Israel and the surrounding area or the ongoing conflict between Russia and Ukraine escalates or expands, our ability to conduct business in these regions could be adversely impacted, potentially resulting in delays to product development, sales and marketing, and other key business functions. Additionally, inas lighta result of reportsgeopolitical ofconflicts, an increaseincluding in RussianRussia cyberand attacks in connection with the current conflict,Iran, we may face a heightened risk of state-sponsored cyber attacks in the near term. Our competitors, many of whom are larger and have greater financial resources than we do, may respond to challenging market conditions by lowering prices in an attempt to attract our customers, which may require us to respond in kind and may negatively impact our existing customer relationships and new customer acquisition strategy. In addition, the increased pace of consolidation in certain industries may result in reduced overall spending on our identity security solutions. We cannot predict the timing, strength, or duration of any economic slowdown, instability, or recovery, generally or within any particular industry.

The preparation of financial statements in conformity with U.S. generally accepted accounting principles (“GAAP") requires management to make estimates and assumptions that affect the amounts reported in our consolidated financial statements and accompanying notes. We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as provided in Part II, Item 7, “Management’s Discussion and Analysis of Financial Condition and Results of Operations.” The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities, and equity and the amount of revenue and expenses that are not readily apparent from other sources. Significant assumptions and estimates used in preparing our consolidated financial statements include those related to the fair value allocation of multiple performance obligations in revenue recognition, the expected period of benefit of contract acquisition costs, the assumptions underlying the fair value used for equity-based compensation expense for awards prior to our IPO, and estimated useful lives,lives and impairment of intangible assets and goodwill arising from business combinations.combinations and the assumptions underlying the fair value used for the redemption value of the redeemable convertible units issued prior to our IPO. Our operating results may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our operating results to fall below the expectations of securities analysts and investors, resulting in a decline in the trading price of our common stock.

The majority of our employees, including all of our officers and key employees, are employed on an at-will basis, which means that they could terminate their employment with us at any time. The loss of one or more members of our senior management team, particularly if closely grouped, could adversely affect our ability to execute our business plan and thus, our business, operating results, and prospects. We do not maintain key manperson insurance on any of our officers or key employees, and we may not be able to find adequate replacements.

Competition for well-qualified employees in all aspects of our business, including sales, professional services, and software engineering, is intense. We have from time to time experienced, and may in the future have, difficulty hiring and retaining employees with appropriate qualifications, and many of the companies with which we compete for experienced personnel have greater resources than we have. We may need to invest significant amounts of cash and equity to attract and retain new employees, and we may never realize returns on these investments. Additionally, many of our employees may be able to receive significant proceeds from sales of our common stock in the public markets following the expiration of applicable lock-up periods, which may reduce their motivation to continue to work for us.

Our platform and solutions are billed in multiple currencies, and therefore, a portion of our revenue (and, consequently, ARR) is subject to foreign currency risk. A strengthening of the U.S. dollar could increase the real cost of our platform and solutions to our customers outside of the United States, which could also adversely affect our results of operations. In addition, an increasing portion of our operating expenses are incurred outside the United States. These operating expenses are denominated in foreign currencies and are subject to fluctuations due to changes in foreign currency exchange rates. While we do not currently hedge against the risks associated with currency fluctuations, if our foreign currency risk increases in the future and we are not able to successfully hedge against the risks associated with currency fluctuations, our results of operations would be adversely affected.

Occurrence of any catastrophic event, including earthquake, fire, flood, tsunami, or other weather event, power loss, telecommunications failure, software or commodity appliance malfunction, cyber attack, war, military action, terrorist attack, explosion, or pandemic could impact our business. Our insurance coverage may not compensate us for losses that may occur in the event of a significant natural disaster. Additionally, we rely on third-party systems and enterprise applications, technology systems, and our website for our development, marketing, operational support, hosted services, and sales activities. In the event of a catastrophic event, we may be unable to continue our operations and may endure system interruptions, reputational harm, delays in our product development, lengthy interruptions in our identity security solutions, and breaches of data security, all of which could have an adverse effect on our results of operations. If we are unable to develop adequate plans to ensure that our business functions continue to operate during and after a disaster and to execute successfully on those plans in the event of a disaster or emergency, our business would be harmed.

Our solutions analyze and otherwise process proprietary and confidential information, including personal information. Increasingly, companies in our industry are subject to a wide variety of attacks on their networks and systems. As a well-known provider of identity security solutions, we pose an attractive target for such attacks, and as our footprint grows larger, we may become an even more attractive target for cyber attacks. We have previously experienced, and may in the future experience, various attempts to access or disrupt our networks, systems, and applications. We face threats from a variety of sources, including sophisticated nation-state and nation-state supported actors, cyber criminals, terrorists, and politically motivated groups or individuals that pose risks to our internal networks, our platform, our third-party service providers, and our customers’ systems and the proprietary, confidential, or sensitive information, including personal information processed by us or on our behalf. We may face a heightened risk of state-sponsored cyber attacks in the near term as a result of geopolitical conflicts, including in Russia and Iran.

We host our SaaS solution primarily using AWS data centers. Our related operations depend on protecting the virtual cloud infrastructure hosted in AWS by maintaining its configuration, architecture, features, and interconnection specifications, as well as the information stored in these virtual data centers and which third-party internet service providers transmit. Although we have disaster recovery plans that utilize multiple AWS locations, any incident affecting their infrastructure that may be caused by fire, flood, severe storm, earthquake, or other natural disasters, cyber attacks, terrorist, or other attacks, military actions, public health issues, or other similar events beyond our control have in the past, and could in the future, negatively affect our SaaS platform. For example, in October 2025, we experienced limited disruptions to our SaaS platform due to a widespread AWS outage. More recently, we experienced a limited disruption affecting our services hosted in the United Arab Emirates due to the conflict in the Middle East. Neither situation has had a significant impact on our business. A prolonged AWS service disruption affecting our SaaS platform for any of the foregoing or other reasons would negatively impact our ability to serve our customers and could damage our reputation with current and potential customers, expose us to liability, cause us to lose customers, or otherwise harm our business. We may also incur significant costs for using alternative equipment or taking other actions in preparation for, or in reaction to, events that damage the AWS services we use, which would also likely require significant investments of time. In addition, AWS may terminate theour agreement for cause by providing 30 days’ prior written notice and may, in some cases, terminate the agreement immediately for cause upon notice. In the event that our AWS service agreements are terminated, or there is a lapse of service, elimination of AWS services or features that we utilize, interruption of internet service provider connectivity, or damage to such facilities, we could experience interruptions in access to our platform as well as significant delays and additional expense in arranging or creating new facilities and services and/or re-architecting our SaaS solution for deployment on a different cloud infrastructure service provider, which may adversely affect our business, operating results, and financial condition.

The market in which we compete is relatively new and subject to rapid technological change,change (including increasingly rapid advancement in AI technologies and capabilities), evolving industry standards, and changing regulations, as well as changing customer needs, requirements, and preferences. The success of our business will depend, in part, on our ability to adapt and respond effectively to these changes on a timely basis. In addition, as our customers’ technologies and business plans grow more complex, we expect them to face new and increasing challenges. Our customers require that our solution effectively identifies and responds to these challenges without disrupting the performance of our customers’ IT systems. As a result, we must continually modify and improve our solutions and introduce or acquire new solutions in response to changes in our customers’ IT infrastructures.

Since our customers use our platform and solutions for important aspects of their security environment and operational business, any real or perceived errors, failures, or vulnerabilities in our solutions, or disruptions in service or other performance problems, could hurt our reputation and may damage our customers’ businesses. Furthermore, defects, errors, vulnerabilities, or failures in our platform or solutions may require us to implement design changes or software updates. Any defects, vulnerabilities, or errors in our platform or solutions, or the perception of such defects, vulnerabilities, or errors, could result in: (i) expenditure of significant financial and product development resources in efforts to analyze, correct, eliminate, or work around errors or defects; (ii) loss of existing or potential customers or channel partners; (iii) delayed or lost revenue; (iv) delay or failure to attain market acceptance; (v) delay in the development or release of new solutions; (vi) negative publicity, which will harm our reputation; (vii) an increase in collection cycles for accounts receivable or the expense and risk of litigation; and (viii) harm to our operating results.

Our solutions include software or other intellectual property licensed from certain third parties, and we use certain software and other intellectual property licensed from third parties in our business. We anticipate that we will continue to rely on such third-party software and intellectual property in the future, and from time to time, we may be required to renegotiate our current third-party licenses or license additional technology from third parties to develop new solutions or enhancements thereto or to facilitate new business models. This exposes us to risks over which we may have little or no control. For example, the third-party software we currently license may not always be available,available (including as a result of periodic government restrictions on use and licensing), or available on commercially reasonable terms, and we may not have access to alternative third-party software in the event of any issues with such software. In addition, a third party may assert that we or our customers are in breach of the terms of applicable licenses, which could, among other things, force us to cease use of such software and give such third party the right to terminate the applicable license or seek damages from us, or both. Additionally, we may not have the right to control the maintenance, prosecution, preparation, filing, enforcement, defense, or litigation of intellectual property that we license from third parties and are reliant on our licensors to do so. We also cannot be certain that activities such as intellectual property protection, maintenance, prosecution, and enforcement by our licensors have been or will be conducted consistent with our best interests or in compliance with applicable laws and regulations or will result in valid and enforceable intellectual property rights. It is possible that our licensors’ infringement proceedings or defense activities may be less vigorous than had we conducted them ourselves or may not be conducted in accordance with our best interests. Furthermore, we cannot be certain that our licensors are not infringing, misappropriating, or otherwise violating the intellectual property rights of third parties or that our licensors have sufficient rights to the licensed intellectual property in all jurisdictions in which we may offer our solutions. Our inability to obtain or maintain certain licenses or other rights, to obtain or maintain such licenses or rights on favorable terms, or the need to engage in litigation or any other proceedings regarding these matters could result in delays in releases of new solutions and could otherwise disrupt our business, until equivalent technology can be identified, licensed, or developed, if at all. Also, to the extent that our platform and solutions depend upon the successful operation of third-party software in conjunction with our software, any undetected errors, vulnerabilities, compromises, or defects in such third-party software could prevent the deployment or impair the functionality of our solutions, delay new feature introductions, result in a failure of our platform, and injure our reputation. Any of the foregoing could materially adversely affect our business, financial condition, and results of operations.

We are currently party to a credit agreement (the “2025 Credit Agreement”) that provides for a seniorfive-year secured$250.0 term loan facility (the “Term Loan”) in an original aggregate principal amount of $1.59 billion and amillion senior secured revolving credit facilityfacility, inincluding ana aggregate principal amountletter of $125.0credit sub-facility up to $10.0 million (the “2025 Revolving Credit Facility”). While as of March 27, 2025, we have fully repaid the Term Loan and have no outstanding borrowings or letters of credit under the 2025 Credit Agreement or 2025 Revolving Credit Facility, we have historically relied on the availability of debt financing and we may incur significant indebtedness in the future under the Revolving Credit Facility or otherwise. We may also consider investments in joint ventures or acquisitions, which may increase our indebtedness. Our ability to meet our future debt service obligations, if any, will depend on our future performance, which is subject to economic, financial, competitive, and other factors beyond our control, including the factors described in this “Risk Factors” section. If we are unable to generate adequate cash flow to meet any such obligations, we may be required to adopt one or more alternatives, such as selling assets, restructuring debt, or obtaining additional equity capital on terms that may be onerous or highly dilutive. Prevailing economic conditions and global credit markets could adversely impact our ability to do so on terms acceptable to us, or at all. In addition, our existing 2025 Credit Agreement and any of our future debt agreements may contain restrictive covenants that prohibit us from adopting any of these alternatives. The amount and terms of any future indebtedness could also make us more vulnerable to economic downturns, less able to withstand competitive pressures, and less flexible in responding to changing business and economic conditions as well as require us to allocate more of our cash flow from operations to the payment of outstanding indebtedness, rather than research and development or business growth.

The terms, conditions, and restrictions contained in the 2025 Credit Agreement could expose us to risks that could adversely affect our liquidity and financial condition or otherwise adversely affect our operating results.

The 2025 Credit Agreement contains, and any future debt agreements may contain, various covenants that, among other things, limit our and certain of our subsidiaries’ abilities to:

The 2025 Credit Agreement also contains, and any future debt agreements may also contain, numerous affirmative covenants, including financial covenants. Our failure to comply with these covenants could result in an event of default, which, if not cured or waived, could result in the acceleration of our then outstanding debt.

Indebtedness under the 2025 Revolving Credit Facility, if any, bears interest at variable rates, and we may incur additional variable interest rate indebtedness in the future. This exposes us to interest rate risk, and any interest rate swaps we enter into in order to reduce interest rate volatility may not fully mitigate our interest rate risk. If interest rates were to increase, our debt service obligations on the variable rate indebtedness would increase even if the amount borrowed remained the same, and our net income and cash flows, including cash available for servicing our indebtedness, would correspondingly decrease.

A wide variety of domestic and foreign laws, rules and regulations, and contractual requirements apply to the use and processing of proprietary, confidential, and sensitive information, including personal information. These laws, rules, regulations, industry standards, contractual requirements, and other obligations are constantly evolving, and we expect that we will continue to become subject to new proposed laws, rules, regulations, industry standards, contractual requirements, and other obligations in the United States, the EU, the UK,Europe, and other jurisdictions.

For example, in the United States, there are numerous federal, state, and local privacy, data protection, and cybersecurity laws, rules, and regulations governing the use and processing of personal data. At the federal level, we are subject to, among other laws, rules, and regulations, the rules and regulations promulgated under the authority of the Federal Trade Commission, which has the authority to regulate and enforce against unfair or deceptive acts or practices in or affecting commerce, including acts and practices with respect to privacy, data protection, and cybersecurity. Moreover, Congress has considered, and continues to consider, many proposals for comprehensive national data privacy and cybersecurity legislation. As another example, at the state level, we are subject to laws, rules, and regulations, such as the California Consumer Privacy Act (as amended by the California Privacy Rights Act (collectively, “CCPA”)), which, amongst other things, requires businesses to provide specific disclosures in privacy notices, implement new operational practices, honor requests from California residents to exercise certain privacy rights (such as the right to access and request deletion of their personal information and to opt out of certain sharing and sales of personal information) and provides for civil penalties of up to $7,500$7,998 per violation, as well as a private right of action for certain data breaches that may increase the likelihood of and risks associated with data breach litigation. Many other states have also enacted, or are in the process of enacting, comprehensive privacy, data protection, and cybersecurity laws, rules, and regulations thatmany of which share similarities with the CCPA, which creates the potential forcreating a patchwork of overlapping but different state laws. In addition, all 50 states have laws that require the provision of notification for security breaches of personal information to affected individuals, state officers, or others. Possible consequences for non-compliance with these various state laws include enforcement actions in response to rules and regulations promulgated under the authority of federal agencies, state attorneys general, and legislatures and consumer protection agencies.

Outside of the United States, an increasing number of laws, rules, regulations, and industry standards apply to privacy, data protection, and cybersecurity. For example, we are subject to the GDPR in the EU, and in the UK, we are subject to the UK’s Data Protection Act 2018 as supplemented by the GDPR as implemented into UK law (collectively, “UK GDPR”), both of which impose similar, stringent data protection requirements. The GDPR and UK GDPR are wide-ranging in scope and impose numerous additional requirements on companies that process personal data, including imposing special requirements in respect of the processing of personal data, requiring that consent of individuals to whom the personal data relates is obtained in certain circumstances, requiring additional disclosures to individuals regarding data processing activities, requiring that safeguards are implemented to protect the security and confidentiality of personal data, creating mandatory data breach notification requirements in certain circumstances, and requiring that certain measures (including contractual requirements) are put in place when engaging third-party processors. The GDPR and UK GDPR also provide individuals with various rights in respect of their personal data, including rights of access, erasure, portability, rectification, restriction, and objection. Failure to comply with the GDPR and the UK GDPR can result in significant fines and other liability, including fines of up to EUR 20 million (or GBP 17.5 million under the UK GDPR) or four percent of global revenue, whichever is greater. European data protection authorities have shown a willingness to impose significant fines and issue orders preventing the processing of personal data on non-compliant businesses and have alreadyimposed imposedseveral fines for GDPR violations up to, in some cases,for hundreds of millions of Euros, and even one fine totaling 1.2 billion Euros. WhileEurope's theoverlapping UKand GDPR currently imposes substantially the same obligations as the GDPR, the UK GDPR will not automatically incorporate changes to the GDPR going forward (which would need to be specifically incorporated by the UK government). Moreover, the UK government has publicly announced plans to reform the UK GDPR in ways that, if formalized, are likely to deviate from the GDPR, all of which creates a risk ofyet divergent paralleldata protection regimes and related uncertainty, along with the potential forcreate increased compliance costschallenges, costs, and risks for affected businesses. Legal developments in the European Economic Area (“EEA”) and the UK, including rulings from the Court of Justice of the European Union (“CJEU”), have also created complexity and uncertainty regarding processing and transfers of personal data from the EEA and the UK to the United States and other so-called third countries outside the EEA and the UK that have not been determined by the relevant data protection authorities to provide an adequate level of protection for privacy rights. Case law from the CJEU indicates that reliance on the standard contractual clauses—a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism—alone may not necessarily be sufficient in all circumstances and that transfers must be assessed on a case-by-case basis. In July 2023, the European Commission adopted an adequacy decision in relation to the new EU-U.S. Data Privacy Framework (“DPF”) rendering the DPF effective as a GDPR transfer mechanism for personal data transferred from the EEA to the United States by U.S. entities self-certified under the DPF. In October 2023, the UK Extension to the DPF came into effect, as approved by the UK government, as a data transfer mechanism from the UK to U.S. entities self-certified under the DPF. While we have taken steps to mitigate the impact on us, such as implementing the European Commission’s standard contractual clauses, the efficacy and longevity of these mechanisms remains uncertain. Other jurisdictions outside the EU and the UK are similarly introducing or enhancing privacy, data protection, and cybersecurity laws, rules, and regulations, which could increase our compliance costs and the risks associated with noncompliance. We cannot yet fully determine the impact these or future laws, rules, and regulations may have on our business or operations. These laws, rules, and regulations mayare beoften inconsistent from one jurisdiction to another, subject to differing interpretations, and may be interpreted to conflict with our practices. While we have implemented controls and procedures designed to comply with the requirements of the privacy, data protection, and cybersecurity laws, rules, and regulations of the jurisdictions in which we operate, such controls and procedures may not be effective in ensuring compliance or preventing unauthorized transfers of personal information. Failure to comply with such requirements could result in fines, sanctions, or other penalties, which could materially affect our reputation, business, financial condition, and results of operations.

Loss, retention, or misuse of certain information and alleged violations of laws and regulations relating to privacy and data security, and any relevant claims, may expose us to potential liability and may require us to expend significant resources on identity security and in responding to and defending such allegations and claims. Any failure or perceived failure by us or any third parties with which we do business to comply with laws, rules, regulations, industry standards, contractual requirements, or other actual or asserted obligations to which we or such third parties are or may become subject may result in significant liability, adverse publicity, inability to process data, and investigations, proceedings, and other legal actions against us by governmental entities and private claims, demands, and litigation. Any such action or other matter could be expensive to defend, may require the expenditure of substantial legal and other costs and substantial time and resources, may result in fines, penalties, or other liabilities, and likely would damage our reputation and adversely affect our business, financial condition, and results of operations. We have in the past and may in the future be party to suchprivacy-related actions and disputes. In many jurisdictions, enforcement actions and consequences for non-compliance with privacy, data protection, and cybersecurity laws, rules, regulations, industry standards, contractual requirements, or other obligations are rising. Data subjects may also have a private right of action, as well as consumer associations, to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of applicable privacy, data protection, and cybersecurity laws, rules, and regulations. In addition, privacy advocates and industry groups have regularly proposed, and may propose in the future, self-regulatory standards that may legally or contractually apply to us or be alleged to apply to us. If we fail or are alleged to fail to follow these standards, even if no personal information is compromised, we may incur significant fines or experience a significant increase in costs and face regulatory investigations and other proceedings or private claims, demands, and litigation. In addition, future laws, regulations, standards, and other obligations, and changes in the interpretation of existing laws, regulations, standards, and other obligations, could impair our customers’ ability to collect, use, or disclose data relating to individuals, which could decrease demand for our platform and solutions, increase our costs, and impair our ability to maintain and grow our customer base and increase our revenue. This includes evolutions in definitions of what constitutes “Personal Information” and “Personal Data” subject to privacy laws, especially relating to classification of intellectual property addresses, machine or device identification numbers, location data and other information. Changes in the law may limit or inhibit our ability to offer certain solutions or features, limit the growth of features and/or development of new solutions, including that supported by AI or ML, or limit our ability to operate or expand our business and develop technology alliance relationships that may involve the sharing of data.

Around the world, there are numerousa number of lawsuits in process against various technology companies that process personal data. If thosemore lawsuits are successful, it could increase the likelihood that our company may be exposed to liability for our own policies and practices concerning the processing of personal data and could hurt our business. Furthermore, the costs of compliance with, and other burdens imposed by laws, regulations, and policies concerning privacy and identity security that are applicable to the businesses of our customers may limit the use and adoption of our platform or solutions and reduce overall demand for them. Privacy concerns, whether or not valid, may inhibit market adoption of our solutions. Additionally, concerns about security or privacy may result in the adoption of new legislation that restricts the implementation of technologies like ours or requires us to make modifications to our solutions, which could significantly limit the adoption and deployment of our technologies or result in significant expense to modify our solutions.

We publicly post our privacy policies and practices concerning our processing, use, and disclosure of the personally identifiable information provided to us by our website visitors. Our publication of our privacy policies and other statements we publish that provide promises and assurances about privacy and security can subject us to potential state, federal, and international action if they are found to be deceptiveincomplete or misrepresentative of our actual policies and practices or if our practices are found to be unfair.

We are subject to the Foreign Corrupt Practices Act (the “FCPA”), the U.K. Bribery Act, and other anti-corruption, anti-bribery, and anti-money laundering laws in various jurisdictions both domestic and abroad. The FCPA prohibits any U.S. individual or business from paying, offering, authorizing payment, or offering of anything of value, directly or indirectly, to any foreign official, political party, or candidate for the purpose of influencing any act or decision of the foreign entity in order to assist the individual or business in obtaining or retaining business. The U.K. Bribery Act is similar but even broader in scope in that it prohibits bribery of private (non-government) persons as well. The FCPA also obligates companies whose securities are listed in the United States to comply with certain accounting provisions requiring the company to maintain books and records that accurately and fairly reflect all transactions of the corporation, including international subsidiaries, and to devise and maintain an adequate system of internal accounting controls for international operations. Our sales model presents some risk under these laws. We leverage third parties, including channel partners, to sell our solutions and conduct our business abroad. We and our third-party intermediaries may have direct or indirect interactions with officials and employees of government agencies, state-owned or affiliated entities, and non-governmental commercial entities and may be held liable for the corrupt or other illegal activities of these third-party intermediaries, our employees, representatives, contractors, channel partners, and agents, even if we do not explicitly authorize such activities. While we have policies and procedureprocedures to address compliance with these laws, we cannot assure you that all of our employees and agents will not take actions in violation of our policies and applicable law, for which we may be ultimately held responsible. Noncompliance with these laws could subject us to investigations, sanctions, settlements, prosecution, other enforcement actions, disgorgement of profits, significant fines, damages, other civil and criminal penalties or injunctions, adverse media coverage, and other consequences. Any investigations, actions, or sanctions could adversely affect our business, operating results, and financial condition.

Increased and complex scrutiny of environmental, social, governance, and governancesustainability (“ESG”) matters may require us to incur additional costs or otherwise adversely impact our business.

Increased attention to climate change, diversity, equity, and inclusion, and other ESG issues, may result in increased costs (including but not limited to increased costs related to compliance, stakeholder engagement, and contracting), impact our reputation or otherwise affect our business performance. In addition, organizations that provide information to investors on corporate governance and related matters have developed ratings processes for evaluating companies on ESG matters. Such ratings are used by some investors to inform their investment or voting decisions and also by some customers and prospective customers to inform their purchasing decisions. Unfavorable ESG ratings could lead to negative investor sentiment toward us and/or our industry, which could have a negative impact on our access to and costs of capital.capital, and could also cause customers and prospective customers to not purchase our solutions. To the extent ESG matters negatively impact our reputation, we may also not be able to compete as effectively to recruit or retain employees. We may take certain actions, including the establishment of ESG-related goals, to improve our ESG profile and/or respond to stakeholder demand;demands, however,and such actions may be costly or be subject to numerous conditions that are outside our control, and we cannot guarantee that such actions will have the desired effect.

Moreover, while we may have and may continue to create and publish voluntary disclosures regarding ESG matters from time to time, many of the statements in those voluntary disclosures are based on hypothetical expectations and assumptions that may or may not be representative of current or actual risks or events or forecasts of expected risks or events, including the costs associated therewith. Such expectations and assumptions are necessarily uncertain and may be prone to error or subject to misinterpretation given the long timelines involved and the lack of an established single approach to identifying, measuring, and reporting on many ESG matters. Such disclosures may also be at least partially reliant on third-party information that we have not independently verified or cannot be independently verified. In addition, we expect there will likely be increasing levels of regulation, disclosure-related and otherwise, with respect to ESG matters, and increased regulation will likely lead to increased compliance costs as well as scrutiny that could heighten all of the risks identified in this risk factor. Such ESG matters may also impact our customers, which may adversely impact our business, financial condition, or results of operations.

•announcements of new solutions, products, or technologies, commercial relationships, acquisitions, or other events by usus, our competitors, or ourother competitorstechnology industry companies, including potential technology industry disruption as a result of AI and agentic AI advancements;

In addition, if the market for technology stocks or the stock market in general experiences a loss of investor confidence, the trading price of our common stock could declinedecline, including for reasons unrelated to our business, operating results, or financial condition. The trading price of our common stock might also decline in reaction to events that affect other companies in our industry even if these events do not directly affect us. In the past, following periods of volatility in the trading price of a company’s securities, securities class action litigation has often been brought against that company. If our stock price is volatile, we may become the target of securities litigation. Securities litigation could result in substantial costs and divert our management’s attention and resources from our business. This could have an adverse effect on our business, operating results, and financial condition.

InvestmentAs of January 31, 2026, investment entities affiliated with Thoma Bravo UGP, LLC (together with its affiliated entities, "Thoma Bravo") control approximately 86%85% of the voting power of our outstanding common stock, which means that, based on its percentage voting power, Thoma Bravo controls the vote of all matters submitted to a vote of our stockholders. This control enables Thoma Bravo to control the election of the members of the Board and all other corporate decisions. Even when Thoma Bravo ceases to control a majority of the total voting power, for so long as Thoma Bravo continues to own a significant percentage of our common stock, Thoma Bravo will still be able to significantly influence the composition of our Board and the approval of actions requiring stockholder approval. Accordingly, for such period of time, Thoma Bravo will have significant influence with respect to our management, business plans, and policies, including the appointment and removal of our officers, decisions on whether to raise future capital, and amending our charter and bylaws, which govern the rights attached to our common stock. In particular, for so long as Thoma Bravo continues to own a significant percentage of our common stock, Thoma Bravo will be able to cause or prevent a change of control of us or a change in the composition of our Board and could preclude any unsolicited acquisition of us. The concentration of ownership could deprive you of an opportunity to receive a premium for your shares of common stock as part of a sale of us and ultimately might affect the market price of our common stock.

Our fiscal year end is January 31, and our fiscal quarters end on April 30, July 31, October 31, and January 31. Our fiscal year ended January 31, 2026, January 31, 2025 and January 31, 2024 are referred to herein as "fiscal 2026", "fiscal 2025", and "fiscal 2024," respectively,respectively. This MD&A generally discusses fiscal 2026 and thefiscal period2025 from August 16, 2022 to January 31, 2023 is referred to as "Successor"items and the period from February 1, 2022 to August 15, 2022 is referred to as "Predecessor." Year-to-yearyear-to-year comparisons between 2026 and 2025. Discussions of fiscal 2024 to the Successoritems and Predecessoryear-to-year periodscomparisons between 2025 and discussions2024 of items in such periodsthat are not included in this AnnualForm Report, and10-K can be found in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” in our finalAnnual prospectusReport datedon Februaryour 12,Form 202510-K and filed withfor the SECfiscal pursuantyear to Rule 424(b)(4) on February 14,ended 2025.

We deliver solutions to enable comprehensiveadaptive identity security for the enterprise. We do this byvia unifyingthe SailPoint Platform that unifies identity data across systems and identity types, including employee identities, non-employee identities, machine identities, and machineAI identities.agents for real-time governance. Our SaaS and customer-hosted offerings leverage intelligent analytics to provide organizations with critical visibility into which identities currently have access to which resources, which identities should have access to those resources, and how that access is being used. Our solutions enable organizations to establish, control, and automate policies that help them define and maintain a robust security posture and achieve regulatory compliance. Powered by AI, our solutions enable organizations to overcome the scale and complexity of managing identities in real-time across dynamic, complex IT environments. Our solutions empower organizations to maintain a robust security posture and achieve regulatory compliance.

Today, we offer a range of solutions to meet the varied needs of our customers across a broad set of deployment options including: Identity Security Cloud, our SaaS-based cloud solution built on our unified platform,SailPoint Atlas,Platform, and IdentityIQ, our customer-hosted identity security solution. These solutions are designed to enable our customers to make more effective decisions regarding access, improve security processes, and provide them with a deeper understanding of identity and access.

In recent years, we have transitioned our business to a subscription model. This transition is substantially complete with subscription revenue, which consists primarily of SaaS, maintenance, and term subscriptions, comprising 94%, 92% and 89% of our total revenue for the year ended January 31, 2026, 2025 and 2024, respectively. As of January 31, 2025, our ARR was $876.7 million, reflecting an increase of 29% compared to January 31, 2024. Our go-to-market motion is focused primarily on our SaaS solution, and the growth in our ARR is primarily driven by an increase in SaaS ARR. As of January 31, 2025, our SaaS ARR was $540.3 million, reflecting an increase of 39% as compared to $388.3 million as of January 31, 2024.

TheOur numbercustomers include many of customersthe withworld’s $250,000 or more of ARR as of January 31, 2025 increased 26% on a year-over-year basis,largest and themost numbercomplex oforganizations, customersincluding withlarge overenterprises $1,000,000across ofall ARRmajor asverticals ofand January 31, 2025 increased 78% on a year-over-year basis.governments. Most new customers purchase one of our SaaS suites, Standard, Business, or Business Plus. For the last twelve months ending January 31, 2025, over 90% of new SaaS customers landed with a suite offering. We believe we deliver exceptional value to our customers and as a result benefit from high customer retention. Our go-to-market approach tends to result in a larger land, with future opportunities for expansion. We focus on expanding our customer relationships over time with significant up-selling and cross-selling opportunities, including suite upgrades and additional products. In recent years, our expansion motion has grown rapidly, demonstrating the growing value proposition of our solutions. AsFor ofthe last twelve months ending January 31, 2025,2026, ourover dollar-based95% netof retentionnew rateSaaS wascustomers 114%.landed with a suite offering.

For Identity Security Cloud, our SaaS-based cloud solution, and IdentityIQ, our customer-hosted solution, our customers typically enter into three-year contracts, with annual billing upfront. For Identity Security Cloud, our pricing is tiered and based on the suite, with the option for the customer to purchase additional products and capabilities a-la-carte. We price our IdentityIQ term subscriptions based on a number of factors, including the number of digital identities governed with the solution. Customers also have the option to purchase additional products and capabilities. As of January 31, 2025, the weighted duration of our SaaS and term subscription contracts was approximately three years.

Add New Customers within Existing Markets. Countless organizations still use a combination of legacy solutions and home-grown tools. Furthermore, we estimate that over 60% of organizations in our target market still have a fragmented identity experience or use a mostly manual process based on our internal research. As a result, we believe that there is a significant opportunity for us to accelerate the growth of our customer base by enhancing our marketing efforts, increasing our sales capacity and productivity, and expanding and further leveraging our use of channel partners, including MSPs.managed service providers. Our ability to attract new customers depends on a number of factors, including the effectiveness and pricing of our solutions, our ability to drive awareness of them, and the offerings of our competitors.

Generate Additional Sales to Existing Customers. We believe that our existing customer base provides us with a significant opportunity to expand incremental sales. Most new customers initially purchase one of our SaaS suites (Standard, Business, or Business Plus). We focus on expanding our customer relationships over time through up-selling and cross-selling opportunities, including suite upgrades and additional products. Additionally, we are focused on continuing to migrate customers of our customer-hosted solution to our SaaS suites, which typically results in increased ARR because of the additional functionality that our SaaS suites offer. Our focus on growing our product portfolio as well as expanding customer relationships over time through cross-selling and up-selling has driven expansion of our dollar-based net retention rate from 110% as of January 31, 2023 to 114% as of January 31, 2025. Our ability to increase sales to existing customers will depend on a number of factors, including our customers’ satisfaction with our products, competition, pricing, and overall changes in our customers’ spending levels.

Increase Share of Revenue Derived from SaaS. Our go-to-market motion is focused primarily on Identity Security Cloud, our SaaS offering. For the twelve months ended January 31, 2025, SaaS contracts comprised approximately 78% of incremental ARR, up from 75% for the twelve months ended January 31, 2023, and we expect this trend to continue in the future. We define incremental ARR as the increase in ARR from the prior period to current period. While we expect that this increase in SaaS contracts will drive growth in ARR, it is also expected to have a near term negative impact on revenue growth, driven by differences in revenue recognition policies between SaaS subscriptions and term subscriptions, and gross margins, as we incur hosting costs for our SaaS offering. Our ability to increase our revenue from SaaS subscriptions will depend on a number of factors, including our customers’ specific circumstances, some of which necessitate their preference for our customer-hosted identity governance solution, IdentityIQ.

Deepen our Penetration in International Markets. We expect to continue to invest in our sales and marketing efforts and channel partner network to expand our reach and deepen our presence in existing geographies and to expand into new geographies. We believe that our global market opportunity is large and growing in response to the evolving IT and threat landscapes. For the twelve months ended January 31, 2025, weWe generated 68%65% of our revenue from the United States, 19%21% of our revenue from EMEA,EMEA and 13%14% from the rest of the world, billed primarily in U.S. dollars.dollars, for the year ended January 31, 2026. Our ability to deepen our penetration in international markets will depend on a number of factors, including the competitiveness of our solutions, the efficacy of our channel partner network, and our sales and marketing efforts.

In addition to our financial information prepared in accordance with GAAP, we monitor the following key business metrics to help us measure and evaluate the effectiveness of our operations. Prior to the Take-Private Transaction, our Predecessor monitored the key business metric of ARR. The Take-Private Transaction did not have any direct effects on ARR or our other key business metrics. Although we believe we have a reasonable basis for each of these metrics, we caution you that these metrics are based on a combination of assumptions that may prove to be inaccurate over time. Please see the section titled “Risk Factors” for more information.

In recent years, we have transitioned our business to a SaaS-first subscription model. As a result of those efforts, our SaaS ARR has more than doubled from January 31, 2023continued to Januaryshow 31,strong 2025,growth, and the share of SaaS ARR to total ARR has increased from 51%57% to 62%66% from January 31, 20232024 to January 31, 2025.2026. We believe the share of ARR generated by our SaaS solution will continue to increase over time.

Our historical results of operations may not be comparable from period to period or going forward. Set forth below is a brief discussion of the key factors impacting the comparability of our results of operations.

On February 14, 2025, we closed the IPO and became a public company. We incur additional costs associated with operating as a public company as compared to periods prior to the IPO. The Sarbanes-Oxley Act, as well as rules adopted by the SEC and national securities exchanges, require public companies to implement specified corporate governance practices that were inapplicable to us as a private company. These additional rules and regulations increase our legal, regulatory, financial, and insurance compliance costs and make some activities more time-consuming and costly. We incurred a significant increase in equity-based compensation expense due to the conversion and vesting of equity awards issued prior to the IPO as well as the issuance of equity awards to certain employees in connection with the IPO. We no longer incur the Thoma Bravo monitoring fees discussed above.

Over time, we expect our professional services revenue as a percentage of total revenue to decrease as we increasingly rely on partners to help our customers deploy our software.software and on our focus on increasing subscription revenue.

Cost of subscription revenue consists primarily of third-party cloud-based hosting costs, software, amortization expenses for developed technology acquired, amortization expense for capitalized software development costs, equity-based compensation, employee-related costs (which we define as salaries, benefits, bonuses,bonuses and allocated overhead) for providing subscriptions, third party royalties, facilities costs and contractor costs to supplement staff levels. We expect third-party cloud-based hosting costs to increase as our SaaS subscriptions continue to grow.

Cost of services and other revenue consists primarily of (1) employee-related costs of professional services and training organizations, equity-based compensation, travel-related costs, facilities costs and contractor costs to supplement staff levels.levels; and (2) amortization expense for developed technology acquired and third-party royalties related to perpetual licenses. As of the year ended January 31, 2026, the Company has begun presenting cost of perpetual license revenue as part of cost of services and other revenue due to amounts no longer being significant and has recast prior year amounts accordingly.

Recent Developments: Launch of SailPoint Agentic Fabric

Our customers include many of the world’s largest and most complex organizations, including large enterprises across all major verticals and governments. The approximate number of total customers and customers at each annual recurring revenue ("ARR") level are as follows:

The number of customers with $250,000 or more of ARR as of AprilJuly 30,31, 2026 increased 24%22% on a year-over-year basis, and the number of customers with over $1,000,000 of ARR as of AprilJuly 30,31, 2026 increased 32%27% on a year-over-year basis.

For Identity Security Cloud, our pricing is tiered and based on the suite, with the option for the customer to purchase additional products and capabilities a-la-carte.à la carte. We price our IdentityIQ term subscriptions based on a number of factors, including the number of digital identities governed with the solution. Customers also have the option to purchase additional products and capabilities.

Deepen our Penetration in International Markets. We expect to continue to invest in our sales and marketing efforts and channel partner network to expand our reach and deepen our presence in existing geographies and to expand into new geographies. We believe that our global market opportunity is large and growing in response to the evolving IT and threat landscapes. For the three and six months ended AprilJuly 30,31, 2026, we generated 64%66% and 65% of our revenue from the United States, 22%20% and 21% from Europe, the Middle East and Africa (“"EMEA”"), and 14% from the rest of the world. For the three months ended April 30, 2025, we generated 66% of our revenue from the United States, 21% from EMEA,13% and 14% from the rest of the world, billedrespectively. primarilyFor inthe U.S.three dollars.and six months ended July 31, 2025, we generated 64% and 65% of our revenue from the United States, respectively, 22% of our revenue from EMEA and 13% from the rest of the world for both periods, respectively. Our ability to deepen our penetration in international markets will depend on a number of factors, including the competitiveness of our solutions, the efficacy of our channel partner network, and our sales and marketing efforts.

Worldwide economic and political uncertainties and negative trends, including financial and credit market fluctuations, tariffs and increasing trade protectionism, changes in government spending levels, uncertainty in the banking sector, rising interest rates, inflationinflation, and other impacts from the macroeconomic environment have, and could continue to, adversely affect our business operations or financial results. As we continue to monitor the direct and indirect impacts of these circumstances, the broader implications of these macroeconomic and political events on our business, results of operations, and overall financial position remain uncertain. See the section titled "Risk Factors'' included under Part I, Item 1A of the fiscal 2026 Form 10-K for further discussion of the possible impact of these factors and other risks on our business.

In recent years, we have transitioned our business to a SaaS-first subscription model. As a result of those efforts, the share of SaaS ARR to total ARR has increased to 67%69% as of AprilJuly 30,31, 2026 from 62%63% as of AprilJuly 30,31, 2025. We believe the share of ARR generated by our SaaS solution will continue to increase over time.

Our dollar-based net retention rate has decreased to 113% as of AprilJuly 30,31, 2026 from 115%114% as of AprilJuly 30,31, 2025. We continue to focus on growing our product portfolio, increasing our SaaS mix, and expanding customer relationships over time through cross-selling and up-selling.

Cost of services and other revenue consists primarily of (1i) employee-related costs of professional services and training organizations, equity-based compensation, travel-related costs, facilities costs, and contractor costs to supplement staff levels; and (2ii) amortization expense for developed technology acquired and third-party royalties related to perpetual licenses.

(2) Amounts for the period during February 2025 prior to the Corporate Conversion have been retrospectively adjusted to give effect to the Corporate Conversion described in Note 1 Description of Business and Summary of Significant Accounting Policies in the notes to our consolidated financial statements included in this Quarterly Report. These amounts do not consider the shares of common stock sold in our IPO or the Class A Units considered preferred shares that were converted into common stock and issued upon the closing of our IPO.

Comparison of the Three Months Ended AprilJuly 30,31, 2026 and 2025

Subscription Revenue. Subscription revenue increased by $50.5$47.3 million, or 23%,19%, for the three months ended AprilJuly 30,31, 2026 compared to the three months ended AprilJuly 30,31, 20252025, primarily due to an increase in SaaS revenue and term subscription revenue from our shift in focus on selling subscriptions to new customers and expanding our footprint with existing customers.

Services and Other Revenue. Services and other revenue decreased by $0.8$2.8 million, or 5%17%, for the three months ended AprilJuly 30,31, 2026 compared to the three months ended AprilJuly 30,31, 2025. This decrease was primarily a result of a strategic shift toward selling a higher proportion of professional services and training on a subscription basis.

Cost of Subscription Revenue. Cost of subscription revenue increased $4.7$13.7 million, or 6%,19%, for the three months ended AprilJuly 30,31, 2026 compared to the three months ended AprilJuly 30,31, 20252025, primarily due to an increase in software and hosting costs of $5.7 million driven by the increase in sales of SaaS subscriptions, an increase in employee-related costs of $5.6$4.4 million due to higher headcount and increased investments in existing employees, an increase in software and hostinga costs of $4.1$2.2 million from the increase in sales of SaaS subscriptions, an increase in amortization of intangible assets of $0.8 million, an increase in third-party royalties of $0.7 million, and an increase in amortization of capitalized software of $0.4 million. This increase was partially offset by a decrease of $6.7 million in equity-based compensation relatedprimarily due to thenew accelerationgrants ofissued equity-basedduring awardsfiscal fromyear the completion of our IPO and a decrease in partner costs of $0.3 million.2027.

Cost of Services and Other. Cost of services and other decreasedincreased by $8.5$3.2 million, or 31%,20%, for the three months ended AprilJuly 30,31, 2026 compared to the three months ended AprilJuly 30,31, 2025, primarily due to aan decreaseincrease in partner-related costs of $8.4$2.6 million driven by a greater use of partners to deliver professional services and a $0.9 million increase in equity-based compensation relatedprimarily due to thenew accelerationgrants ofissued equity-basedduring awardsfiscal uponyear the completion of our IPO.2027.

ServicesSubscription. and Other. Services and otherSubscription gross profit increased by $7.7$33.6 millionmillion, or 19%, during the three months ended AprilJuly 30,31, 2026 compared to the three months ended AprilJuly 30,31, 2025. The increase in gross profit and gross profit margin was primarily due to the decreasegrowth in employee-relatedsubscription costsrevenue. relatedSubscription togross accelerationmargin ofremained equity-basedconsistent awards fromwith the completionprior of our IPO.period.

Total gross profit increased by $53.5$27.6 million, or 42%,16%, during the three months ended AprilJuly 30,31, 2026 compared to the three months ended AprilJuly 30,31, 2025. The increase was primarily due to the growth in total revenue. Total gross profit margin wasremained 65%consistent forwith the threeprior months ended April 30, 2026 and 55% for the three months ended April 30, 2025. Total gross profit margin increased primarily due to the overall increase in subscription revenue, which was partially offset by the decrease in employee-related costs related to acceleration of equity-based awards from completion of our IPO.period.

Research and Development Expenses. Research and development expenses decreasedincreased by $5.6$14.1 million, or 8%,29%, for the three months ended AprilJuly 30,31, 2026 compared to the three months ended AprilJuly 30,31, 2025. This decreaseincrease was primarily driven by aan $12.4$8.3 million decreaseincrease in equity-based compensation relateddue to thenew accelerationgrants ofissued equity-basedduring awardsfiscal fromyear the2027, completion of our IPO, partially offset byand a $5.8$5.4 million increase in employee-basedemployee-related costs due to continued investment in talent related to the development of our products, and a $1.0 million increase in software and hosting costs.products.

Sales and Marketing Expenses. Sales and marketing expenses decreasedincreased by $10.3$24.6 million, or 6%,19%, for the three months ended AprilJuly 30,31, 2026 compared to the three months ended AprilJuly 30,31, 2025. This decreaseincrease was primarily driven by aan $31.0 million decrease in equity-based compensation related to the acceleration of equity-based awards from the completion of our IPO, partially offset by a $14.4$18.0 million increase in employee-related costs to support deeper penetration into our existing customer base and expansion into new industry verticals and geographic markets, a $4.7 million increase in advertisingequity-based andcompensation promotionprimarily costs,due to new grants issued during fiscal year 2027, a $0.6 million increase in software and hosting costs, a $0.4 million increase in professional services fees and a $0.1$2.2 million increase in travel expenses.expenses, and a $2.0 million increase in advertising and promotion costs.

General and Administrative Expenses. General and administrative expenses decreasedincreased by $35.8$7.1 million, or 44%,18%, for the three months ended AprilJuly 30,31, 2026 compared to the three months ended AprilJuly 30,31, 2025. This decreaseincrease was primarily driven by a $32.9$3.8 million decreaseincrease in equity-based compensation related to the acceleration of equity-based awards from the completion of our IPO, a $2.8 million decrease in employee-based costsprimarily due to lowernew contractgrants laborissued costs,during fiscal year 2027, a $2.4$2.3 million decrease in provision for credit losses compared to prior year, and a $0.3 million decreaseincrease in professional services fees.fees This decrease was partially offsetdriven by higher third-party consulting and advisory costs, and a $1.9$1.3 million increase in software and hosting costs.costs to support the growth of our business operations.

Total other income (expense), net decreasedincreased by $19.1$2.9 million, or 99%,271%, for the three months ended AprilJuly 30,31, 2026 compared to the three months ended AprilJuly 30,31, 2025. This decreaseincrease was primarily due to a $22.1$1.4 million net decrease in interest expense due to the full repaymentextinguishment of debt related to the remaining balance of debt issuance costs for our Term2022 LoansRevolving Credit Facility in the prior year, which included a $15.3 million loss on the extinguishment of debt and $6.7 million in related interest expense, partially offset by a $2.8$1.1 million increase in interest income due to higher average cash and cash equivalent balances, and a $0.4 million decrease in other expense related to foreign currency exchange loss.

The Company recorded an income tax benefit of $5.4$6.8 million for the three months ended AprilJuly 30,31, 2026 compared to an income tax benefit of $17.0$31.3 million for the three months ended AprilJuly 30,31, 2025, leading to a net benefit decrease of $11.6$24.5 million, or 68%,78%, year-over-year. The decrease was primarily due to the decreasenet discrete tax benefit for the change in lossvaluation beforeallowance incomefor taxesinterest expense and discretelyTexas recordedR&D credit carryforwards from changes in tax expense for equity-based compensationlaw in the three months period ended AprilJuly 30,31, 2026.2025.

For further information, refer to Note 11 “Income Taxes” in ourthe notes to our condensed consolidated financial statements included in this Quarterly Report.

In addition to our financial information presented in accordance with GAAP, we use certain “non-GAAP financial measures” to clarify and enhance our understanding of past performance.

We define adjusted gross profit as gross profit excluding equity-based compensation expense, payroll taxes related to awards that were accelerated upon the closing of our IPO and payroll taxes related to RSUs, amortization of acquired intangible assets, which includes impairment charges, impairment of intangible assets, acquisition-related expensesexpenses, and restructuring expenses..expenses. We define adjusted gross profit margin as adjusted gross profit divided by total revenue.

Our adjusted gross profit margin for the three and six months ended July 31, 2026 and 2025 has remained generally consistent in recent periods and reflects the high value-added nature of our offerings.

We define adjusted subscription gross profit as subscription gross profit excluding equity-based compensation expense, payroll taxes related to awards that were accelerated upon the closing of our IPO and payroll taxes related to RSUs, all of which were issued after the closing of the IPO, amortization of acquired intangible assets, which include impairment charges, impairment of intangible assets, acquisition-related expensesexpenses, and restructuring expenses. We define adjusted subscription gross profit margin as adjusted subscription gross profit divided by subscription revenue.

Our adjusted subscription gross profit margin for the three and six months ended AprilJuly 30,31, 2026 and 2025 has remained generally consistent and reflects the high value-added nature of our offerings.

Our adjusted income from operations and adjusted operating margin increased for the three monthsand ended April 30, 2026 compared to the threesix months ended AprilJuly 30,31, 2025,2026 primarilyand due2025 tohas remained generally consistent and reflects the growthhigh invalue-added nature of our overall business and increased operating leverage.offerings.

Our free cash flow for the threesix months ended AprilJuly 30,31, 2026 increased when compared to the threesix months ended AprilJuly 30,31, 2025, primarily due to a lower net operating loss from operations as a result of higher revenue growth compared to the prior period. Free cash flow for the threesix months ended AprilJuly 30,31, 2025 includes $78.5 million of cash paid to settle equity related awards, cash awards and their associated payroll taxes upon the closing of our IPO, $36.6$36.7 million in cash paid for interest expense related to our 2022 Credit Agreement, and $9.3 million of cash paid for fees under our advisory services agreement with Thoma Bravo, which was terminated upon the closing of our IPO.

We believe we have sufficient sources of funding to meet our business requirements for the next 12 months and in the longer term. Our primary sources of liquidity are cash flows from operations and proceeds from the IPO, which are supplemented by our undrawn 2025 Revolving Credit Facility. As of AprilJuly 30,31, 2026, we had cash and cash equivalents totaling $390.8$309.9 million. Our primary uses of liquidity are operating expenses, working capital requirements, capital expendituresexpenditures, and acquisitions.

Although cash flows from operations have historically been historically negative, inwe eachhad fiscalpositive quartercash sinceflow from operations for the threeyear ended January 31, 2026 and for the six months ended July 31, 2025 through the three months ended April 30, 2026, we have had positive cash flows from operations.2026. We expect to continue to incur positive cash flows from operations in the foreseeable future.

To the extent existing cash and cash equivalents are not sufficient to fund future activities, we may borrow under our 2025 Revolving Credit Facility or seek to raise additional funds through equity, equity-linkedequity-linked, or debt financings. WeAlso, we may continue to enter into agreements or letters of intent with respect to potential investments in, or acquisitions of, complementary businesses, services or technologies, which could also require us to seek additional equity financing, incur indebtedness or use cash resources. In the event that additional financing is required from outside sources, we may not be able to raise it on terms acceptable to us or at all. If we are unable to raise additional capital when desired, or if we cannot expand our operations or otherwise capitalize on our business opportunities because we lack sufficient capital, our business, operating results and financial condition would be adversely affected.