​

​

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

​

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☐☒

​

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act).   Yes ☐   No ⌧

​

The registrantaggregate market value of voting stock held by non-affiliates of the Registrant was not a public company$838.0 million as of June 30, 2020, the last business day of itsthe Registrant’s most recently completed second fiscal quarter and therefore, cannot calculate the aggregate market value(based on a closing price of its$32.09 per share). Shares of common stock held by non-affiliates aseach executive officer, director, and holder of 5% or more of the outstanding common stock have been excluded in that such date.persons may be deemed to be affiliates. This determination of affiliate status is not necessarily a conclusive determination for other purposes.

​

On March 2, 2020,February 17, 2021, the Registrant had 79,731,03181,371,147 shares of common stock, $0.001 par value, outstanding.

​

​

DOCUMENTS INCORPORATED BY REFERENCE

​

Portions of the information called for by Part III of this Annual Report on Form 10-K isare hereby incorporated by reference from the definitive proxy statement for the Registrant’s annual meeting of stockholders, which will be filed with the Securities and Exchange Commission not later than 120 days after the Registrant’s fiscal year ended December 31, 2019.2020.

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

PING IDENTITY HOLDING CORP.

FORM 10-K

For the Fiscal Year Ended December 31, 20192020

TABLE OF CONTENTS

​

​

Table of Contents

Forward-Looking Statements

​

In addition to historical consolidated financial information, this Annual Report on Form 10-K contains “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995 that involve substantial risks and uncertainties. All statements other than statements of historical fact included in this Annual Report on Form 10-K are forward-looking statements. These statements may include words such as “anticipate,” “estimate,” “expect,” “project,” “plan,” “intend,” “believe,” “may,” “will,” “should,” “can have,” “likely” and other words and terms of similar meaning in connection with any discussion of the timing or nature of future operating or financial performance or other events. For example, all statements we make relating to our estimated and projected costs, expenditures, cash flows, growth rates and financial results or our plans and objectives for future operations, growth initiatives, or strategies are forward-looking statements. All forward-looking statements are subject to risks and uncertainties that may cause actual results to differ materially from those that we expected. Specific factors that could cause such a difference include, but are not limited to, those set forth under Item 1A. “Risk Factors” and other important factors disclosed previously in our other filings with the SECSecurities and Exchange Commission (“SEC”) which include, but are not limited to:

​to, the risks detailed in “Risk Factors—Risk Factor Summary.”

Table of Contents

PART I.

​

Item 1. Business

​

Our Mission

Our mission is to secure the digital world through Intelligent Identity.

Overview

Ping Identity is pioneeringthe Intelligent Identity.Identity solution for the enterprise. We enable secure accesscompanies to any service, application or application program interface (“API”) from any device. Ourachieve Zero Trust identity-defined security and more personalized, streamlined user experiences. The Ping Intelligent Identity Platform canprovides customers, workforce and partners with secure, convenient access to their applications whether they are software-as-a-service (“SaaS”), mobile, in the cloud or on-premise. We leverage artificial intelligence (“AI”) and machine learning (“ML”) to analyze device, network, application and user behavior data to make real-time authentication and security control decisions, enhancing the user experience. Our platform is designed to detect anomalies and automatically insert additional security measures, such as multi-factor authentication, only when necessary. We built our platform to meet the requirements of the most demanding enterprises.enterprises, including over 60% of the Fortune 100. Our cloud-based platform can be deployed across cloud, hybridhas differentiated deployment flexibility to support multi-cloud and on-premise infrastructures to meet the diverse and demanding requirements of large enterprise customers. Our platform offers a comprehensive suite of turnkey integrations and is able to scale to millions of identities and thousands of cloud and on-premise applications in a single deployment.

​

Enterprises are undergoing an acceleration of their digital transformation initiatives as they seek to adapt to work-from-home realities, create new revenue streams, transition to new digital business models and increase customer engagement. Concurrently, enterprises are becoming more distributed as the adoption of cloud, mobile, global and remote workforces and the Internet of Things (“IoT”) movesmove data, applications and access requirements beyond the traditional network perimeter. These enterprises must contend with an evolving cyber-threat landscape, new privacy directives and stringent regulatory requirements. As a result, enterprises require Intelligent Identity solutions that proactively ensure the right user has authorized access to resources at the appropriate time.

​

OurThe Ping Intelligent Identity Platform can secure all primary identity use cases, including customer, workforce, partner and IoT. For example, enterprises can use our platform to enhance their customers’ user experience by creating a single ID and login across web and mobile properties. For the year ended December 31, 2019, 42%2020, 45% of our subscription revenue was derived from the customer use case. Enterprises can also use our platform to provide their workforce and commercial partners with secure, seamless access from any device to the applications, data and APIs they need to be productive. Enterprises are increasingly using our platform to manage and authenticate IoT devices, such as connected vehicles and consumer devices.

​

OurThe Ping Intelligent Identity Platform is comprised of sixmultiple solutions that can be purchased individually or integrated as a more complete set of integrated offeringssolutions for the customer, workforce, partner or IoT use case:

​

Table of Contents

We have spent over a decade building a comprehensive suite of turnkey integrations designed to ensure that enterprises can use our platform to secure their applications wall-to-wall,entire application portfolio no matter where it is deployed, facilitating rapid time-to-value and easier deployment and rapid time-to-value.management.

​

​Table of Contents

Our Growth Strategy

The key elements of our growth strategy include:

​

Table of Contents

OurThe Ping Intelligent Identity Platform Supports All Primary Use Cases

​

Table of Contents

integrations for a wide range of applications, cloud services, IT infrastructures and directory solutions, including third party directories, as well as our Directory solution. Within our SSO solution, our adaptive authentication policies enable organizations to predictively authenticate users in real-time based on device, network, application and user behavior data. Our advanced SSO features include:

​

Multi-Factor Authentication. Our adaptive MFA solution helps optimize the balance between security and user experience by enforcing additional authentication factors as necessary when accessing sensitive resources, conducting high-value transactions and engaging in other elevated risk scenarios. Adaptive MFA allows users to conduct low-value transactions from trusted devices without interruption, while prompting MFA during high-

Table of Contents

Directory. Our Directory solution securely stores and manages sensitive identity and device data at scale. It includes real-time, bidirectional synchronization capabilities to migrate or sync data from multiple sources into a secure, scalable and unified profile. This single source of data is designed to provide a consistent experience across digital business interactions, no matter where the applications and services are deployed. Our advanced Directory features include:

​

Table of Contents

Risk Management. Our Risk Management solution enables organizations to make smarter authentication decisions by using machine learning and analytics to detect malicious activity. Our solution continuously analyzes multiple risk signals to give organizations in-depth user behavior insights to understand the risk in giving a user access to a resource or application. This provides enterprises with the ability to make real-time authentication decisions in determining if a user can access a resource, require additional assurances through step-up authentication or is denied access. Our Risk Management solution enables organizations to create intelligence-based policies to apply the appropriate strong authentication for resources or provide trusted users with a passwordless experience. Our Risk Management features include:

Identity Verification. Our Identity Verification solution enables enterprises to allow their customers to securely and conveniently verify their identity during enrollment and registration. This provides organizations with an increased level of assurance in the identity of their customers during the onboarding process to prevent fraudulent account creation and activity. Our solution can be integrated into an organization’s mobile application to prompt customers to provide a live face capture and to scan a government-issued ID using their mobile device. The customer’s identity is verified using our solution by matching the live face capture to the image on the government ID and validating the identification document for authenticity. Our Identity Verification solution enables enterprises in regulated industries, such as financial services and insurance, to meet Know Your Customer (“KYC”) requirements by providing customers a method to prove their identity. Our advanced Identity Verification features include:

Table of Contents

API Intelligence. Our API Intelligence solution can apply AI and ML to continuously inspect, report and act on all API activity. Our solution is purpose-built to recognize and respond to attacks that are designed to exploit the unique vulnerabilities of individual APIs. These attacks often go undetected by traditional security tools, such as application firewalls and API gateways. Our advanced API Intelligence features include:

​

Our Technology

Our technology has been developed to the highest standards for security, performance, scale and interoperability. Our platform is built on the following core tenets:

​

Table of Contents

​

Sales and Marketing

Sales

​

We sell our solutions primarily through direct sales. We have a stratified direct sales organization that is organized by customer size and the type of solution and deployment. Within our sales organization, our strategic account executives focus on the largest and most complex enterprises primarily in the Fortune 1000, that typically purchase multiple products or deployment options. In addition,the last two years, we have also built a sales team focused more intensely on the Global 3000, with account executives that target less complex enterprise customers that typically purchase a single solutioncapability or deployment option initially.

Table of 61 in 2019.Contents

​

Partnerships and Strategic Relationships

The PingPartner Network is comprised of key partnerships across our solution provider and technology alliance programs. This global network delivers expertise, value-added services and technology that are critical to the success of our customers.

​

Solution Provider Program

​

We have built strong relationships with channel partners, system integrators and technology partners that have allowed us to generate new business opportunities and enhance existing practices such as strategic planning, program management, architecture, design, implementation, ongoing change management and support.

​

Technology Alliance

​

We have built a broad ecosystem of over 100 technology partners. Our Technology Alliance Partner ecosystem spans the landscape of IAM and related technologies, giving our customers access to comprehensive, cross-application, integrated solutions. Our technology partners expand and extend the value of their solutions, and our solutions, by integrating their technology with ourthe Ping Intelligent Identity Platform. Additionally, our partners provide us with complementary technology and sales and marketing collateral that help us to more effectively sell together.

​

We partner with Microsoft, and this partnership has led to key product integrations. Through our collaboration, customers can leverage our platform to connect to the Microsoft Azure or Office365 services and enjoy rapid

​Table of Contents

Research and Development

​

Innovation is at the core of what we do. Approximately one-third of our employees are devoted to research and development. Our research and development efforts are focused on building industry leading solutions, addressing all primary use cases, enhancing deployment flexibility and providing seamless integration across cloud and on-premise applications. We believe that the ongoing and timely development of new solutions and features is imperative to maintaining our competitive position. We continue to invest in our solutions across our development centers in:in Denver, Colorado; Austin, Texas; Tel Aviv, Israel; Vancouver, Canada; and Bangalore, India.

​

Intellectual Property

​

Our success depends in part on our ability to protect our intellectual property. We rely on copyrights and trade secret laws, confidentiality procedures, employment agreements and proprietary information and invention assignment agreements, trademarks and patents to protect our intellectual property rights.

​

We control access to, and use of, our solutions and other confidential information through the use of internal and external controls, including contractual protections with employees, contractors, customers and partners, and our software is protected by U.S. and international copyright and trade secret laws. Despite our efforts to protect our trade secrets and proprietary rights through intellectual property rights, licenses and confidentiality agreements, unauthorized parties may still copy or otherwise obtain and use our software and technology, and such risks may increase as we attempt to expand into jurisdictions where such rights are less easily enforced, or are more subject to reverse engineering or misappropriation due to local legal requirements.

​

As of December 31, 2019,2020, we had 1634 issued United States patents and 816 patent applications pending in the United States relating to certain aspects of our technology. Our issued United States patents expire between December 14, 2031 and July 31, 2036.October 12, 2038. We cannot assure you whether any of our patent applications will result in the issuance of a patent or whether the examination process will require us to narrow our claims. Any of our

​Table of Contents

We believe the principal competitive factors in the IAM market include: (1) the ability to address all primary use cases from one platform; (2) the ability to deploy in large, complex hybrid IT environments; (3) the ability to integrate easily with all applications (cloud and on-premise); (4) technology uptime, reliability, scalability and performance; (5) the ability to support open standards; and (6) customer, technology and platform support. We believe we compete favorably on these factors.

​

EmployeesHuman Capital Resources

​

As of December 31, 2019,2020, we had a total of 953 full timeemployed 1,022 employees of which approximately one-third were in researchacross six global regions including Australia, Canada, Europe, India, Israel and development.the U.S.

We recognize that our ability to attract, develop and retain talent is key to our success. We have a strong corporate culture, high employeeemployment engagement and consider our relationship with employees very strong, with 93% of employees recommending us as a great place to work. We are consistently ranked by third parties as oneproud of the consistent work ethic our employees displayed during 2020; we pivoted quickly and efficiently to a remote working environment because of the flexibility and resiliency of our committed employee base.

At Ping Identity, trust is core to who we are and what we do. We know that how we work together is just as important as what we accomplish. We believe that our customers, partners and employees are on the same team striving for the same goals, and the best places to work.teams rely on a foundation of trust. We treat all who enter the Ping Identity ecosystem with respect and honesty, and always keep our commitments.

​

​

Corporate Information

​

Our principal executive offices are located at 1001 17th Street, Suite 100, Denver, Colorado 80202. Our telephone number is (303) 468-2900. Our website address is www.pingidentity.com. The information contained on, or that can be accessed through, our website is not incorporated by reference into this annual report, and you should not consider any information contained on, or that can be accessed through, our website as part of this Annual Report on Form 10-K. We are a holding company and all of our business operations are conducted through our subsidiaries. We were incorporated in 2016 as Roaring Fork Holding, Inc. and changed our name to Ping Identity Holding Corp. in connection with our initial public offering (“IPO”).

​

This Annual Report on Form 10-K includes our trademarks and service marks such as “Ping Identity” and “Identiverse,” which are protected under applicable intellectual property laws and are the property of us or our subsidiaries. This report also contains trademarks, service marks, trade names and copyrights of other companies, such as “Amazon,” “Google” and “Microsoft,” which are the property of their respective owners. Solely for convenience, trademarks and trade names referred to in this report may appear without the ® or ™

Table of Contents

Item 1A. Risk Factors

​

A description of the risks and uncertainties associated with our business is set forth below. You should carefully consider the risks described below, together with the financial and other information contained in this Annual Report on Form 10-K. If any of the following risks actually occurs, our business, financial condition, results of operations, cash flows and prospects could be materially and adversely affected. As a result, the trading price of our common stock could decline and you could lose all or part of your investment in our common stock.

Risk Factor Summary

There are a number of risks related to our business, our indebtedness, and our common stock. You should carefully consider all the information presented in this section entitled “Risk Factors” in this Annual Report on Form 10-K. Some of the principal risks include the following:

​

Risks relating to our business include, among others:

​

Risks relating to our indebtedness include, among others:

​

Table of Contents

Risks relating to our common stock include, among others:

​

Risks Relating to Our Business

If we fail to adapt to rapid technological change, evolving industry standards and changing customer needs, requirements or preferences, our ability to remain competitive could be impaired.

The IAM market is characterized by rapid technological change, evolving industry standards and changing regulations, as well as changing customer needs, requirements and preferences. The success of our business will depend, in part, on our ability to anticipate, adapt and respond effectively to these changes on a timely and cost-effective basis. In addition, as our customers’ technologies and business plans grow more complex, we expect them to face new and increasing challenges. Our customers require that our platform effectively identify and respond to these challenges without disrupting the performance of our customers’ IT systems or interrupting their business operations. As a result, we must continually modify and improve our offerings in response to changes in our customers’ IT infrastructures and operational needs or end-user preferences. The success of any enhancement to our existing offerings or the deployment of new offerings depends on several

Table of Contents

factors, including the timely completion and market acceptance of our enhancements or new offerings. Any enhancement to our existing offerings or new offerings that we develop and introduce involves significant commitment of time and resources and is subject to a number of risks and challenges including:

Table of Contents

based offerings could harm our margins, making it difficult to continue to justify the continued allocation of resources. Customers may require features and capabilities that our current solutions or solution packages do not have and that we may be unable to develop. If we are unable to develop and deploy cloud-based offerings alongside on-premise offerings that satisfy customer preferences in a timely and cost-effective manner, it may harm our ability to renew subscriptions with existing customers and to create or increase demand for our solutions or solution packages with new customers, and may adversely impact our financial condition and results of operations.

We face intense competition, especially from larger, well-established companies, and we may lack sufficient financial or other resources to maintain or improve our competitive position.

The IAM market is intensely competitive, and we expect competition to increase in the future from established competitors and new market entrants. We face competition from (1) legacy providers, (2) cloud-only providers and (3) homegrown solutions. Legacy providers include Broadcom, IBM and Oracle, among others. We also compete with cloud-only providers, such as Okta and OneLogin that primarily focus on the workforce use case. Microsoft also competes in our market and has tied its identity services to both its Azure and Office365 offerings. With the recent increase in large merger and acquisition transactions in the technology industry, particularly transactions involving cloud-based technologies, there is a greater likelihood that we will compete with other large technology companies in the future. For example, Amazon or Google could acquire or develop an IAM or identity security platform that competes directly with our solutions. These companies have significant name recognition, considerable resources and existing IT infrastructures and powerful economies of scale and scope, which allow them to rapidly develop and deploy new solutions. Many of our existing competitors have, and some of our potential competitors could have, substantial competitive advantages such as greater name

Table of Contents

The novel COVID-19 pandemic could materially adversely affect our business, operating results, financial condition and prospects.

The severity, magnitude and duration of the current COVID-19 pandemic is uncertain and rapidly changing. The COVID-19 pandemic has resulted in authorities implementing numerous measures to try to contain the virus, such as travel bans and restrictions, quarantines, shelter in place orders and shutdowns. These measures have impacted and may further impact all or portions of our facilities, workforce and operations, the behavior of our customers and consumers and the operations of our respective vendors and suppliers. Concern over the impact of COVID-19 has delayed the purchasing decisions of prospective Ping Identity customers and caused certain customers to opt for shorter contract durations. While governmental authorities have taken measures to try to contain the COVID-19 pandemic, there is considerable uncertainty regarding such measures and potential future measures. There is no certainty that measures taken by governmental authorities will be sufficient to mitigate the risks posed by the COVID-19 pandemic, and our ability to perform critical functions could be harmed.

While most of our operations can be performed remotely, there is no guarantee that we will be as effective while working remotely because our team is dispersed, many employees may have additional personal needs to attend to (such as looking after children as a result of school closures or family who become sick), and employees may become sick themselves and be unable to work. Decreased effectiveness of our team could adversely affect our results due to our inability to meet in person with potential customers, cancellation and inability to participate in conferences and other industry events that lead to sales generation, longer time periods to review and approve work product and a corresponding reduction in innovation, longer time to respond to platform performance issues, or other decreases in productivity that could seriously harm our business. Significant management time and resources may be diverted from our ordinary business operations in order to develop, implement and manage workplace safety strategies and conditions as we attempt to return to office workplaces. Further, we may decide to postpone or cancel planned investments in our business in response to changes in our business as a result of the spread of COVID-19, or we may have to reduce headcount in certain areas of our business as a result of the economic impact of COVID-19, which may impact our ability to respond to our customers’ needs and fulfill contractual obligations. In addition, as a result of financial or operational difficulties, our suppliers, system integrators and channel partners may experience delays or interruptions in their ability to provide services to us or our customers, if they are able to do so at all, which could interrupt our customers’ access to our services which could adversely affect their perception of our platform’s reliability and result in increased liability exposure. We rely upon third parties for certain critical inputs to our business and solutions, such as data centers and technology infrastructure. Any disruptions to services provided to us by third parties that we rely upon to provide our solutions, including as a result of actions outside of our control, could significantly impact the continued performance of such solutions. This uncertain environment may also lead to increased cyber and fraud risk related to COVID-19, as cybercriminals attempt to profit from the disruption, given the increase in online transaction activity. The dispersed nature of our workforce may also increase our cyber and fraud risk as our information technology and security teams must manage and secure equipment used by our employees remotely, and with our employees working more independently, there are increased opportunities for humor error. We could experience direct financial loss, or be exposed to contractual or reputational liability, if we were affected by cyber security attacks.

The COVID-19 pandemic has also significantly increased economic and demand uncertainty, and has led to disruption and volatility in the global capital markets, which can increase the cost of capital and adversely impact access to capital. The COVID-19 pandemic has caused an economic slowdown, and it is possible that it could cause a global recession. The COVID-19 pandemic has caused a general decrease in consumer spending and decrease in consumer confidence. Our revenue, results of operations and cash flows depend on the overall demand for our solutions and solution packages. Concerns about the systemic impact of a potential widespread recession (in the United States or internationally), geopolitical issues or the availability and cost of credit have led to increased market volatility, decreased consumer confidence and diminished growth expectations in the U.S. economy and abroad, which in turn could result in reductions in IT, IAM and identity security spending by our existing and prospective customers, while also disrupting sales channels, marketing activities and supply chains for an unknown period of time until the outbreak is contained. Some of our customers have experienced and may continue to experience financial hardship that may result in delayed or uncollectible payments. To add to the uncertainty, it is unclear when an economic recovery could start and what

Table of Contents

a recovery will look like after this unprecedented shutdown of the economy. All of these factors are expected to have a negative impact on our revenue, cash flows and results of operations.

The severity, magnitude and duration of the current COVID-19 pandemic is uncertain, rapidly changing and hard to predict and depends on events beyond our knowledge or control. These and other impacts of the COVID-19 pandemic could have the effect of heightening many of the other risks described in the “Risk Factors” section, such as those relating to our reputation, product sales, results of operations or financial condition. We might not be able to predict or respond to all impacts on a timely basis to prevent near- or long-term adverse impacts to our results. As a result, we cannot at this time predict the impact of the COVID-19 pandemic, but it could have a material adverse effect on our business, results of operations, financial condition and cash flows.

A network or data security incident may allow unauthorized access to our network or data or our customers’ data, harm our reputation, create additional liability and adversely impact our financial results.

Increasingly, companies are subject to a wide variety of attacks on their networks and systems. In addition to threats from traditional computer hackers, malicious code (such as malware, viruses, worms and ransomware), employee theft or misuse, password spraying, phishing and distributed denial-of-service (“DDOS”) attacks, we now also face threats from sophisticated nation-state and nation-state supported actors who engage in attacks (including advanced persistent threat intrusions) that add to the risks to our internal networks, our platform, our third-party service providers and our customers’ systems and the information that they store and process. Despite significant efforts to create security barriers to safeguard against such threats, it is virtually impossible for us to entirely mitigate these risks. As a well-known provider of IAM solutions, we pose an attractive target for such attacks. The security measures we have integrated into our internal networks and platform, which are designed to detect unauthorized activity and prevent or minimize security breaches, may not function as expected or may not be sufficient to protect our internal networks and platform against certain attacks. In addition, techniques used to sabotage or obtain unauthorized access to networks in which data is stored or through which data is transmitted change frequently and generally are not recognized until launched against a target. As a result, we may be unable to anticipate these techniques or implement adequate preventative measures to prevent an electronic intrusion into our networks.

If a breach of customer data security or unauthorized access to customer systems through our platform were to occur, as a result of third-party action, employee error, malfeasance or otherwise, and the confidentiality, integrity or availability of our customers’ data or systems was disrupted, we could incur significant liability to our customers and to individuals or businesses whose information we process, and our platform may be perceived as less desirable, which could negatively affect our business and damage our reputation. In such event, the potential liability exposure to our customers under our contracts could significantly exceed the revenue associated with those contracts. Our ability to retain existing customers, expand use case and solution or

Table of Contents

mitigation and remediation expenses, and have a negative impact on our ability to attract and retain new customers. Furthermore, any such incident, including a breach of our customers’ systems, could compromise our networks or networks secured by our solutions, creating system disruptions or slowdowns and exploiting security vulnerabilities of our or our customers’ networks, and the information stored on our or our customers’ systems could be accessed or disclosed without authorization, altered, lost or stolen, which could subject us to liability and cause us financial harm. An actual or perceived breach of our networks, our customers’ networks or other networks secured by our solutions, whether or not due to a vulnerability in our platform, may also undermine confidence in our platform or our industry and result in expenditure of significant resources in efforts to analyze, correct, eliminate or work around errors or defects, delayed or lost revenue, delay in the development or release of new solutions, solution packages or services, an increase in collection cycles for accounts receivable, damage to our brand and reputation, negative publicity, loss of channel partners, customers and sales, increased costs to remedy any problem, increased insurance expense and costly litigation. In addition, if a high profilehigh-profile security incident occurs with respect to another IAM solution provider, our customers and potential customers may lose trust in the value of the IAM solution business model generally, including the security of our solutions, which could adversely impact our ability to retain existing customers or attract new ones, potentially causing a negative impact on our business. Any of these negative outcomes could adversely impact market acceptance of our solutions or solution packages and could adversely affect our business, results of operations and financial condition.

Third parties may attempt to fraudulently induce employees or customers into disclosing sensitive information such as user names, passwords or other information or otherwise compromise the security of our internal networks, electronic systems and/or physical facilities or those of our third-party service providers, in order to gain access to our data or our customers’ data, which could result in significant legal and financial exposure, a loss of confidence in the security of our platform, interruptions or malfunctions in our operations, and, ultimately, harm to our future business prospects and revenue. We may be required to expend significant capital and financial resources to protect against such threats or to alleviate problems caused by breaches in security.

Our future revenue and operating results will be harmed if we are unable to acquire new customers, if our customers do not renew their arrangements with us, or if we are unable to expand sales to our existing customers or develop new solutions and solution packages that achieve market acceptance.

To continue to grow our business, it is important that we continue to acquire new customers. Our success in adding new customers depends on numerous factors, including our ability to (1) offer a compelling Intelligent Identity Platform and effective solutions and solution packages, (2) execute our sales and marketing strategy, (3) attract, effectively train and retain new sales, marketing, professional services and support personnel in the markets we pursue, (4) develop or expand relationships with channel partners, system integrators and technology partners, (5) expand into new geographies and vertical markets, (6) deploy our platform, solutions and solution packages for new customers and (7) provide quality customer support once deployed.

Table of Contents

implemented, their ability to integrate our solutions and solution packages with existing technologies and our pricing model. As we expand our market reach, we may experience difficulties in gaining traction and raising awareness among potential customers regarding the critical role that our solutions play in securing their businesses and we may face more competitive pressure in such markets.

If our new solutions and/or solution packages do not achieve adequate acceptance in the market or if we fail to effectively incorporate features and capabilities that our customers expect, our competitive position could be impaired, and our potential to generate new revenue or to retain existing revenue could be diminished. The adverse effect on our financial results may be particularly acute because of the significant research, development, marketing, sales and other expenses we will have incurred in connection with the new solutions and solution packages and our ability to introduce compelling new solutions and solution packages that address the requirements of our customers in light of the dynamic IAM market in which we operate.

If we are unable to successfully acquire new customers, retain our existing customers, expand sales to existing customers or introduce new solutions and solution packages, our business, financial condition and operating results could be adversely affected.

If we fail to manage our growth effectively, we may be unable to execute our business plan, maintain high levels of service and customer satisfaction or adequately address competitive challenges.

We have experienced, and may continue to experience, rapid growth and organizational change, which has placed, and may continue to place, significant demands on our management and our operational and financial resources. Additionally, our organizational structure may become more complex as we improve our operational, financial and management controls, as well as our reporting systems and procedures. We may require significant capital expenditures and the allocation of valuable management resources to grow and change in these areas. If we fail to effectively manage our anticipated growth and change, the quality of our platform may suffer, which could negatively affect our brand and reputation and harm our ability to retain and attract customers and employees.

We currently have international operations in the United Kingdom, Canada, Australia, France, Germany, India, Israel, the Netherlands and Switzerland, and we may continue to expand our international operations in these jurisdictions and/or other countries in the future. Our expansion has placed, and our expected future growth will continue to place, a significant strain on our managerial, customer operations, research and development, sales and marketing, administrative, financial and other resources. If we are unable to manage our continued growth successfully, our business and results of operations could suffer.

In addition, as we expand our business, it is important that we continue to maintain a high level of customer service and satisfaction. As our customer base continues to grow, we will need to expand our account management, customer service and other personnel, and our network of channel partners and system integrators, to provide personalized account management and customer service. If we are not able to continue

Table of Contents

could harm our business. In particular, the loss of services of our founder and Chief Executive Officer, Andre Durand, could significantly delay or prevent the achievement of our strategic objectives. Changes in our executive management team may also cause disruptions in, and harm to, our business.

Failure to effectively develop and expand our sales and marketing capabilities could harm our ability to increase our customer base and achieve broader market acceptance of our solutions and solution packages.

Our ability to increase our customer base and achieve broader market acceptance of our solutions and solution packages will depend on our ability to expand our sales and marketing operations. Our business will be harmed if our business development efforts do not generate a corresponding increase in revenue. We may not achieve anticipated revenue growth from expanding our direct sales force if we are unable to hire and develop talented direct sales personnel, if our new direct sales personnel are unable to achieve desired productivity levels in a reasonable period of time, or if we are unable to retain our existing direct sales personnel. There is significant competition for sales personnel with the advanced sales skills and technical knowledge we need. Selling our solutions and solution packages to sophisticated enterprise customers requires particularly talented sales personnel with the ability to communicate the transformative potential of our platform.

We must attract and retain highly qualified personnel in order to execute our growth plan.

Competition for highly qualified personnel is intense, especially for engineers experienced in designing and developing software and SaaS offerings and experienced sales professionals. In recent years, recruiting, hiring and retaining employees with expertise in our industry has become increasingly difficult as the demand for cybersecurity and identity professionals has increased as a result of the recent cybersecurity attacks on global corporations and governments. We have, from time to time experienced, and we expect to continue to experience, difficulty in hiring and retaining employees with appropriate qualifications. Many of the companies with which we compete for experienced personnel have greater resources than we have. If we hire employees from competitors or other companies, their former employers may attempt to assert that these employees or we have breached certain legal obligations, resulting in a diversion of our time and resources. If we fail to attract new personnel or fail to retain and motivate our current personnel, our business and future growth prospects could be harmed.

If there are interruptions or performance problems associated with our technology or infrastructure, our existing customers may experience service outages, and our new customers may experience delays in the deployment of our platform.

Our continued growth depends on the ability of our existing and potential customers to access our platform 24 hours a day, seven days a week, without interruption or degradation of performance. We have in the past and may in the future experience disruptions, outages and other performance problems with our infrastructure due to a variety of factors, including infrastructure changes, introductions of new functionality, human or software errors, capacity constraints, DDOS attacks or other security-related incidents. In some instances, we

Table of Contents

service provider fails to provide sufficient capacity to support our platform or otherwise experiences service outages, such failure could interrupt our customers’ access to our services, which could adversely affect their perception of our platform’s reliability and our revenue. Any disruptions in these services, including as a result of actions outside of our control, would significantly impact the continued performance of our solutions. In the future, these services may not be available to us on commercially reasonable terms, or at all. Any loss of the right to use any of these services could result in decreased functionality of our solutions until equivalent technology is either developed by us or, if available from another provider, is identified, obtained and integrated into our infrastructure. If we do not accurately predict our infrastructure capacity requirements, our customers could experience service shortfalls. We may also be unable to effectively address capacity constraints, upgrade our systems as needed and continually develop our technology and network architecture to accommodate actual and anticipated changes in technology.

Our platform is accessed by a large number of customers, often at the same time. As we continue to expand the number of our customers and solutions and solution packages available to our customers, we may not be able to scale our technology to accommodate the increased capacity requirements, which may result in interruptions or delays in service. In addition, the failure of third-party cloud infrastructure providers, third-party internet service providers or other third-party service providers whose services are integrated with our platform to meet our capacity requirements could result in interruptions or delays in access to our platform or impede our ability to scale our operations. In the event that our service agreements are terminated with our cloud infrastructure providers, or there is a lapse of service, interruption of internet service provider connectivity or damage to such providers’ facilities, we could experience interruptions in access to our platform as well as delays and additional expense in arranging new facilities and services.

Any of the above circumstances or events may harm our reputation, cause customers to terminate their agreements with us, impair our ability to obtain subscription renewals from existing customers, impair our ability to grow our customer base, result in the expenditure of significant financial, technical and engineering resources, subject us to financial penalties and liabilities under our service level agreements, and otherwise could adversely affect our business, results of operations and financial condition.

The delivery of our platform depends on AWS cloud infrastructure services.

Our SaaS offerings are hosted solely in AWS and our other offerings utilize the cloud infrastructure offered by AWS. Our operations depend on maintaining the configuration, architecture and interconnection specifications required by AWS. Although we have disaster recovery plans that utilize multiple AWS infrastructure locations, any incident affecting this infrastructure that may be caused by fire, flood, severe storm, earthquake, power loss, telecommunications failures, unauthorized intrusion, computer viruses and disabling devices, natural disasters, war, criminal act, military actions, terrorist attacks and other similar events beyond our control could negatively affect our platform. A prolonged AWS service disruption affecting our platform for any of the foregoing reasons could damage our reputation with current and potential customers, expose us to liability, cause us to lose customers or otherwise harm our business. In addition, since all of our cloud-based offerings utilize AWS cloud infrastructure services, in the event of a prolonged AWS services disruption we may not be able to find an alternative provider on commercially reasonable terms or in a timely manner, if at all. We may also incur

Table of Contents

relationships with customers and/or result in the loss of customers across one or more use case, solution or solution package.

Data privacy concerns, evolving regulations of cloud computing, cross-border data transfer restrictions and other domestic and foreign laws and regulations may limit the use and adoption of, or require modification of, our solutions, solution packages and services, which could adversely affect our business.

Laws and regulations related to the provision of services on the Internet are increasing, as federal, state and foreign governments continue to adopt new laws and regulations addressing data privacy and the collection, processing, storage and use of personal information. Internationally, many of the jurisdictions in which we operate have established their own data security and privacy legal frameworks with which we, or our customers, must comply. We have implemented various features and processes intended to enable our customers to better comply with applicable privacy and security requirements, but these features and processes do not guarantee compliance and may not guard against all potential privacy concerns.

For example, the European Union (the “EU”) adopted the GDPR, which became effective and enforceable across all then-current member states of the EU on May 25, 2018. Following the U.K.’sUnited Kingdom (the “U.K.”) withdrawal from the EU on January 31, 2020, pursuant to the transitional arrangements agreed between the U.K. and EU, the GDPR will continuecontinued to have effect in U.K. law, until December 31, 2020, in the same fashion as was the case prior to that withdrawal as if the U.K. remained a member state of the EU for such purposes. FollowingWhile the GDPR is no longer the law of the U.K. following December 31, 2020, it is likely thatits content falls into the retained law created by the European Union (Withdrawal) Act 2018 and U.K. data protection obligationslaw is expected to remain similar to the GDPR. On December 24, 2020, the EU and the U.K. reached a Trade and Cooperation Agreement, provisionally applicable since January 1, 2021, which permits continuity in data flows in the same manner as prior to the withdrawal of the GDPRU.K. until such time as official adequacy determinations can be made by the EU and the U.K., and there is no guarantee that an adequacy determination will continue to apply to U.K.-based organization’s processing of personal data in substantially unvaried form and fashion, for at least the short term thereafter.be reached. The GDPR applies to any company established in the EU as well as to those outside the EU if they process personal data in relation to the offering of goods or services to individuals in the EU and/or the monitoring of their behavior. The GDPR enhances data protection obligations for both processors and controllers of personal data, including by extending the rights available to affected data subjects, materially expanding the definition of what is expressly noted to constitute personal data, requiring additional disclosures about how personal data is to be used, and imposing limitations on retention of personal data, creating mandatory data breach notification requirements in certain circumstances, and establishing onerous new obligations on services providers who process personal data simply on behalf of others. Under the GDPR, fines of up to €20 million or up to 4% of an undertaking’s total worldwide annual turnover of the preceding financial year, whichever is higher, may be imposed. In addition to administrative fines, a wide variety of other potential enforcement powers are available to competent authorities in respect of potential and suspected violations of the GDPR, including extensive audit and inspection rights, and powers to order temporary or permanent bans on all or some processing of personal data carried out by noncompliant actors. Given the breadth and depth of changes in data protection obligations, complying with its requirements has caused us to expend significant resources and such expenditures are likely to continue into the near future as we respond to new interpretations, additional guidance and potential enforcement actions and patterns, and as we continue to negotiate data processing agreements with our customers and business partners. While we have taken steps to comply with the GDPR, and implementing legislation in applicable member states, including by seeking to establish appropriate lawful bases for the various processing activities we carry out as a controller, reviewing our security procedures, and entering into data processing agreements with relevant customers and business partners, we

Table of Contents

of certain personal information sharing and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. The CCPA may increase our compliance costs and potential liability. Some observers have noted that the CCPA could mark the beginning of a trend toward more stringent privacy legislation in the U.S., which could increase our potential liability and adversely affect our business.

Privacy and data protections laws and regulations are subject to new and differing interpretations and there may be significant inconsistency in laws and regulations among the jurisdictions in which we operate or provide our SaaS offerings. Legal and other regulatory requirements could restrict our ability to store and process data as part of our SaaS offerings, or, in some cases, impact our ability to provide our SaaS offerings in certain jurisdictions. Our inability to provide our offerings in certain jurisdictions, particularly China and Russia, as a result of their local data privacy frameworks may result in the loss of business opportunities from customers operating in, or seeking to expand into, those jurisdictions. In addition, we may seek to engage third party support providers in certain jurisdictions in order to comply with our customers’ data privacy concerns and such engagements may be costly.

Privacy and data protection laws and regulations may also impact our customers’ ability to deploy certain of our solutions and solution packages globally, to the extent they utilize our solutions and solution packages for storing personal information that they process. Additionally, if third parties that we work with violate applicable laws or our policies, such violations may also put our customers’ information at risk and could in turn have an adverse effect on our business. The costs of compliance with, and other burdens imposed by, data privacy laws, regulations and standards may require resources to create new solutions or solution packages or modify existing solutions or solution packages, could lead to us being subject to significant fines, penalties or liabilities for noncompliance, could lead to complex and protracted contract negotiations with respect to privacy and data protection terms, and may slow the pace at which we close sales transactions, any of which could harm our business.

The data protection landscape is rapidly evolving, and we expect that there will continue to be new proposed laws, regulations and industry standards concerning privacy, data protection and information security. We cannot yet determine the impact that such future laws, regulations and standards may have on our business. Such laws and regulations are often subject to differing interpretations and may be inconsistent among jurisdictions. Any failure or perceived failure by us to comply with federal, state or foreign laws or regulations, industry standards, contractual obligations or other legal obligations, with respect to any security incident, whether or not resulting in unauthorized access to, or acquisition, release or transfer of personal data or other data, may result in governmental enforcement actions and prosecutions, private litigation, fines and penalties, friction in our customer relationships or adverse publicity, and could cause our customers to lose trust in us, which could have an adverse effect on our reputation and business.

Around the world, there are numerous lawsuits in process against various technology companies that process personal data. If those lawsuits are successful, it could increase the likelihood that we may be exposed to liability for our own policies and practices concerning the processing of personal data and could hurt our business. Furthermore, the costs of compliance with, and other burdens imposed by, laws, regulations and policies concerning privacy and data security that are applicable to the businesses of our customers may limit the use and adoption of our platform and reduce overall demand for it.

In addition, if our platform is perceived to cause, or is otherwise unfavorably associated with, violations of privacy or data security requirements, it may subject us or our customers to public criticism and potential legal liability. Existing and potential laws and regulations concerning privacy and data security and increasing sensitivity of consumers to unauthorized processing of personal data may create negative public reactions to technologies, solutions, solution packages and services such as ours. Public concerns regarding personal data

Table of Contents

Our continued development of AI and ML is dependent, in part, on our customers’ willingness to allow us to use their data to develop the necessary algorithms. Concerns about data privacy may discourage customers from allowing us to use their data in this manner, which may limit our ability to continue to leverage AI and ML in ourthe Ping Intelligent Identity Platform.

Our quarterly operating results and other metrics are likely to vary significantly and be unpredictable, which could cause the trading price of our stock to decline.

Our operating results and other metrics have historically varied from period to period, and we expect that they will continue to do so as a result of a number of factors, many of which are outside of our control and may be difficult to predict, including:

Table of Contents

Any one of the factors above or the cumulative effect of some of the factors referred to above may result in significant fluctuations in our financial and other operating results, including fluctuations in our key metrics. This variability and unpredictability could result in our failing to meet the expectations of securities analysts or investors for any period. If we fail to meet or exceed such expectations for these or any other reasons, the market price of our shares could fall substantially and we could face costly lawsuits, including securities class action suits. In addition, a significant percentage of our operating expenses are fixed in nature and based on forecasted revenue and cash flow trends. Accordingly, in the event of revenue shortfalls, we are generally unable to mitigate the negative impact on margins or other operating results in the short term.

We may fail to meet or exceed the expectations of securities analysts and investors, and the market price for our common stock could decline. If one or more of the securities analysts who cover us change their recommendation regarding our stock adversely, the market price for our common stock could decline. Additionally, our stock price may be based on expectations, estimates or forecasts of our future performance that may be unrealistic or may not be achieved. Further, our stock price may be affected by financial media, including press reports and blogs.

Our revenue recognition policy and other factors may distort our financial results in any given period and make them difficult to predict.

Under accounting standards update No. 2014-09 (Topic 606), Revenue from Contracts with Customers (“ASC 606”), we recognize revenue when our customer obtains control of goods or services in an amount that reflects the consideration that we expect to receive in exchange for those goods or services. Our subscription revenue includes subscription term-based license revenue, which is recognized when we transfer control of the term-based license to the customer, and subscription SaaS and support and maintenance revenue, which is recognized ratably over the contract period. Because subscription term-based license revenue is recognized upfront, a single, large license in a given period may distort our operating results for that period. In contrast, the impact of agreements that are recognized ratably may take years to be fully reflected in our financial statements. Consequently, a significant increase or decline in our subscription SaaS and support and maintenance contracts in any one quarter will not be fully reflected in the results for that quarter, but will affect our revenue in future quarters. This also makes it challenging to forecast our revenue for future periods, as both the mix of solutions, solution packages and services we will sell in a given period, as well as the size of contracts, is difficult to predict.

Furthermore, the presentation of our financial results requires us to make estimates and assumptions that may affect revenue recognition. In some instances, we could reasonably use different estimates and assumptions, and changes in estimates are likely to occur from period to period. See “Item 8. Financial Statements — Note 2. Summary of Significant Accounting Policies.”

Given the foregoing factors, our actual results could differ significantly from our estimates, comparing our revenue and operating results on a period-to-period basis may not be meaningful, and our past results may not be indicative of our future performance.

If we fail to enhance our brand cost-effectively, our ability to expand our customer base will be impaired and our business, results of operations and financial condition may be adversely affected.

We believe that developing and maintaining awareness of our brand in a cost-effective manner is critical to achieving widespread acceptance of our existing and future solutions and solution packages and is an important

Table of Contents

solutions and solution packages to customers. In the past, our efforts to build our brand have involved significant expense. Brand promotion activities may not yield increased revenue, and even if they do, any increased revenue may not offset the expense we incur in building our brand. If we fail to successfully promote and maintain our brand, or incur substantial expense in an unsuccessful attempt to promote and maintain our brand, we may fail to attract new customers or retain our existing customers to the extent necessary to realize a sufficient return on our brand-building efforts, and our business, results of operations and financial condition could be adversely affected.

We are subject to anti-corruption, anti-bribery and similar laws, and non-compliance with such laws can subject us to criminal penalties or significant fines and harm our business and reputation.

We are subject to anti-corruption and anti-bribery and similar laws, such as the U.S. Foreign Corrupt Practices Act of 1977, as amended (the “FCPA”), the U.S. domestic bribery statute contained in 18 U.S.C. § 201, the U.S. Travel Act, the USA PATRIOT Act, the U.K. Bribery Act 2010 and other anti-corruption, anti-bribery and anti-money laundering laws in countries in which we conduct activities. Anti-corruption and anti-bribery laws have been enforced aggressively in recent years and are interpreted broadly and prohibit companies and their employees and agents from promising, authorizing, making, offering, soliciting, or accepting, directly or indirectly, improper payments or other improper benefits to or from any person whether in the public or private sector. As we increase our international sales and business, our risks under these laws may increase. Noncompliance with these laws could subject us to investigations, sanctions, settlements, prosecution, other enforcement actions, disgorgement of profits, significant fines, damages, other civil and criminal penalties or injunctions, adverse media coverage and other consequences. Any investigations, actions or sanctions could adversely affect our business, results of operations and financial condition.

We are subject to governmental export and import controls and economic sanctions laws that could impair our ability to compete in international markets and subject us to liability if we are not in full compliance with applicable laws.

Our business activities are subject to various restrictions under U.S. export and import controls and trade and economic sanctions laws, including the U.S. Commerce Department’s Export Administration Regulations, U.S. Customs regulations and various economic and trade sanctions regulations maintained by the U.S. Treasury Department’s Office of Foreign Assets Control. U.S. export control laws and U.S. economic sanctions laws include prohibitions on the sale or supply of certain products and services to U.S. embargoed or sanctioned countries, governments, persons and entities. Changes in our solutions, solution packages or services or changes in applicable export or import regulations may create delays in the introduction and sale of our solutions and solution packages in international markets, prevent our customers with international operations from deploying our solutions or solution packages or, in some cases, prevent the export or import of our solutions or solution packages to certain countries, governments, or persons altogether. Any decreased use of our solutions and solution packages or limitation on our ability to export or sell our solutions and solution packages would likely adversely affect our business.

Furthermore, we incorporate encryption technology into certain of our solutions. U.S. export control laws require authorization for the export of encryption items. In addition, various countries regulate the import of certain encryption technology, including through import permitting and licensing requirements, and have enacted laws that could limit our ability to deploy our solutions, solution packages and services or could limit our customers’ ability to implement our offerings and services in those countries. Obtaining the necessary authorizations, including any required license, for a particular transaction may be time-consuming, is not guaranteed, and may result in the delay or loss of sales opportunities.

Although we take precautions to prevent our solutions and solution packages from being provided in violation of U.S. export control and economic sanctions laws, our solutions and solution packages may have been in the past, and could in the future be, provided inadvertently in violation of such laws. If we fail to comply with U.S. export control and economic sanctions laws and regulations, we and certain of our employees could be

Table of Contents

addition, violations of such laws could result in negative consequences to us, including government investigations, penalties and harm to our reputation.

We function as a HIPAA “business associate” for certain of our customers and, as such, are subject to strict privacy and data security requirements. If we fail to comply with any of these requirements, we could be subject to significant liability, all of which can adversely affect our business as well as our ability to attract and retain new customers.

The Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”) and their respective implementing regulations, (“HIPAA”), imposes specified requirements relating to the privacy, security and transmission of individually identifiable health information. Among other things, HITECH makes HIPAA’s security standards directly applicable to “business associates.” We function as a business associate for certain of our customers that are HIPAA covered entities and service providers, and in that context we are regulated as a business associate for the purposes of HIPAA. If we are unable to comply with our obligations as a HIPAA business associate, we could face substantial civil and even criminal liability. HITECH imposes four tiers of civil monetary penalties and gives state attorneys general authority to file civil actions for damages or injunctions in federal courts to enforce the federal HIPAA laws and seek attorneys’ fees and costs associated with pursuing federal civil actions. In addition, many state laws govern the privacy and security of health information in certain circumstances, many of which differ from HIPAA and each other in significant ways and may not have the same effect.

As a business associate, we are required by HIPAA to maintain HIPAA-compliant business associate agreements with our customers that are HIPAA covered entities and service providers, as well as our subcontractors that access, maintain, create or transmit individually identifiable health information on our behalf for the rendering of services to our HIPAA covered entity and service provider customers. These agreements impose stringent data security and other obligations on us. If we or our subcontractors are unable to meet the requirements of any of these business associate agreements, we could face contractual liability under the applicable business associate agreement as well as possible civil and criminal liability under HIPAA, all of which can have an adverse impact on our business and generate negative publicity, which, in turn, can have an adverse impact on our ability to attract and retain customers.

We may be the subject of various legal proceedings which could have a material adverse effect on our business, financial condition or results of operations.

In the ordinary course of business, we may be involved in various litigation matters, including but not limited to commercial disputes, employee claims and class actions, and from time to time may be involved in governmental or regulatory investigations or similar matters arising out of our current or future business. Any claims asserted against us, regardless of merit or eventual outcome, could harm our reputation and have an adverse impact on our relationship with our customers and other third parties and could lead to additional related claims. Certain claims may seek injunctive relief, which could disrupt the ordinary conduct of our business and operations or increase our cost of doing business. Our insurance or indemnities may not cover all claims that may be asserted against us, and any claims asserted against us, regardless of merit or eventual outcome, may harm our reputation and cause us to expend resources in our defense. Furthermore, there is no guarantee that we will be successful in defending ourselves in future litigation or similar matters under various laws. Should the ultimate judgments or settlements in any future litigation or investigation significantly exceed our insurance coverage, they could adversely affect our business, results of operations and financial condition.

Our sales cycle is frequently long and unpredictable, and our sales efforts require considerable time and expense.

Since we primarily focus on selling our solutions and solution packages to enterprises, the timing of our sales can be difficult to predict. We and our channel partners are often required to spend significant time and resources to better educate and familiarize potential customers with the value proposition of our platform, solutions and solution packages. Customers often view the purchase of our solutions and solution packages as a strategic decision and significant investment and, as a result, frequently require considerable time to

Table of Contents

evaluate, test and qualify our platform, solutions and solution packages prior to purchasing our solutions and/or solution packages. In particular, for customers in highly-regulated industries, the selection of a security solution provider is a critical business decision due to the sensitive nature of these customers’ data, which results in particularly extensive evaluation prior to the selection of information security vendors. During the sales cycle, we expend significant time and money on sales and marketing and contract negotiation activities, which may not result in a sale. Additional factors that may influence the length and variability of our sales cycle include:

If our efforts in pursuing sales and customers are unsuccessful, or if our sales cycles lengthen, our revenue could be lower than expected, which would adversely affect our business, results of operations or financial condition.

Our growth strategy includes the acquisition of other businesses or technologies, and we may not be able to identify suitable acquisition targets or otherwise successfully implement our growth strategy.

In order to expand our business, we have made several acquisitions of businesses, products and technologies and expect to continue making similar acquisitions and possibly larger acquisitions as part of our growth strategy. The success of our future growth strategy will depend in part on our ability to identify, negotiate, complete and integrate the acquisition of businesses or technologies and, if necessary, to obtain satisfactory debt or equity financing to fund those acquisitions. We expect to continue evaluating potential strategic acquisitions of businesses, assets and technologies. However, we may not be able to identify suitable candidates, negotiate appropriate or favorable acquisition terms, obtain financing that may be needed to consummate such transactions or complete proposed acquisitions. Further, there is significant competition for acquisition and expansion opportunities in the IAM industry.

Acquisitions are inherently risky, and any acquisitions we complete may not be successful. Our past acquisitions and any acquisitions that we may undertake in the future involve numerous risks, including, but not limited to, the following:

Table of Contents

Table of Contents

Additionally, acquisitions or asset purchases made entirely or partially for cash may reduce our cash reserves or require us to incur additional debt under our credit agreements or otherwise. We may seek to obtain additional cash to fund an acquisition by selling equity or debt securities. We may be unable to secure the equity or debt funding necessary to finance future acquisitions on terms that are acceptable to us. If we finance

Table of Contents

of focused support, including premium support offerings, to fully realize the benefits of our solutions. Any failure by us to maintain the expected level of support could reduce customer satisfaction and hurt our customer retention, particularly with respect to our large enterprise customers. To the extent that we are unsuccessful in hiring, training and retaining adequate support resources, our ability to provide adequate and timely support to our customers will be negatively impacted, and our customers’ satisfaction with our solutions could be adversely

Table of Contents

Our growth is substantially dependent on the success of our strategic relationships with channel partners, technology partners and other third parties.

As part of our business development efforts, we anticipate that we will continue to depend on relationships with third parties, such as our channel partners and technology partners, to sell, market, build, operate and deploy our solutions and solution packages. Identifying these partners and maintaining these relationships requires significant time and resources. Our competitors may be effective in providing incentives to channel partners and other third parties to favor their solutions or services over subscriptions to our platform and a substantial number of our agreements with channel partners are non-exclusive such that those channel partners may offer customers the solutions of several different companies, including solutions that compete with ours. Our channel partners may cease marketing or reselling our platform with limited or no notice and without penalty. Our channel partners may also choose to promote our competitors’ solutions versus our own solutions and solution packages. If our technology partners fail to build, deploy or operate our solutions and/or solution packages in a manner that satisfies our customers, or if we fail to adequately negotiate and document the underlying agreement with such technology partners, our customers may seek direct recourse against us orus. In the event that a relationship with a technology partner deploying and operating our solution is terminated, we may be unable to properlyallocate the proper engineering resources to support the solution ifinternally, or the relationship with the technology partner is terminated.solution may become too costly to run ourselves. In addition, given the competitive landscape, acquisitions of our channel or technology partners by a competitor could adversely affect our customers, as these partners may no longer be in a position to sell, market, build, operate and/or deploy our solutions and solution packages.packages. Furthermore, some of these partners may themselves build competitive solutions that are or may become competitive with certain of our solutions and/or solution packages and then elect to no longer support or integrate with our platform. Lastly, we cannot accurately predict the impact of the COVID-19 pandemic on the business operations of these critical third parties, and thus may not be able to recoup any financial or strategic losses as a result of an unexpected termination of the underlying relationship. If we are unsuccessful in establishing or maintaining our relationships with critical third parties, our ability to compete in the marketplace or to grow our revenue could be impaired, and our results of operations may suffer. Even if we are successful, we cannot assure you that these relationships will result in increased customer usage of our solutions or increased revenue.

Adverse general and industry-specific economic and market conditions and reductions in IT and identity spending may reduce demand for our solutions and solution packages, which could harm our results of operations.

Our revenue, results of operations and cash flows depend on the overall demand for our solutions and solution packages. Concerns about the systemic impact of a potential widespread recession (in the United States or internationally), geopolitical issues or the availability and cost of credit could lead to increased market volatility, decreased consumer confidence and diminished growth expectations in the U.S. economy and abroad, which in turn could result in reductions in IT, IAM and identity security spending by our existing and prospective customers. For the year ended December 31, 2019, 31%2020, 33% of our revenue was derived from the financial services industry, including banking. Negative economic conditions, including in the financial services industry, may cause customers to reduce their IT spending. Prolonged economic slowdowns may result in customers delaying or canceling IT projects, choosing to focus on in-house development efforts or seeking to lower their costs by

Table of Contents

If our platform, solutions and solution packages do not effectively interoperate with our customers’ existing or future IT infrastructures, our business would be harmed.

Our success depends on the interoperability of our platform, solutions and solution packages with our customers’ IT infrastructures, including third-party operating systems, applications, data and devices that we have not developed and do not control. Any changes in such infrastructure, operating systems, applications, data or devices that degrade the functionality of our platform, solutions or solution packages or give preferential treatment to competitive solutions could adversely affect the adoption and usage of our platform. We may not be successful in quickly or cost effectively adapting our platform, solutions or solution packages to operate effectively with these operating systems, applications, data or devices. If it is difficult for our customers to access and use our platform, solutions or solution packages, or if our platform, solutions or solution packages cannot connect a broadening range of applications, data and devices, then our customer growth and retention may be harmed, and our business, results of operations and financial condition could be adversely affected. We rely on open standards for many integrations between our solutions and solution packages and third-party applications that our customers utilize, and in other instances on such third parties making available the necessary tools for us to create interoperability with their applications. If application providers were to move away from open standards, or if a critical, widely-utilized application provider were to adopt proprietary integration standards and not make them available for the purposes of facilitating interoperability with our platform, the utility of our solutions and solution packages for our customers would be decreased.

Our ability to introduce new solutions and features is dependent on adequate research and development resources and our ability to successfully complete acquisitions. If we do not adequately fund our research and development efforts or complete acquisitions successfully, we may not be able to compete effectively and our business and results of operations may be harmed.

To remain competitive, we must continue to offer new solutions and enhancements to our platform. This is particularly true as we further expand and diversify our capabilities. Maintaining adequate research and development resources, such as the appropriate personnel and development technology, to meet the demands of the market is essential. If we elect not to or are unable to develop solutions internally due to certain constraints, such as high employee turnover, lack of management ability or a lack of other research and development resources, we may choose to expand into a certain market or strategy via an acquisition for which we could potentially pay too much or fail to successfully integrate into our operations. Further, many of our competitors expend a considerably greater amount of funds on their respective research and development programs, and those that do not may be acquired by larger companies that would allocate greater resources to our competitors’ research and development programs. Our failure to maintain adequate research and development resources or to compete effectively with the research and development programs of our competitors would give an advantage to such competitors and our business, results of operations and financial condition could be adversely affected. Moreover, there is no assurance that our research and development or acquisition efforts will successfully anticipate market needs and result in significant new marketable solutions or enhancements to our solutions, design improvements, cost savings, revenues or other expected benefits. If we are unable to generate an adequate return on such investments, we may not be able to compete effectively and our business and results of operations may be materially and adversely affected.

Table of Contents

damage or interrupt computer, broadband or other communications systems and infrastructure at any time. Any of these events could cause system interruption, delays and loss of critical data, and could prevent us from providing access to our platform.

While we have backup systems for certain aspects of our operations, disaster recovery planning by its nature cannot be sufficient for all eventualities. In addition, we may not have adequate insurance coverage to compensate for losses from a major interruption. If any of these events were to occur, our business, results of operations and financial condition could be adversely affected.

We rely on software and services from other parties. Defects in or the loss of access to software or services from third parties could increase our costs and adversely affect the quality of our solutions.

We rely on third-party computer systems, broadband and other communications systems and service providers in providing access to our platform. Any interruptions, outages or delays in our systems and infrastructure, our business and/or third parties, or deterioration in the performance of these systems and infrastructure, could impair our ability to provide access to our platform. Our business would be disrupted if any of the third-party software or services we utilize, particularly with respect to third-party software or services embedded in our solutions, or functional equivalents thereof, were unavailable due to extended outages or interruptions or because they are no longer available on commercially reasonable terms or prices or at all.

In each case, we would be required to either seek licenses to software or services from other parties and redesign our solutions to function with such software or services or develop these components ourselves, which would result in increased costs and could result in delays in our solution and solution package launches and the release of new solution and solution package offerings until equivalent technology can be identified, licensed or developed, and integrated into our solutions. Furthermore, we might be forced to limit the features available in our current or future solutions. If these delays and feature limitations occur, our business, results of operations and financial condition could be adversely affected.

Real or perceived errors, failures, vulnerabilities or bugs in our solutions, including deployment complexity, could harm our business and results of operations.

Errors, failures, vulnerabilities or bugs may occur in our solutions, especially when updates are deployed or new solutions are rolled out. Our platform is often used in connection with large-scale computing environments with different operating systems, system management software, equipment and networking configurations, which may cause errors or failures of solutions. In addition, deployment of our solutions into complicated, large-scale computing environments may expose errors, failures, vulnerabilities or bugs in our solutions. Any such errors, failures, vulnerabilities or bugs may not be found until after they are deployed to our customers. Real or perceived errors, failures, vulnerabilities or bugs in our solutions could result in negative publicity, loss of customer data, loss of or delay in market acceptance of our solutions, loss of competitive position, or claims by customers for losses sustained by them, all of which could adversely affect our business, results of operations and financial condition.

Table of Contents

may be inadequate. In addition, certain countries into which we may expand our business may require us to do business through an entity that is partially owned by a local investor, to make available our technologies to state regulators or to grant license rights to local partners in a manner not required by the jurisdictions in which we currently operate. To the extent we expand our international activities, our exposure to unauthorized reverse engineering of our technologies or copying and use of our solutions and proprietary information may increase. Accordingly, despite our efforts, we may be unable to prevent third parties from infringing upon or misappropriating our technology and intellectual property.

We rely in part on trade secrets, proprietary know-how and other confidential information to maintain our competitive position. Although we enter into confidentiality and invention assignment agreements with our employees and consultants and enter into confidentiality agreements with the parties with whom we have strategic relationships and business alliances, no assurance can be given that these agreements will be effective in controlling access to and distribution of our solutions and proprietary information. Further, these agreements do not prevent our competitors from independently developing technologies that are substantially equivalent or superior to our solutions and solution packages.

To protect our intellectual property rights, we may be required to spend significant resources to monitor and protect these rights. Litigation may be necessary in the future to enforce our intellectual property rights and to protect our trade secrets. Such litigation could be costly, time consuming and distracting to management and could result in the impairment or loss of portions of our intellectual property. Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims and countersuits attacking the validity and enforceability of our intellectual property rights. Our inability to protect our proprietary technology against unauthorized copying or use, as well as any costly litigation or diversion of our management’s attention and resources, could delay further sales or the implementation of our solutions and solution packages, impair the functionality of our solutions, delay introductions of new solutions and solution packages, result in our substituting inferior or more costly technologies into our solutions, or injure our reputation. In addition, we may be required to license additional technology from third parties to develop and market new solutions and solution packages, and we cannot assure you that we could license that technology on commercially reasonable terms or at all, and our inability to license this technology could harm our ability to compete.

Our results of operations may be harmed if we are subject to an infringement claim or a claim that results in a significant damage award.

Other companies have claimed in the past, and may claim in the future, that we infringe upon their intellectual property rights. A claim may also be made relating to technology that we acquire or license from third parties. Because of constant technological change in the segments in which we compete, the extensive patent coverage of existing technologies, and the rapid rate of issuance of new patents, it is possible that the number of these claims may grow. If we were subject to a claim of infringement, regardless of the merit of the claim or our defenses, the claim could:

Table of Contents

Any one or more of the above could adversely affect our business, results of operations and financial condition.

Our use of open source software in our offerings could negatively affect our ability to sell our solutions and solution packages and subject us to possible litigation.

We use software modules licensed to us by third-party authors under “open source” licenses in our offerings. Some open source licenses require that users of the applicable software make available source code for modifications or derivative works created using that open source software. If we were to combine our proprietary software with open source software in a certain manner, we could, under certain open source licenses, be required to release or otherwise make available the source code of our proprietary software to the public. This would allow our competitors to create similar products with lower development effort and time and ultimately could result in a loss of sales for us.

Although we monitor our compliance with open source licenses and attempt to protect our proprietary source code from the effects stated above, we may inadvertently use open source software in a manner we do not intend and that could expose us to claims for breach of contract and intellectual property infringement. In addition, the terms of many open source licenses have not been interpreted by United States courts, and there is a risk that these licenses could be construed in a way that could impose unanticipated conditions or restrictions on our ability to commercialize our solutions and solution packages. If we are held to have breached the terms of an open source software license, we could be required to seek licenses from third parties to continue providing our offerings on terms that are not economically feasible, to re-engineer our offerings, to discontinue the sale of our offerings if re-engineering cannot be accomplished on a timely basis, or to make generally available, in source code form, a portion of our proprietary code, any of which could adversely affect our business, results of operations and financial condition. In addition to the risks described above, usage of open source software typically exposes us to greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or assurance of title or controls on the functionality or origin of the software. Many of the risks associated with usage of open source software, such as the lack of warranties or assurances of title, cannot be eliminated, and could, if not properly addressed, negatively affect our business. We have established processes to help alleviate these risks, including a review process for screening requests from our development organizations for the use of open source software, but we cannot be sure that our processes for controlling our use of open source software in our offerings will be effective. Use of open source software may also present additional security risks because the public availability of such software may make it easier for hackers and other third parties to determine how to compromise our offerings.

We rely on SaaS vendors to operate certain functions of our business and any failure of such vendors to provide services to us could adversely impact our business and operations.

We rely on third-party SaaS vendors to operate certain critical functions of our business, including financial management, human resource management and customer relationship management. If these services become unavailable due to extended outages or interruptions or because they are no longer available on commercially reasonable terms or prices, our expenses could increase, our ability to manage our finances could be interrupted and our processes for managing sales of our solutions and solution packages and supporting our

Table of Contents

Indemnity provisions in various agreements potentially expose us to substantial liability for intellectual property infringement and other losses.

Our agreements with customers and other third parties may include indemnification or other provisions under which we agree to indemnify them for losses suffered or incurred as a result of claims of intellectual property infringement, damage caused by us to property or persons, or other liabilities relating to or arising from the use of our platform or other acts or omissions. The term of these contractual provisions often survives termination or expiration of the applicable agreement. As we continue to grow, the possibility of infringement claims and other intellectual property rights claims against us may increase. For any intellectual property rights indemnification claim against us or our customers, we may incur significant legal expenses and may have to pay damages, settlement fees, license fees and/or stop using technology found to be in violation of the third-party’s rights. Large indemnity payments could harm our business, results of operations and financial condition. We may also have to seek a license for the infringing or allegedly infringing technology. Such license may not be available on reasonable terms, if at all, and may significantly increase our operating expenses or may require us to restrict our business activities and limit our ability to deploy certain offerings. As a result, we may also be required to develop alternative non-infringing technology, which could require significant effort and expense and/or cause us to alter our platform, solutions or solution packages, which could negatively affect our business. In addition, we may be subject to increased risk of infringement claims as a result of our use of open source software given that our agreements with our customers generally do not exclude open source software from the intellectual property indemnity we contractually agree to provide for our offerings.

From time to time, customers require us to indemnify them for breach of confidentiality, violation of applicable law or failure to implement adequate security measures with respect to their data stored, transmitted, or accessed using our platform. Although we normally contractually limit our liability with respect to such obligations, the existence of such a dispute may have adverse effects on our customer relationship and reputation and we may still incur substantial liability related to them.

Any assertions by a third party, whether or not successful, with respect to such indemnification obligations could subject us to costly and time-consuming litigation, expensive remediation and licenses, divert management attention and financial resources, harm our relationship with that customer and other current and prospective customers, reduce demand for our platform and result in our brand, business, results of operations and financial condition being adversely affected.

We may be subject to liability claims if we breach our contracts and our insurance may be inadequate to cover our losses.

We are subject to numerous obligations in our contracts with our customers and strategic partners. Despite the procedures, systems and internal controls we have implemented to comply with our contracts, we may breach these commitments, whether through a weakness in these procedures, systems and internal controls, negligence or the willful act of an employee or contractor.

Our insurance policies, including our errors and omissions insurance, may be inadequate to compensate us for the potentially significant losses that may result from claims arising from breaches of our contracts, disruptions in our services, including those caused by cybersecurity incidents, failures or disruptions to our infrastructure, catastrophic events and disasters or otherwise. In addition, such insurance may not be available to us in the future on economically reasonable terms, or at all. Further, our insurance may not cover all claims made against us and defending a suit, regardless of its merit, could be costly and divert management’s attention.

Our customers may fail to pay us in accordance with the terms of their agreements, necessitating action by us to compel payment.

If customers fail to pay us under the terms of our agreements, we may be adversely affected both from the inability to collect amounts due and the cost of enforcing the terms of our contracts, including related litigation.

Table of Contents

amounts due to us, or pay those amounts more slowly, either of which could adversely affect our business, results of operations and financial condition.

Because our long-term success depends, in part, on our ability to expand the sales of our solutions and solution packages to customers located outside of the United States, our business will be susceptible to risks associated with international operations.

We currently have international operations in the United Kingdom, Canada, Australia, France, Germany, India, Israel, the Netherlands and Switzerland. For the year ended December 31, 2019,2020, our international revenue was 22%26% of our total revenue. Any efforts that we may undertake to increase our international revenue may not be successful. In addition, continuing to expand our international footprint with our solutions and solution packages subjects us to new risks, some of which we have not generally faced in the United States. These risks include, among other things:

Table of Contents

Additionally, operating in international markets also requires significant management attention and financial resources. We cannot be certain that the investment and additional resources required in establishing operations in other countries will produce desired levels of revenue or profitability.

In addition, some of our business functions, such as research and development, may be siloed geographically, which may adversely affect the integration of our operations on a global scale.

We have limited experience in marketing, selling and supporting our platform abroad. Our limited experience in operating our business internationally increases the risk that any potential future expansion efforts that we may undertake will not be successful. If we invest substantial time and resources to increase our international revenue and are unable to do so successfully and in a timely manner, our business and results of operations will suffer.

We may face exposure to foreign currency exchange rate fluctuations.

Today, our international contracts are usually denominated in local currencies and the majority of our international costs are denominated in local currencies. Over time, an increasing portion of our international contracts may be denominated in local currencies. Therefore, fluctuations in the value of the U.S. dollar and foreign currencies may affect our results of operations when translated into U.S. dollars. We do not currently engage in currency hedging activities to limit the risk of exchange rate fluctuations. However, in the future, we may use derivative instruments, such as foreign currency forward and option contracts, to hedge certain exposures to fluctuations in foreign currency exchange rates. The use of such hedging activities may not offset any or more than a portion of the adverse financial effects of unfavorable movements in foreign exchange rates over the limited time the hedges are in place. Moreover, the use of hedging instruments may introduce additional risks if we are unable to structure effective hedges with such instruments.

Exposure to political developments inEconomic conditions and regulatory changes following the United Kingdom, including theU.K.’s exit from the EU could harm us.have a material adverse effect on our business and results of operations.

Following the result of a referendum in 2016, the United Kingdom (the “U.K.”)The U.K. formally left the EU on January 31, 2020, commonlytypically referred to as Brexit.“Brexit.” Pursuant to the formal withdrawal arrangements agreed between the U.K. and EU, the U.K. will bewas subject to a transition period until December 31, 2020 (the “Transition Period”), during which EU rules will continuecontinued to apply. Negotiations betweenOn December 24, 2020, the EU and the U.K. reached a Trade and theCooperation Agreement, provisionally applicable since January 1, 2021, which sets out preferential arrangements in areas such as trade in goods and in services, digital trade, intellectual property, public procurement, aviation and road transport, energy, fisheries, social security coordination, law enforcement and judicial cooperation in criminal matters, thematic cooperation and participation in EU are expected to continue in relation to the customs and trading relationship between the U.K. and the EU following the expiration of the Transition Period.  

programs. The uncertainty concerning the U.K.’s legal, political and economic relationship with the EU after the Transition Periodtransition period may be a source of instability in the international markets, create significant currency fluctuations and/orand otherwise adversely affect trading agreements or similar cross-border co-operationcooperation arrangements, (whetherwhether economic, tax, fiscal, legal, regulatory or otherwise).  We may also face new regulatory costs and challenges as a resultotherwise. While the full effects of Brexit (including potentially divergent national lawswill not be known for some time, Brexit could cause disruptions to, and regulations between the U.K.create uncertainty surrounding, our business and EU) that could have an adverse effect on ourresults of operations. For example, following the transition period, the U.K. could lose the benefits of global trade agreements negotiated by the EU on behalf of its members, which may result in increased trade barriers that could make our doing business in the EU and the European Economic Area more difficult. Ongoing global market volatility and a deterioration in economic conditions due to uncertainty surrounding the future relationship between the U.K. and EU could significantly disrupt the markets in which we operate and lead our customers to closely monitor their costs and delay capital spending decisions.

Additionally, Brexit has resulted in the strengthening of the U.S. dollar against foreign currencies in which we conduct business. Although this strengthening has been somewhat ameliorated by the implementation of the transition period, because we translate revenue denominated in foreign currency into U.S. dollars for our financial statements, during periods of a strengthening U.S. dollar, our reported revenue from foreign operations

Table of Contents

is reduced. As a result of Brexit and the continued negotiations between the U.K. and EU, there may be further periods of volatility in the currencies in which we conduct business.

The effects of Brexit will depend on any agreements the U.K. makes to retain access to EU markets following the transition period. The measures could potentially disrupt the markets we serve and may cause us to lose customers and employees. In addition, Brexit could lead to legal uncertainty and potentially divergent national laws and regulations as the U.K. determines which EU laws to replace or replicate, which could present new regulatory costs and challenges.

Any of these effects of Brexit could materially adversely affect our business, results of operations and financial condition.

Our international operations may give rise to potentially adverse tax consequences.

Our corporate structure and associated transfer pricing policies anticipate future growth into the international markets. The amount of taxes we pay in different jurisdictions may depend on the application of the tax laws of the various jurisdictions, including the United States, to our international business activities, changes in tax

Table of Contents

taxing jurisdictions’ administrative interpretations, decisions, policies, and positions, could have a material adverse effect on our business, results of operations, or financial condition.

Comprehensive tax reform legislation could adversely affect our business and financial condition.

On December 22, 2017, tax reform legislation known as the Tax Cuts and Jobs Act (the “Tax Act”) was enacted in the United States. The Tax Act, as amended by the CARES Act (defined below) among other things, included changes to U.S. federal tax rates, imposed significant additional limitations on the deductibility of interest and net operating loss carryforwards and allowed for the expensing of capital expenditures. Accounting for the income tax effects of the Tax Act and subsequent guidance issued required complex new calculations to be performed and significant judgments in interpreting the legislation. Additional guidance may be issued on how the provisions of the Tax Act will be applied or otherwise administered that is different from our interpretation, which could result in adjustments to the income tax effects of the Tax Act that we have recorded at December 31, 2019.2020. These adjustments could have a negative impact on our business and financial condition.

We may not be eligible to participate in the relief programs provided under the recently adopted Coronavirus Aid Relief, and Economic Security (CARES) Act and even if we are eligible we may not realize any material benefits from participating in such programs.

On March 27, 2020, legislation known as the Coronavirus Aid, Relief, and Economic Security Act (the “CARES Act”) was enacted in the United States. The CARES Act, among other things, includes provisions relating to refundable payroll tax credits, deferment of employer side social security payments, net operating loss carryback periods, alternative minimum tax credit refunds, modifications to the net interest deduction limitations and technical corrections to tax depreciation methods for qualified improvement property. We are evaluating the applicability of the CARES Act to the Company, and the potential impacts on our business. Accounting for the income tax effects of the CARES Act and subsequent guidance issued will require complex new calculations to be performed and significant judgments in interpreting the legislation. Additional guidance may be issued on how the provisions of the CARES Act will be applied or otherwise administered that is different from our interpretation. While we may determine to apply for such credits or other tax benefits provided under the CARES Act, there is no guarantee that we will meet any eligibility requirements to benefit from any of the tax relief provisions under the CARES Act or, even if we are able to participate, that such provisions will provide meaningful benefit to our business.

If we cannot maintain our corporate culture as we grow, our business may be harmed.

We believe that our corporate culture has been a critical component to our success and that our culture creates an environment that drives and perpetuates our overall business strategy. We have invested substantial time and resources in building our team and we expect to continue to hire aggressively as we expand, including with respect to our international operations. As we grow and mature as a public company and grow internationally, we may find it difficult to maintain our corporate culture. Any failure to preserve our culture could negatively affect our future success, including our ability to recruit and retain personnel and effectively focus on and pursue our business strategy.

As a result of becoming a public company in September 2019,We are subject to SEC rules and regulations regarding our internal control over financial reporting. If we are obligatedfail to develop and maintain proper and effective internal control over financial reporting and disclosure controls and procedures or identify material weaknesses in order to comply with Section 404 of the Sarbanes-Oxley Act. We may not complete our analysis of our internal control over financial reporting, we may not be able to accurately report our financial results, or report them in a timely manner, or these internal controls may not be determinedmanner.

As a public reporting company, we are subject to be effective, which may adversely affect investor confidence in usthe rules and as a result,regulations established from time to time by the value ofSEC and the NYSE. These rules and regulations require that, among other things, we establish and periodically evaluate procedures with respect to our common stock.

Our management is responsible for establishing and maintaining adequate internal control over financial reporting. Internal control overReporting obligations as a public company place a considerable strain on our financial reporting isand management systems, processes and controls, as well as on our personnel. Our management team, including our chief executive officer and chief financial officer, has limited experience managing a process designedpublicly-traded company, and limited experience complying with the increasingly complex and changing laws pertaining to provide reasonable assurancepublic companies.

Table of Contents

regarding the reliability of financial reporting and the preparation of financial statements in accordance with GAAP. We are in the very early stages of the costly and challenging process of compiling the system and processing documentation necessary to perform the evaluation needed to comply with Section 404 of the Sarbanes-Oxley Act. We may not be able to complete our evaluation, testing and any required remediation inIn addition, as a timely fashion. Ifpublic company we are unable to assert that our internal control over financial reporting is effective, we could lose investor confidence in the accuracy and completeness of our financial reports, which would cause the price of our common stock to decline, and we may be subject to investigation or sanctions by the SEC.

We will be required, pursuant to Section 404 of the Sarbanes-Oxley Act, to furnish a report by management on, among other things, the effectiveness of our internal control over financial reporting as of the end of the fiscal year that coincides with the filing of our second annual report on Form 10-K. This assessment will need to include disclosure of any material weaknesses identified by our management in our internal control over financial reporting. We are required to disclose changes made in our internal controldocument and procedures on a quarterly basis. However, our independent registered public accounting firm will not be required to report on the effectiveness oftest our internal control over financial reporting pursuant to Section 404 of the Sarbanes-OxleySarbanes–Oxley Act until the later of the year following our first annual report required to be filed with the SEC, or the date we are no longer an “emerging growth company” as defined in the Jumpstart Our Business Startups Act of 2012 (the “JOBS Act”) if we take advantage of the exemptions contained in the JOBS Act. At such time,so that our independent registered public accounting firm may issue a report thatcan attest in this Annual Report on Form 10-K as to the effectiveness of our internal control over financial reporting, and in future annual reports. Under this law, we have been required and will continue to be required to document and make significant changes to our internal control over financial reporting.

If our senior management is adverse in the event, in their opinion,unable to conclude that we have not maintained, in all material respects, effective internal control over financial reporting basedor to certify the effectiveness of such controls; if our independent registered public accounting firm cannot render an unqualified opinion on criteria established in Internal Control – Integrated Framework (2013) issued bymanagement's assessment and the Committeeeffectiveness of Sponsoring Organizations of the Treadway Commission (“COSO”).

Additionally, the existence of anyour internal control over financial reporting; or if material weakness or significant deficiency would require management to devote significant time and incur significant expense to remediate any such material weaknesses or significant deficiencies and management may not be able to remediate any such material weaknesses or significant deficiencies in a timely manner. The existence of any material weakness in our internal control over financial reporting is identified, we could also result in errorsbe subject to regulatory scrutiny, a loss of public and investor confidence, and to litigation from investors and stockholders, which could have a material adverse effect on our business and our stock price. In addition, if we do not maintain adequate financial and management personnel, processes and controls, we may not be able to manage our business effectively or accurately report our financial performance on a timely basis, which could cause a decline in our financial statements that could require us to restate our financial statements, cause us to fail to meet our reporting obligations and cause shareholders to lose confidence in our reported financial information, all of which could materiallycommon stock price and adversely affect our business and stock price. To comply with the requirements of being a public company, we may need to undertake various costly and time-consuming actions, such as implementing new internal controls and procedures and hiring accounting or internal audit staff, which may adversely affect our business, financial condition and results of operations.

As was previously disclosed in our Quarterly Report on Form 10-Q for the quarter ended September 30, 2019, we reported a material weakness in controls related to the quarterly accounting for income taxes. During the year ended December 31, 2019, we completed the remediation measures related to our previously reported material weakness. However, completion of remediation does not provide assurance that our remediated controls will continue to operate properly or that ouroperations and financial statements will be free from error.condition.

Our management team has limited experience managing a public company.

Most members of our management team have limited experience managing a publicly traded company, interacting with public company investors, and complying with the increasingly complex laws pertaining to public companies. Our management team may not successfully or efficiently manage us as a public company that is subject to significant regulatory oversight and reporting obligations under the federal securities laws and the continuous scrutiny of securities analysts and investors. These new obligations and constituents require significant attention from our senior management and could divert their attention away from the day to day management of our business, which could adversely affect our business, results of operations and financial condition.

We face risks associated with having operations and employees located in Israel.

We have an office and employees located in Israel. As a result, political, economic, and military conditions in Israel directly affect our operations. The future of peace efforts between Israel and its Arab neighbors remains uncertain. There has been a significant increase in hostilities and political unrest between Hamas and Israel in

Table of Contents

delays adversely affecting public sector demand for our solutions and solution packages. Governments routinely investigate and audit government contractors’ administrative processes and any unfavorable audit could result in fines, civil or criminal liability, further investigations, damage to our reputation and debarment from further government business.

Catastrophic events may disrupt our business.

Natural disasters, pandemics or other catastrophic events may cause damage or disruption to our operations, international commerce and the global economy, and thus could harm our business. In the event of a major earthquake, hurricane or catastrophic event such as fire, power loss, telecommunications failure, cyberattack, pandemic, war or terrorist attack, we may be unable to continue our operations and may endure system interruptions, reputational harm, delays in our application development, lengthy interruptions in our solutions, breaches of data security and loss of critical data, all of which could adversely affect our business, results of operations and financial condition. In addition, the insurance we maintain may not be adequate to cover our losses resulting from disasters or other business interruptions.

​

The emerging Coronavirus outbreak may have a negative impact on worldwide economic activity and our business.

The recent outbreak in China of the Coronavirus Disease 2019 (“COVID-19”), which has been declared by the World Health Organization to be a “public health emergency of international concern,” has spread across the globe and is impacting worldwide economic activity and financial markets. COVID-19 may disrupt our operations and the operations of our suppliers, customers, channel partners and system integrators and other business partners for an indefinite period of time, including as a result of travel restrictions and/or business shutdowns. For example, travel restrictions at our channel partners and system integrators may result in lengthier sales cycles. This is a rapidly evolving situation and the impact of COVID-19 on the global economy and our business is uncertain at this time. While it is not possible at this time to estimate the impact that COVID-19 could have on worldwide economic activity and our business, the continued spread of COVID-19 and the measures taken by the governments, businesses and other organizations in response to COVID-19 could adversely impact our business, financial condition or results of operations.

​

Table of Contents

Our level of indebtedness may place us at a competitive disadvantage to our competitors that are not as highly leveraged. Fluctuations in interest rates can increase borrowing costs. Increases in interest rates may directly impact the amount of interest we are required to pay and reduce earnings accordingly. In addition, developments in tax policy, such as the disallowance of tax deductions for interest paid on outstanding indebtedness, could have an adverse effect on our liquidity and our business, financial conditions and results of operations. Further, our 2019 Credit Agreement contains customary affirmative and negative covenants and certain restrictions on operations that could impose operating and financial limitations and restrictions on us, including restrictions on our ability to enter into particular transactions and to engage in other actions that we may believe are advisable or necessary for our business.

We expect to use cash flow from operations to meet current and future financial obligations, including funding our operations, debt service requirements and capital expenditures. The ability to make these payments depends on our financial and operating performance, which is subject to prevailing economic, industry and competitive conditions and to certain financial, business, economic and other factors beyond our control.

Table of Contents

indebtedness is secured, foreclose on our assets. In such an event, we may not have sufficient assets to repay all of our indebtedness.

The terms of the financing documents governing our 2019 Credit Facilities restrict our current and future operations, particularly our ability to respond to changes or to take certain actions.

The financing documents governing our 2019 Credit Facilities contain a number of restrictive covenants that impose significant operating and financial restrictions on us and may limit our ability to engage in acts that may be in our long-term best interests, including restrictions on our ability to:

Table of Contents

assurance that we will be able to obtain sufficient funds to enable us to repay or refinance our debt obligations on commercially reasonable terms, or at all.

A lowering or withdrawal of the ratings assigned to our debt securities by rating agencies may increase our future borrowing costs and reduce our access to capital.

Our debt currently has a non-investment grade rating, and any rating assigned could be lowered or withdrawn entirely by a rating agency if, in that rating agency’s judgment, future circumstances relating to the basis of the rating, such as adverse changes, so warrant. Any future lowering of our ratings likely would make it more difficult or more expensive for us to obtain additional debt financing.

Our failure to raise additional capital or generate cash flows necessary to expand our operations and invest in new technologies in the future could reduce our ability to compete successfully and harm our results of operations.

We may need to raise additional funds, and we may not be able to obtain additional debt or equity financing on favorable terms or at all. If we raise additional equity financing, our security holders may experience significant

Table of Contents

you of an opportunity to receive a premium for your shares of common stock as part of a sale of us and ultimately might affect the market price of our common stock.

In addition, in connection with our IPO, we entered into a Director Nomination Agreement with Vista that provides Vista the right to designate: (i) all of the nominees for election to our Board for so long as Vista beneficially owns 40% or more of the total number of shares of our common stock it owned on the date of our IPO; (ii) a number of directors (rounded up to the nearest whole number) equal to 40% of the total directors for so long as Vista beneficially owns at least 30% and less than 40% of the total number of shares of our common stock it owned on the date of our IPO; (iii) a number of directors (rounded up to the nearest whole number) equal to 30% of the total directors for so long as Vista beneficially owns at least 20% and less than 30% of the total number of shares of our common stock it owned on the date of our IPO; (iv) a number of directors (rounded up to the nearest whole number) equal to 20% of the total directors for so long as Vista beneficially owns at least 10% and less than 20% of the total number of shares of our common stock it owned on the date of our IPO; and (v) one director for so long as Vista beneficially owns at least 5% and less than 10% of the total number of shares of our common stock it owned on the date of our IPO. The Director Nomination Agreement

Table of Contents

activities more time consuming. These laws, regulations and standards are subject to varying interpretations, in many cases due to their lack of specificity, and, as a result, their application in practice may evolve over time as new guidance is provided by regulatory and governing bodies. This could result in continuing uncertainty regarding compliance matters and higher costs necessitated by ongoing revisions to disclosure and governance practices. We intend to invest resources to comply with evolving laws, regulations and standards, and this investment may result in increased general and administrative expenses and a diversion of our management’s time and attention from sales-generating activities to compliance activities. If our efforts to comply with new

Table of Contents

15% of our common stock for a period of three years from the date such person acquired such common stock, unless Board or shareholder approval is obtained prior to the acquisition. These provisions could discourage, delay or prevent a transaction involving a change in control of our company. These provisions could also discourage proxy contests and make it more difficult for you and other shareholders to elect directors of your choosing and cause us to take other corporate actions you desire, including actions that you may deem advantageous, or negatively affect the trading price of our common stock. In addition, because our Board is responsible for

Table of Contents

our shares to wide price fluctuations regardless of our operating performance. Our operating results and the trading price of our shares may fluctuate in response to various factors, including:

Table of Contents

limited by covenants of existing and any future outstanding indebtedness we or our subsidiaries incur, including under our 2019 Credit Facilities. Therefore, any return on investment in our common stock is solely dependent upon the appreciation of the price of our common stock on the open market, which may not occur.

Table of Contents

Item 4. Mine Safety Disclosure

​

None.

​

Table of Contents

PART II.

​

Item 5. Market for Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities

​

Market Information for Our Common Stock

Our common stock, $0.001 par value per share, began trading on the NYSE under the symbol “PING” on September 18, 2019. Prior to that time, there was no public market for our common stock. Shares sold in our IPO were priced at $15.00 per share.

​

Holders of Record

As of December 31, 2019,February 17, 2021, there were 1341,634 holders of record of our common stock. This figure does not include a greater number of beneficial holders of our common stock whose shares are held by banks, brokers and other financial institutions.

​

Dividend Policy

We have never declared or paid any cash dividends on our capital stock, and we do not currently intend to pay any cash dividends in the foreseeable future. We expect to retain future earnings, if any, to fund the development and growth of our business. Any decision to declare and pay dividends in the future will be made at the discretion of our Board and will depend on, among other things, our results of operations, financial condition, cash requirements, contractual restrictions and other factors that our Board may deem relevant. In addition, our ability to pay dividends is, and may be, limited by covenants of existing and any future outstanding indebtedness we or our subsidiaries incur, including under our 2019 Credit Facilities.

​

Securities Authorized for Issuance under Equity Compensation Plans

See Item 12, “Security Ownership of Certain Beneficial Owners and Management and Related Stockholder Matters.”

​

Stock Performance Graph

The following performance graph and related information shall not be deemed to be “filed” for purposes of Section 18 of the Securities Exchange Act of 1934, as amended, or otherwise subject to the liabilities of that section or Sections 11 and 12(a)(2) of the Securities Act of 1933, as amended, and shall not be incorporated by reference into any registration statement or other document filed by us with the SEC, whether made before or after the date of this Annual Report on Form 10-K, regardless of any general incorporation language in such filing, except as shall be expressly set forth by specific reference in such filing.

​

The following graph and related information shows a comparison of the cumulative total return for our common stock, Standard & Poor’s 500 Index (“S&P 500 Index”) and, Standard & Poor’s 500 Information Technology Index (“S&P 500 IT Index”) and the Russell 2000 Index between September 19, 2019 (the date our common stock commenced trading on the NYSE) through December 31, 2019.2020. All values assume an initial investment of $100 and reinvestment of any dividends. The comparisons are based on historical data and are not indicative of, nor intended to forecast, the future performance of our common stock.

​

​

Table of Contents