UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

Form 10-Q


☒			QUARTERLY REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the Quarterly Period Ended June 30, ~~2021~~2022


☐			TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the transition period from to

Commission File Number 001-40351

KNOWBE4, INC.

(Exact name of Registrant as specified in its charter)


Delaware	7370	36-4827930
(State or other jurisdiction of incorporation or organization)	(Primary Standard Industrial Classification Code Number)	(I.R.S. Employer Identification Number)

KnowBe4, Inc.

33 N. Garden Avenue

Clearwater, FL 33755

(855) 566-9234

(Address, including zip code, and telephone number, including area code, of Registrant’s principal executive offices)

Sjoerd Sjouwerman

Chief Executive Officer

KnowBe4, Inc.

33 N. Garden Avenue

Clearwater, FL 33755

(855) 566-9234

(Name, address, including zip code, and telephone number, including area code, of agent for service)

Securities registered pursuant to Section 12(b) of the Act:


Title of each class	Trading Symbol	Name of each exchange on which registered
Class A common stock, par value $0.00001	KNBE	The Nasdaq Stock Market LLC

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☐☒ No ☒☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.


			Large accelerated filer ☐			Accelerated filer ☐
			Non-accelerated filer ☒			Smaller reporting company ☐
						Emerging growth company ☒

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☒

Indicate by check mark whether the registrant is a shell company (as defined by Rule 12b-2 of the Exchange Act). Yes ☐ No ☒

At July ~~28, 2021,~~29, 2022, there were ~~14,375,542~~79,672,881 shares of the registrant’s Class A Common Stock ~~outstanding.and 155,115,925~~outstanding and 96,024,566 shares of the registrant’s Class B Common Stock outstanding.

KNOWBE4, INC.

Quarterly Report on Form 10-Q

TABLE OF CONTENTS


		Page
Part I. Financial Information
Item 1.	Financial Statements (Unaudited)
	Consolidated Balance Sheets	1
	Consolidated Statements of Operations	2
	Consolidated Statements of Comprehensive Income (~~Loss~~(Loss)	3
	Consolidated Statements o fof Stockholders’ Equity ~~(Deficit)~~	4
	Consolidated Statements o fof Cash Flows	68
	Notes Toto Consolidated Financial Statements	810
Item 2.	Management’s Discussion a ndand Analysis o fof Financial Condition a ndand Results o fof Operations	3032
Item 3.	Quantitative and Qualitative Disclosures About Market Risk	4446
Item 4.	Controls and Procedures	4446
Part II. Other Information
Item 1.	Legal Proceedings	4548
Item 1A.	Risk Factors	4548
Item 2.	Unregistered Sales of Equity Securities and Use of Proceeds	7574
Item 3.	Defaults Upon Senior Securities	7574
Item 4.	Mine Safety Disclosures	7574
Item 5.	Other Information	7574
Item 6.	Exhibit ~~Index~~s	7675
	Signatures

Table of Contents

CAUTIONARY NOTE REGARDING FORWARD-LOOKING STATEMENTS

This Quarterly Report on Form 10-Q contains forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended (the “Securities Act”), and Section 21E of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), which statements involve substantial risk and uncertainties. Forward-looking statements generally relate to future events or our future financial or operating performance. In some cases, you can identify forward-looking statements because they contain words such as “may,” “will,” “should,” “expect,” “plan,” “anticipate,” “could,” “intend,” “target,” “project,” “contemplate,” “believe,” “estimate,” “predict,” “potential” or “continue” or the negative of these words or other similar terms or expressions that concern our expectations, strategy, plans or intentions. Forward-looking statements contained in this Quarterly Report on Form 10-Q include statements about:

• our future financial performance, including our revenues, cost of revenues, gross profit or gross margin and operating ~~expenses;~~expenses and free cash flow;

• the sufficiency of our cash, cash equivalents and investments to meet our liquidity needs;

• our ability to achieve or maintain profitability;

• our ability to effectively manage our growth and future expenses;

• our investment strategy, business strategy and growth strategy, including the use of acquisitions to grow our business;

• the impact of our acquisitions and our ability to successfully integrate acquired businesses;

• management’s plans, beliefs and objectives for future operations;

• our expectations about competition and our ability to compete effectively;

• our ability to attract new customers, cross-sell or upsell our existing customers and develop new ~~products;~~

~~• our ability to maintain the security and availability of our platform and~~ products;

• our ability to continue to build our direct sales organization and expand our network of channel partners;

• our ability to ~~effectively manage our growth and future expenses;~~

~~• our ability to~~ successfully expand in our existing markets and into new markets;

• our anticipated investments in sales and marketing and research and development;

• our ability to ~~effectively~~maintain our brand;

• our ability to offer high-quality customer support;

• our ability to manage our ~~growth~~global operations;

• our ability to maintain the security and ~~future expenses;~~availability of our platform and products;

• potential harm caused by significant disruptions of service, or the actual or perceived failure of our products to prevent security incidents;

• our ability to prevent serious errors or defects across, and to otherwise maintain the interrupted operation of our network;

• our ability to maintain, protect and enhance our intellectual property;

• our expectations of the impact of, and our ability to comply with existing, modified or new laws and regulations ~~applying~~applicable to our business;

• our ~~anticipated investments~~ability to correctly estimate our tax obligations;

• the impact of macroeconomic factors including COVID-19, the conflict in ~~sales~~Ukraine, inflation, and ~~marketing and research and development;~~government actions to counter inflation; and

• our ability to successfully defend litigation brought against us.

We caution you that the foregoing list may not contain all of the forward-looking statements made in this Quarterly Report on Form 10-Q.

You should not rely upon forward-looking statements as predictions of future events. We have based the forward-looking statements contained in this Quarterly Report on Form 10-Q primarily on our current expectations and projections about future events and trends that we believe may affect our business, financial condition and results of operations, and prospects. The outcomes of the events described in these forward-looking statements are

Table of Contents

subject to risks, uncertainties, and other factors described in the section titled “Risk Factors” and elsewhere in this Quarterly Report on Form 10-Q. Moreover, we operate in a very competitive and rapidly changing environment. New risks and uncertainties emerge from time to time, and it is not possible for us to predict all risks and uncertainties that could have an impact on the forward-looking statements contained in this Quarterly Report on Form 10-Q.

The forward-looking statements made in this Quarterly Report on Form 10-Q relate only to events as of the date on which the statements are made. We undertake no obligation to update any forward-looking statements to reflect events or circumstances after the date of this Quarterly Report on Form 10-Q or to reflect new information or the occurrence of unanticipated events, except as required by law. We may not actually achieve the plans, intentions, or expectations disclosed in our forward-looking statements, and you should not place undue reliance on our forward-looking statements. Our forward-looking statements do not reflect the potential impact of any future acquisitions, mergers, dispositions, joint ventures, or investments we may make.

You should read this Quarterly Report on Form 10-Q in conjunction with the audited consolidated financial statements and related notes thereto in our Annual Report on Form 10-K for the year ended December 31, 2021 filed with the Securities and Exchange Commission (“SEC”) on March 10, 2022.

Table of Contents

PART I. FINANCIAL INFORMATION

Item 1. Financial Information

KNOWBE4, INC.

CONSOLIDATED BALANCE SHEETS

(in thousands, except share and per share amounts)

June 30, 2021 December 31, 2020
(unaudited)
Assets
Current assets
Cash and cash equivalents $ 257,056 $ 85,582
Accounts receivable, net 42,714 38,664
Current portion of deferred commissions 15,559 13,177
Prepaid and other current assets 13,124 6,124
Total current assets 328,453 143,547
Deferred commissions, net of current portion 27,267 24,022
Capitalized software and content, net 14,473 15,523
Property and equipment, net 9,342 10,284
Operating lease right of use assets, net 11,330 12,067
Intangible assets, net 8,142 2,985
Goodwill 43,028 8,605
Other assets 1,194 1,177
Total assets
$ 443,229 $ 218,210
Liabilities and stockholders’ equity (deficit)
Current liabilities:
Accounts payable and accrued expenses $ 32,249 $ 19,265
Current portion of deferred revenue 137,406 112,469
Current portion of operating lease liabilities 2,860 2,651
Total current liabilities 172,515 134,385
Non-current liabilities:
Deferred revenue, net of current portion 84,541 73,227
Operating lease liabilities, net of current portion 9,008 9,766
Other non-current liabilities 2,259 3,991
Total liabilities
268,323 221,369
Stockholders’ equity (deficit)
Preferred stock, $0.00001 par value, 0 shares authorized, issued, and outstanding at June 30, 2021 and 114,164,600 shares authorized, issued and outstanding (liquidation value $384.5 million) at December 31, 2020 0 0
Common stock, $0.00001 par value, 0 shares authorized, issued, and outstanding at June 30, 2021 and 176,000,000 shares authorized; and 42,279,000 shares issued and outstanding as of December 31, 2020 0 0
Common stock, 0.00001 par value, Class A, 1,000,000,000 shares authorized; and 11,709,402 shares issued and outstanding at June 30, 2021 and 0 shares authorized, issued and outstanding at December 31, 2020 0 0
Common stock, $0.00001 par value, Class B, 500,000,000 shares authorized; and 157,697,645 issued and outstanding at June 30, 2021 and 0 shares authorized, issued and outstanding at December 31, 2020 2 0
Additional paid-in capital 351,124 158,483
Accumulated deficit (175,966) (161,303)
Accumulated other comprehensive loss (254) (339)
Total stockholders’ equity (deficit) 174,906 (3,159)
Total liabilities and stockholders’ equity (deficit)
$ 443,229 $ 218,210


	June 30, 2022		December 31, 2021
	(unaudited)
Assets
Current assets:
Cash and cash equivalents	$	315,495	$	273,723
Accounts receivable, net	62,486		54,071
Current portion of deferred commissions	19,377		17,842
Prepaid and other current assets	17,646		10,580
Total current assets	415,004		356,216

Deferred commissions, net of current portion	38,301		33,869
Capitalized software and content, net	29,903		27,074
Property and equipment, net	10,056		9,120
Operating lease right of use assets, net	14,080		12,998
Intangible assets, net	8,009		7,992
Goodwill	88,173		89,329
Other assets	2,884		1,080

Total assets	$	606,410	$	537,678

Liabilities and stockholders’ equity
Current liabilities:
Accounts payable and accrued expenses	$	39,798	$	37,642
Current portion of deferred revenue	215,631		184,496
Current portion of operating lease liabilities	3,274		2,938
Total current liabilities	258,703		225,076

Non-current liabilities:
Deferred revenue, net of current portion	95,900		81,278
Operating lease liabilities, net of current portion	11,275		10,484
Other non-current liabilities	4,012		3,573
Total liabilities	369,890		320,411

Stockholders’ equity
Preferred stock, $0.00001 par value, 100,000,000 shares authorized, and 0 issued and outstanding at June 30, 2022 and December 31, 2021	—		—
Common stock, Class A, $0.00001 par value, 1,000,000,000 shares authorized; and 78,178,186 and 66,335,930 shares issued and outstanding at June 30, 2022 and December 31, 2021, respectively	1		1
Common stock, Class B, $0.00001 par value, 500,000,000 shares authorized; and 97,492,186 and 107,936,779 shares issued and outstanding at June 30, 2022 and December 31, 2021, respectively	1		2
Additional paid-in capital	407,620		391,803
Accumulated deficit	(168,440)		(173,148)
Accumulated other comprehensive loss	(2,662)		(1,391)
Total stockholders’ equity	236,520		217,267

Total liabilities and stockholders’ equity	$	606,410	$	537,678

The accompanying notes are an integral part of these consolidated financial statements.

Table of Contents

KNOWBE4, INC.

CONSOLIDATED STATEMENTS OF OPERATIONS

(in thousands, except share and per share amounts)

(unaudited)

(~~unaudited~~)


		Three Months Ended June 30,				Six Months Ended June 30,					Three Months Ended June 30,				Six Months Ended June 30,
		2021		2020		2021		2020			2022		2021		2022		2021
Revenues, net	Revenues, net	$	59,350	$	41,489	$	112,900	$	80,667	Revenues, net	$	80,762	$	59,350	$	155,795	$	112,900
Cost of revenues	Cost of revenues	8,591		6,303		15,934		12,346		Cost of revenues	10,909		8,591		21,054		15,934
Gross profit	Gross profit	50,759		35,186		96,966		68,321		Gross profit	69,853		50,759		134,741		96,966
Operating expenses:	Operating expenses:									Operating expenses:
Sales and marketing	Sales and marketing	31,510		19,875		54,581		39,502		Sales and marketing	34,684		31,510		65,431		54,581
Technology and development	Technology and development	6,760		4,391		12,502		9,297		Technology and development	8,764		6,760		17,673		12,502
General and administrative	General and administrative	28,284		10,976		42,913		21,096		General and administrative	23,587		28,284		46,227		42,913
Total operating expenses	Total operating expenses	66,554		35,242		109,996		69,895		Total operating expenses	67,035		66,554		129,331		109,996
Operating loss		(15,795)		(56)		(13,030)		(1,574)
Operating income (loss)										Operating income (loss)	2,818		(15,795)		5,410		(13,030)
Other income (expense):	Other income (expense):									Other income (expense):
Interest income	Interest income	7		14		25		139		Interest income	503		7		533		25
Interest expense	Interest expense	(66)		(16)		(262)		(29)		Interest expense	(65)		(66)		(151)		(262)
Other (loss) income		(416)		80		(559)		113
(Loss) income before income tax (expense) benefit		(16,270)		22		(13,826)		(1,351)
Income tax (expense) benefit		(593)		407		(837)		419
Net (loss) income		$	(16,863)	$	429	$	(14,663)	$	(932)
Net (loss) income per share, basic and diluted(1)		$	(0.14)	$	0.00	$	(0.24)	$	(0.02)
Weighted-average shares used in calculating basic net (loss) income per share		122,273,944		42,118,845		61,136,973		42,089,816
Weighted-average shares used in calculating diluted net (loss) income per share		122,273,944		164,160,470		61,136,973		42,089,816
Other income (expense)										Other income (expense)	264		(416)		(274)		(559)
Income (loss) before income tax expense										Income (loss) before income tax expense	3,520		(16,270)		5,518		(13,826)
Income tax expense										Income tax expense	(172)		(593)		(810)		(837)
Net income (loss)										Net income (loss)	$	3,348	$	(16,863)	$	4,708	$	(14,663)

Net income (loss) per share, basic										Net income (loss) per share, basic	$	0.02	$	(0.14)	$	0.03	$	(0.24)
Net income (loss) per share, diluted										Net income (loss) per share, diluted	$	0.02	$	(0.14)	$	0.03	$	(0.24)

Weighted-average shares used in calculating basic net income (loss) per share										Weighted-average shares used in calculating basic net income (loss) per share	175,293,173		122,273,944		174,909,849		61,136,973
Weighted-average shares used in calculating diluted net income (loss) per share										Weighted-average shares used in calculating diluted net income (loss) per share	182,220,649		122,273,944		182,229,908		61,136,973

~~(1)~~

~~At June 30, 2021, basic and diluted (loss) income per share for Class A and Class B common stock are the same.~~

The accompanying notes are an integral part of these consolidated financial statements.

Table of Contents

KNOWBE4, INC.

CONSOLIDATED STATEMENTS OF COMPREHENSIVE INCOME (LOSS) ~~INCOME~~

(in thousands)

(unaudited)

(~~unaudited~~)

Three Months Ended June 30, Six Months Ended June 30,
2021 2020 2021 2020
Net (loss) income $ (16,863) $ 429 $ (14,663) $ (932)
Other comprehensive income (loss):
Net change in foreign currency translation adjustments 284 126 85 (1,498)
Other comprehensive income (loss): 284 126 85 (1,498)
Total comprehensive (loss) income $ (16,579) $ 555 $ (14,578) $ (2,430)


	Three Months Ended June 30,				Six Months Ended June 30,
	2022		2021		2022		2021
Net income (loss)	$	3,348	$	(16,863)	$	4,708	$	(14,663)
Other comprehensive (loss) income:
Net change in foreign currency translation adjustments	(1,757)		284		(1,271)		85
Other comprehensive (loss) income:	(1,757)		284		(1,271)		85
Total comprehensive income (loss)	$	1,591	$	(16,579)	$	3,437	$	(14,578)

The accompanying notes are an integral part of these consolidated financial statements.

Table of Contents

KNOWBE4, INC.

CONSOLIDATED STATEMENTS OF STOCKHOLDERS’ EQUITY ~~(DEFICIT)~~

(in thousands, except shares)

(~~unaudited~~)(unaudited)

Convertible Preferred Stock Common Stock Class A Common Stock Class B Common Stock Additional Paid In Capital Accumulated Other Comprehensive (Loss) Income Accumulated Deficit Total
Shares Amount Shares Amount Shares Amount Shares Amount
Balance, December 31, 2020 114,164,600 $ 0 42,279,000 $ 0 0 $ 0 0 $ 0 $ 158,483 $ (339) $ (161,303) $ (3,159)
Issuance of common stock for exercise of stock options — — 274,720 — — — — — — 347 — — 347
Issuance of common stock — — 1,245,440 — — — — — — 24,675 — — 24,675
Repurchase of common stock — — (97,600) — — — — — — (861) — — (861)
Stock compensation expense — — — — — — — — — 1,681 — — 1,681
Other comprehensive loss — — — — — — — — — — (199) — (199)
Net income — — — — — — — — — — — 2,200 2,200
Balance, March 31, 2021 114,164,600 0 43,701,560 0 0 0 0 0 184,325 (538) (159,103) 24,684
Issuance of common stock for exercise of stock options — — — — — — 589,937 — 605 — — 605
Conversion of convertible preferred stock and previously authorized common stock to Class B common stock (114,164,600) — (43,701,560) — — — 157,866,160 2 — — — 2
Issuance of common stock in connection with initial public offering, net of underwriting discounts and issuance costs — — — — 10,425,000 — — — 153,796 — — 153,796
Issuance of restricted stock units — — — — 949,815 — — — — — — —
Conversion of Class B common stock to Class A common stock — — — — 758,452 — (758,452) — — — — —
Taxes paid related to net share settlement of equity awards — — — — (423,865) — — — (6,782) — — (6,782)
Repurchase of common stock — — — — — — — — 680 — — 680
Stock compensation expense — — — — — — — — 18,500 — — 18,500
Other comprehensive income — — — — — — — — — 284 — 284
Net loss — — — — — — — — — — (16,863) (16,863)
Balance, June 30, 2021 0 0 0 0 11,709,402 0 157,697,645 2 351,124 (254) (175,966) 174,906
For the three months ended June 30, 2022:


	Common Stock, Class A			Common Stock, Class B			Additional Paid In Capital		Accumulated Other Comprehensive (Loss)		Accumulated Deficit		Total
	Shares	Amount		Shares	Amount
Balance, March 31, 2022	72,909,377	$	1	101,903,213	$	2	$	397,785	$	(905)	$	(171,788)	$	225,095
Issuance of common stock for exercise of stock options	—	—		434,092	—		1,175		—		—		1,175
Issuance of common stock under the employee stock purchase plan	193,595	—		—	—		2,932		—		—		2,932
Issuance of common stock upon settlement of restricted stock units	338,568	—		—	—		—		—		—		—
Conversion of Common stock, Class B to Common stock, Class A	4,845,119	—		(4,845,119)	(1)		—		—		—		(1)
Taxes paid related to net share settlement of equity awards	(108,473)	—		—	—		(1,818)		—		—		(1,818)
Stock compensation expense	—	—		—	—		7,546		—		—		7,546
Other comprehensive loss, net	—	—		—	—		—		(1,757)		—		(1,757)
Net income	—	—		—	—		—		—		3,348		3,348
Balance, June 30, 2022	78,178,186	$	1	97,492,186	$	1	$	407,620	$	(2,662)	$	(168,440)	$	236,520

Table of Contents

KNOWBE4, INC.

CONSOLIDATED STATEMENTS OF STOCKHOLDERS’ EQUITY ~~(DEFICIT) (CONTINUED)~~

(in thousands, except shares)

(~~unaudited~~)(unaudited)

For the three months ended June 30, 2021:

Convertible Preferred Stock Common Stock Additional Paid In Capital Accumulated Other Comprehensive (Loss) Income Accumulated Deficit Total
Shares Amount Shares Amount
Balance, December 31, 2019 114,164,600 $ 0 42,087,280 $ 0 $ 154,287 $ (429) $ (158,873) $ (5,015)
Issuance of common stock for exercise of stock options — — 85,400 — 60 — — 60
Repurchase of common stock — — (81,840) — (192) — — (192)
Stock compensation expense — — — — 710 — — 710
Other comprehensive loss — — — — — (1,624) — (1,624)
Net loss — — — — — — (1,361) (1,361)
Balance, March 31, 2020 114,164,600 0 42,090,840 0 154,865 (2,053) (160,234) (7,422)
Issuance of common stock for exercise of stock options — — 128,080 — 75 — — 75
Repurchase of common stock — — (55,040) — (657) — — (657)
Stock compensation expense — — — — 1,327 — — 1,327
Other comprehensive income — — — — — 126 — 126
Net income — — — — — — 429 429
Balance, June 30, 2020 114,164,600 $ 0 42,163,880 $ 0 $ 155,610 $ (1,927) $ (159,805) $ (6,122)

~~The accompanying notes are an integral part of these consolidated financial statements.~~


	Convertible Preferred Stock			Common Stock			Common Stock, Class A			Common Stock, Class B			Additional Paid In Capital		Accumulated Other Comprehensive (Loss) Income		Accumulated Deficit		Total
	Shares	Amount		Shares	Amount		Shares	Amount		Shares	Amount
Balance, March 31, 2021	114,164,600	$	—	43,701,560	$	—	—	$	—	—	$	—	$	184,325	$	(538)	$	(159,103)	$	24,684
Issuance of common stock for exercise of stock options	—	—		—	—		—	—		589,937	—		605		—		—		605
Repurchase of common stock	—	—		—	—		—	—		—	—		680		—		—		680
Conversion of convertible preferred stock and previously authorized Common Stock to Common Stock, Class B	(114,164,600)	—		(43,701,560)	—		—	—		157,866,160	2		—		—		—		2
Issuance of common stock in connection with initial public offering, net of underwriting discounts and issuance costs	—	—		—	—		10,425,000	—		—	—		153,796		—		—		153,796
Issuance of common stock upon settlement of restricted stock units	—	—		—	—		949,815	—		—	—		—		—		—		—
Conversion of Common stock, Class B to Common stock, Class A	—	—		—	—		758,452	—		(758,452)	—		—		—		—		—
Taxes paid related to net share settlement of equity awards	—	—		—	—		(423,865)	—		—	—		(6,782)		—		—		(6,782)
Stock compensation expense	—	—		—	—		—	—		—	—		18,500		—		—		18,500
Other comprehensive income, net	—	—		—	—		—	—		—	—		—		284		—		284
Net loss	—	—		—	—		—	—		—	—		—		—		(16,863)		(16,863)
Balance, June 30, 2021	—	$	—	—	$	—	11,709,402	$	—	157,697,645	$	2	$	351,124	$	(254)	$	(175,966)	$	174,906

Table of Contents

KNOWBE4, INC.

CONSOLIDATED STATEMENTS OF ~~CASH FLOWS~~STOCKHOLDERS’ EQUITY

(in ~~thousands)~~thousands, except shares)

(unaudited)

For the six months ended June 30, 2022:


	Common Stock, Class A			Common Stock, Class B			Additional Paid In Capital		Accumulated Other Comprehensive (Loss)		Accumulated Deficit		Total
	Shares	Amount		Shares	Amount
Balance, December 31, 2021	66,335,930	$	1	107,936,779	$	2	$	391,803	$	(1,391)	$	(173,148)	$	217,267
Issuance of common stock for exercise of stock options	—	—��		963,004	—		2,222		—		—		2,222
Issuance of common stock under the employee stock purchase plan	193,595	—		—	—		2,932		—		—		2,932
Issuance of common stock upon settlement of restricted stock units	354,443	—		—	—		—		—		—		—
Conversion of Common stock, Class B to Common stock, Class A	11,407,597	—		(11,407,597)	(1)		—		—		—		(1)
Taxes paid related to net share settlement of equity awards	(113,379)	—		—	—		(1,985)		—		—		(1,985)
Stock compensation expense	—	—		—	—		12,648		—		—		12,648
Other comprehensive loss, net	—	—		—	—		—		(1,271)		—		(1,271)
Net income	—	—		—	—		—		—		4,708		4,708
Balance, June 30, 2022	78,178,186	$	1	97,492,186	$	1	$	407,620	$	(2,662)	$	(168,440)	$	236,520

(
~~unaudited~~)

Six Months Ended June 30,
2021 2020
Cash flows from operating activities:
Net loss $ (14,663) $ (932)
Adjustments to reconcile net loss to net cash from operating activities:
Additions to capitalized content (2,619) (2,421)
Depreciation and amortization expense 6,600 5,619
Deferred commissions amortization 8,735 6,805
Stock-based compensation expense 20,481 2,037
Other, net 400 (91)
Changes in operating assets and liabilities, net of business combinations:
Accounts receivable (2,741) 3,145
Deferred commissions (14,386) (9,958)
Prepaid and other assets (8,279) (950)
Accounts payable and other liabilities 10,021 3,140
Deferred revenue 32,397 20,569
Net cash provided by operating activities 35,946 26,963
Cash flows from investing activities:
Business combinations, net of cash acquired (11,323) 0
Purchases of property and equipment (1,055) (3,855)
Capitalized internal-use software costs (1,121) (1,506)
Net cash used in investing activities (13,499) (5,361)
Cash flows from financing activities:
Proceeds from the exercise of stock options 952 135
Repurchase of common stock (1,171) (497)
Proceeds from the issuance of common stock 155,958 0
Acquisition-related contingent liability payments (375) (252)
Proceeds from finance lease obligations 0 214
Payments for finance lease obligations (20) (15)
Taxes paid for the net share settlement of restricted stock units (6,782) 0
Net cash provided by (used in) financing activities 148,562 (415)
Effect of exchange rate changes on cash and cash equivalents 465 (284)
Net change in cash and cash equivalents $ 171,474 $ 20,903
Cash and cash equivalents, beginning of period $ 85,582 $ 48,864
Cash and cash equivalents, end of period $ 257,056 $ 69,767

~~The accompanying notes are an integral part of these consolidated financial statements.~~

Table of Contents

KNOWBE4, INC.

CONSOLIDATED STATEMENTS OF ~~CASH FLOWS (CONTINUED)~~

~~SUPPLEMENTAL CASH FLOW DISCLOSURES~~STOCKHOLDERS’ EQUITY

(in ~~thousands)~~thousands, except shares)

(unaudited)

For the six months ended June 30, 2021:


	Convertible Preferred Stock			Common Stock			Common Stock, Class A			Common Stock, Class B			Additional Paid In Capital		Accumulated Other Comprehensive (Loss) Income		Accumulated Deficit		Total
	Shares	Amount		Shares	Amount		Shares	Amount		Shares	Amount
Balance, December 31, 2020	114,164,600	$	—	42,279,000	$	—	—	$	—	—	$	—	$	158,483	$	(339)	$	(161,303)	$	(3,159)
Issuance of common stock for exercise of stock options	—	—		274,720	—		—	—		589,937	—		952		—		—		952
Issuance of common stock for business combinations	—	—		1,245,440	—		—	—		—	—		24,675		—		—		24,675
Repurchase of common stock	—	—		(97,600)	—		—	—		—	—		(181)		—		—		(181)
Conversion of convertible preferred stock and previously authorized Common Stock to Common Stock, Class B	(114,164,600)	—		(43,701,560)	—		—	—		157,866,160	2		—		—		—		2
Issuance of common stock in connection with initial public offering, net of underwriting discounts and issuance costs	—	—		—	—		10,425,000	—		—	—		153,796		—		—		153,796
Issuance of common stock upon settlement of restricted stock units	—	—		—	—		949,815	—		—	—		—		—		—		—
Conversion of Common stock, Class B to Common stock, Class A	—	—		—	—		758,452	—		(758,452)	—		—		—		—		—
Taxes paid related to net share settlement of equity awards	—	—		—	—		(423,865)	—		—	—		(6,782)		—		—		(6,782)
Stock compensation expense	—	—		—	—		—	—		—	—		20,181		—		—		20,181
Other comprehensive income, net	—	—		—	—		—	—		—	—		—		85		—		85
Net loss	—	—		—	—		—	—		—	—		—		—		(14,663)		(14,663)
Balance, June 30, 2021	—	$	—	—	$	—	11,709,402	$	—	157,697,645	$	2	$	351,124	$	(254)	$	(175,966)	$	174,906

(
~~unaudited~~)

Three Months Ended June 30, Six Months Ended June 30,
2021 2020 2021 2020
Supplemental disclosure of cash flow information:
Cash paid for taxes $ 575 $ 7 $ 1,397 $ 16
Supplemental disclosure of noncash investing and financing activities:
Capital expenditures and other assets included in accounts payable and accrued expenses $ 955 $ 570 $ 955 $ 570
Stock compensation recorded as liability $ 0 $ 602 $ 0 $ 602

The accompanying notes are an integral part of these consolidated financial statements.

Table of Contents

KNOWBE4, INC.

CONSOLIDATED STATEMENTS OF CASH FLOWS

(in thousands)

(unaudited)


	Six Months Ended June 30,
	2022		2021
Cash flows from operating activities:
Net income (loss)	$	4,708	$	(14,663)
Adjustments to reconcile net income (loss) to net cash provided by operating activities:
Additions to capitalized content	(2,817)		(2,619)
Depreciation and amortization expense	7,655		6,600
Deferred commissions amortization	10,733		8,735
Stock compensation expense	12,608		20,481
Other, net	(1,002)		400
Changes in operating assets and liabilities, net of business combinations:
Accounts receivable	(8,740)		(2,741)
Deferred commissions	(17,491)		(14,386)
Prepaid and other assets	(6,611)		(8,279)
Accounts payable and other liabilities	1,983		10,021
Deferred revenue	46,367		32,397
Net cash provided by operating activities	47,393		35,946
Cash flows from investing activities:
Business combinations, net of cash acquired	40		(11,323)
Purchases of investments	(2,375)		—
Purchases of property and equipment	(2,621)		(1,055)
Capitalized internal-use software costs	(2,260)		(1,121)
Net cash used in investing activities	(7,216)		(13,499)
Cash flows from financing activities:

Proceeds from the exercise of stock options	2,222		952
Proceeds from issuance of common stock under the employee stock purchase plan	2,932		—
Repurchases of common stock	—		(1,171)

Proceeds from the issuance of common stock	—		155,958
Acquisition-related contingent consideration payments	—		(375)

Payments for finance lease obligations	(21)		(20)
Taxes paid for the net share settlement of equity awards	(1,985)		(6,782)
Net cash provided by financing activities	3,148		148,562
Effect of exchange rate changes on cash and cash equivalents	(1,553)		465
Net change in cash and cash equivalents	$	41,772	$	171,474
Cash and cash equivalents, beginning of period	$	273,723	$	85,582
Cash and cash equivalents, end of period	$	315,495	$	257,056

The accompanying notes are an integral part of these consolidated financial statements.

KNOWBE4, INC.

CONSOLIDATED STATEMENTS OF CASH FLOWS (CONTINUED)

SUPPLEMENTAL CASH FLOW DISCLOSURES

(in thousands)

(unaudited)


	Six Months Ended June 30,
	2022		2021
Supplemental disclosure of cash flow information:
Cash paid for taxes	$	949	$	1,397

Supplemental disclosure of noncash investing and financing activities:
Capital expenditures and other assets included in accounts payable and accrued expenses	$	926	$	955

The accompanying notes are an integral part of these consolidated financial statements.

Table of Contents

KNOWBE4, INC.

INDEX TO THE NOTES TO CONSOLIDATED FINANCIAL STATEMENTS

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS

Note 1 – Description of Business

KnowBe4, Inc. (“KnowBe4” or the “Company”), was incorporated in Delaware in January 2016 and is the successor ofto operations ~~that~~which began in August 2010. The Company is currently headquartered in Clearwater, Florida.

The Company provides a comprehensive platform incorporating security awareness training and simulated phishing with advanced analytics and reporting that helps organizations manage the ongoing problem of social engineering. Additional offerings on the Company’s platform include a security orchestration, automation and response ~~or “SOAR”~~(“SOAR”) tool, ~~and~~ a governance, risk and compliance ~~or “GRC”~~(“GRC”) product, ~~both~~and comprehensive compliance training, all of which further the Company’s goal of providing products focused on meeting the needs of information security professionals. KnowBe4 conducts business globally and its platform is available as a software as a service (“SaaS”) subscription.

Stock Split

On April 9, 2021, the Company effected a 40-for-1 forward stock split of its authorized, issued and outstanding capital stock. All share and per share amounts presented in the accompanying consolidated financial statements have been retrospectively adjusted to reflect the forward stock split for all periods presented.

Initial Public Offering

As further described in Note 11 “Stockholders’ Equity”, in April 2021, the Company completed an initial public offering (“IPO”) of its Class A common stock.

Table of Contents

KNOWBE4, INC.

Note 2 – Summary of Significant Accounting Policies

a.Basis of Presentation and Consolidation

The Company’s consolidated financial statements and accompanying notes include the accounts of ~~the Company~~KnowBe4, Inc. and its wholly-owned subsidiaries. The accompanying consolidated balance sheets as of June 30, ~~2021~~2022 and the consolidated statements of operations, consolidated statements of comprehensive ~~(loss)~~ income ~~and~~(loss), consolidated statements of stockholders' equity ~~(deficit)~~ for the three and six months ended June 30, 2022 and 2021 and ~~2020 and the~~ consolidated statements of cash flows for the six months ended June 30, ~~2021~~2022 and ~~2020~~2021 are unaudited.

These financial statements have been prepared in accordance with U.S. generally accepted accounting principles (“U.S. GAAP”) for interim financial information. Accordingly, they do not include all of the financial information and footnotes required by U.S. GAAP for complete financial statements. In the opinion of the Company’s management, the unaudited consolidated financial statements include all adjustments necessary for the fair presentation of the Company’s consolidated balance sheets as of June 30, ~~2021,~~2022, and its consolidated statements of operations, consolidated statements of comprehensive income (loss) ~~income,~~, consolidated statements of stockholders' equity ~~(deficit)~~for the three and six months ended June 30, 2022 and 2021 and its consolidated statements of cash flows for the six months ended June 30, ~~2021~~2022 and ~~2020.~~2021. All intercompany balances and transactions have been eliminated in consolidation. The results for the three and six months ended June 30, ~~2021~~2022 are not necessarily indicative of the results to be expected for any subsequent quarter or for the fiscal year ending December 31, ~~2021.~~2022. The accompanying interim unaudited consolidated financial statements and related financial information should be read in conjunction with the audited consolidated financial statements and the related notes thereto included in the Company’s Annual Report on Form 10-K for the year ended December 31, ~~2020, included in our prospectus filed under Rule 424(b) of the Securities Act of 1933, as amended (the “Prospectus”).~~2021.

b. Use of Estimates

The preparation of consolidated financial statements in conformity with U.S. GAAP requires management to make estimates and assumptions that affect the amounts reported and disclosed in the Company’s consolidated financial statements and accompanying notes. Estimates and assumptions used by management primarily affect revenue recognition, deferred commissions, fair value of net assets acquired in business combinations, common stock valuations (prior to the IPO), and ~~stock-based~~stock compensation expense.

These estimates are based on information available as of the date of the consolidated financial statements. On an ongoing basis, the Company evaluates these assumptions, judgments and estimates. Actual results may differ materially from these estimates.

c. Operating Segments

The Company operates as a single operating segment, which engages in the development, marketing and sale of the Company’s SaaS-based security awareness platform. Operating segments are defined as components of an enterprise for which separate financial information is evaluated regularly by the chief operating decision maker in deciding how to allocate resources and assess performance. The Company’s chief operating decision maker is the Chief Executive Officer, who is responsible for evaluating the Company’s financial results, evaluating the Company’s resources and assessing the performance of the operations on a consolidated basis.

d. Cash and Cash Equivalents

The Company considers all investments purchased with an original maturity of 90 days or less to be cash equivalents. Cash and cash equivalents include ~~$19.8~~$203.1 million and ~~$22.5~~$180.2 million of overnight money market mutual funds at June 30, ~~2021~~2022 and December 31, ~~2020,~~2021, respectively. The carrying amount of such cash equivalents approximates their fair value due to the short-term and highly liquid nature of these instruments.

e. Accounts Receivable, Net

Accounts receivable represents amounts owed to the Company for subscriptions to the Company’s platform and unbilled receivables representing the Company’s unconditional right to consideration for subscription contracts for

Table of Contents

KNOWBE4, INC.

which ~~revenue has~~revenues have been earned in excess of the amount invoiced. Accounts receivable balances are recorded at the invoiced amount and are non-interest bearing.

The Company maintains an allowance for doubtful accounts based on future expected credit losses measured over the contractual term of the receivable. Management regularly reviews the adequacy of the allowance for doubtful accounts by considering various factors including the age of each outstanding invoice, each customer’s expected ability to pay, historical loss rates and expectations of forward-looking loss estimates to determine whether the allowance is appropriate. The Company writes off accounts receivable balances to the allowance for doubtful accounts when the Company has exhausted all collection efforts. As of June 30, ~~2021~~2022 and December 31, ~~2020~~2021 the allowance for doubtful accounts was ~~$0.3~~$0.5 million, and ~~$0.4 million, respectively. Allowance~~allowance activity for the periods presented was not material to the consolidated financial statements.

f. Deferred Commissions

The Company capitalizes sales commissions and associated benefits and payroll taxes paid to internal sales personnel that are considered incremental costs to acquire a customer contract. These costs are classified as deferred commissions on the consolidated balance sheets. Sales commissions related to an initial subscription contract are considered incremental to the acquisition of the customer contract to the extent that they exceed commissions earned on renewal sales. Sales commissions related to the renewal of a subscription contract are not considered commensurate with the commissions paid for the acquisition of the initial subscription contract given the substantive difference in commission rate between new and renewal contracts. The portion of commissions paid upon the initial acquisition of a contract that are incremental to acquisition of the customer contract are amortized over an estimated period of benefit of six years. The portion of commissions paid upon initial acquisition that are commensurate with those paid on a renewal contract and commissions paid related to renewal contracts are amortized over the average length of the related ~~revenue~~revenues contract. An estimate of the portion of commissions related to the downloadable content performance obligation is made, which is recognized at contract inception consistent with the pattern of revenue recognition. The estimated period of benefit for commissions paid for the acquisition of the initial subscription contract is determined based on qualitative and quantitative factors including the initial estimated customer life, the technological life of the Company’s platform and related significant features, customer attrition and industry practices. Amortization of deferred sales commissions is included in sales and marketing expense in the accompanying consolidated statements of operations.

g. Property and Equipment, Net

Property and equipment are stated at cost, net of accumulated depreciation. Depreciation is calculated on a straight-line basis over the estimated useful lives of the assets, as follows:


Computers and equipment			3 years
Furniture and fixtures			5 - 7 years
Leasehold improvements			shorter of lease term or 5 years

Expenditures which significantly add to productive capacity or extend the useful life of an asset are capitalized. Maintenance and repairs to property and equipment are expensed as incurred. When assets are retired or otherwise disposed of, the cost and accumulated depreciation is removed from the accounts and gains or losses, if any, are recorded in other ~~expenses.~~income (expenses).

h. Capitalized Software and Content, Net

The Company capitalizes costs incurred related to the development of internal use software during the application development stage. These capitalized costs are primarily related to the development of the Company’s security awareness platform. Costs are capitalized to develop new internal use software or to significantly increase the functionality of existing software. Additionally, the Company records acquired internal-use software and technology assets within the capitalized software and content caption on its consolidated balance sheets. Capitalized software costs are amortized on a straight-line basis over the software’s estimated useful life of ~~two~~three to ~~five~~six years. Management evaluates the useful lives of these assets on an annual basis and tests for impairment whenever events

Table of Contents

KNOWBE4, INC.

or changes in circumstances occur that could impact the recoverability of these assets. There were 0no impairments of capitalized internal use software during the three and six months ended June 30, ~~2021 and 2020.~~2022 or 2021.

The Company also capitalizes costs related to the production of its training content, which includes interactive modules, movie series, videos, games and other content. Costs associated with the production of content, including development costs, direct costs and production overhead, are capitalized. Capitalized content is amortized over the estimated period of use, which generally ranges from ~~two~~three to ~~four~~seven years. The Company’s business model is subscription based, therefore, capitalized content is reviewed in the aggregate when an event or change in circumstances indicates a change in the expected usefulness of the content. To date, we have not identified any such event or ~~changes~~change in circumstances. If such changes are identified in the future, capitalized content will be stated at the lower of unamortized cost, net realizable value or fair value. In addition, unamortized costs for assets that have been, or are expected to be, abandoned are written off.

i.Goodwill and Intangible Assets

Goodwill represents the excess of the purchase price in a business combination over the estimated fair value of identifiable net assets acquired. The Company evaluates and tests the recoverability of goodwill for impairment at least annually, on October 1, or more frequently if circumstances indicate that goodwill may not be recoverable. The Company performs the impairment testing by first assessing qualitative factors to determine whether the existence of events or circumstances leads to a determination that it is more likely than not that the fair value of its single reporting unit is less than its carrying amount. In assessing the qualitative factors, the Company considers the impact of certain key factors including macroeconomic conditions, industry and market considerations, changes in management, litigation or regulatory matters, changes in enterprise value, and overall financial performance. If, after assessing the totality of events or circumstances, the Company determines it is more likely than not that the fair value of the reporting unit is less than its carrying amount, the Company calculates the estimated fair value of the reporting unit and any excess of the carrying amount over fair value is recognized as a goodwill impairment loss.

Based on the results of the qualitative goodwill impairment analyses, the Company has determined there were 0no triggering events indicating impairment of goodwill during the three and six months ended June 30, ~~2021~~2022 and ~~2020.~~2021.

Intangible assets consist of both definite-lived intangible assets, primarily acquired ~~training~~ content, customer ~~relationship assets,~~relationships, patents, trademarks and domain names, and indefinite-lived trade name intangible assets. Definite-lived intangible assets are amortized on a straight-line basis over their estimated useful lives, as follows:


Acquired content			3 - 4 years
Customer relationships			4 - 6 years
Other Intangibles			3 - 10 years
Patents			20 years

j. Impairment of Intangible and Other Long-Lived Assets

The Company performs an impairment review of long-lived assets, including property and equipment and both definite and indefinite-lived intangible assets, whenever events or changes in circumstances indicate that the carrying value may not be recoverable, in accordance with the respective accounting standards. If the Company determines that the carrying value of an asset group may not be recoverable, the Company measures recoverability by comparing the carrying amount of the asset group to the future undiscounted cash flows it expects the asset group to generate. If the Company considers any of these assets to be impaired, the impairment to be recognized equals the amount by which the carrying value of the asset exceeds its fair value. In addition, the Company periodically evaluates the estimated remaining useful lives of long-lived assets to determine whether events or changes in circumstances warrant a revision to the remaining period of depreciation or amortization. No impairment indicators were identified and 0no impairment charges were recorded during the three and six months ended June 30, ~~2021 and 2020.~~2022 or 2021.

Table of Contents

KNOWBE4, INC.

k. Leases

The Company determines whether an arrangement is or contains a lease at inception and classifies its leases at commencement. Operating leases with initial terms of twelve months or greater are included in operating lease right-of-use (“ROU”) assets and operating lease liabilities in the consolidated balance sheets.

ROU assets represent the Company’s right to use ~~the~~ underlying assets over the term of the lease and lease liabilities represent the Company’s contractual obligation to make lease payments over the lease term. Operating lease ROU assets and lease liabilities are recognized at the commencement date based on the present value of the lease payments over the lease term. Operating lease ROU assets also include any unamortized initial direct costs and any prepayments less any unamortized lease incentives received. As the Company’s leases do not provide an implicit rate for use in determining the present value of future payments, the Company uses its incremental borrowing rate. Options to extend or terminate a lease are included in the ROU asset and lease liability when it is reasonably certain that the Company will exercise the option.

Lease expense for minimum lease payments for operating leases is recognized on a straight-line basis over the lease term and is included ~~primarily~~ in operating expenses within the consolidated ~~statement~~statements of operations. Variable lease costs represent non-lease components, namely common area maintenance and taxes, that are not fixed and are expensed as incurred.

l. Income Taxes

The Company uses the asset and liability method of accounting for income taxes. Under this method, deferred tax assets and liabilities are determined based on temporary differences between the financial statement and tax bases of assets and liabilities using enacted tax rates in effect for the year in which the differences are expected to reverse.

The Company’s tax positions are subject to income tax audits by certain tax jurisdictions throughout the world. The Company recognizes the tax benefit of an uncertain tax position only if it is more likely than not that the position will be sustainable upon examination by the taxing authority. The tax benefit recognized is measured as the

largest amount of benefit which is greater than 50 percent likely to be realized upon settlement with the taxing authority. The Company recognizes interest accrued and penalties related to unrecognized tax benefits in the income tax ~~(benefit)~~ provision.

Valuation allowances are established when necessary to reduce deferred tax assets to the amounts that are more likely than not expected to be realized based on the weighting of positive and negative evidence. Future realization of deferred tax assets ultimately depends on the existence of sufficient taxable income of the appropriate character (for example, ordinary income or capital gain) within the carryback or carryforward periods available under the applicable tax law. The Company regularly reviews the deferred tax assets for recoverability based on historical taxable income, projected future taxable income, the expected timing of the reversals of existing temporary differences and tax planning strategies. The Company’s judgments regarding future profitability may change due to many factors, including future market conditions and the ability to successfully execute its business plans and/or tax planning strategies. Should there be a change in the ability to recover deferred tax assets, the tax provision would increase or decrease in the period in which the assessment is changed.

m. Foreign Currency Transactions

The functional currency of the Company’s subsidiaries is determined based on the primary economic environment in which the subsidiary operates. Assets and liabilities of its non-U.S. dollar functional currency subsidiaries are translated into U.S. dollars using exchange rates in effect at the end of each period and revenues and expenses are translated at the average exchange rate for the period. Gains and losses from these translations are recognized as cumulative translation adjustments and included in accumulated other comprehensive ~~(loss) income.~~loss.

The Company remeasures monetary assets and liabilities that are not denominated in the functional currency at average exchange rates in effect during each period. Gains and losses from these remeasurement adjustments are recognized within other ~~income.~~income (expense).

Table of Contents

KNOWBE4, INC.

n. Revenue Recognition

The Company derives substantially all of its ~~revenue~~revenues from subscription services fees paid by customers for access to the Company’s cloud-based platform and content. The Company applies the following five-step approach for considering contracts:

•identification of the contract, or contracts, with the customer;

•identification of the performance obligations in the contract;

•determination of the transaction price;

•allocation of the transaction price to the performance obligations in the contract; and

•recognition of ~~revenue~~revenues when, or as, the Company satisfies a performance obligation.

The Company recognizes ~~revenue~~revenues at the time the related performance obligation is satisfied by transferring the service to a customer in an amount that reflects the consideration the Company expects to be entitled to in exchange for those services, net of any sales or other tax. The Company’s subscription contracts typically vary from one year to three years and are generally noncancellable and nonrefundable.

Subscription service ~~revenue consists~~revenues consist of subscription fees earned from providing access to the Company’s cloud-based platform, including support services and feature upgrades, if and when available. The Company’s cloud-based platform also includes training content which can be downloaded by the customer during their subscription term. The subscription service contracts do not provide customers with the right to take possession of the software operating on the cloud platform and, as a result, are accounted for as service arrangements. Access to the platform represents a series of distinct services that the Company continually provides access to, which fulfills its obligation to the end customer over the subscription term. This series of distinct services represents a single performance obligation that is satisfied over time. Accordingly, the amounts ~~invoiced related~~allocated to the ratable portion of subscription ~~revenue~~revenues are recorded as deferred revenue and recognized on a straight-line basis over the contract

term, beginning on the date that the service is made available to the customer. Amounts expected to be recognized within one year of the balance sheet date are classified within current liabilities and the remaining portion is classified in long-term liabilities.

The customers’ ability to access and download content throughout their subscription term is considered distinct and accounted for as a separate performance obligation. The portion of the transaction price allocated to the downloadable content performance obligation is recognized as revenue at contract inception when the customer gains access to the downloadable content.

The transaction price is allocated to the separate performance obligations on a relative stand-alone selling price (“SSP”) basis, which requires significant judgment. The Company determines SSP using an adjusted market assessment approach based on the prices at which ~~we sell~~it sells subscription services, including adjustments for standard discounting practices. As it relates to the content available for download, the calculation of SSP primarily ~~considers~~utilizes suggested royalty rates, assumptions regarding content production costs and other industry pricing ~~differences among varying subscription tiers, which provide customers with differing levels of content.~~data.

o. Cost of Revenues

Cost of revenues consists of certain direct costs associated with delivering the Company’s platform and includes hosting fees as well as amortization of capitalized internal-use software and content and allocated overhead. Cost of revenues also includes personnel costs, including salaries, benefits, bonuses, and ~~stock-based~~stock compensation, for employees who provide support services to customers.

~~Stock-Based~~p. Stock Compensation

The Company ~~accounts~~measures and recognizes compensation expense for all stock-based awards ~~including~~based on the estimated fair value of the award on the date of grant. Following the IPO, stock awards primarily consist of time and performance-based restricted stock units (“RSUs”) ~~and stock options, based on the awards’ estimated grant date fair value.~~. The grant date fair value of RSUs is measured at the grant date closing stock price and expense is recognized on a straight-line basis over the vesting period of the award, which is generally three years, and net of forfeitures, which are recorded as incurred.

Table of Contents

KNOWBE4, INC.

Performance-based RSUs vest, if at all, based on internal performance targets in effect during the year of grant. Stock compensation expense related to these awards is initially based on the number of shares that would vest if the Company achieved 100% of the performance target, which is the intended outcome at the grant date. Throughout the requisite service period, which is generally three years, management monitors the probability of achievement of the ~~awards and forfeitures~~performance target. If it becomes probable that more or less than the current estimate of awarded shares will vest, an adjustment to stock compensation expense will be recognized as a change in accounting estimate in the period that such probability changes.

Stock compensation expenses related to the Company’s Employee Stock Purchase Plan (“ESPP”) are ~~accounted~~based on the grant date fair value using the Black-Scholes option-pricing model. These expenses are recognized on a straight-line basis over the offering period, which is generally 6 months unless otherwise determined by the Company’s board of directors or compensation committee. The ESPP allows eligible employees to purchase shares of the Company’s Class A common stock at a 15.0% discount from the lesser of the fair market value of our common stock on (i) the first trading day of the applicable offering period or (ii) the last trading day of the purchase period in the applicable offering period.

Prior to the IPO, given the absence of an active market for ~~as incurred.~~

~~The~~the Company’s Class A common stock, the Company ~~estimates~~estimated the grant date fair value of its stock options using the Black-Scholes option-pricing model. The ~~determination of the grant date fair value using an option-pricing model is affected by the estimated fair value of the~~ Company’s ~~common stock as well as assumptions regarding a number of other complex and subjective variables. These variables include:~~

•~~Fair Value of Common Stock~~ ~~- Prior to the Company’s IPO, because the Company’s common stock was not yet publicly traded, the Company estimated the fair value of common stock, as discussed below.~~

•~~Expected Term~~ - The expected term is estimated using the simplified method, due to a lack of historical exercise activity. The simplified method calculates the expected term as the mid-point of the vesting date and the contractual expiration date of the award.

•~~Volatility~~ - Since the Company does not have a trading history of its common stock, the expected volatility is determined based on the historical stock volatilities of comparable companies. Comparable companies consist of public companies in the industry, which are similar in size, stage of life cycle and financial leverage. The Company intends to continue to apply this process using the same or similar public companies until a sufficient amount of historical information regarding the volatility of its own share price becomes available, or until circumstances change such that the identified companies are no longer similar, in which case, more suitable companies whose share prices are publicly available would be used in the calculation.

•~~Risk-Free Interest Rate~~ - The risk-free interest rate is based on the U.S. Treasury yield curve in effect at the date closest to the grant date for U.S. Treasury zero-coupon issues with maturities approximating the expected term of the awards.

•~~Dividend Yield~~ ~~- The expected dividend assumption is based on the Company’s current expectations about its anticipated dividend policy. As the Company has a history of only paying a single one-time dividend~~

~~and does not anticipate paying dividends in the future, the Company uses an expected dividend yield of 0.~~

~~The resulting fair value is recognized on a straight-line basis, net of forfeitures, which are recorded as incurred, over the requisite service period.~~

~~Prior to the Company’s IPO, our~~ board of directors who exercised judgment and considered numerous objective and subjective factors to determine the best estimate of the fair value of our common stock at each grant date, including (i) valuations performed at or near the time of grant; (ii) rights, preferences, and privileges of our redeemable convertible preferred stock relative to those of our common stock; (iii) our actual operating and financial performance at the time of the option grant; (iv) likelihood of achieving a liquidity event, such as an initial public offering or a merger or acquisition of our business; (v) the value of comparable companies with respect to industry, business model, stage of growth, financial risk or other factors; (vi) our stage of development and future financial projections; (vii) market transactions at or near the time of grant; and (viii) the lack of marketability of our common stock. ~~The Company has historically utilized unrelated third-party specialists to prepare valuations in accordance with the American Institute of Certified Public Accountants Practice Guide,~~ ~~Valuation of Privately-Held-Company Equity Securities Issued as Compensation~~, or AICPA Guide. Prior to the Company’s IPO, the Company used the Probability Weighted Expected Return Method (“PWERM”), method for estimating the Company’s common stock value, since this is the preferred method for a company expecting a liquidity event in the near future. PWERM involves a forward-looking analysis of the possible future outcomes of the enterprise. Discrete future outcomes considered under the PWERM included an IPO as well as non-IPO market-based outcomes. Determining the fair value of the enterprise using the PWERM required the Company to develop assumptions and estimates for both the probability of an IPO liquidity event and non-IPO outcomes, as well as the values the Company expected those outcomes could yield. After the equity value is determined and allocated to the various classes of shares, a discount for lack of marketability (“DLOM”), is applied to arrive at the fair value of common stock based on the theory that as an owner of a private company stock, the stockholder has limited opportunities to sell this stock and any such sale would involve significant transaction costs, thereby reducing overall fair market value.

Following the IPO, ~~there is an active market for~~ the Company’s Class A common stock is traded on the Nasdaq Global Select Market and the Company is no longer ~~applying these valuation approaches.~~

The Company’s Employee Stock Purchase Plan (“ESPP”) allows eligible employees to acquire shares of the Company’s Class A common stock by accumulating funds through payroll deductions of up to 15% of their compensation, subject to plan limitations. Purchases are accomplished through participation in discrete offering periods. Each offering period is six months and consists of 1 six-month purchase period, unless otherwise determined by the Company’s board of directors or compensation committee. The purchase price for shares of common stock purchased under the ESPP is 85% of the lesser of the fair market value of our common stock on (i) the first trading day of the applicable offering period or (ii) the last trading day of the purchase period in the applicable offering period. Stock-based compensation expense related to ESPP purchases is recorded based onestimating the fair value of ~~the ESPP purchase right estimated on the grant date using a Black-Scholes option-pricing model.~~its common stock.

q. 401(k) Plan

The Company maintains a tax-qualified retirement plan, or the 401(k) plan, that provides eligible employees with an opportunity to save for retirement on a tax-advantaged basis. Eligible employees are able to participate in the 401(k) plan as of the first day of the month following the date they meet the 401(k) plan’s eligibility requirements, and participants are able to defer up to 100% of their eligible compensation subject to applicable annual Internal Revenue Code limits. All participants’ interests in their deferrals are 100% vested when contributed and the Company’s matching contributions are 100% vested following one year of service. The Company contracted with a third-party provider to act as a custodian and trustee, and to process and maintain the records of participant data. ~~The~~For the three months ended June 30, 2022 and 2021, the Company made contributions to the 401(k) Plan ~~for the three months ended June 30, 2021~~of $0.9 million and ~~2020 of~~ $0.5 million, ~~and $0.3 million, respectively, and for~~respectively. For the six months ended June 30, 2022 and 2021 the Company made contributions of $1.8 million and ~~2020 of~~ $1.0 million, ~~and $0.8 million,~~ respectively.

r. Advertising

Advertising costs are expensed as incurred. Advertising expenses were ~~$4.1~~$7.1 million and ~~$3.2~~$4.1 million for the three months ended June 30, ~~2021~~2022 and ~~2020,~~2021, respectively, and were ~~$7.2~~$11.6 million and ~~$6.3~~$7.2 million for the six months ended June 30, 2022 and 2021, ~~and 2020,~~ respectively. ~~Advertising~~These costs are included within sales and marketing expenses in the accompanying consolidated statements of operations.

s. Research and Development Costs

Research and development costs are expensed when incurred, except for certain internal-use software development costs, which may be capitalized as noted above. Research and development expenses consist primarily of personnel and related headcount costs, costs of professional services associated with the ongoing development of

Table of Contents

KNOWBE4, INC.

the Company’s technology, and allocated overhead and are recorded within technology and development expense in the accompanying consolidated statements of operations.

t. Net Income (Loss) per Share

Basic and diluted net income (loss) per share is presented in conformity with the two-class method required for participating securities. Prior to the IPO, the Company considered all series of its convertible preferred stock to be participating securities. Net loss was not allocated to the convertible preferred stock as the holders of the convertible preferred stock do not have a contractual obligation to share in any losses. Since the completion of the IPO, theThe Company considers shares of Class B common stock to be participating securities, since each share of Class B common stock is convertible into 1 share of Class A common stock at the option of the holder. Net income is attributed to common stockholders and participating securities based on their participation rights.

Basic net income (loss) per share is computed by dividing ~~the~~ net income (loss) by the weighted-average number of shares of common stock outstanding during the period. Diluted net income (loss) per share is computed by giving ~~affect~~effect to all potentially dilutive common stock equivalents to the extent they are dilutive.

u. Business Combinations

The Company includes the results of operations of the businesses that it acquires as of the respective dates of acquisition. The Company allocates the fair value of the purchase price of its acquisitions to the assets acquired and liabilities assumed based on their estimated fair values at the date of acquisition. The excess of the fair value of the purchase price over the fair values of these identifiable assets and liabilities is recorded as goodwill. Such valuations require management to make significant estimates and assumptions, especially with respect to intangible assets. Significant estimates in valuing certain intangible assets include, but are not limited to, future expected cash flows from acquired ~~users,~~customers, acquired technology, the value of trade names from a market participant perspective, useful lives and discount rates. Management’s estimates of fair value are based upon assumptions believed to be reasonable, but which are inherently uncertain and, as a result, actual results may differ from estimates. During the measurement period, which may be up to one year from the acquisition date, the Company may record adjustments to the fair value of assets acquired and liabilities assumed. Upon conclusion of the measurement period or final determination of the fair value of assets acquired or liabilities assumed, whichever comes first, any subsequent adjustments are recorded to the Company’s consolidated ~~statement~~statements of operations. Transaction costs associated with business combinations are expensed as incurred and are included in general and administrative expense in the Company’s consolidated statements of operations.

v. Concentrations of Credit Risk and Significant Customers

The Company’s financial instruments that are exposed to concentrations of credit risk consist primarily of cash and cash equivalents and accounts receivable. The Company’s cash deposits typically exceed the federally insured limits. Collateral is not required for accounts receivable.

No single customer accounted for more than ten percent of total ~~revenue~~revenues, net during the three and six months ended June 30, ~~2021~~2022 and ~~2020.~~2021. Additionally, no single customer accounted for more than ten percent of accounts receivable at June 30, ~~2021~~2022 or at December 31, ~~2020.~~2021.

w. Fair Value Measurement

Assets and liabilities recorded at fair value in the consolidated financial statements are categorized based upon the level of judgment associated with the inputs used to measure their fair value. The lowest level of significant input determines the placement of the fair value measurement within the following hierarchical levels:

•Level 1: Observable inputs that reflect quoted prices (unadjusted) for identical assets or liabilities in active markets.

•Level 2: Other inputs that are directly or indirectly observable in the marketplace.

•Level 3: Unobservable inputs which are supported by little or no market activity.

The following tables present information about the Company’s financial assets and liabilities that are measured at fair value and indicate the fair value hierarchy of the valuation inputs used (in thousands):

June 30, 2021
Quoted Prices in Active Markets for Identical Assets
(Level 1) Significant Other
Observable
Inputs
(Level 2) Significant
Unobservable
Inputs
(Level 3) Total
Assets:
Cash equivalents:
Money market mutual funds $ 19,824 $ 0 $ 0 $ 19,824
Total assets $ 19,824 $ 0 $ 0 $ 19,824
Liabilities:
Accounts payable and accrued expenses:
Business acquisition contingent liabilities $ 0 $ 0 $ 0 $ 0
Total liabilities $ 0 $ 0 $ 0 $ 0

Table of Contents

December 31, 2020
Quoted Prices in Active Markets for Identical Assets
(Level 1) Significant Other
Observable
Inputs
(Level 2) Significant
Unobservable
Inputs
(Level 3) Total
Assets:
Cash equivalents:
Money market mutual funds $ 22,479 $ 0 $ 0 $ 22,479
Total assets $ 22,479 $ 0 $ 0 $ 22,479
Liabilities:
Accounts payable and accrued expenses:
Business acquisition contingent liabilities $ 0 $ 0 $ 350 $ 350
Total liabilities $ 0 $ 0 $ 350 $ 350
KNOWBE4, INC.


	June 30, 2022
	Quoted Prices in Active Markets for Identical Assets (Level 1)		Significant Other Observable Inputs (Level 2)		Significant Unobservable Inputs (Level 3)		Total
Assets:
Cash equivalents:
Money market mutual funds	$	203,070	$	—	$	—	$	203,070
Other assets:
Investments	$	—	$	—	$	2,375	$	2,375
Total assets	$	203,070	$	—	$	2,375	$	205,445

Liabilities:
Accounts payable and accrued expenses:
Contingent consideration	$	—	$	—	$	5,000	$	5,000
Other non-current liabilities:
Contingent consideration	—		—		1,239		1,239
Total liabilities	$	—	$	—	$	6,239	$	6,239


	December 31, 2021
	Quoted Prices in Active Markets for Identical Assets (Level 1)		Significant Other Observable Inputs (Level 2)		Significant Unobservable Inputs (Level 3)		Total
Assets:
Cash equivalents:
Money market mutual funds	$	180,170	$	—	$	—	$	180,170
Total assets	$	180,170	$	—	$	—	$	180,170

Liabilities:
Accounts payable and accrued expenses:
Contingent consideration	$	—	$	—	$	5,000	$	5,000
Total liabilities	$	—	$	—	$	5,000	$	5,000

The carrying amounts of certain financial instruments, including cash held in banks, accounts receivable, and accounts payable, approximate fair value due to their short-term maturities and are excluded from the fair value tables above.

The Company invested in equity securities of privately held companies which do not have a readily determinable fair value. The Company elected to measure these securities at cost less impairment, if any, adjusted for observable price changes resulting from orderly transactions for the identical or a similar security of the same issuer.

The Company’s contingent consideration liabilities were initially measured using both a probability estimate of achieving the contingency and a Monte Carlo simulation utilizing future revenues projections, a risk-adjusted discount rate and performance volatility assumptions both of which involve inherent uncertainties.

There were no transfers between levels during the three and six months ended June 30, ~~2021~~2022 or the year ended December 31, ~~2020.~~2021.

1618

~~Recent Accounting Pronouncements~~

~~Recently Adopted Accounting Pronouncements~~

~~In December 2019, the FASB issued ASU No. 2019-12,~~ ~~Income Taxes (Topic 740): Simplifying the Accounting for Income Taxes, (“ASU 2019-12”), which removes certain exceptions related to the approach for intraperiod tax allocation, the methodology for calculating income taxes in an interim period and the recognition~~Table of deferred tax liabilities for outside basis differences. ASU 2019-12 also amends other aspects of the guidance to help simplify and promote consistent application of US GAAP. The guidance is effective for interim and annual periods beginning after December 15, 2020, with early adoption permitted. The Company adopted ASU 2019-12 on January 1, 2021 and the adoption was not material to the Company’s consolidated financial statements.Contents

KNOWBE4, INC.

Note 3 – ~~Revenue,~~Revenues, Deferred Revenue and Remaining Performance Obligations

The following table summarizes ~~revenue~~revenues recognized from performance obligations delivered to customers, which relate to (i) subscription services ~~which is~~that are recognized ratably over the term of the contract and (ii) ~~initial~~ subscription ~~revenue representing~~revenues allocated to downloadable content ~~available for download,~~ which isare recognized at a point in time, ~~for the three and six months ended June 30, 2021 and 2020~~as follows (in thousands):

Three Months Ended June 30, Six Months Ended June 30,
2021 2020 2021 2020
Ratable portion of subscription revenue $ 50,320 $ 35,690 $ 95,730 $ 68,948
Subscription revenue allocated to downloadable content 9,030 5,799 17,170 11,719
Total $ 59,350 $ 41,489 $ 112,900 $ 80,667


	Three Months Ended June 30,				Six Months Ended June 30,
	2022		2021		2022		2021
Ratable portion of subscription revenues	$	71,178	$	50,320	$	137,293	$	95,730
Subscription revenues allocated to downloadable content	9,584		9,030		18,502		17,170
Total	$	80,762	$	59,350	$	155,795	$	112,900

The following table summarizes the ~~revenue~~revenues by region based on the shipping address of customers who have contracted to use the Company’s platform (in thousands):


		Three Months Ended June 30,				Six Months Ended June 30,					Three Months Ended June 30,				Six Months Ended June 30,
		2021		2020		2021		2020			2022		2021		2022		2021
North America	North America	$	50,353	$	36,880	$	96,420	$	72,075	North America	$	66,720	$	50,353	$	129,118	$	96,420
International	International	8,997		4,609		16,480		8,592		International	14,042		8,997		26,677		16,480
Total	Total	$	59,350	$	41,489	$	112,900	$	80,667	Total	$	80,762	$	59,350	$	155,795	$	112,900

Contract Balances

The Company records unbilled receivables when ~~revenue~~revenues recognized on a contract ~~exceeds~~exceed amounts invoiced. Unbilled receivables were not material as of June 30, ~~2021~~2022 or December 31, ~~2020.~~

2021.

Contract liabilities consist of deferred revenue which represents contractual billings made in advance of performance under the contract. Changes in deferred revenue ~~for the three and six months ended June 30, 2021 and 2020~~ were as follows (in thousands):


		Three Months Ended June 30,				Six Months Ended June 30,					Three Months Ended June 30,				Six Months Ended June 30,
		2021		2020		2021		2020			2022		2021		2022		2021
Beginning balance	Beginning balance	$	204,057	$	151,546	$	185,696	$	138,990	Beginning balance	$	287,082	$	204,057	$	265,774	$	185,696
Plus: Additions to deferred revenue	Plus: Additions to deferred revenue	77,240		49,209		149,151		100,897		Plus: Additions to deferred revenue	105,211		77,240		201,552		149,151
Less: Recognition of revenue deferred in prior periods	Less: Recognition of revenue deferred in prior periods	(49,786)		(35,292)		(81,863)		(59,395)		Less: Recognition of revenue deferred in prior periods	(69,930)		(49,786)		(119,899)		(81,863)
Less: Recognition of revenue deferred in current periods		(9,564)		(6,197)		(31,037)		(21,226)
Less: Recognition of revenue deferred in the current period										Less: Recognition of revenue deferred in the current period	(10,832)		(9,564)		(35,896)		(31,037)
Ending balance	Ending balance	$	221,947	$	159,266	$	221,947	$	159,266	Ending balance	$	311,531	$	221,947	$	311,531	$	221,947

Remaining Performance Obligations

The transaction price allocated to remaining performance obligations represents contracted ~~revenue~~revenues that ~~has~~have not yet been recognized, which includes deferred revenue and unbilled amounts that will be recognized as ~~revenue~~revenues in future periods. The transaction price allocated to the remaining performance obligation is influenced by several factors, including the timing of delivery of the Company’s products and average contract terms. Unbilled portions of the remaining performance obligation are subject to future economic risks including bankruptcies, regulatory changes and other market factors. The Company excludes from the remaining performance obligation amounts related to performance obligations that ~~are billed~~have been delivered and ~~recognized as they are delivered.~~therefore recognized. The majority of the Company’s noncurrent remaining performance obligation is expected to be recognized in the next 13 to 36 months.

Table of Contents

KNOWBE4, INC.

Remaining performance obligations consisted of the following (in thousands):


		June 30, 2021		December 31, 2020			June 30, 2022		December 31, 2021
Current	Current	$	167,417	$	136,382	Current	$	231,218	$	198,134
Noncurrent	Noncurrent	101,826		87,395		Noncurrent	146,709		125,534
Total	Total	$	269,243	$	223,777	Total	$	377,927	$	323,668

Deferred Commissions

Changes in deferred commissions ~~for the three and six months ended June 30, 2021 and 2020~~ were as follows (in thousands):


		Three Months Ended June 30,				Six Months Ended June 30,					Three Months Ended June 30,				Six Months Ended June 30,
		2021		2020		2021		2020			2022		2021		2022		2021
Beginning balance	Beginning balance	$	38,910	$	30,917	$	37,199	$	29,176	Beginning balance	$	54,671	$	38,910	$	51,711	$	37,199
Plus: Additions to deferred commissions	Plus: Additions to deferred commissions	8,539		4,791		14,386		9,958		Plus: Additions to deferred commissions	9,182		8,539		17,491		14,386
Less: Recognition of deferred commissions	Less: Recognition of deferred commissions	(4,651)		(3,430)		(8,735)		(6,805)		Less: Recognition of deferred commissions	(5,448)		(4,651)		(10,733)		(8,735)
Plus: Foreign currency impacts on deferred commissions	Plus: Foreign currency impacts on deferred commissions	28		20		(24)		(31)		Plus: Foreign currency impacts on deferred commissions	(727)		28		(791)		(24)
Ending balance	Ending balance	$	42,826	$	32,298	$	42,826	$	32,298	Ending balance	$	57,678	$	42,826	$	57,678	$	42,826

Note 4 – Business Combinations

~~Current year acquisition~~2021 Acquisitions

MediaPro

On March 1, 2021, the Company acquired all outstanding equity interests in MediaPro Holdings, LLC (“MediaPro”), a SaaS company that specializes in security and privacy solutions including ~~the~~ production of digital

content and custom software. The acquisition was funded using cash consideration of approximately $11.3 million, net of cash acquired of $1.9 million, and equity consideration of $24.7 million.

SecurityAdvisor

On November 1, 2021 the Company acquired all outstanding equity interests of SecurityAdvisor Technologies, Inc., collectively referred to as “SecurityAdvisor”, a SaaS company providing a personalized security awareness platform that integrates with its customers’ existing security infrastructure and provides customers the ability to address human layer risks in real-time through targeted alerts and micro-trainings. The acquisition was funded using cash consideration of approximately $22.6 million, net of cash acquired of $4.0 million, and equity consideration of $29.0 million.

The purchase agreement also includes earn-out provisions payable in a combination of cash and equity that are contingent upon future events. These earn-outs include $5.0 million payable in cash upon the first sale of a product incorporating the developed technology and up to $10.0 million payable in shares of Class A common stock based upon performance targets measured by the achievement of certain annual recurring revenue levels. These earn-out provisions are classified as contingent consideration liabilities and are subject to recurring fair value measurements. The fair value of the contingent consideration is estimated to be $6.2 million, which includes a measurement period adjustment of $1.2 million resulting from the finalization of a third-party valuation report.

Table of Contents

KNOWBE4, INC.

The acquisition was accounted for as a business combination in accordance with ~~ASC~~the Financial Accounting Standards Board’s Accounting Standards Codification, Topic 805, Business Combinations, and the Company has included the financial results of the acquired business in the consolidated financial statements from the date of acquisition. The resulting goodwill, which is not deductible for tax purposes, is ~~reflective of synergies the Company expects~~primarily attributable to ~~realize~~expanded market opportunities and the assembled workforce. The Company has recorded the assets acquired and liabilities assumed at their respective fair values as of the acquisition ~~date. MediaPro revenues and losses were not material~~date, including measurement period adjustments to the acquired technology of $2.7 million, the deferred tax liability of $0.7 million. Acquisition related costs for the ~~three and~~ six months ended June 30, ~~2021. Acquisition related costs of $0.5 million are included in the accompanying consolidated statement of operations for the three and six months ended June 30, 2021.~~2022 were not material.

The following table summarizes the fair values of the assets acquired and liabilities assumed as of the acquisition date (in thousands):


~~Accounts receivable~~Cash	$	~~1,391~~3,985
Deferred tax asset	938
Other assets ~~acquired~~	~~4,075~~
~~Trade name~~	~~300~~119
Acquired ~~content~~technology	~~1,600~~
~~Customer relationships~~	~~3,300~~14,600
Deferred ~~revenue~~tax liability	~~(3,919)~~(3,692)
Other liabilities ~~acquired~~	~~(3,172)~~(221)
Total identifiable net assets assumed	~~3,575~~15,729
Goodwill	~~34,339~~46,070
Total net asset value	$	~~37,914~~61,799

The purchase price allocation was based on estimates of the fair value of the net assets acquired and ~~is considered preliminary and subject to change as~~was finalized during the ~~valuation is finalized. The Company expects to finalize the valuation as soon as practicable, but not later than one year from the acquisition date.~~second quarter. The Company has not presented pro forma results of operations because the acquisition is not material to the Company's consolidated results of operations, financial position, or cash flows.

Following the acquisition, the Company also granted certain key employees of SecurityAdvisor restricted stock awards, containing both service and performance-based vesting conditions, with an aggregate grant date fair value of $15.9 million. The awards are expensed as stock compensation expense over the requisite service period, assuming the service and performed conditions are achieved.

Note 5 – Capitalized Software and Content, Net

~~Internally developed capitalized~~Capitalized software and content, net consists of the following (in thousands):


		June 30, 2021		December 31, 2020			June 30, 2022		December 31, 2021
Capitalized software		$	15,703	$	15,081
Internally developed capitalized software						Internally developed capitalized software	$	18,458	$	16,689
Acquired technology						Acquired technology	14,600		11,900
Capitalized content	Capitalized content	19,350		16,899		Capitalized content	26,568		23,277
		35,053		31,980			59,626		51,866
Less: Accumulated amortization	Less: Accumulated amortization	(20,580)		(16,457)		Less: Accumulated amortization	(29,723)		(24,792)
Total capitalized software and content, net	Total capitalized software and content, net	$	14,473	$	15,523	Total capitalized software and content, net	$	29,903	$	27,074

~~Capitalized software and content amortization~~Amortization expense for ~~each of~~ the three months ended June 30, 2022 and 2021 totaled $2.6 million and ~~2020 totaled~~ $2.1 ~~million. Amortization expense~~million, respectively, and for ~~the~~ six months ended June 30, 2022 and 2021 ~~and 2020~~ totaled ~~$4.1~~

$5.0 million and ~~$3.9~~$4.1 million, respectively. These costs are primarily included in cost of revenues in the accompanying consolidated statements of operations.

~~Capitalized~~

Table of Contents

KNOWBE4, INC.

Internally developed capitalized software and content ~~amounts~~balances include accumulated costs not yet placed in service of ~~$1.5~~$4.3 million at June 30, ~~2021.~~2022. As ~~these costs are~~the related software and content is not yet in service, ~~they~~the costs are not included in the following estimated future amortization expenses for capitalized software and content ~~placed in service as of June 30, 2021~~ (in thousands):


2021		$	3,856
2022	2022	5,232		2022	$	4,406
2023	2023	2,274		2023	6,701
2024	2024	641		2024	4,771
2025	2025	424		2025	3,657
2026				2026	3,160
Thereafter	Thereafter	564		Thereafter	2,954
Total	Total	$	12,991	Total	$	25,649

Note 6 – Property and Equipment, Net

Property and equipment, net consists of the following (in thousands):


		June 30, 2021		December 31, 2020			June 30, 2022		December 31, 2021
Leasehold improvements	Leasehold improvements	$	8,412	$	9,143	Leasehold improvements	$	10,284	$	8,677
Computer and other equipment		6,337		5,630
Computers and other equipment						Computers and other equipment	7,334		7,038
Furniture and fixtures	Furniture and fixtures	2,087		2,107		Furniture and fixtures	2,205		2,002
		16,836		16,880			19,823		17,717
Less: Accumulated depreciation	Less: Accumulated depreciation	(7,494)		(6,596)		Less: Accumulated depreciation	(9,767)		(8,597)
Total property and equipment, net	Total property and equipment, net	$	9,342	$	10,284	Total property and equipment, net	$	10,056	$	9,120

~~Property and equipment depreciation~~Depreciation expense for the three months ended June 30, ~~2021~~2022 and ~~2020~~2021 totaled$1.1 million ~~$1.0~~and $1.0 million ~~and $0.9 million,~~, respectively, and totaled ~~$2.0~~$2.1 million and ~~$1.6~~$2.0 million, for the six months ended June 30, ~~2021~~2022 and ~~2020,~~2021, respectively.

Additionally, ~~92.8%~~93.6% and ~~92.7%~~92.6% of the Company’s property and equipment were located in the United States and ~~7.2%~~6.4% and ~~7.3%~~7.4% were located in various international jurisdictions, as of June 30, ~~2021~~2022, and December 31, ~~2020,~~2021, respectively.

2022

Table of Contents

KNOWBE4, INC.

Note 7 – Intangible Assets and Goodwill

Intangible assets

Intangible assets, net consist of the following (in thousands):


		Weighted Average Amortization Period		June 30, 2021										Weighted Average Amortization Period			June 30, 2022
			Gross Carrying Amount			Accumulated Amortization			Net Carrying Amount							Gross Carrying Amount			Accumulated Amortization			Net Carrying Amount
				(in years)										(in years)
Acquired content and customer relationships(1)	Acquired content and customer relationships(1)	4.9 years		$	7,182		$	(2,268)				$	4,914		Acquired content and customer relationships(1)	4.0 years				$	7,084		$	(3,270)	$	3,814
Domain names	Domain names	1.1 years		245			(188)			57		Domain names		1.7 years			260			(218)			42
Patents	Patents	18.8 years		1,478			(78)			1,400		Patents		18.4 years			2,113			(164)			1,949
Trade names and other indefinite-lived intangibles(1)	Trade names and other indefinite-lived intangibles(1)	Indefinite		732			—			732		Trade names and other indefinite-lived intangibles(1)		Indefinite			707			—			707
In-process patents and trademarks	In-process patents and trademarks	Not applicable		1,039			—			1,039		In-process patents and trademarks		Not applicable			1,497			—			1,497
Total intangible assets	Total intangible assets			$	10,676		$	(2,534)		$	8,142	Total intangible assets					$	11,661		$	(3,652)		$	8,009


		Weighted Average Amortization Period		December 31, 2020										Weighted Average Amortization Period			December 31, 2021
			Gross Carrying Amount			Accumulated Amortization			Net Carrying Amount							Gross Carrying Amount			Accumulated Amortization			Net Carrying Amount
				(in years)										(in years)
Acquired content and customer relationships(1)	Acquired content and customer relationships(1)	3.7 years		$	2,268		$	(1,859)				$	409		Acquired content and customer relationships(1)	4.5 years				$	7,124		$	(2,762)	$	4,362
Domain names	Domain names	1.3 years		245			(156)			89		Domain names		2.1 years			260			(211)			49
Patents	Patents	19.1 years		1,235			(46)			1,189		Patents		18.5 years			1,761			(120)			1,641
Trade names and other indefinite-lived intangibles(1)	Trade names and other indefinite-lived intangibles(1)	Indefinite		425			—			425		Trade names and other indefinite-lived intangibles(1)		Indefinite			709			—			709
In-process patents and trademarks	In-process patents and trademarks	Not applicable		873			—			873		In-process patents and trademarks		Not applicable			1,231			—			1,231
Total intangible assets	Total intangible assets			$	5,046		$	(2,061)		$	2,985	Total intangible assets					$	11,085		$	(3,093)		$	7,992

_______________

(1) - Gross carrying amount includes impact of ~~currency~~ translation of foreign denominated intangible ~~assets~~assets.

Intangible asset amortization ~~expense~~ for the three months ended June 30, 2022 and 2021 totaled $0.4 million and $0.3 million, respectively, and totaled $0.7 million and $0.5 million, for the six months ended June 30, 2022 and 2021, ~~was $0.3 million and $0.5 million,~~ respectively. ~~Intangible asset amortization expense for the three and six months ended June 30, 2020 was not material.~~ These expenses are primarily presented in operating expenses with a portion allocated to cost of revenues within the accompanying consolidated statements of operations.

~~As of June 30, 2021, estimated~~Estimated future amortization expense is as follows (in thousands):


2021		$	598
2022	2022	1,151		2022	$	584
2023	2023	1,091		2023	1,120
2024	2024	1,059		2024	1,090
2025	2025	726		2025	754
2026				2026	680
Thereafter	Thereafter	1,746		Thereafter	1,577
Total	Total	$	6,371	Total	$	5,805

2123

Table of Contents

KNOWBE4, INC.

Goodwill

Goodwill represents the excess of the purchase price in a business combination over the fair value of net assets acquired. Goodwill amounts are not amortized, but rather tested for impairment at least annually.

The changes in carrying amounts of goodwill were as follows (in thousands):


Balance at December 31, ~~2019~~2020	$	~~8,873~~8,605
Acquisitions	81,092
Other adjustments(1)	~~(268)~~(368)
Balance at December 31, 2021	89,329
~~Balance at December 31, 2020~~Measurement period adjustments	~~8,605~~
~~Additions~~	~~34,339~~ (779)
Other adjustments(1)	84 (377)
Balance at June 30, ~~2021~~2022	$	~~43,028~~88,173

________________

(1)Other adjustments represents the impact of ~~currency~~ translation of foreign currency denominated goodwill balances.

Note 8 – Accounts Payable and Accrued Expenses

Accounts payable and accrued expenses consisted of the following (in thousands):


		June 30, 2021		December 31, 2020			June 30, 2022		December 31, 2021
Accrued commissions						Accrued commissions	$	9,216	$	9,302
Accrued payroll	Accrued payroll	$	15,489	$	4,839	Accrued payroll	14,493		8,798
Accrued commissions		7,982		6,662
Accounts payable	Accounts payable	4,283		2,530		Accounts payable	4,653		5,628
Contingent consideration						Contingent consideration	5,000		5,000
Other accrued expenses	Other accrued expenses	4,495		5,234		Other accrued expenses	6,436		8,914
Total accounts payable and accrued expenses	Total accounts payable and accrued expenses	$	32,249	$	19,265	Total accounts payable and accrued expenses	$	39,798	$	37,642

Note 9 – Leases

The Company primarily enters into operating lease agreements for office space and other property and equipment, some of which include options to renew or terminate the lease. The options to renew, which extend for up to 5 years, are reviewed on a per lease basis to determine if the renewal option is considered reasonably certain to be recognized and, therefore, are included in the determination of lease payments. Additionally, during the year ended December 31, 2020, the Company entered into a finance lease agreement with total future lease payments of $0.2 million, which is not considered material to the business.

The components of lease ~~expense~~costs were as follows (in thousands):


		Three Months Ended June 30,				Six Months Ended June 30,					Three Months Ended June 30,				Six Months Ended June 30,
		2021		2020		2021		2020			2022		2021		2022		2021
Operating lease cost	Operating lease cost	$	930	$	679	$	1,802	$	1,310	Operating lease cost	$	947	$	930	$	1,848	$	1,802
Short-term lease cost	Short-term lease cost	131		164		282		328		Short-term lease cost	189		131		362		282
Variable lease cost	Variable lease cost	232		125		370		240		Variable lease cost	169		232		306		370
Total lease cost	Total lease cost	$	1,293	$	968	$	2,454	$	1,878	Total lease cost	$	1,305	$	1,293	$	2,516	$	2,454

Lease costs are ~~primarily included~~amortized in general and administrative expenses in the accompanying consolidated statements of operations. The Company reports the amortization of ROU assets and the change in operating lease liabilities on a net basis in accounts payable and other liabilities in the accompanying consolidated statements of cash flows.

2224

Table of Contents

KNOWBE4, INC.

Other information related to operating and finance leases is as follows:


		Six Months Ended June 30,					Six Months Ended June 30,
		2021		2020			2022		2021
Weighted-average remaining lease term (in years)	Weighted-average remaining lease term (in years)	4.79		4.25		Weighted-average remaining lease term (in years)	4.8		4.8
Weighted-average discount rate	Weighted-average discount rate	4.5	%	6.7	%	Weighted-average discount rate	1.9	%	4.5	%

Future lease payments under non-cancellable leases recorded as of June 30, ~~2021,~~2022, were as follows (in thousands):


		Operating Leases			Operating Leases
2021		$	1,774
2022	2022	3,011		2022	$	1,835
2023	2023	2,861		2023	3,320
2024	2024	2,124		2024	3,174
2025	2025	1,672		2025	2,564
2026				2026	2,557
Thereafter	Thereafter	1,584		Thereafter	1,660
Total lease payments	Total lease payments	13,026		Total lease payments	15,110
Less: imputed interest	Less: imputed interest	(1,158)		Less: imputed interest	(562)
Total future lease payments under non-cancellable leases	Total future lease payments under non-cancellable leases	$	11,868	Total future lease payments under non-cancellable leases	$	14,548

Supplemental cash flow information related to leases is as follows (in thousands):


		Six Months Ended June 30,					Six Months Ended June 30,
		2021		2020			2022		2021
Cash paid for amounts included in the measurement of lease liabilities:	Cash paid for amounts included in the measurement of lease liabilities:					Cash paid for amounts included in the measurement of lease liabilities:
Operating cash outflows from operating leases	Operating cash outflows from operating leases	$	1,751	$	1,305	Operating cash outflows from operating leases	$	1,848	$	1,751

ROU assets obtained in exchange for lease obligations:	ROU assets obtained in exchange for lease obligations:					ROU assets obtained in exchange for lease obligations:
Operating leases	Operating leases	$	1,606	$	513	Operating leases	$	2,469	$	1,606

Note 10 – Revolving Credit Facility

~~The~~In 2021, the Company ~~has a revolving line of credit (the “Revolving Credit Facility”) that provides for~~entered into a $100.0 million revolving credit facility (the “Revolving Credit Facility”) with Bank of America, N.A., with a letter of credit and swingline sublimit of $10.0 million each ~~respectively,~~ and an accordion feature under which the Company can increase borrowings under the ~~credit facility~~Revolving Credit Facility by up to $50.0 million. The Company is also obligated to pay other customary fees for a credit facility of this size and type, including letter of credit fees, an upfront fee, and an unused commitment fee which are expensed as incurred and included within interest expense in the consolidated statement of operations. The Revolving Credit Facility matures on March 12, 2024 and contains certain financial covenants.

The borrowings under the Revolving Credit Facility bear interest, at our option, at a base rate equal to the highest of (a) the federal funds rate plus 0.50%, (b) the rate of interest in effect for such date as publicly announced from time to time by Bank of America as its “prime rate”, or (c) the eurodollar rate plus 1.0%, provided that such rate shall not be less than 0.5%. As of June 30, ~~2021,~~2022, the Company did 0tnot have any outstanding borrowings under the Revolving Credit Facility, there were 0no issued letters of credit outstanding from the credit agreement and the Company was in compliance with all covenant requirements.

2325

Table of Contents

KNOWBE4, INC.

Note 11 – ~~Stockholders’~~Stockholder’s Equity

Initial Public Offering

On April 26, 2021, the Company completed an IPO of its Class A common stock, in which the Company issued and sold 10,425,000 shares of Class A common stock, including 1,425,000 shares resulting from the exercise in full of the underwriters’ option to purchase additional shares, at an IPO price of $16.00 per share for net proceeds to the Company of $156.0 million. Upon recording the proceeds from the transaction, the Company reclassified $2.2 million of offering costs into stockholders’ equity (deficit) as a reduction of the net proceeds received from the IPO.

Immediately prior to the completion of the IPO, the Company filed an amended ~~its Fifth Charter in the form~~and restated certificate of ~~the IPO Charter,~~incorporation, which authorized capital stock consisting of 1,000,000,000 shares of Class A common stock, par value $0.00001 per share, 500,000,000 shares of Class B common stock, par value $0.00001 per share, and 100,000,000 shares of preferred stock, par value $0.00001 per share. The rights of the holders of Class A common stock and Class B common stock are identical, except with respect to voting and conversion rights. Each share of Class B common stock is entitled to 10 votes and is convertible into 1 share of Class A common stock. Additionally, all shares of the Company’s capital stock outstanding immediately prior to the IPO, including all of the Company’s outstanding shares of convertible preferred stock, were reclassified into shares of the Company’s Class B common stock. No dividends were declared or paid during the three and six months ended June 30, 2022.

Stockholder’s Equity Prior to Initial Public Offering

Prior to the completion of the IPO, the terms of the Company’s equity securities were defined in the Company’s Fifth Amended and Restated Certificate of Incorporation, which was filed with the Secretary of the State of Delaware on July 1, 2019 (the “Fifth Charter”). As described above, the Company amended and then restated its Fifth Charter. The summary below relates to the Company’s Fifth Charter, inclusive of the amendment, which included the forward stock split, but prior to the restatement which was filed in conjunction with the IPO.

Common Stock

Prior to the completion of the IPO, the Company had one class of common stock where each share of common stock entitled the holder to ~~one~~1 vote ~~together with the holders of preferred stock,~~ on all matters submitted to the stockholders for a vote. The voting, dividend and liquidation rights of the holders of the common stock were subject to and qualified by the rights, powers and preference of the holders of the preferred stock set forth below.

Preferred Stock

Prior to the completion of the IPO, the Company was authorized to issue 114,164,600 shares of ~~convertible~~ preferred stock, par value $0.00001 per share. As of ~~December~~March 31, ~~2020,~~2021, the Company had outstanding Series A, A-1, B, C and C-1 Preferred Stock (individually referred to as “Series A, A-1, B, C or C-1” or collectively “preferred stock”) as ~~follows (in thousands, except share and per share amounts):~~follows:


		As of December 31, 2020									Issue Price per Share		Shares Authorized	Issued and Outstanding	Net Carrying Value		Liquidation Preference
		Issue Price per Share		Shares Authorized	Issued and Outstanding	Net Carrying Value		Liquidation Preference			(in thousands, except share and per share amounts)
Series A	Series A	$	0.26	30,525,040	30,525,040	$	8,000	$	8,000	Series A	$	0.26	30,525,040	30,525,040	$	8,000	$	8,000
Series A-1	Series A-1	$	0.82	6,764,960	6,764,960	5,541		5,541		Series A-1	$	0.82	6,764,960	6,764,960	5,541		5,541
Series B	Series B	$	1.67	17,955,840	17,955,840	30,000		30,000		Series B	$	1.67	17,955,840	17,955,840	30,000		30,000
Series C	Series C	$	4.85	6,511,400	6,511,400	31,377		31,561		Series C	$	4.85	6,511,400	6,511,400	31,377		31,561
Series C-1	Series C-1	$	5.90	52,407,360	52,407,360	309,015		309,400		Series C-1	$	5.90	52,407,360	52,407,360	309,015		309,400
Total	Total			114,164,600	114,164,600	$	383,933	$	384,502	Total			114,164,600	114,164,600	$	383,933	$	384,502

As it relates to voting and dividend rights, the rights, preferences, and privileges of the preferred stock did not differ from the rights of the common stock. ~~NaN~~No dividends were declared during the ~~year~~three and six months ended ~~December 31, 2020.~~

June 30, 2021. In the event of any deemed liquidation ~~or Deemed Liquidation Event~~event, as defined in the ~~Certificate~~Company’s certificate of ~~Incorporation,~~incorporation as then in effect, the holders of preferred stock were entitled to the greater of (i) the original issue

Table of Contents

KNOWBE4, INC.

price of the preferred stock plus any dividends declared and unpaid thereon, or (ii) the amount payable had all classes of shares been converted to common stock.

Additionally, each share of preferred stock was convertible, at the option of the holder at any time, into the number of shares of common stock determined by dividing the original issue price for such series of preferred stock by the conversion price for such series of preferred share that is in effect at the time of conversion. Each share of preferred stock ~~other than the shares~~was converted to 1 share of ~~Series C-1 preferred stock, automatically converts into~~Class B common stock atin connection with the then-applicable conversion rate in the event of the closing of a sale of shares to the public in a firm-commitment underwritten public offering at a price per share of $4.85 (the “IPO Value”) that results in net proceeds to the Company of not less than $100.0 million (a “Qualifying Public Offering” or “QPO”), or (ii) upon the consent of the holders of a majority of the shares of each of the other outstanding preferred stock classes. All shares of Series C-1 Preferred Stock automatically convert into shares of Common Stock at the then-applicable conversion rate upon the closing of a QPO with an IPO Value equal to or greater than $8.86 per share or equal to or more than $6.48 per share subject to certain approvals and additional share conversion requirements.

IPO.

Note 12 – ~~Stock-Based~~Stock Compensation

~~Equity Incentive Plans~~

2016 Equity Incentive Plan

~~Effective January 19, 2016, the~~The Company initially established the ~~KnowBe4, Inc.~~ 2016 Equity Incentive Plan (the “2016 Incentive Plan”)~~. The 2016 Incentive Plan initially~~ which authorized the issuance of up to an aggregate of ~~32,746,480~~37,728,000 shares of common stock in the form of stock options and other types of equity awards that ~~could be~~were granted to officers, employees, directors, consultants and advisors of the Company and its subsidiaries and affiliates. ~~Effective July 2, 2019, the Company amended the 2016 Incentive Plan to increase the maximum number of shares issuable under the plan to 37,728,000 shares of common stock.~~ The Company ~~has~~ only granted stock options under the 2016 Incentive Plan. These options generally vest within four years from the date of grant and expire ten years from the date of grant, with typical vesting of 25% on the first anniversary and monthly thereafter.

The Company (i) amended the 2016 Incentive Plan to clarify that, following the closing of the IPO, outstanding awards under the 2016 Incentive Plan would cover shares of the Company’s Class B common stock, and (ii) terminated the 2016 Incentive Plan; provided, however, that the 2016 Incentive Plan continues to govern the terms and conditions of awards outstanding ~~awards~~ under the 2016 Incentive Plan as of the time of its termination. As of June 30, ~~2021,~~2022, a total of ~~13,112,000~~8,040,614 shares of Class B common stock have been reserved for issuance upon the exercise of stock options under the 2016 Incentive Plan.

2021 Equity Incentive Plan

~~The Company’s board of directors~~In April 2021, the Company adopted the 2021 Equity Incentive Plan ~~(“2021~~(the “2021 Incentive Plan”), which ~~became effective on April 20, 2021 and authorizes a maximum number~~initially authorized the issuance of up to an aggregate of 18,400,000 shares ~~issuable~~ of ~~18,400,000. The 2021 Incentive Plan provides for~~Class A common stock in the ~~grant~~form of incentive stock options, nonstatutory stock options, restricted stock, restricted stock units, stock appreciation rights, performance units and performance shares to our employees, directors and consultants and any of our future subsidiary corporations’ employees and consultants. ~~Additionally,~~In addition, the shares reserved for issuance under the 2021 Incentive Plan ~~includes an annual increase in~~include a number of shares of Class A common stock equal to the number of shares of Class B common stock subject to awards granted under the 2016 Incentive Plan up to a maximum of 14,219,800 shares. The number of shares of the Company’s Class A common stock available for issuance under the 2021 Incentive Plan is subject to an annual increase on the first day of each fiscal year beginning ~~with our~~on January 1, 2022, ~~fiscal year.~~equal to the lesser of: (i) 18,400,000 shares; (ii) 5% of the outstanding shares of all classes of the Company’s common stock as of the last day of the immediately preceding year; or (iii) such other amount as the Company’s board of directors may determine. As of June 30, ~~2021, 16,665,740~~2022, 22,748,584 shares of Class A common stock were reserved for future issuance under the 2021 Incentive Plan.

Stock Options

The Company records compensation expense for stock options based on the estimated fair value of the options on the date of grant using the Black-Scholes option-pricing model with the assumptions set forth in the table below.

Six Months Ended June 30,
2021 2020
Expected term (years) 6.3 5.8
Expected stock price volatility 45.0 % 45.0 %
Risk-free interest rate 0.8 % 1.3 %
Dividend yield 0 % 0 %
Fair value of common stock $ 19.82 $ 4.14


	Six Months Ended June 30, 2021
Expected term (years)	6.3
Expected stock price volatility	45.0		%
Risk-free interest rate	0.8		%
Dividend yield	—		%
Fair value of common stock	$	19.82

Table of Contents

KNOWBE4, INC.

The following table summarizes the common stock option activity for the six months ended June 30, ~~2021:~~2022:


		Number of Shares	Weighted-Average Exercise Price		Weighted-Average Grant Date Fair Value		Weighted-Average Remaining Contractual Term (years)	Aggregate Intrinsic Value (in thousands)			Number of Shares	Weighted-Average Exercise Price		Weighted-Average Grant Date Fair Value		Weighted-Average Remaining Contractual Term (years)	Aggregate Intrinsic Value (in thousands)
Outstanding as of December 31, 2020		14,219,800	$	2.73	$	1.25	7.9	$	131,893
Outstanding as of December 31, 2021										Outstanding as of December 31, 2021	9,104,749	$	3.18	$	1.51	6.9
Granted	Granted	40,000	12.01		11.52		0	312		Granted	—	—		—
Exercised	Exercised	(864,657)	1.10		0.35		0	13,113		Exercised	(963,004)	2.32					18,106
Forfeited or expired	Forfeited or expired	(282,960)	4.16		1.86		0	3,637		Forfeited or expired	(101,131)	5.17
Outstanding as of June 30, 2021		13,112,183	$	2.84	$	1.33	7.5	$	372,783
Vested and exercisable as of June 30, 2021		8,705,263	$	2.09	$	0.97	6.9	$	253,998
Outstanding as of June 30, 2022										Outstanding as of June 30, 2022	8,040,614	$	3.25	$	1.56	6.8	$	99,439
Vested and exercisable as of June 30, 2022										Vested and exercisable as of June 30, 2022	5,866,254	$	2.74	$	1.31	6.5	$	75,538

The aggregate intrinsic value of the options exercised represents the difference between the estimated fair value of our common stock on the date of exercise and the exercise price of the options.

Share Repurchases

Prior to the completion of its IPO, the Company ~~had~~ repurchased or promised to repurchase shares of common stock from former employees under pre-existing contingent call options triggered upon termination. The repurchase price paid or promised was in excess of the fair value of the common stock on the repurchase date, which resulted in additional compensation expense of $0.6 million and $0.8 million for the three and six months ended June 30, 2020, respectively. As of December 31, 2020, the Company recorded a liability representing the fair value of shares committed to be repurchased of $1.0 million, which is included in accounts payable and accrued expenses in the accompanying consolidated balance sheets.date. During ~~the six months ended June 30,~~April 2021, the Company completed its IPO, establishing a public market for the Company’s shares and no longer ~~intends to repurchase~~repurchases shares under remaining contingent call options.

Restricted Stock Units

The Company recognizes ~~stock-based~~stock compensation expense associated with ~~restricted stock units (“RSUs”)~~RSUs over the term of the respective awards. The following table summarizes the ~~RSUs~~RSU activity ~~for~~during the six months ended June 30, ~~2021:~~2022:


		Shares	Weighted-Average Grant-Date Fair Value per share			Shares	Weighted-Average Grant-Date Fair Value per Share
Outstanding at December 31, 2020		0	$	0
Outstanding as of December 31, 2021					Outstanding as of December 31, 2021	2,433,681	$	20.80
Granted	Granted	1,734,260	$	16.14	Granted	793,784	$	19.40
Vested	Vested	(949,815)	$	16.20	Vested	(354,443)	$	17.88
Forfeited or expired	Forfeited or expired	0	$	0	Forfeited or expired	(84,191)	$	22.01
Outstanding at June 30, 2021		784,445	$	16.06
Outstanding as of June 30, 2022					Outstanding as of June 30, 2022	2,788,831	$	20.73

The majority of RSUs granted during the period relates to RSUs granted to certain executives in conjunction with the IPO. A portion of these awards were fully vested at the time of grant while additional awards are subject to vesting upon the satisfaction of a service condition and/or achievement of certain performance metrics.

2021 Employee Stock Purchase Plan

~~The Company’s~~In April 2021, ~~Employee Stock Purchase Plan (“ESPP”) became effective on April 20, 2021 and allows~~the Company adopted its ESPP, which initially reserved for ~~the sale of~~issuance 3,350,000 shares of Class A common stock. The number of shares ~~of Class A common stock that are available for sale~~reserved under the ESPP ~~also includes an annual~~will automatically increase on the first day of each fiscal year, ~~beginning~~starting on January 1, ~~2022.~~ 2022, in an amount equal to the lesser of (i) 3,350,000 shares, (ii) 1% of the outstanding shares of our common stock on the last day of the immediately preceding fiscal year, or (iii) such other amount as the administrator of the ESPP may determine. As of June 30, 2022, 5,092,727 shares of Class A common stock were reserved for future issuance under the ESPP.

Table of Contents

KNOWBE4, INC.

The fair value of the ESPP purchase right is estimated on the grant date using the Black-Scholes option-pricing model with the following assumptions:


	~~Six Months Ended June 30, 2021~~
~~Expected term (years)~~	~~0.5~~
~~Expected stock price volatility~~	~~60.9~~	%
~~Risk-free interest rate~~	~~0.4~~	%
~~Dividend yield~~	0	%


	Six Months Ended June 30, 2022		Six Months Ended June 30, 2021
Expected term (years)	0.5		0.5
Expected stock price volatility	71.0% - 81.9%		60.9	%
Risk-free interest rate	0.1% - 1.5%		0.4	%
Dividend yield	—	%	—	%

~~Stock-based~~Stock Compensation Expense

The following table summarizes the components of ~~stock-based~~stock compensation expense recognized in the consolidated statements of operations (in thousands):


		Three Months Ended June 30,				Six Months Ended June 30,					Three Months Ended June 30,				Six Months Ended June 30,
		2021		2020		2021		2020			2022		2021		2022		2021
Cost of revenues	Cost of revenues	$	76	$	31	$	129	$	52	Cost of revenues	$	179	$	76	$	345	$	129
Sales and marketing	Sales and marketing	5,662		251		6,551		402		Sales and marketing	1,421		5,662		2,575		6,551
Technology and development	Technology and development	148		100		288		170		Technology and development	1,328		148		2,581		288
General and administrative	General and administrative	12,983		934		13,560		1,395		General and administrative	4,053		12,983		7,107		13,560
Total stock-based compensation expense		$	18,869	$	1,316	$	20,528	$	2,019
Total stock compensation expense										Total stock compensation expense	$	6,981	$	18,869	$	12,608	$	20,528

As of June 30, ~~2021,~~2022, the Company had ~~$20.4~~$50.5 million of unrecognized stock compensation associated with stock awards, which is expected to be recognized over a weighted-average period of ~~2.8~~2.3 years.

2729

Table of Contents

KNOWBE4, INC.

Note 13 – Net Income (Loss) ~~Income~~ per Share

The computation of net income (loss) ~~income~~ per share is as follows (in thousands, except share and per share data):


		Three Months Ended June 30,						Six Months Ended June 30,							Three Months Ended June 30, 2022				Six Months Ended June 30, 2022
		2021				2020		2021				2020			Class A		Class B		Class A		Class B
		Class A		Class B				Class A		Class B
Net income per share, basic:														Net income per share, basic:
Numerator:	Numerator:													Numerator:
Allocation of undistributed (losses) earnings for basic calculation		$	(1,136)	$	(15,727)	$	116	$	(988)	$	(13,675)	$	(932)
Reallocation of undistributed earnings for diluted calculation		$	0	$	0	$	313	$	0	$	0	$	0
Allocation of undistributed (losses) earnings for diluted calculation		$	(1,136)	$	(15,727)	$	429	$	(988)	$	(13,675)	$	(932)
Allocation of undistributed income for basic calculation														Allocation of undistributed income for basic calculation	$	1,452	$	1,896	$	1,976	$	2,732
Denominator:	Denominator:													Denominator:
Number of shares used in basic per share computation	Number of shares used in basic per share computation	8,235,097		114,038,847		42,118,845		4,117,549		57,019,424		42,089,816		Number of shares used in basic per share computation	76,023,858		99,269,315		73,404,219		101,505,630
Net income per share, basic														Net income per share, basic	$	0.02	$	0.02	$	0.03	$	0.03

Net income per share, diluted:														Net income per share, diluted:
Numerator:														Numerator:
Allocation of undistributed income for basic calculation														Allocation of undistributed income for basic calculation	$	1,452	$	1,896	$	1,976	$	2,732
Reallocation of undistributed income for diluted calculation based on conversion of Class B to Class A shares														Reallocation of undistributed income for diluted calculation based on conversion of Class B to Class A shares	1,896		—		2,732		—
Reallocation of undistributed income														Reallocation of undistributed income	—		(72)		—		(110)
Allocation of undistributed income for diluted calculation														Allocation of undistributed income for diluted calculation	$	3,348	$	1,824	$	4,708	$	2,622
Denominator:														Denominator:
Number of shares used in basic per share computation														Number of shares used in basic per share computation	76,023,858		99,269,315		73,404,219		101,505,630
Plus: reallocation of Class B to Class A shares outstanding														Plus: reallocation of Class B to Class A shares outstanding	99,269,315		—		101,505,630		—
Plus: dilutive common stock options and restricted stock units														Plus: dilutive common stock options and restricted stock units	6,927,476		—		7,320,059		—
Number of shares used in diluted per share computation	Number of shares used in diluted per share computation	8,235,097		114,038,847		164,160,470		4,117,549		57,019,424		42,089,816		Number of shares used in diluted per share computation	182,220,649		99,269,315		182,229,908		101,505,630
Net (loss) income per share, basic and diluted		$	(0.14)	$	(0.14)	$	0	$	(0.24)	$	(0.24)	$	(0.02)
Net income per share, basic and diluted														Net income per share, basic and diluted	$	0.02	$	0.02	$	0.03	$	0.03


	Three Months Ended June 30, 2021				Six Months Ended June 30, 2021
	Class A		Class B		Class A		Class B
Net loss per share, basic and diluted:
Numerator:
Allocation of undistributed loss for basic and diluted calculation	$	(1,136)	$	(15,727)	$	(988)	$	(13,675)
Denominator:
Number of shares used in basic and diluted per share computation	8,235,097		114,038,847		4,117,549		57,019,424
Net loss per share, basic and diluted	$	(0.14)	$	(0.14)	$	(0.24)	$	(0.24)

Table of Contents

KNOWBE4, INC.

Potentially dilutive securities that were not included in the June 30, 2021 diluted per share calculations because they would be antidilutive were as follows:

Three Months Ended June 30, Six Months Ended June 30,
2021 2020 2021 2020
Stock options 12,030,920 0 12,109,270 8,003,137
Restricted stock units 175,301 0 175,301 0
Preferred shares, Series A 0 0 0 30,525,040
Preferred shares, Series A-1 0 0 0 6,764,960
Preferred shares, Series B 0 0 0 17,955,840
Preferred shares, Series C 0 0 0 6,511,400
Preferred shares, Series C-1 0 0 0 52,407,360


	Three Months Ended June 30, 2021	Six Months Ended June 30, 2021
Stock options	12,030,920	12,109,270
Restricted stock units	175,301	175,301
Shares issuable pursuant to the 2021 Employee Stock Purchase Plan	—	—
Total potentially dilutive securities	12,206,221	12,284,571

Note 14 – Income Taxes

The Company computes its year-to-date provision for income taxes by applying the estimated annual effective tax rate to year-to-date pretax income or loss and adjusts the provision for discrete tax items recorded in the period. Each quarter the Company updates its estimated annual effective tax rate and makes a cumulative adjustment if the estimated annual tax rate has changed.

The Company recognized income tax expense of $0.2 million and $0.6 million for the three months ended June 30, 2022 and 2021, respectively, and of $0.8 million for the ~~three and~~ six months ended June 30, ~~2021, respectively,~~2022 and ~~an income tax benefit of $0.4 million for the each of the three and six months ended June 30, 2020. The tax~~2021. Tax expense ~~for the three and six months ended June 30, 2021~~ was primarily attributable to taxes generated on operating income ~~earning~~expected to be earned in both the U.S. and foreign jurisdictions along with U.S. state tax expense. The tax benefit recognized for the three and six months ended June 30, 2020 primarily relates to the recognition of deferred tax assets in jurisdictions where the Company did not record a valuation allowance.jurisdictions. As of June 30, ~~2021,~~2022, the Company has a full valuation allowance on its U.S. federal and state and certain foreign deferred tax assets.

Note 15 – Commitments and Contingencies

The Company is subject to various legal proceedings and claims arising in the ordinary course of business. The Company establishes accruals for specific legal proceedings when it is considered probable that a loss has been incurred and the amount of the loss can be reasonably estimated. Accruals for loss contingencies are reviewed periodically and adjusted as additional information becomes available. If a loss is not both probable and reasonably estimable, or if an exposure to loss exists in excess of the amount accrued, the Company assesses whether there is at least a reasonable possibility that a loss, or additional loss, may have been incurred. If there is a reasonable possibility that a loss, or additional loss, may have been incurred, the Company discloses the estimate of the possible loss or range of loss, or states that such an estimate cannot be made. The evaluation as to whether a loss is reasonably possible or probable is based on the Company’s assessment, in conjunction with legal counsel, regarding the ultimate outcome of the matter.

The Company believes that it has adequately accrued for the potential impact of loss contingencies that are probable and reasonably estimable. The Company does not believe that the ultimate resolution of any matters to which the Company is presently a party will have a material adverse effect on its consolidated results of operations, financial condition or cash flows. However, the results of these matters cannot be predicted with certainty, and an unfavorable resolution of one or more of these matters could have a material adverse effect on the Company’s consolidated results of operations, financial condition or cash flows. Legal costs are expensed as incurred.

Note 16 – Related Party Transactions

Kevin Mitnick, a former member of the board of directors and a holder of greater than 5% of the Company’s Class B common stock, performs consulting services for and licenses to the Company the right to use his name and likeness in connection with the Company’s products. Mr. Mitnick's consulting agreement calls for an annual fee of $0.2 million plus the reimbursement of certain expenses.

Note 17 – Subsequent Events

The Company has evaluated subsequent events through the filing of this Quarterly Report on Form 10-Q and determined that there have been no events that have occurred that would require adjustments to our disclosures in the consolidated financial statements.

Table of Contents

Item 2. Management’s Discussion and Analysis of Financial Condition and Results of Operations

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with our consolidated financial statements and the related notes to those statements included elsewhere in this Quarterly Report on Form 10-Q. As discussed in “Cautionary Note Regarding Forward-Looking Statements,” in addition to historical financial information, the following discussion and analysis may contain forward-looking statements regarding our expectations of future performance, liquidity and capital resources, our plans, estimates, beliefs and expectations that involve risks, uncertainties and assumptions. Our actual results and timing of selected events may differ materially from those anticipated or implied in these forward-looking statements as a result of many factors, including those discussed under “Risk Factors” and elsewhere in this Quarterly Report on Form 10-Q.

Overview

KnowBe4 has developed the leading security awareness platform enabling organizations to assess, monitor and minimize the ongoing cybersecurity threat of social engineering attacks. We are pioneering an integrated approach to security awareness that incorporates cloud-based software, machine learning, artificial intelligence, advanced analytics and insights with engaging content. Our platform is designed to drive awareness, change human behavior and enable a security-minded culture that results in a reduction of social engineering risks. The KnowBe4 platform is designed to be powerful, yet highly scalable, intuitive and easy to deploy, in order to reduce the administrative burden of managing social engineering risk on security and IT professionals. Customers typically deploy our platform quickly across their entire organization to monitor and reduce the cybersecurity risk associated with their employees’ behavior.

Our flagship product, Kevin Mitnick Security Awareness Training ~~or KMSAT,~~(“KMSAT”), focuses on enabling organizations to assess their social engineering risks and providing security awareness training to mitigate these risks. KnowBe4 Compliance Manager ~~or KCM,~~(“KCM”), enables organizations to manage compliance and audit cycles and PhishER, our security orchestration and automation product, enables security operations teams to prioritize and automate security workstreams in order to respond to, and remediate, social engineering attacks. Our ~~newest product,~~ Compliance Plus product provides our customers with relevant and engaging compliance content on a broad range of topics from data privacy to diversity, equity and inclusion. Additionally, we are currently developing the SecurityCoach product to incorporate technology gained through the SecurityAdvisor acquisition to address human behavior risks in real-time.

We generate substantially all of our ~~revenue~~revenues from the sale of subscriptions to access our cloud-based platform. Subscription sales are primarily generated by our inside sales representatives and our network of channel partners. Our platform is priced individually by product then based on the subscription tier and number of subscribed users. This pricing model allows us to offer organizations flexibility to meet their individual needs without compromising the overall value of our platform. For KMSAT, Compliance Plus and PhishER, the number of subscribed users typically includes all or a majority of the employees ofwithin the customer organization. For KCM, the number of subscribed users typically includes the employees responsible for the administration of governance and compliance functions within the customer organization. KMSAT and KCM each feature premium tiers, which offer customers access to additional features, including many of our APIs and AI functionality. Additionally, the premium tiers of KMSAT offer customers access to more differentiated content options, including highly produced, serialized content, interactive modules, games and compliance modules.

~~Generally,~~Our platform is designed to be powerful, yet highly scalable, intuitive and easy to deploy, in order to reduce the ~~subscription terms~~administrative burden of managing social engineering risk on security and IT professionals. Customers typically deploy our platform quickly across their entire organization to monitor and reduce the cybersecurity risk associated with their employees’ behavior. Because our products are designed to change human behavior within the entire organization, rollout of our products is performed organization-wide at the onset of a contract rather than focused on certain departments or portions of an organization. We utilize our team of customer ~~contracts range from one~~success managers to ~~three years~~ensure successful adoption and ~~are invoiced on an annual basis. A substantial majority~~use of our products, while our team of dedicated pricing specialists are tasked with negotiating customer renewals, along with upselling and cross-selling. We sell our products to customers of all sizes both directly through our dedicated inside sales teams for enterprise and small and medium businesses (“SMBs”), and indirectly through channel partners and managed service providers (“MSPs”).

Table of Contents

We have established a significant market presence, with more than 52,200 customers as of June 30, 2022, across virtually all industries and multiple geographies. No single direct customer represented more than 1% of our revenues for three and six months ended June 30, 2022.

Our business has experienced significant growth with total revenues, net of $80.8 million and $59.4 million for the three months ended June 30, 2022 and 2021, respectively, and $155.8 million and $112.9 million for the six months ended June 30, 2022 and 2021, respectively. As of June 30, 2022 and 2021, we had annual recurring revenue (“ARR”), of $328.3 million and $240.6 million, respectively. For the three months ended June 30, 2022 and 2021, we had net income of $3.3 million and net loss of $16.9 million, respectively, and for the six months ended June 30, 2022 and 2021 we had net income of $4.7 million and net loss of $14.7 million, respectively. See the sections titled “—Key Business Metrics—Annual Recurring Revenue” for additional information regarding ARR.

We have built our business with a focus on cash flow generation. Our net cash provided by operating activities for the six months ended June 30, 2022 and 2021 was $47.4 million and $35.9 million and our free cash flow was $42.5 million and $33.8 million, respectively. See the sections titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Non-GAAP Financial Measures—Free Cash Flow” for additional information regarding free cash flow and for a reconciliation of free cash flow to the most directly comparable financial measure calculated in accordance with U.S. generally accepted accounting principles (“GAAP”).

Recent Events

Our business is ~~recognized over~~subject to risks and uncertainties arising from current global macroeconomic and geopolitical conditions, including but not limited to, the ~~period~~Russian invasion of Ukraine, inflationary pressures and actions to counter those pressures, supply chain constraints, labor shortages, and the ongoing impacts of the ~~subscription. For~~COVID-19 pandemic. While the ultimate impact of these events on our ~~KMSAT product, a portion of revenue earned from subscriptions~~business is ~~recognized at the point-in-time that the customer’s subscription begins. Revenue recognized at contract inception relates~~uncertain, we have not experienced significant adverse impacts to our ~~customer’s ability~~results of operations, including our number of customers, ARR and revenues, or any indications that our results of operations would be adversely impacted in the future. We expect the competitive nature of our pricing model to ~~download content from~~allow our ~~platform,~~customers, particularly SMBs, to retain their subscriptions throughout the ongoing macroeconomic challenges. Further, we believe that organizations will continue to prioritize cybersecurity spending, which ~~represents~~may result in increases to our number of customers, ARR and revenues as organizations see a ~~separate performance obligation.~~greater need for our platform.

Refer to Part II, Item 1A, “Risk Factors” in this Quarterly Report on Form 10-Q for further discussion of the possible impact of the current macroeconomic environment on our business.

Key Business Metrics

We regularly monitor a number of financial and operating metrics, including the following key metrics, in order to measure our current performance and estimate our future performance, as follows:


		June 30,				Change					June 30,				Change
		2021		2020		Amount		%			2022		2021		Amount		%
		(dollars in thousands)									(dollars in thousands)
Number of customers	Number of customers	41,601		33,056		8,545		25.9	%	Number of customers	52,216		41,601		10,615		25.5	%
Annual recurring revenue (in thousands)		$	240,595	$	169,003	$	71,592	42.4	%
Annual recurring revenue										Annual recurring revenue	$	328,325	$	240,595	$	87,730	36.5	%

Number of Customers

We believe that our ability to increase and retain the number of customers on our platform is an indicator of our market penetration, the growth of our business and potential future business opportunities. Increasing awareness of our platform and products, combined with further overall awareness of the need to address the human risk within cybersecurity, has continued to expand our customer base to include organizations of all sizes across all industries. We define a customer as a separate and distinct buying entity, such as a company, an educational or government institution or a distinct business unit of a large company that has an active contract with us to access our platform. We do not consider our channel partners as separate customers as our contracts are executed with the end user, and we treat ~~Managed Service Providers (“MSPs”),~~MSPs who may purchase our products on behalf of multiple companies, as a single customer. As our

Table of Contents

customer base grows and as our market penetration increases, we do not expect to continue to grow at the same year-over-year rate.

Annual Recurring Revenue

We believe that ~~annual recurring revenue (“ARR”)~~ARR is a key metric to measure our business performance because it ~~reflects~~is driven by our ability to acquire new customers and to maintain and expand our relationship with existing customers. We define ARR as the annualized value of all contractual subscription agreements as of the end of the period. We perform this calculation on an individual contract basis by dividing the total dollar amount of a contract by the total contract term stated in months and multiplying this amount by twelve to annualize. Calculated ARR for each individual contract is then aggregated to arrive at total ARR. ARR does not have a standardized meaning and therefore may not be comparable to similarly titled measures presented by other companies. ARR should be viewed independently of ~~revenue,~~revenues, deferred revenue and remaining performance obligations and is not intended to be combined with or to replace any of those items. Specifically, ARR, as calculated under the definition herein, does not adjust for the timing impact of revenue recognition for specific performance obligations identified within a contract. ARR is not a forecast and the active contracts at the date used in calculating ARR may or may not be extended by our customers. We expect ARR in total dollars to continue to grow as we execute on our growth strategies and increase our market penetration, but we do not expect to continue to grow at the same year-over-year rate as we become a larger, more mature business.

Non-GAAP Financial Measures

In addition to our results determined in accordance with ~~U.S. generally accepted accounting principles (“GAAP”),~~GAAP, we believe the following non-GAAP measures are useful in evaluating our operating performance. We believe that non-GAAP financial information, when taken collectively, may be helpful to investors because it provides consistency and comparability with past financial performance. However, non-GAAP financial information is presented for supplemental informational purposes only, has limitations as an analytical tool, and should not be considered in isolation or as a substitute for financial information presented in accordance with GAAP. Other companies, including companies in our industry, may calculate similarly-titled non-GAAP measures differently or may use other measures to evaluate their performance, all of which could reduce the usefulness of our non-GAAP financial measures as tools for comparison. A reconciliation is provided below for each non-GAAP financial measure to the most directly comparable financial measure stated in accordance with GAAP. Investors are encouraged to review the related GAAP financial measures and the reconciliation of these non-GAAP financial

measures to their most directly comparable GAAP financial measures and not to rely on any single financial measure to evaluate our business.

Non-GAAP Gross Profit

We define non-GAAP gross profit as GAAP gross profit excluding stock compensation expense, amortization of acquired technology and intangible assets and acquisition and integration related costs, if applicable. Costs associated with acquisitions and integration include legal, accounting and other professional fees, changes in the fair value of contingent consideration obligations and other costs related to the transition of the acquired business. We believe non-GAAP gross profit provides our management and investors consistency and comparability with our past financial performance and facilitates period-to-period comparisons of our results of operations, as this metric generally eliminates the effects of certain variables unrelated to our overall operating performance.


	Three Months Ended June 30,				Six Months Ended June 30,
	2022		2021		2022		2021
	(in thousands)				(in thousands)
Gross profit	$	69,853	$	50,759	$	134,741	$	96,966
Add: Stock compensation expense	179		76		345		129
Add: Amortization of acquired technology and intangible assets	960		147		1,605		241
Non-GAAP gross profit	$	70,992	$	50,982	$	136,691	$	97,336

Table of Contents

Non-GAAP Operating Income

We define non-GAAP operating income ~~(loss)~~ as GAAP operating income ~~(loss)~~ excluding ~~stock-based~~stock compensation expense, amortization of acquired technology and intangible assets and acquisition and integration related costs. Costs associated with acquisitions and integration include legal, accounting and other professional fees, changes in the fair value of contingent consideration obligations and other costs related to the transition of the acquired business. We believe non-GAAP operating income ~~(loss)~~ provides our management and investors consistency and comparability with our past financial performance and facilitates period-to-period comparisons of operations, as this metric generally eliminates the effects of certain variables unrelated to our overall operating performance.

Three Months Ended June 30, Six Months Ended June 30,
2021 2020 2021 2020
(in thousands)
Operating loss $ (15,795) $ (56) $ (13,030) $ (1,574)
Add: Stock-based compensation expense 18,869 1,316 20,528 2,019
Add: Amortization of acquired intangible assets 294 83 469 166
Add: Acquisition and integration related costs 1,137 — 2,448 —
Non-GAAP operating income $ 4,505 $ 1,343 $ 10,415 $ 611


	Three Months Ended June 30,				Six Months Ended June 30,
	2022		2021		2022		2021
	(in thousands)				(in thousands)
Operating income (loss)	$	2,818	$	(15,795)	$	5,410	$	(13,030)
Add: Stock compensation expense	6,981		18,869		12,608		20,528
Add: Amortization of acquired technology and intangible assets	1,121		294		1,926		469
Add: Acquisition and integration related costs	34		1,137		34		2,448
Non-GAAP operating income	$	10,954	$	4,505	$	19,978	$	10,415

Free Cash Flow

We define free cash flow as net cash provided by operating activities less purchases of property, equipment, amounts capitalized for internal-use software and principal payments on finance leases. We believe that free cash flow is a meaningful indicator of liquidity to management and investors about the amount of cash generated from our operations that, after the investments in property, equipment and capitalized internal-use software, can be used for strategic initiatives.


		Three Months Ended June 30,				Six Months Ended June 30,					Three Months Ended June 30,				Six Months Ended June 30,
		2021		2020		2021		2020			2022		2021		2022		2021
		(in thousands)									(in thousands)				(in thousands)
Net cash provided by operating activities	Net cash provided by operating activities	$	14,076	$	13,034	$	35,946	$	26,963	Net cash provided by operating activities	$	22,252	$	14,094	$	47,393	$	35,946
Less: Purchases of property and equipment	Less: Purchases of property and equipment	(536)		(1,185)		(1,055)		(3,855)		Less: Purchases of property and equipment	(1,590)		(536)		(2,621)		(1,055)
Less: Capitalized internal-use software	Less: Capitalized internal-use software	(759)		(639)		(1,121)		(1,506)		Less: Capitalized internal-use software	(1,522)		(759)		(2,260)		(1,121)
Less: Principal payments on finance leases	Less: Principal payments on finance leases	(10)		(9)		(20)		(15)		Less: Principal payments on finance leases	(11)		(10)		(21)		(20)
Free Cash Flow		$	12,771	$	11,201	$	33,750	$	21,587
Free cash flow										Free cash flow	$	19,129	$	12,789	$	42,491	$	33,750

Components of Our Operating Results

Revenues

We derive substantially all of our revenues from subscription services fees paid by customers for access to our cloud-based platform, which includes support services and feature upgrades throughout the duration of the customer’s contract. While contracts with our customers do not provide the customer with the right to take possession of software operating on our global cloud-based platform, certain arrangements allow our customers the ability to download and use our content within their own learning management systems. Our content is only available to customers throughout the duration of their subscription and is accessed through our cloud-based platform. Subscription services fees and access to content for download are considered separate performance obligations. Invoiced amounts are allocated between subscription services fees and access to content and are

recorded as deferred revenue and ~~revenue,~~revenues, respectively. Deferred revenue primarily consists of amounts invoiced to customers for our subscription services and is generally recognized ratably over the subscription period while ~~revenue~~revenues related to content downloads is recognized at contract inception.

Table of Contents

Subscription terms typically range from one year to three years and generally begin on the date access to our platform is made available to the customer. Our subscriptions are generally invoiced upfront for the duration of the contract term or in annual installments. Our arrangements are primarily noncancellable and nonrefundable. We collect our receivables in advance of the subscription service period and often issue renewal invoices in advance of the renewal service period.

Because we recognize revenues ratably over the terms of our subscription contracts, a substantial portion of the ~~revenue~~revenues that we report in each period is attributable to the recognition of deferred revenue relating to agreements that we entered into during previous periods. Consequently, increases or decreases in new sales or renewals in any one period may not be immediately reflected as ~~revenue~~revenues for that period. Accordingly, the effect of downturns in sales and market acceptance of our platform, and potential changes in our rate of renewals, may not be fully reflected in our results of operations until future periods.

Cost of Revenues and Gross Margin

Cost of revenues consists of costs associated with delivering our platform and providing ~~support.~~support to our customers. These costs include employee-related costs such as salaries and bonuses, ~~stock-based~~stock compensation expense and benefits costs associated with our operations and support personnel, costs associated with third-party hosting services, amortization of acquired technology, amortization of capitalized internal-use software and content and allocated overhead. We expect cost of revenues to increase in absolute dollars and as a percentage of revenues, relative to the extent of the growth of our ~~business.~~business and reflective of the impacts of wage inflation seen in the market as a whole.

Gross margin is gross profit expressed as a percentage of total revenues. Our gross margin has been and will continue to be affected by various factors, including the timing and amount of costs associated with supporting our platform, ~~and~~ the extent to which we expand our customer success team and the rate at which we develop or acquire new products, significant features and additional content added to ~~be hosted on~~ our platform. We intend to continue to invest additional resources in our platform, content development and support services which we expect to result in steady gross margin over time.

Operating Expenses

Sales and Marketing

Sales and marketing expenses consist primarily of employee-related costs, including salaries and wages, ~~stock-based~~stock compensation expenses and sales commissions, costs of general marketing programs and promotional activities, travel-related expenses and allocated overhead. Sales commissions earned by our sales force that are considered to be incremental to the cost of acquiring a customer are deferred and amortized over the estimated period of benefit. Marketing programs consist of advertising, events, including our KB4-CON customer conference, which has historically been held during the second quarter of each year, corporate communications, brand building and product marketing activities. We expect our sales and marketing expenses to increase on an absolute dollar basis as we continue to make significant investments in our sales and marketing organization to drive additional ~~revenue,~~revenues, increase market share and expand our global customer base.

Technology and Development

Technology and development costs consist primarily of research and development activities, non-capitalizable costs of developing platform features and content and certain overhead allocations. These costs include employee-related costs, including salaries and wages and stock compensation expenses, consulting services, expenses related to the design, development, testing and enhancements of our subscription services. Technology and development costs are expensed as incurred. ~~From a unit cost standpoint, our technology and development costs are lower primarily due to favorable costs of living in the geographic locations in which our offices are based.~~ We expect that our technology and development expenses ~~will increase in absolute dollars and~~ may increase ~~as a percentage of our revenues~~ as we continue to enhance our platform functionality and develop new content and ~~features. Additionally, our technology~~features and ~~development expense~~ may fluctuate as a percentage of our ~~revenue from period to period~~revenues depending on the timing and nature of ~~development.~~development activities. Additionally, our technology and development costs could be impacted by the ongoing trend towards remote work and overall wage inflation.

3336

Table of Contents

General and Administrative

General and administrative expenses consist primarily of employee-related costs for accounting, finance, legal, IT and human resources personnel and also include expenses related to consulting services, audit fees, tax services, legal services and other general corporate items. Our general and administrative costs also include our investment in internal initiatives and tools which we believe promotes our corporate culture and helps us attract and retain talent. We expect our general and administrative expenses to increase in absolute dollars in future periods as we continue to expand our operations, hire additional personnel, see the ongoing impact of overall wage inflation and incur costs to support the requirements of being a public company.

Interest ~~and Other~~ Income

Interest ~~and other~~ income primarily consists of interest earned on overnight cash deposits and fluctuates with market rates of interest and overall cash balances.

Interest Expense

Interest expense primarily relates to imputed interest calculated on certain contingent consideration obligations arising from our historical business combinations along with fees ~~incurred in conjunction~~associated with ~~the Company’s $100.0 million~~our revolving ~~credit facility.~~line of credit.

Income Tax ~~(Expense) Benefit~~Expense

Income tax ~~(expense) benefit~~expense consists of federal and state income taxes in the United States and income taxes in certain foreign jurisdictions. Our provision for income taxes has not historically been significant to our business as we have incurred annual operating losses ~~in our largest jurisdictions, including the United States.~~to date. We maintain a valuation allowance on our U.S. federal, state and certain foreign deferred tax assets as we have concluded that it is not more likely than not that the deferred assets will be realized.

Table of Contents

Results of Operations

The following table is a summary of our consolidated statements of operations:

Three Months Ended June 30, Six Months Ended June 30,
2021 2020 2021 2020
(in thousands)
Revenues, net $ 59,350 $ 41,489 $ 112,900 $ 80,667
Cost of revenues(1)
8,591 6,303 15,934 12,346
Gross profit 50,759 35,186 96,966 68,321
Operating expenses:
Sales and marketing(1)
31,510 19,875 54,581 39,502
Technology and development(1)
6,760 4,391 12,502 9,297
General and administrative(1)
28,284 10,976 42,913 21,096
Total operating expenses 66,554 35,242 109,996 69,895
Operating loss (15,795) (56) (13,030) (1,574)
Other income (expense):
Interest income 7 14 25 139
Interest expense (66) (16) (262) (29)
Other (expense) income (416) 80 (559) 113
(Loss) income before income tax (expense) benefit (16,270) 22 (13,826) (1,351)
Income tax (expense) benefit (593) 407 (837) 419
Net (loss) income $ (16,863) $ 429 $ (14,663) $ (932)


	Three Months Ended June 30,				Six Months Ended June 30,
	2022		2021		2022		2021
	(in thousands)				(in thousands)
Revenues, net	$	80,762	$	59,350	$	155,795	$	112,900
Cost of revenues(1)	10,909		8,591		21,054		15,934
Gross profit	69,853		50,759		134,741		96,966
Operating expenses:
Sales and marketing(1)	34,684		31,510		65,431		54,581
Technology and development(1)	8,764		6,760		17,673		12,502
General and administrative(1)	23,587		28,284		46,227		42,913
Total operating expenses	67,035		66,554		129,331		109,996
Operating income (loss)	2,818		(15,795)		5,410		(13,030)
Other income (expense):
Interest income	503		7		533		25
Interest expense	(65)		(66)		(151)		(262)
Other income (expense)	264		(416)		(274)		(559)
Income (loss) before income tax expense	3,520		(16,270)		5,518		(13,826)
Income tax expense	(172)		(593)		(810)		(837)
Net income (loss)	$	3,348	$	(16,863)	$	4,708	$	(14,663)

________________

(1)Amounts include ~~stock-based~~stock compensation expense as follows:


		Three Months Ended June 30,				Six Months Ended June 30,					Three Months Ended June 30,				Six Months Ended June 30,
		2021		2020		2021		2020			2022		2021		2022		2021
		(in thousands)									(in thousands)				(in thousands)
Cost of revenues	Cost of revenues	$	76	$	31	$	129	$	52	Cost of revenues	$	179	$	76	$	345	$	129
Sales and marketing	Sales and marketing	5,662		251		6,551		402		Sales and marketing	1,421		5,662		2,575		6,551
Technology and development	Technology and development	148		100		288		170		Technology and development	1,328		148		2,581		288
General and administrative	General and administrative	12,983		934		13,560		1,395		General and administrative	4,053		12,983		7,107		13,560
Total stock-based compensation expense		$	18,869	$	1,316	$	20,528	$	2,019
Total stock compensation expense										Total stock compensation expense	$	6,981	$	18,869	$	12,608	$	20,528

Table of Contents

The following table is a summary of our consolidated statements of operations as a percentage of our total revenues for the periods:


		Three Months Ended June 30,				Six Months Ended June 30,					Three Months Ended June 30,				Six Months Ended June 30,
		2021		2020		2021		2020			2022		2021		2022		2021
Revenues, net	Revenues, net	100.0	%	100.0	%	100.0	%	100.0	%	Revenues, net	100.0	%	100.0	%	100.0	%	100.0	%
Cost of revenues	Cost of revenues	14.5	%	15.2	%	14.1	%	15.3	%	Cost of revenues	13.5	%	14.5	%	13.5	%	14.1	%
Gross profit	Gross profit	85.5	%	84.8	%	85.9	%	84.7	%	Gross profit	86.5	%	85.5	%	86.5	%	85.9	%
Operating expenses:	Operating expenses:									Operating expenses:
Sales and marketing	Sales and marketing	53.1	%	47.9	%	48.3	%	49.0	%	Sales and marketing	42.9	%	53.1	%	42.0	%	48.3	%
Technology and development	Technology and development	11.4	%	10.6	%	11.1	%	11.5	%	Technology and development	10.9	%	11.4	%	11.3	%	11.1	%
General and administrative	General and administrative	47.7	%	26.5	%	38.0	%	26.2	%	General and administrative	29.2	%	47.7	%	29.7	%	38.0	%
Total operating expenses	Total operating expenses	112.1	%	84.9	%	97.4	%	86.6	%	Total operating expenses	83.0	%	112.1	%	83.0	%	97.4	%
Operating loss		(26.6)	%	(0.1)	%	(11.5)	%	(2.0)	%
Operating income (loss)										Operating income (loss)	3.5	%	(26.6)	%	3.5	%	(11.5)	%
Other income (expense):	Other income (expense):									Other income (expense):
Interest income	Interest income	—	%	—	%	—	%	0.2	%	Interest income	0.6	%	—	%	0.3	%	—	%
Interest expense	Interest expense	(0.1)	%	—	%	(0.2)	%	—	%	Interest expense	(0.1)	%	(0.1)	%	(0.1)	%	(0.2)	%
Other (expense) income		(0.7)	%	0.2	%	(0.5)	%	0.1	%
(Loss) income before income tax (expense) benefit		(27.4)	%	0.1	%	(12.2)	%	(1.7)	%
Income tax (expense) benefit		(1.0)	%	1.0	%	(0.7)	%	0.5	%
Net (loss) income		(28.4)	%	1.0	%	(13.0)	%	(1.2)	%
Other income (expense)										Other income (expense)	0.3	%	(0.7)	%	(0.2)	%	(0.5)	%
Income (loss) before income tax expense										Income (loss) before income tax expense	4.4	%	(27.4)	%	3.5	%	(12.2)	%
Income tax expense										Income tax expense	(0.2)	%	(1.0)	%	(0.5)	%	(0.7)	%
Net income (loss)										Net income (loss)	4.1	%	(28.4)	%	3.0	%	(13.0)	%

Comparison of the Three Months Ended June 30, ~~2021~~2022 and ~~2020~~2021

Revenues

Three Months Ended June 30, Change
2021 2020 $ %
(dollars in thousands)
Revenues, net $ 59,350 $ 41,489 $ 17,861 43.0 %


	Three Months Ended June 30,				Change
	2022		2021		$		%
	(dollars in thousands)
Revenues, net	$	80,762	$	59,350	$	21,412	36.1	%

Revenues increased by ~~$17.9~~$21.4 million, or ~~43.0%~~36.1%, for the three months ended June 30, ~~2021,~~2022, compared to the three months ended June 30, ~~2020.~~2021. Due to the nature of our subscription-based business model, the ~~majority~~large portion of our ~~revenue~~revenues in a given period results from the recognition of revenues deferred in prior periods. As such, ~~$14.5~~$20.1 million of the year-over-year increase in revenue is related to the recognition of deferred revenues from the accumulation of contracts entered into during prior periods. The remaining increase is attributable to revenues from new customers combined with revenues from cross-selling additional products into our existing customer base. We attribute our success gaining new customers to our ongoing industry evangelism and overall marketing efforts combined with current events driving awareness of the need for our products. Our customer base grew by ~~25.9% over the prior year quarter, while~~25.5% and the number of customers with active subscriptions to more than one of our products ~~grew from 10.7% at June 30, 2020~~has increased to ~~17.0% at June 30, 2021.~~

26.3% of our total customer base. Additionally, revenues earned in foreign jurisdictions increased by $5.0 million compared to the prior year quarter.

Cost of Revenues and Gross Margin


		Three Months Ended June 30,						Change					Three Months Ended June 30,						Change
		2021			2020			$		%			2022			2021			$		%
		(dollars in thousands)											(dollars in thousands)
Cost of revenues	Cost of revenues	$	8,591		$	6,303		$	2,288	36.3	%	Cost of revenues	$	10,909		$	8,591		$	2,318	27.0	%
Gross profit		$	50,759		$	35,186		$	15,573	44.3	%
Gross margin	Gross margin	85.5		%	84.8		%					Gross margin	86.5		%	85.5		%

Cost of revenues increased by $2.3 million, or ~~36.3%~~27.0%, for the three months ended June 30, ~~2021,~~2022, compared to the three months ended June 30, ~~2020.~~2021. The overall increase in cost of revenues is in line with our increase in

Table of Contents

revenues over the same period, while ~~maintaining~~slightly improving our margin position. The total dollar value increase in cost of revenues is primarily driven by $1.5 million of additional personnel costs related to increased headcount to support our ~~overall~~customer growth. Other increases relate to amortization expense associated with recently acquired intangible assets and higher platform hosting costs, which are in line with our business growth. Gross margins were slightly higher compared to the prior year period driven primarily by reductions in amortization expense for our platform and content assets as certain of our historical acquired assets have become fully amortized.

Operating Expenses

Sales and Marketing

Three Months Ended June 30, Change
2021 2020 $ %
(dollars in thousands)
Sales and marketing $ 31,510 $ 19,875 $ 11,635 58.5 %
Percentage of total revenues 53.1 % 47.9 %


	Three Months Ended June 30,				Change
	2022		2021		$		%
	(dollars in thousands)
Sales and marketing	$	34,684	$	31,510	$	3,174	10.1	%

Sales and marketing expenses increased by ~~$11.6~~$3.2 million, or ~~58.5%~~10.1%, for the three months ended June 30, ~~2021,~~2022, compared to ~~the~~ three months ended June 30, ~~2020. The~~2021. This increase ~~in sales and marketing expenses~~ primarily relates to ~~increased~~ personnel costs of ~~$10.2~~$3.6 million, including stock-based compensation expense of $5.7 million primarily related to the issuance of restricted stock units (“RSUs”) in conjunction with our initial public offering (“IPO”) completed in April 2021. Salariessalaries and commissions, ~~cost increases were~~ driven by ~~additional~~ headcount increases within our sales organization, which is consistent with our overall business growth. ~~Additional cost increases relate~~An additional $3.8 million of sales and marketing expenses primarily relates to ~~marketing campaigns~~industry events, including our KB4-CON customer conference, and other demand generation activities. These expenses were offset by a ~~larger KB4-CON event~~decrease in stock compensation expense of $4.2 million when compared to the ~~same event~~prior year quarter, which was primarily driven by $5.0 million of stock compensation expense recognized in ~~the prior year.~~connection with our initial public offering (“IPO”) completed in April 2021.

Technology and Development

Three Months Ended June 30, Change
2021 2020 $ %
(dollars in thousands)
Technology and development $ 6,760 $ 4,391 $ 2,369 54.0 %
Percentage of total revenues 11.4 % 10.6 %


	Three Months Ended June 30,				Change
	2022		2021		$		%
	(dollars in thousands)
Technology and development	$	8,764	$	6,760	$	2,004	29.6	%

Technology and development expenses increased by ~~$2.4~~$2.0 million, or ~~54.0%~~29.6%, for the three months ended June 30, ~~2021,~~2022, compared to the three months ended June 30, ~~2020. The~~2021. This increase ~~in technology and development costs~~ is ~~primarily driven by $1.9 million of~~largely due to additional personnel costs of $1.4 million which primarily relate to additional stock compensation expense of $1.2 million as we began granting RSUs after IPO. Other personnel costs for the three months have not materially changed, despite increases to headcount, due to the additional capitalization of labor costs associated with the SecurityCoach product development. The remainder of the increase ~~developer headcount~~over the prior year is primarily associated with non-capitalizable costs to ~~support~~produce Inside Man 4, which is part of our ~~growth initiatives.~~

serialized content.

General and Administrative

Three Months Ended June 30, Change
2021 2020 $ %
(dollars in thousands)
General and administrative $ 28,284 $ 10,976 $ 17,308 157.7 %
Percentage of total revenues 47.7 % 26.5 %


	Three Months Ended June 30,				Change
	2022		2021		$		%
	(dollars in thousands)
General and administrative	$	23,587	$	28,284	$	(4,697)	(16.6)	%

General and administrative expenses ~~increased~~decreased by ~~$17.3~~$4.7 million, or ~~157.7%~~16.6%, for the three months ended June 30, ~~2021,~~2022, compared to the three months ended June 30, ~~2020.~~2021. This ~~increase~~decrease primarily relates to ~~$16.5~~a decrease in stock compensation expense for the three months of $8.9 million, primarily resulting from the $10.0 million of ~~additional personnel costs, including stock-based~~stock compensation expense ~~of $12.0 million primarily related to the issuance of RSUs~~recognized in ~~conjunction~~connection with ~~the completion of~~ our IPO completed in April 2021. ~~The remaining~~This decrease was offset by increases in other personnel ~~cost~~costs of $2.4 million, driven by headcount increases of 33.5%, comparatively, across our administrative support functions much of which is to support our international growth and shared service center operations. Additional offsetting increases of $0.5 million relate to ~~higher~~incremental costs of subscription services that are correlated to headcount ~~within our administrative functions, such as finance, legal~~and/or usage and ~~human resources, to support growth in the business.~~$1.2 million of incremental costs for professional services, including consulting and software implementation costs.

~~Income~~

Table of Contents

Income Tax ~~Benefit (Expense)~~Expense

Three Months Ended June 30, Change
2021 2020 $ %
(dollars in thousands)
Income tax benefit (expense) $ (593) $ 407 $ 1,000 245.7 %


	Three Months Ended June 30,				Change
	2022		2021		$		%
	(in thousands)
Income tax expense	$	172	$	593	$	(421)	(71.0)	%

Income tax expense ~~increased~~decreased by ~~$1.0~~$0.4 million, or ~~245.7%~~71.0%, for the three months ended June 30, ~~2021,~~2022, compared to the three months ended June 30, ~~2020. This increase is~~2021, primarily due ~~additional state~~to the tax ~~expense recorded~~impacts of the acquired technology fair value adjustment made during the three months ended June 30, 2020. Comparatively, during the three months ended June 30, 2021 we recorded an income tax benefit primarily related to net operating losses at foreign jurisdictions for which we did not have a related valuation allowance established.current quarter.

Comparison of the Six Months Ended June 30, ~~2021~~2022 and ~~2020~~2021

Revenues

Six Months Ended June 30, Change
2021 2020 $ %
(dollars in thousands)
Revenues, net $ 112,900 $ 80,667 $ 32,233 40.0 %


	Six Months Ended June 30,				Change
	2022		2021		$		%
	(dollars in thousands)
Revenues, net	$	155,795	$	112,900	$	42,895	38.0	%

Revenues increased by ~~$32.2~~$42.9 million, or ~~40.0%~~38.0%, for the six months ended June 30, ~~2021,~~2022, compared to the six months ended June 30, ~~2020.~~2021. Due to the nature of our subscription-based business model, the ~~majority~~large portion of our revenues in a given period results from the recognition of revenues deferred in prior periods. As such, ~~$22.5~~$38.0 million of the year-over-year increase in revenues is related to the recognition of deferred ~~revenues~~revenue from the accumulation of contracts entered into during prior periods. The remaining increase is attributable to revenues from new customers combined with revenues from cross-selling additional products into our existing customer ~~base.~~base driven by our customer success teams’ efforts to expand our customers’ use of our platform beyond a single product. Our customer base grew by ~~25.9% over the prior year while~~25.5% and the number of customers with active subscriptions to more than one of our products ~~grew from 10.7% at June 30, 2020~~has increased to ~~17.0% at June 30, 2021.~~

26.3% of our total customer base. Additionally, revenues earned in foreign jurisdictions increased by $10.2 million compared to the prior year period.

Cost of Revenues and Gross Margin


		Six Months Ended June 30,						Change					Six Months Ended June 30,						Change
		2021			2020			$		%			2022			2021			$		%
		(dollars in thousands)											(dollars in thousands)
Cost of revenues	Cost of revenues	$	15,934		$	12,346		$	3,588	29.1	%	Cost of revenues	$	21,054		$	15,934		$	5,120	32.1	%
Gross profit		$	96,966		$	68,321		$	28,645	41.9	%
Gross margin	Gross margin	85.9		%	84.7		%					Gross margin	86.5		%	85.9		%

Cost of revenues increased by ~~$3.6~~$5.1 million, or ~~29.1%~~32.1%, for the six months ended June 30, ~~2021,~~2022, compared to the six months ended June 30, ~~2020.~~2021. The overall increase in cost of revenues is in line with our increase in revenues over the same period, while ~~maintaining~~slightly improving our margin position. The total dollar value increase in cost of revenues is primarily driven by $3.4 million of additional personnel costs related to increased headcount to support our ~~overall~~customer growth. Other increases relate to additional amortization expense associated with recently acquired intangible assets and higher platform hosting costs, which are in line with our business growth. ~~Gross margins were slightly higher compared to the prior year period as we begin to scale our customer support functions.~~

Operating Expenses

Sales and Marketing

Six Months Ended June 30, Change
2021 2020 $ %
(dollars in thousands)
Sales and marketing $ 54,581 $ 39,502 $ 15,079 38.2 %
Percentage of total revenues 48.3 % 49.0 %


	Six Months Ended June 30,				Change
	2022		2021		$		%
	(dollars in thousands)
Sales and marketing	$	65,431	$	54,581	$	10,850	19.9	%

Table of Contents

Sales and marketing expenses increased by ~~$15.1~~$10.9 million, or ~~38.2%~~19.9%, for the six months ended June 30, ~~2021,~~2022, compared to the six months ended June 30, ~~2020. The~~2021. This increase ~~in sales and marketing expenses~~ primarily relates to increased personnel costs of ~~$12.9~~$8.6 million, including ~~stock-based compensation expense of $6.1 million primarily related to the issuance of RSUs in conjunction with the completion of our IPO in April 2021. Salaries~~salaries and commissions, ~~cost increases were~~ driven by ~~additional~~ headcount increases within our sales organization, which is consistent with our overall business growth. ~~The additional cost increases primarily relate~~$4.6 million of the increase in sales and marketing expenses relates to ~~overall growth in the business, including overhead allocations and~~ expanded marketing ~~campaigns.~~programs, specifically industry events, including our KB4-CON customer conference, corporate communications, brand building and product marketing activities. Additional corporate allocations, which are in line with sales and marketing headcount growth, contributed $1.2 million to the overall increase. These increases were offset by a decrease in stock compensation expense of $4.0 million primarily resulting from the $5.0 million of stock compensation expense recognized in connection with our IPO completed in April 2021.

Technology and Development

Six Months Ended June 30, Change
2021 2020 $ %
(dollars in thousands)
Technology and development $ 12,502 $ 9,297 $ 3,205 34.5 %
Percentage of total revenues 11.1 % 11.5 %


	Six Months Ended June 30,				Change
	2022		2021		$		%
	(dollars in thousands)
Technology and development	$	17,673	$	12,502	$	5,171	41.4	%

Technology and development expenses increased by ~~$3.2~~$5.2 million, or ~~34.5%~~41.4%, for the six months ended June 30, ~~2021,~~2022, compared to the six months ended June 30, ~~2020. The~~2021. This increase ~~in technology and development costs~~ is ~~primarily driven by $2.6 million of additional~~due to personnel costs ~~as we~~of $4.0 million including additional stock compensation expense of $2.3 million and other headcount driven increases in salaries. Increases to headcount-related costs for the period were offset by additional capitalization of labor costs associated with the SecurityCoach product development. The remainder of the increase ~~developer headcount~~relates to ~~support our~~costs of subscription services and corporate allocations which fluctuate with growth ~~initiatives. These expenses have remained consistent as a percentage~~ of ~~revenue as they align to growth in our~~the business.

General and Administrative

Six Months Ended June 30, Change
2021 2020 $ %
(dollars in thousands)
General and administrative $ 42,913 $ 21,096 $ 21,817 103.4 %
Percentage of total revenues 38.0 % 26.2 %


	Six Months Ended June 30,				Change
	2022		2021		$		%
	(dollars in thousands)
General and administrative	$	46,227	$	42,913	$	3,314	7.7	%

General and administrative expenses increased by ~~$21.8~~$3.3 million, or ~~103.4%~~7.7%, for the six months ended June 30, ~~2021,~~2022, compared to the six months ended June 30, ~~2020.~~2021. This increase primarily relates to ~~$19.3 million of~~ additional personnel costs ~~including stock-based compensation expense~~ of ~~$13.6~~$7.1 million, ~~primarily related to the issuance of RSUs in conjunction with the completion of our IPO in April 2021. Additional increased personnel costs are~~ driven by ~~a 22% increase in~~ headcount increases of 33.5%, comparatively, across our administrative support functions, ~~such as legal, finance~~a portion of which support anticipated growth of our international locations and ~~human resources,~~shared service center. Additional general and administrative expenses of $1.2 million relate to ~~support overall business growth. An additional $1.3~~incremental costs of subscription services that are also correlated to headcount and/or usage and $1.6 million of incremental costs ~~relates to~~for professional services, including consulting and ~~professional fees incurred to support the completion of our IPO and the acquisition of MediaPro Holdings, LLC.~~

~~Income Tax Benefit (Expense)~~

Six Months Ended June 30, Change
2021 2020 $ %
(dollars in thousands)
Income tax benefit (expense) $ (837) $ 419 $ 1,256 299.8 %

~~Income tax~~software implementation costs. These increases were offset by a decrease in stock compensation expense ~~increased by $1.3 million, or 299.8%,~~ for the six months ~~ended June 30, 2021, compared to~~of $6.5 million, driven by the ~~six months ended June 30, 2020. This increase is primarily due to~~$10.0 million of additional ~~foreign tax~~stock compensation expense ~~recorded~~recognized in ~~jurisdictions where we generate operating income along~~conjunction with ~~additional state tax expense recorded during the six months ended June 30,~~our IPO completed in April 2021. Comparatively, during the six months ended June 30, 2020 we recorded an income tax benefit primarily related to net operating losses at foreign jurisdictions for which we did not have a related valuation allowance established.

Liquidity and Capital Resources

At June 30, ~~2021,~~2022, our principal sources of liquidity were cash and cash equivalents totaling ~~$257.1~~$315.5 million and accounts receivable of ~~$42.7~~$62.5 million. Our cash and cash equivalents are comprised of time deposits with financial institutions. To date, we have financed our operations primarily through payments received from customers using our platform supplemented by ~~historical private placements~~proceeds from sales of our equity securities. Our positive cash flows from operations ~~on an annual basis~~ enable us to make continued investments in the growth of our business. ~~We expect that our operating cash flows, in addition to our cash and cash equivalents, will enable us to continue to make such investments in the future.~~ We expect our operating cash flows to further improve as we increase our operational efficiency and experience economies of scale.

We typically invoice our subscription customers annually in advance. Therefore, a substantial source of our cash is from customer prepayments, which are included on our consolidated balance sheets as deferred revenue. Deferred revenue consists of invoiced fees for our subscription services, prior to satisfying the criteria for revenue recognition, which are subsequently recognized as ~~revenue~~revenues in accordance with our revenue recognition policy. As of June 30, ~~2021,~~2022, we had deferred revenue of ~~$221.9~~$311.5 million, of which ~~$137.4~~$215.6 million was recorded as a current

Table of Contents

liability and is expected to be recorded as ~~revenue~~revenues in the next 12 months, provided all other revenue recognition criteria are met.

Our remaining performance obligation represents contracted ~~revenue~~revenues that has not yet been recognized and includes deferred revenue, which has been invoiced and is recorded on the consolidated balance ~~sheet,~~sheets, and unbilled amounts that are not yet recorded on the balance ~~sheet,~~sheets, that will be recognized as ~~revenue~~revenues in future periods. As of June 30, ~~2021,~~2022, our remaining performance obligation was ~~$269.2~~$377.9 million.

On March 12, 2021, we entered into a three-year $100.0 million revolving credit facility with Bank of America, N.A. (the “Revolving Credit Facility”). Interest on any borrowings under the ~~revolving credit facility~~Revolving Credit Facility bear interest, at our option, at (i) a base rate equal to the highest of (a) the federal funds rate plus ~~0.50%~~0.5%, (b) the rate of interest in effect for such date as publicly announced from time to time by Bank of America as its “prime rate”, or (c) the eurodollar rate plus 1.0%, provided that such rate will not be less than 0.5%. We are obligated to pay other customary fees for a credit facility of this size and type, including letter of credit fees, an upfront fee, and an unused commitment fee. The terms of our Revolving Credit Facility include a number of covenants that limit our ability and our subsidiaries’ ability to, among other things, incur additional indebtedness, grant liens, merge or consolidate with other companies or sell substantially all of our assets, pay dividends, make redemptions and repurchases of stock, make investments, loans and acquisitions, or engage in transactions with affiliates. We expect to use the revolving credit facility for general corporate purposes, including potential future acquisitions and expansions. As of June 30, ~~2021,~~2022, we were in compliance with all covenants and there were no amounts outstanding under this facility.

On April 26, 2021, we completed anour IPO, in which we sold 10,925,000 shares of our Class A common stock ~~in which we issued and sold 10,425,000 shares~~at a price to the public of ~~Class A common stock,~~$16.00 per share, including 1,425,000 shares ~~resulting from~~pursuant to the exercise in full of the underwriters’ option to purchase additional ~~shares, at an IPO price of $16.00 per share.~~shares. We received net proceeds of ~~$156.0~~$153.0 million, after deducting underwriting discounts and commissions ~~but before estimated~~of $10.8 million and offering ~~costs~~expenses paid by us of approximately $3.0 million.

We believe our existing cash and cash equivalents, cash provided by operating activities, available borrowings under our ~~revolving line of credit~~Revolving Credit Facility, and unbilled amounts related to contracted non-cancelable subscription agreements, which are not reflected on the balance sheet, will be sufficient to meet our working capital and capital expenditure needs over the next 12 months. In the future, we may enter into arrangements to acquire or invest in complementary businesses, products and technologies, and intellectual property rights, though we currently have no agreements or commitments to do so. To facilitate these acquisitions or investments, we may seek additional equity or debt financing, which may not be available on terms favorable to us or at all, impacting our ability to complete subsequent acquisitions or investments.

Cash Flows

The following table presents a summary of our consolidated cash flows from operating, investing and financing activities.


		Six Months Ended June 30,			Six Months Ended June 30,
			2021			2020			2022		2021
			(in thousands)						(in thousands)
Net cash provided by operating activities	Net cash provided by operating activities		$	35,946		$	26,963	Net cash provided by operating activities	$	47,393	$	35,946
Net cash used in investing activities	Net cash used in investing activities		$	(13,499)		$	(5,361)	Net cash used in investing activities	$	(7,216)	$	(13,499)
Net cash provided by (used in) financing activities			$	148,562		$	(415)
Net cash provided by financing activities								Net cash provided by financing activities	$	3,148	$	148,562

Operating Activities

Our largest source of cash flows from operations is cash collections from our customers for subscription services while our primary use of cash for operating activities is for employee-related expenses, including salaries, commissions and monthly performance bonuses. We have historically generated positive cash flows from operations as a result of our efficient sales model and period-over-period growth in subscription services.

Table of Contents

Net cash provided by operating activities during the six months ended June 30, 2022 was $47.4 million, which consisted of net income of $4.7 million, adjusted for non-cash charges of $27.2 million and net cash inflows of $15.5 million provided by changes in our operating assets and liabilities. Non-cash charges primarily consisted of $12.6 million of stock compensation expense, $10.7 million of amortization of deferred commissions and $7.7 million of depreciation and amortization of our capital assets. Cash inflows from changes in operating assets and liabilities primarily relate to a $45.8 million increase in the total deferred revenue balance resulting from the sale of additional subscription services under our standard advanced invoicing practices. These inflows were offset by cash outflows from changes in operating assets and liabilities related to a $6.0 million increase in the total deferred commissions balance as we increase sales to new customers and renew our existing contracts, an $8.4 million increase in accounts receivable due to a substantial increase in sales close to the end of quarter and a $7.1 million increase in the prepaid and other assets balance primarily due to advanced payroll funding, renewed insurance policies for directors and officers and future in-person marketing events..

Net cash provided by operating activities during the six months ended June 30, 2021 was $35.9 million, which consisted of a net loss of $14.7 million, adjusted for non-cash charges of $33.6 million and net cash inflows of $17.0 million provided by changes in our operating assets and liabilities. Non-cash charges primarily consisted of $8.7 million of amortization of deferred commissions, $6.6 million of depreciation and amortization of our capital assets and $20.5 million of ~~stock-based~~stock compensation expense, which was primarily incurred in conjunction with our IPO. Cash outflows from changes in operating assets and liabilities primarily resulted from a $5.6 million increase in the total deferred commissions balance, a $4.1 million increase in the total accounts receivable balance and a $7.0 million increase in ~~the~~ prepaid and other ~~assets balance.~~assets. The increases in deferred commissions balance is due to the

addition of new customers and renewal of existing contracts during the period while the increase in accounts receivable is due to the timing of billings and collections combined with growth in sales. The increase in prepaid and other assets is due to $3.0 million of advanced payroll funding and $3.4 million of additional prepaid insurance policies for directors and officers. Cash inflows from changes in operating assets and liabilities primarily relate to a $36.3 million increase in the total deferred revenue balance resulting from the sale of additional subscription services under our standard advanced invoicing practices and a $13.0 million increase in the accounts payable ~~and accrued expense balances~~balance due primarily to the timing of payroll payments combined with overall growth in the business.

Investing Activities

Net cash ~~provided by operating~~used in investing activities during the six months ended June 30, ~~2020 was $27.0~~2022 related to the purchase of property and equipment for $2.6 million ~~which consisted~~as we continue update our office space requirements and $2.3 million for the development of ~~a net loss of $0.9 million, adjusted for non-cash charges of $11.9 million~~internal-use software as we develop new products and ~~net cash inflows of $15.9 million provided by changes in~~features, including our ~~operating assets and liabilities. Non-cash charges primarily consisted of $6.8~~recently announced SecurityCoach product. We also purchased $2.4 million of amortization of deferred commissions, $5.6 million of depreciation and amortization of our capital assets and $2.0 million of stock-based compensation expense. Cash outflows from changes in operating assets and liabilities primarily resulted from increases in the total deferred commissions balance due to the addition of new customers and renewal of existing contractsinvestments during the period. Cash inflows from changes in operating assets and liabilities primarily related to increases in the total deferred revenue balance resulting from the sale of additional subscription services under our standard advanced invoicing practices.

~~Investing Activities~~

Net cash used in investing activities during the six months ended June 30, 2021 primarily related to the $11.3 million of net cash paid for the acquisition of MediaPro Holdings, LLC, completed March 1, 2021, combined with $1.1 million and $1.1 million of capital expenditures for internal-use software and the purchase of property and equipment, respectively.

Financing Activities

Net cash ~~used in investing~~provided by financing activities during the six months ended June 30, ~~2020~~2022 primarily related to ~~$1.5 million and $3.9~~$2.9 million of ~~capital expenditures~~proceeds from the issuance of common stock under the employee stock purchase plan and $2.2 million of proceeds from the exercise of stock options, partially offset by $2.0 million of taxes paid for ~~internal-use software and~~ the ~~purchase~~net share settlement of ~~property and equipment, respectively.~~

~~Financing Activities~~equity awards the vested during the period.

Net cash provided by financing activities during the six months ended June 30, 2021 primarily related to $156.0 million of net proceeds received from the issuance of common stock in connection with the IPO. These ~~financing activities~~ proceeds were offset by $6.8 million paid for taxes related to the net ~~share~~ settlement of restricted stock units and $1.2 million paid to repurchase shares of our common stock, prior to the IPO.

Net cash used in financing activities during the six months ended June 30, 2020 primarily related to $0.5 million paid for the repurchase of common stock offset by $0.1 million of cash received upon the issuance of common stock from the exercise of stock options.

Commitments and Contractual Obligations

Table of Contents

There were no material changes to our commitments and contractual obligations during the six months ended June 30, ~~2021 from the commitments and contractual obligations disclosed in the Prospectus.~~2022. Refer to Note 15 “Commitments and Contingencies” to the consolidated financial statements contained within this Quarterly Reporton Form 10-Q for further details.

Indemnification Agreements

Our subscription agreements generally contain standard indemnification obligations. Pursuant to these agreements, we will indemnify, defend and hold the other party harmless with respect to a claim, suit, or proceeding brought against the other party by a third party alleging that our intellectual property infringes upon the intellectual property of the third party, or results from a breach of our representations and warranties or covenants, or that results from any acts of negligence or willful misconduct. The term of these indemnification agreements is generally perpetual any time after the execution of the agreement. Typically, these indemnification provisions do not provide

for a maximum potential amount of future payments we could be required to make. However, in the past we have not been obligated to make significant payments for these obligations and no liabilities have been recorded for these obligations on our consolidated balance ~~sheet~~sheets as of June 30, ~~2021~~2022 or December 31, ~~2020.~~2021.

We also indemnify our officers and directors for certain events or occurrences, subject to certain limits, while the officer is or was serving at our request in such capacity. The maximum amount of potential future indemnification is unlimited. However, our director and officer insurance policy limits our exposure and enables us to recover a portion of any future amounts paid. Historically, we have not been obligated to make any payments for these obligations and no liabilities have been recorded for these obligations on our consolidated ~~balance~~balances sheet as of June 30, ~~2021~~2022 or December 31, ~~2020.~~2021.

~~Off-Balance Sheet Arrangements~~

As of June 30, 2021, we did not have any relationships with unconsolidated organizations or financial partnerships, such as structured finance or special purpose entities, which would have been established for the purpose of facilitating off-balance sheet arrangements or for other contractually narrow or limited purposes.

~~Quantitative and Qualitative Disclosures About Market Risk~~

~~We have operations in the United States and internationally and we are exposed to market risk in the ordinary course of business.~~

~~Inflation Rate Risk~~

We do not believe that inflation has had a material effect on our business, financial condition or results of operations. Nonetheless, if our costs were to become subject to significant inflationary pressures, we may not be able to fully offset such higher costs through price increases. Our inability or failure to do so could harm our business, financial condition and results of operations.

~~Interest Rate Risk~~

Our cash and cash equivalents primarily consist of cash on hand and highly liquid investments in money market funds, including overnight investments. As of June 30, 2021, we had cash and cash equivalents of $257.1 million. The carrying amount of our cash equivalents reasonably approximates fair value, due to the short maturities of these instruments. The primary objectives of our investment activities are the preservation of capital, the fulfillment of liquidity needs and the fiduciary control of cash and investments. We do not enter into investments for trading or speculative purposes. Our investments are exposed to market risk due to fluctuations in interest rates, which may affect our interest income and the fair market value of our investments. However, due to the short-term nature of our investment portfolio, we do not believe an immediate 10% increase or decrease in interest rates would have a material effect on the fair market value of our portfolio. We therefore do not expect our operating results or cash flows to be materially affected by a sudden change in market interest rates.

~~Foreign Currency Risk~~

The vast majority of our sales contracts are denominated in U.S. dollars, with a small number of contracts denominated in foreign currencies. A portion of our operating expenses are incurred outside the United States, denominated in foreign currencies and subject to fluctuations due to changes in foreign currency exchange rates, particularly changes in the British Pound, Brazilian Real and South African Rand. Additionally, fluctuations in foreign currency exchange rates may cause us to recognize transaction gains and losses in our consolidated statements of operations. During the six months ended June 30, 2021 and 2020, a hypothetical 10% change in foreign currency exchange rates applicable to our business would not have had a material impact on our consolidated financial statements. As the impact of foreign currency exchange rates has not been material to our historical operating results, we have not entered into derivative or hedging transactions, but we may do so in the future if our exposure to foreign currency becomes more significant.

Critical Accounting Policies and Estimates

Our management’s discussion and analysis of financial condition and results of operations is based upon our consolidated financial statements and notes to our financial statements, which were prepared in accordance with GAAP. The preparation of these consolidated financial statements requires us to make estimates and judgments that affect the reported amounts of assets and liabilities and related disclosure of contingent assets and liabilities at the date of the financial statements, and the reported amounts of ~~revenue~~revenues and expenses during the reporting periods. We base our estimates on historical experience and on various other assumptions that we believe to be reasonable, the results of which form the basis for making judgments about the carrying values of assets and liabilities that are not readily apparent from other sources.

The accounting estimates we use in the preparation of our financial statements will change as new events occur, more experience is acquired, additional information is obtained and our operating environment changes. Changes in estimates are made when circumstances warrant. Such changes in estimates and refinements in estimation methodologies are reflected in our reported results of operations and, if material, the effects of changes in estimates are disclosed in the notes to our financial statements. By their nature, these estimates and judgments are subject to an inherent degree of uncertainty and actual results could differ materially from the amounts reported based on these estimates.

~~While our~~Our significant accounting policies are more fully described in Note 2, “Summary of Significant Accounting Policies” of our consolidated financial statements. Our critical accounting policies and our more significant judgments and estimates used in the preparation of our consolidated financial statements ~~“Summary~~are discussed in “Management’s Discussion and Analysis of ~~Significant Accounting Policies” included elsewhere~~Financial Condition and Results of Operations” in ~~this Quarterly~~our Annual Report on Form 10-Q, the following accounting policies involve a greater degree of judgment and complexity. Accordingly, the following summary identifies the policies we believe are the most critical to aid in fully understanding and evaluating our consolidated financial condition and results of our operations:

•~~the allocation of transaction price to separate performance obligations on a relative stand-along selling price, or SSP, basis;~~

•~~the determination of the period of benefit related to commissions paid~~10-K for the ~~acquisition of an initial subscription contract;~~

•year ended December 31, 2021, filed with the ~~calculation of~~SEC on March 10, 2022, and there have been no significant changes to these policies during the ~~fair value of stock option awards using the Black-Scholes option-pricing model, including certain assumptions made when determining the inputs to the model; and~~

•~~the determination of the fair value of our common stock prior to our IPO.~~six months ended June 30, 2022.

Recent Accounting Pronouncements

See Note 2 “Summary of Significant Accounting Policies” to our consolidated financial statements contained within this Quarterly Report on Form 10-Q for more information.

4345

Table of Contents

Item 3. Quantitative and Qualitative Disclosures About Market Risk

We have operations in the United States and internationally and we are exposed to market risk in the ordinary course of business.

Interest Rate Risk

Our cash and cash equivalents primarily consist of cash on hand and highly liquid investments in money market funds, including overnight investments. As of June 30, 2022, we had cash and cash equivalents of $315.5 million. The carrying amount of our cash equivalents reasonably approximates fair value, due to the short maturities of these instruments. The primary objectives of our investment activities are the preservation of capital, the fulfillment of liquidity needs, the fiduciary control of cash and investments and, to a lesser extent, funding innovation within the cybersecurity industry. We do not enter into investments for trading or speculative purposes. Our investments are exposed to market risk due to fluctuations in interest rates, which may affect our interest income and the fair market value of our investments. However, due to the short-term nature of the majority of our investment portfolio, we do not believe an immediate 10% increase or decrease in interest rates would have a material effect on the fair market value of our portfolio. We therefore do not expect our operating results or cash flows to be materially affected by a sudden change in market interest ~~rate~~rates.

Foreign Currency Risk

The vast majority of our sales contracts are denominated in U.S. dollars, with a small number of contracts denominated in foreign currencies. A portion of our operating expenses are incurred outside the United States, denominated in foreign currencies and subject to fluctuations due to changes ~~and~~in foreign currency ~~fluctuations. Information relating~~exchange rates, particularly changes in the British Pound, Euro, Brazilian Real and South African Rand. Additionally, fluctuations in foreign currency exchange rates may cause us to ~~quantitative~~recognize transaction gains and ~~qualitative disclosures about market risk is set forth~~losses in ~~Item 2~~our consolidated statements of ~~Part I, “Management’s Discussion and Analysis~~operations. We believe a hypothetical 10% change in foreign currency exchange rates applicable to our business would not have had a material impact on our consolidated financial statements. As the impact of ~~Financial Condition and Results of Operations—Liquidity and Capital Resources.”~~foreign currency exchange rates has not been material to our historical operating results, we have not entered into derivative or hedging transactions, but we may do so in the future if our exposure to foreign currency becomes more significant.

Item 4. Controls and Procedures

Evaluation of Disclosure Controls and Procedures

Our management, with the participation of our principal executive officer and principal financial officer, has evaluated the effectiveness of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the ~~Securities~~ Exchange ~~Act of 1934, as amended (the “Exchange Act”)),~~Act) as of the end of the period covered by this Quarterly Report on Form 10-Q. Based on such evaluation, our principal executive officer and principal financial officer have concluded that, as of such date, our disclosure controls and procedures were effective at a reasonable assurance level.

Changes in Internal Control

There were no changes in our internal control over financial reporting identified in management’s evaluation pursuant to Rules 13a-15(d) or 15d-15(d) of the Exchange Act during the period covered by this Quarterly Report on Form 10-Q, that materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

Limitations on Effectiveness of Controls and Procedures

Our management, including our principal executive officer and principal financial officer, do not expect that our disclosure controls and procedures or our internal control over financial reporting will prevent all errors and all fraud. A control system, no matter how well designed and operated, can provide only reasonable, not absolute, assurance that the objectives of the control system are met. Further, the design of a control system must reflect the fact that there are resource constraints, and the benefits of controls must be considered relative to their costs. Because of the inherent limitations in all control systems, no evaluation of controls can provide absolute assurance

Table of Contents

that all control issues and instances of fraud, if any, have been detected. These inherent limitations include the realities that judgments in decision-making can be faulty, and that breakdowns can occur because of a simple error or mistake. Additionally, controls can be circumvented by the individual acts of some persons, by collusion of two or more people or by management override of the controls. The design of any system of controls is also based in part upon certain assumptions about the likelihood of future events, and there can be no assurance that any design will succeed in achieving its stated goals under all potential future conditions; over time, controls may become inadequate because of changes in conditions, or the degree of compliance with policies or procedures may deteriorate. Due to inherent limitations in a cost-effective control system, misstatements due to error or fraud may occur and not be detected.

4447

Table of Contents

PART II. OTHER INFORMATION

Item 1. Legal Proceedings

We are currently a party to, and may in the future be involved in, various litigation matters, ~~(including intellectual property litigation),~~ legal claims, and government investigations. See ~~discussion of Legal Proceedings in~~ Note 15 ~~"Commitments~~“Commitments and Contingencies” to the consolidated financial statements included in Part I, Item 1 of this ~~report.~~Quarterly ReportonForm 10-Q, whichisincorporatedhereinbyreference.

In addition, from time to time, we are involved in various other litigation matters and disputes arising in the ordinary course of business. We cannot at this time fairly estimate a reasonable range of exposure, if any, of the potential liability with respect to these other matters. While we do not believe, at this time, that any ultimate liability resulting from any of these other matters will have a material adverse effect on our results of operations, financial position, or liquidity, we cannot give any assurance regarding the ultimate outcome of these other matters, and their resolution could be material to our operating results for any particular period.

Item 1A. Risk Factors

~~Investing~~An investment in our Class A common stock involves a high degree of risk. You should carefully consider ~~the risks described below, as well as~~these risk factors, together with all of the other information included in this Quarterly Report on Form 10-Q, including the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our consolidated financial statements and related notes, before deciding whether to invest in our Class A common stock. The ~~occurrence of any of the events or developments~~risks and uncertainties described below ~~could materially and adversely affect our business, financial condition, results of operations, and growth prospects.~~may not be the only ones we face. Additional risks and uncertainties not presently known to us or that we currently believe are not material may also impair our business, financial condition and results of operations. If any of the risks actually occur, our business, financial condition and results of operations, cash flows and ~~growth prospects.~~prospects could be adversely affected. In that event, the market price of our Class A common stock could decline, and you could lose part or all of your investment.

Risk Factor Summary

~~Investing in our Class A common stock involves a high degree of risk because our~~Our business is subject to ~~numerous~~a number of risks, ~~and uncertainties, as fully described below. The principal factors and uncertainties~~including those outside of our control, that ~~make investing in our Class A common stock risky include, among other things:~~

•~~We have a limited operating history, which makes it difficult to forecast our revenue and evaluate our business and future prospects.~~

•~~We have a history of losses and~~ may ~~not be able to achieve or sustain profitability in the future.~~

•The global COVID-19 pandemic, including the related containment efforts, has had, and we expect will continue to have, certain negative impacts on our business and operations, and we are unable to predict with certainty the extent to which it may continue to adversely affect our business, financial condition orand results of operations. These risks are discussed more fully below and include, but are not limited to:

Risks Related to Our Business and Industry

•Our limited operating history including a history of losses;

•We ~~believe~~have experienced rapid growth in recent periods and could experience difficulties managing our ~~long-term value as a company will be greater if we focus on growth, which may negatively impact our profitability in the near term.~~future growth;

•~~If we are unable~~Our long-term focus on growth;

•Our ability to attract new customers ~~or develop new products that achieve market acceptance,~~and retain our ~~revenue growth and profitability will be harmed.~~existing customers;

•~~If our customers do not renew their subscriptions for our platform and add additional products to their subscriptions, our future results of operations could be harmed.~~

•We recognize revenue from subscriptions over the term of our customer contracts, and as such, our reported revenue and related metrics may differ significantly in a given period, and our revenue in any period may not be indicative of our financial health and future performance.

•Failure to effectively develop and expand our ~~marketing~~sales and ~~sales~~marketing capabilities or maintain successful relationships with our channel ~~partners could harm our ability to increase our customer base and achieve broader market acceptance of our products.~~partners;

•~~If we are not able~~Our exposure to ~~provide successful updates, enhancements~~risks related to international operations and ~~features to our technology to, among other things, keep up with emerging threats and customer needs, our business, financial condition and results of operations could be adversely affected.~~plans for future international expansion;

•A network, systems or data security incident may allow unauthorized access to our network, systems or data or our ~~customers’ data, harm our reputation, create additional liability and adversely impact our financial results.~~customer’s data;

•~~Complying with evolving privacy and other data related laws and requirements may be expensive and force us~~Our reliance upon Software-as-a-Service (“SaaS”), technologies from third parties to ~~make adverse changes to~~operate our ~~business, and failure to comply with such laws and requirements could result in substantial harm to our business.~~business;

•The ~~nature~~delayed reflection of new sales in our results due to recognizing revenues over the term of our ~~business requires the application~~customer contracts;

•We must maintain an effective system of ~~complex accounting rules, including revenue~~internal controls over our financial reporting in order to produce timely and ~~expense recognition rules, and any significant changes in current rules, or interpretations thereof, could affect our~~accurate financial statements and ~~results~~comply with applicable regulations;

•The requirements of ~~operations.~~being a public company may strain our resources and divert management’s attention;

Table of Contents

•The application of changes in complex accounting rules;

Risks Related to Our Platform and Products

•Our ability to develop or acquire new products and/or provide successful updates, enhancements and features to our technology;

•Interruptions or delays in the services provided by third-party data centers or internet service ~~providers could impair the delivery~~providers;

•Failure of our platform ~~and~~and/or our products ~~expose us~~ to ~~litigation and negatively impacting our relationships with customers, adversely affecting our business.~~perform properly;

Risks Related to Our Intellectual Property

•~~Our results of operations may be harmed if we are subject~~An exposure to ~~a protracted~~an infringement claim or a claim that results in a significant damage ~~award.~~award;

•~~If we fail~~Our ability to ~~adequately~~ protect our proprietary ~~rights,~~rights;

•Usage of open source software in our ~~competitive position could be impaired~~products;

•Usage of third party technology and software in our platform and products;

Risks Related to Government Regulations and Taxation

•Our failure to comply with evolving data privacy and other data related laws and requirements;

•Our failure to comply with laws and regulations, including governmental export and import controls, economic sanctions or anti-boycott laws;

•Adverse changes in tax laws or regulations in the various jurisdictions where we ~~may lose valuable assets, generate reduced revenue~~are subject to taxation;

Governance Risks and ~~incur costly litigation~~Risks Related to ~~protect our rights.~~Ownership of Our Class A Common Stock

•The dual-class structure of our common stock, ~~will have~~which has the effect of concentrating voting control with those stockholders who held our capital stock prior to the completion of our ~~initial public offering (“IPO”), which will limit your ability~~IPO;

•The volatility of the market price of our Class A common stock;

•We have no intention of paying dividends in the foreseeable future;

•Potential dilution to ~~influence~~our existing stockholders due to the ~~outcome~~issuance of ~~important transactions, including a change~~additional stock in ~~control.~~connection with financings, acquisitions, investments, or our equity incentive and employee stock purchase plans;

Risks Related to Macroeconomic Conditions

•Adverse economic conditions or reduced IT security spending; and

•The unpredictability of the impact of the COVID-19 pandemic.

Risks Related to Our Business and Our Industry

We have a limited operating history, which makes it difficult to forecast our ~~revenue~~revenues and evaluate our business and future prospects.

We have been in existence since 2010 and much of our growth has occurred in recent periods. As a result of our limited operating history, our ability to forecast our future results of operations and ~~plan for and~~ model future growth is limited and subject to a number of uncertainties. We have encountered, and will continue to encounter, risks and uncertainties frequently experienced by growing companies in rapidly changing industries, such as the risks and uncertainties described herein. Additionally, the sales cycle for the evaluation and implementation of our platform and products, which can range from several days for small businesses to multiple months for enterprise deals, may also cause us to experience uncertainty in the timing between increasing operating expenses and the generation of corresponding revenue, if any.industries. Accordingly, we may be unable to prepare accurate internal financial forecasts or replace anticipated ~~revenue~~revenues that we do not receive as a result of ~~uncertainties arising from~~ these ~~factors,~~risks and uncertainties, and our results of operations in future reporting periods may be below the expectations of investors. If we do not address these risks successfully, our results of operations could differ materially from our estimates and forecasts or the expectations of investors, causing our business to suffer and our stock price to decline.

Table of Contents

We have generated significant net losses in the past, and we intend to continue to invest substantially in our business. As a ~~history of losses and~~result, we may not be able to achieve or sustain profitability in the future.

~~We have incurred~~While we generated net ~~losses in all annual periods since our inception,~~income of $3.3 million and ~~we expect we will continue to incur net losses~~$4.7 million for the ~~foreseeable future. We~~three and six months ended June 30, 2022, respectively, we experienced net losses of ~~$16.9~~$11.8 million and ~~net income of $0.4~~$2.4 million for

~~Table of~~ ~~Contents~~

the ~~quarters ending June 30,~~years ended December 31, 2021 and 2020, ~~respectively. As~~respectively, and as of June 30, ~~2021,~~2022, we had an accumulated deficit of ~~$176.0~~$168.4 million. Because the market for our platform and products has not yet reached widespread adoption, it is difficult for us to predict our future results of operations. ~~Overall growth of our revenue depends on a number of factors, including:~~

•~~pricing our platform and products effectively so that we are able to attract new customers and expand sales to our existing customers;~~

•~~continuing to develop and offer products that are superior to those of competitors;~~

•~~expanding the functionality of our platform and products;~~

•~~expanding the number of customers who purchase and renew subscriptions to our platform and products;~~

•~~providing our customers with support that meets their needs;~~

•~~continuing to introduce our platform and products to new markets outside of the United States; and~~

•~~our ability to hire and retain sufficient numbers of sales and marketing, research and development and general and administrative personnel, and expand our global operations.~~

~~In addition, we~~We expect our operating expenses to increase significantly over the next several years, as we continue to hire additional personnel, particularly in sales and marketing, expand our operations and infrastructure, both domestically and internationally, and continue to develop our platform and products. In addition to the expected costs to grow our business, we also expect to incur significant additional legal, accounting and other expenses as a newly public company. If we fail to increase our ~~revenue~~revenues to offset the increases in our operating expenses, we may not achieve or sustain profitability in the future.

We have experienced rapid growth in recent periods, and if we do not manage our future growth, our business and results of operations will be adversely affected.

We have experienced rapid ~~revenue~~ growth in recent periods and we expect to continue to invest broadly across our organization to support our growth. ~~For example, our headcount grew 24.2% to 1,196 employees as of June 30, 2021 from 963 employees as of June 30, 2020.~~ Although we have experienced rapid growth historically, we may not sustain our current growth rates nor can we assure you that our investments to support our growth will be successful. The growth and expansion of our business will require us to invest significant financial and operational resources and will require the continuous dedication of our management team. We have encountered, and will continue to encounter, risks and difficulties frequently experienced by rapidly growing companies in evolving industries, including market acceptance of our platform and products, adding new customers, intense competition and our ability to manage our costs and operating expenses. Our future success will depend in part on our ability to manage our growth effectively, ~~which will require us to, among other things:~~

•~~effectively attract, integrate~~ and ~~retain a large number of new employees, particularly members of our sales and marketing and research and development teams;~~

•~~further improve our platform and products to support our business needs;~~

•~~provide a high level of customer service;~~

•~~maintain our corporate culture;~~

•enhance our information and communication systems to ensure that our employees and offices around the world are well coordinated and can effectively communicate with each other and our growing base of channel partners and customers; and

•~~improve our financial, management and compliance systems and controls.~~

~~Table of~~ ~~Contents~~

Ifif we fail to ~~achieve these objectives effectively,~~do so, our ability to ~~manage our expected growth,~~ ensure uninterrupted operation of our platform and products, ~~and~~ comply with the rules and regulations applicable to our business ~~could be impaired. Additionally, the quality of our platform~~ and ~~products could suffer and we may not be able to~~ adequately address competitive ~~challenges.~~challenges could be impaired. Any of the foregoing could adversely affect our business, financial condition and results of operations.

The global COVID-19 pandemic, including the related containment efforts, has had, and we expect will continue to have, certain negative impacts on our business and operations, and we are unable to predict with certainty the extent to which it may continue to adversely affect our business, financial condition or results of operations.

In December 2019, a novel strain of coronavirus, or COVID-19, was first reported to the World Health Organization (“WHO”), and in January 2020, the WHO declared the outbreak to be a public health emergency. In March 2020, the WHO characterized COVID-19 as a pandemic. Since then, the COVID-19 pandemic and efforts to control its spread have significantly curtailed the movement of people, goods and services worldwide.While the duration and full extent of the COVID-19 pandemic depends on future developments that cannot be accurately predicted at this time, the conditions caused by this pandemic have not significantly affected the demand for our platform and products. Although, the COVID-19 pandemic has caused us to experience, in some cases, longer sales cycles and an increase in certain prospective and current customers seeking lower prices or other more favorable contract terms, we do not believe these developments have been substantial enough to significantly impact our results of operations. Additionally, we have not seen significant negative impacts on collections of accounts receivable or attrition rates of our customers. Concerns over the ultimate economic impact of COVID-19 have caused and may continue to cause extreme volatility in financial and other capital markets, which may adversely affect our stock price and our ability to access capital markets in the future.

Conversely, the long term work-from-home policies, which have stemmed from the COVID-19 pandemic, have resulted in employees accessing their companies systems remotely, which has increased cybersecurity and privacy risks for these companies. Increased awareness of cyber and privacy risks could increase interest in our platform and products and there is no assurance that the levels of interest, demand and use of our platform and products will continue or will not decrease in the future. Any such decrease could have an adverse effect on our growth and the success of our platform and products.

We believe our long-term value as a company will be greater if we focus on growth, which may negatively impact our profitability in the near term.

Part of our business strategy is to primarily focus on our long-term growth. As a result, our profitability may be lower in the near term than it would be if our strategy were to maximize short-term profitability. Significant expenditures on sales and marketing efforts, growing our platform and products and expanding our research and development, each of which we intend to continue to invest in, may not ultimately grow our business or cause long-term profitability. If we are ultimately unable to achieve profitability at the level anticipated by industry or financial analysts and our stockholders, our stock price may decline.

~~We provide service level commitments under our customer contracts.~~ If we fail to meet these contractual commitments, we could be obligated to provide credits for future service, or face contract termination with refunds of prepaid amounts related to unused subscriptions, which could harmdo not expand our current customer base by attracting new customers and retaining our existing customers our business, financial condition and results of ~~operations.~~

Our customer agreements contain service level commitments, under which we guarantee specified availability of our platform and products. In light of our historical experience with meeting our service level commitments, we do not currently have any material liabilities accrued on our balance sheet for these commitments. Any failure of or disruption to our cloud-based platformoperations could make our products unavailable to our customers. If we are unable to meet the stated service level commitments to our customers or suffer extended periods of unavailability of our platform and products, we may be contractually obligated to provide affected customers with service credits for future subscriptions, or customers could elect to terminate and receive refunds for prepaid amounts related to unused subscriptions. Our revenue, other results of operations and financial condition could be harmed if we suffer

~~Table of~~ ~~Contents~~

unscheduled downtime that exceeds the service level commitments under our agreements with our customers, and any extended service outages could adversely affect our business and reputation as customers may elect not to renew and we could lose future sales.

~~If we are unable to attract new customers or develop new products that achieve market acceptance to cross-sell or upsell to our existing customers, our revenue growth and profitability will~~ be harmed.

Since our customers tend to adopt our platform across their entire ~~organizations,~~organization, to increase our ~~revenue~~revenues and achieve and maintain profitability, we must expand our customer ~~base.~~base by attracting new customers and retaining our existing customers. To attract new customers, we must drive a broader awareness of the pervasive risks of social engineering. We will continue to invest in our inside sales force complemented by a channel strategy designed to increase brand awareness and to enable us to reach new territories and acquire new customers. Numerous factors, however, may impede our ability to acquire new customers, including our failure to recruit talented sales and marketing personnel and to retain and motivate our current sales and marketing personnel, to develop or expand relationships with effective channel partners and ~~managed service providers (“MSPs”),~~MSPs, to successfully deploy products for new customers, to provide quality customer support once deployed and to execute on our marketing strategies.

~~In addition,~~Further, our ability to increase revenue depends in large part on our ability to develop compelling new products to cross-sell and upsell to our existing customer base. To do so, we must continue to invest in our technology and platform in order to create new adjacencies and use cases. The success of any new product deployment will depend on several factors, including timely completion and delivery, competitive pricing, adequate quality testing, integration with our existing platform and products and overall market acceptance. If we are unable to successfully develop new products or otherwise gain market acceptance, we may not be able to increase revenues by cross-selling or upselling to our existing customer base, and our business, results of operations and financial condition would be harmed.

~~If our customers do not renew their subscriptions for our platform and add additional products to their subscriptions, our future results of operations could be harmed.~~

In order for us to maintain or improve our results of operations, it is important that our customers renew their subscriptions for our platform and products when existing contract terms expire and that we expand our commercial relationships with our existing customers. Our customers have no obligation to renew their subscriptions for our platform and products after the expiration of their contractual period, which is typically one to three years, and, in the normal course of business, some customers have elected not to renew. In addition, our customers may renew for fewer products, renew for

Table of Contents

shorter contract lengths or switch to a lower-cost ~~tier.~~subscription. If our customers do not renew their subscriptions, we could incur impairment losses related to our deferred contract acquisition costs. It is difficult to accurately predict long-term customer retention because of our varied customer base and ~~given the~~ length of our subscription contracts. Our customer retention and expansion may decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with our products, our customer support, our prices and pricing plans, our customers’ spending levels, mergers and acquisitions involving our customers, competition and deteriorating general economic conditions.

We recognize revenue from subscriptions over the term of our customer contracts, and as such, our reported revenue and related metrics may differ significantly in a given period, and our revenue in any period may not be indicative of our financial health and future performance.

The subscription terms of our customer contracts generally range from one to three years and are invoiced on an annual basis. A substantial majority of our revenue is recognized over the term of the subscription. As a result, much of the revenue we report each quarter is derived from contracts that we entered into with customers in prior periods. Consequently, a decline in new or renewed subscriptions in any quarter will not be fully reflected in revenue or other results of operations in that quarter but will negatively affect our revenue and other results of operations across future quarters. Any increases in the average term of subscriptions would result in revenue for those contracts being recognized over longer periods of time with less positive impact on our results of operations in the near term. Accordingly, our revenue in any given period may not be an accurate indicator of our financial health and future performance.

~~Table of~~ ~~Contents~~

Failure to effectively develop and expand our ~~marketing~~sales and ~~sales~~marketing capabilities or maintain successful relationships with our channel partners could harm our ability to increase our customer base and achieve broader market acceptance of our products.

Our ability to increase our customer base and achieve broader market acceptance of our platform and products will depend to a significant extent on our ability to expand our ~~marketing~~sales and ~~sales~~marketing operations and to maintain successful relationships with our channel partners. We plan to continue expanding our direct inside sales force and engaging additional channel partners, both domestically and internationally. This expansion will require us to invest significant financial and other ~~resources. Our~~resources and our business will be harmed if our efforts do not generate a corresponding increase in ~~revenue.~~revenues. We may not achieve anticipated ~~revenue~~revenues growth from expanding our direct sales force if we are unable to hire and develop talented direct inside sales personnel, if our new direct inside sales personnel are unable to achieve desired productivity levels in a reasonable period of time or if we are unable to retain our existing direct inside sales personnel.

In order to grow our business, we anticipate that we will continue to depend on our relationships with our channel partners who we rely on, in addition to our direct sales force, to sell and support our products. ~~For the periods presented, no individual channel partner accounted for 10% or more of our sales.~~ We utilize channel partners to efficiently increase the scale of our marketing and sales efforts and increase our market penetration to customers who we otherwise might not reach on our own. ~~Our ability to achieve revenue growth in the future will depend, in part, on our success in maintaining successful relationships with our channel partners.~~

Our agreements with our channel partners are generally non-exclusive, meaning our channel partners may offer customers competitive products from different companies, and generally allow the channel partner to terminate its agreements with us for any reason upon 30 days’ notice. For example, some of our channel partners also sell or provide integration and administration services for our competitors’ products, and if such channel partners devote greater resources to marketing, reselling and supporting competing products, this could harm our business, financial condition and results of operations. If our channel partners do not effectively market and sell our products, choose to use greater efforts to market and sell their own products or those of others or fail to meet the needs of our customers, our ability to grow our business, sell our products and maintain our reputation may be adversely affected. The loss of key channel partners, our possible inability to replace them or the failure to recruit additional channel partners could materially and adversely affect our results of operations. If we are unable to maintain our relationships with these channel partners, our business, financial condition ~~results of operations or cash flows could be adversely affected~~

If we are not able to provide successful updates, enhancements and features to our technology to, among other things, keep up with emerging threats and customer needs, our business, financial condition and results of operations could be adversely affected.

Our industry is marked by rapid technological developments and demand for new and enhanced products and features to address the evolving risks associated with social engineering. In particular, cybersecurity threats are becoming increasingly sophisticated and responsive to the new security measures designed to thwart them. If we fail to identify and respond to new and increasingly complex methods of attack and update our products to address such threats, our business and reputation will suffer. The success of any new enhancements, features or products that we introduce depends on several factors, including the timely completion, introduction and market acceptance of such enhancements, features or products. We may not be successful in either developing these modifications and enhancements or in bringing them to market in a timely fashion. Furthermore, modifications to existing technologies will increase our research and development expenses. If we are unable to successfully enhance our existing products to meet customer requirements, increase adoption and usage of our products or develop new products, enhancements and features, our business, financial condition and results of operations will be harmed.

In addition, our future success depends, in part, on continued market adoption of cloud-based technologies such as our platform as an alternative to on-premise offerings. While the market for cloud-based technologies is growing, it is not as mature as the market for legacy on-premise offerings, and organizations that have invested substantial resources into on-premise systems may be reluctant or unwilling to migrate to cloud-based platforms. It is uncertain whether cloud-based technologies will achieve and sustain high levels of customer demand and market acceptance.

~~Table of~~ ~~Contents~~

Our success depends on the adoption of cloud-based technologies globally and across industries. It is difficult to predict market adoption rates and the future growth rate and size of the market for cloud-based technologies. If cloud-based technologies do not achieve widespread adoption or there is a reduction in demand for cloud-based technologies caused by a lack of customer acceptance, technological challenges, weakening economic conditions, security or privacy concerns, competing technologies and solutions, reductions in corporate spending or otherwise, our business, financial condition and results of operations will be harmed.

~~If we cannot maintain our company culture as we grow, we could lose the innovation, teamwork, passion and focus on execution that we believe contribute to our success and our business may be harmed.~~

We believe that our corporate culture has been a contributor to our success, which we believe fosters innovation, teamwork, passion and focus on building and marketing our platform and products. As we grow and develop the infrastructure of a public company, we may find it difficult to maintain our corporate culture. Any failure to preserve our culture could harm our future success, including our ability to retain and recruit personnel, innovate and operate effectively and execute on our business strategy. Additionally, our productivity and the quality of our products may be adversely affected if we do not integrate and train our new employees quickly and effectively. If we experience any of these effects in connection with future growth, it could impair our ability to attract new customers, retain existing customers and expand their use of our products, all of which would adversely affect our business, financial condition and results of operations.

~~Our financial results may fluctuate due to increasing variability in our sales cycles.~~

We plan our expenses based on certain assumptions about the length and variability of our sales cycle. These assumptions are based upon historical trends for sales cycles and conversion rates associated with our existing customers. As we continue to focus on sales to larger organizations, we expect our sales cycles to lengthen and become less predictable, which may harm our financial results. Factors that may influence the length and variability of our sales cycle include, among other things:

•~~the need to raise awareness about the benefits of our platform and products;~~

•~~the discretionary nature of purchasing and budget cycles and decisions;~~

•~~the competitive nature of evaluation and purchasing processes;~~

•~~announcements or planned introductions of new products, features or functionality by us or our competitors; and~~

•~~potentially lengthy purchasing approval processes.~~

Our increasing focus on sales to larger organizations may further increase the variability of our financial results. If we are unable to close one or more expected significant transactions with large organizations in a particular period, or if an expected transaction is delayed until a subsequent period, our results of operations for that period, and for any future periods in which revenue from such transaction would otherwise have been recognized, may be harmed.

A network, systems or data security incident may allow unauthorized access to our network, systems or data or our customers’ data, harm our reputation, create additional liability and adversely impact our financial results.

Increasingly, companies are subject to a wide variety of attacks on their networks and systems on an ongoing basis. In addition to traditional computer “hackers,” malicious code (such as viruses and worms), employee or contractor theft or misuse and denial-of-service attacks, sophisticated nation-state and nation-state supported actors now engage in attacks (including advanced persistent threat intrusions). Despite significant efforts to create security barriers to such threats, it is virtually impossible for us to entirely mitigate these risks. The security measures we have integrated into our internal networks and systems, and into our platform and products, which are designed to detect unauthorized activity and prevent or minimize security breaches, may not function as expected or may not be sufficient to protect our internal networks, platform and products against certain attacks. In addition, techniques used

~~Table of~~ ~~Contents~~

to sabotage or to obtain unauthorized access to networks in which data is stored or through which data is transmitted change frequently and generally are not recognized until launched against a target. As a result, we may be unable to anticipate these techniques or implement adequate preventative measures to prevent an electronic intrusion into our networks or systems, unauthorized access to or disclosure of data or other security breaches or incidents.

Third parties also may attempt to fraudulently induce employees or customers into disclosing sensitive information such as user names, passwords or other information or otherwise compromise the security of our networks, electronic systems and/or physical facilities in order to gain access to our data or our customers’ data, which could result in significant legal and financial exposure, the loss, alteration or compromise of our sensitive or otherwise critical business information, a loss of confidence in the security of our platform and products, interruptions or malfunctions in our operations, and, ultimately, harm to our future business prospects and revenue. As a well-known provider of products in the security awareness market, we may be a particularly attractive target for these and other forms of attacks.

In addition, security breaches impacting our platform and products could result in a risk of loss, alteration or unauthorized access to or disclosure of information maintained on or processed by our platform and products, which, in turn, could lead to claims, litigation, governmental audits and investigations and possible liability, damage our relationships with our existing customers and have a negative impact on our ability to attract and retain new customers. These breaches, or any perceived breach, of our employees, networks or systems, in particular, because of our position as a security awareness company, may also undermine confidence in our platform or products and result in damage to our reputation, negative publicity, loss of channel partners, customers and sales, increased costs to remedy any problem and costly litigation. In addition, a breach of the security measures of one of our key channel partners or independent software vendors could result in the exfiltration of confidential corporate information or other data that may provide additional avenues of attack. If a high profile security breach occurs with respect to another Software-as-a-Service, or SaaS, provider, our customers and potential customers may lose trust in the security of the SaaS business model generally, which could adversely impact our ability to retain existing customers or attract new ones, potentially causing a negative impact on our business. Any of these negative outcomes could adversely impact market acceptance of our products and could harm our business, financial condition and results of operations.

We may be required to expend significant capital and financial resources to protect against the foregoing threats and to alleviate problems caused by actual or perceived security breaches. We may face difficulties or delays in identifying, remediating and responding to attacks and actual or perceived security breaches. Additionally, we use third party service providers to provide data hosting and other services to us, and they face similar risks. Any actual or perceived security breach at a company providing services to us could result in the impacts described above. The current COVID-19 pandemic has resulted in increased employees and other personnel working remotely, which increases the risk we and our service providers face.

While we maintain insurance that may cover certain liabilities relating to security breaches, subject to applicable deductibles and policy limitations, our insurance may be insufficient to cover all liabilities incurred. We cannot be certain that our insurance coverage will be adequate for liabilities actually incurred, that insurance will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance

~~Table of~~ ~~Contents~~

~~coverage, or the occurrence of changes in our insurance policies, premiums or deductibles could have a material adverse effect on our business, results of operations and financial condition.~~

Complying with evolving privacy and other data related laws and requirements may be expensive and force us to make adverse changes to our business, and failure to comply with such laws and requirements could result in substantial harm to our business.

Laws and regulations governing data privacy and protection, information security, the use of the Internet as a commercial medium, the use of data in artificial intelligence and machine learning and data sovereignty requirements are rapidly evolving, extensive, complex and include inconsistencies and uncertainties. Examples of recent and anticipated developments that have or could impact our business include the following:

•The General Data Protection Regulation (“GDPR”) took effect in May 2018 and established several requirements applicable to the handling of personal data of individuals in the European Economic Area (“EEA”). The GDPR is wide-ranging in scope and imposes numerous requirements on companies that process personal data, including imposing accountability obligations requiring data controllers and processors to maintain a record of their data processing and implement policies and procedures as part of its mandated privacy governance framework. It also requires data controllers to be transparent and disclose to data subjects how their personal data will be used; establishes rights for individuals with respect to their personal data, including rights of access and deletion in certain circumstances; imposes limitations on retention of personal data; establishes data breach notification requirements; and sets standards for data controllers to demonstrate that they have obtained valid consent for certain data processing activities.

•The GDPR and substantially equivalent legislation in the United Kingdom, also imposes strict rules applied to the transfer of personal data out of the EEA, and the UK to third countries deemed to lack adequate privacy protections (including the United States), unless an appropriate safeguard is implemented, such as the Standard Contractual Clauses (“SCCs”), approved by the European Commission, or a derogation applies. The Court of Justice of the European Union (“CJEU”), deemed the SCCs valid in July 2020. However, the CJEU ruled that transfers made pursuant to the SCCs and other alternative transfer mechanisms must be analyzed on a case-by-case basis to ensure European Union, or EU, standards of data protection are met in the jurisdiction where the data importer is based, and concerns remain about the potential for the SCCs and other mechanisms to face additional challenges. European regulators have issued guidance following the CJEU ruling that imposes significant new requirements on transferring data outside the EEA, including under an approved transfer mechanism. This guidance requires an “essential equivalency” assessment of the laws of the destination country. If essentially equivalent protections are not available in the destination country, the exporting entity must then assess if supplemental measures can be put in place that, in combination with the chosen transfer mechanism, would address the deficiency in the laws and ensure that essentially equivalent protection can be given to the data. Complying with this and other applicable guidance will be expensive and time consuming and may ultimately prevent or restrict us from transferring personal data outside the EEA and the UK, which would cause significant business disruption.

•The EU has proposed the Regulation on Privacy and Electronic Communications (“ePrivacy Regulation”) which, if adopted, would impose new obligations on the use of personal data in the context of electronic communications, particularly with respect to online tracking technologies and direct marketing.

•In January 2020, the California Consumer Privacy Act “CCPA”), took effect, providing California residents increased privacy rights and protections, including the ability to opt out of sales of their personal

~~Table of~~ ~~Contents~~

information. The CCPA went into effect in January 2020 and became enforceable by the California Attorney General in July 2020. Among other things, the CCPA requires covered companies to provide new disclosures to California consumers and afford such consumers new rights with respect to their personal information, including the right to request deletion of their personal information, the right to receive the personal information on record for them, the right to know what categories of personal information generally are maintained about them, as well as the right to opt-out of certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches that result in the loss of personal information. This private right of action may increase the likelihood of, and risks associated with, data breach litigation.

•California voters also approved a new privacy law, the California Privacy Rights Act (“CPRA”), in the November 3, 2020 election. Effective January 1, 2023, the CPRA imposes additional obligations on covered companies and will significantly modify the CCPA, including by expanding consumers’ rights with respect to certain sensitive personal information. The CPRA also creates a new state agency that will have authority to implement and enforce the CCPA and the CPRA. The effects of the CCPA and the CPRA are significant. They increase our potential exposure to regulatory enforcement and/or litigation and may require us to modify our data collection or processing practices and policies and to incur substantial costs and expenses in an effort to comply. Other U.S. states are considering adopting similar laws. Such proposed legislation, if enacted, may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies.

~~Additionally, both U.S. and non-U.S. governments are considering regulating artificial intelligence and machine learning.~~

These and other similar legal and regulatory developments could contribute to legal and economic uncertainty, affect how we design, market, sell and operate our platform and products, how our customers process and share data, how we process, transfer and use data, which could negatively impact demand for our platform and products. We may incur substantial costs to comply with such laws and regulations, to meet the demands of our customers relating to their own compliance with applicable laws and regulations and to establish and maintain internal policies, self-certifications, and third-party certifications supporting our compliance programs. Our customers may bind us to certain obligations pursuant to the GDPR or other laws or regulations relating to privacy or data protection, and we may be or become bound by other contractual obligations relating to privacy, data protection or information security. We may be required to expend substantial resources to comply with these obligations. In addition, any actual or perceived non-compliance with applicable laws, regulations, policies, certifications or contractual or other actual or asserted obligations could result in proceedings, investigations or claims against us by regulatory authorities, customers or others, leading to reputational harm, significant fines, litigation costs and damages. For example, if regulators assert that we have failed to comply with the GDPR or the UK’s legislation implementing the GDPR, we may be subject to fines of up to EUR 20 million (or GBP 17.5 million) or 4% of our worldwide annual revenue, whichever is greater, as well as potential data processing restrictions. Authorities have shown a willingness to impose significant fines and issue orders preventing the processing of personal data on non-compliant businesses. Moreover, individuals can claim damages resulting from infringement of the GDPR and other European and UK data protection laws. The GDPR also introduces the right for non-profit organizations to bring claims on behalf of data subjects. In addition to the foregoing, a breach of the GDPR or other applicable privacy and data protection laws and regulations could result in regulatory investigations, reputational damage, orders change our use of data, enforcement notices, or potential civil claims including class action type litigation. All of these impacts could have a material adverse effect on our business, financial condition and results of operations.

We publish privacy policies and other documentation regarding our collection, processing, use and disclosure of personal information, credit card information or other confidential information. Although we endeavor to comply with applicable laws and regulations relating to privacy, data protection, and information security, and our related policies, certifications, representations and documentation, we may at times fail to do so or may be perceived to have failed to do so. Moreover, despite our efforts, we may not be successful in achieving or maintaining compliance if our employees or service providers fail to comply with our policies, certifications, representations and

~~Table of~~ ~~Contents~~

documentation. Such actual or perceived failures can subject us to potential claims, litigation and international, local, state and federal action if they are found or alleged to be deceptive, unfair or to misrepresent our actual practices.

We also collect information about cyber threats from open sources, intermediaries and third parties that we make available to our customers in our industry publications. While we have implemented certain procedures to facilitate compliance with applicable laws and regulations in connection with the collection of this information, we cannot assure you that these procedures have been effective or that we, or third parties, many of whom we do not control, have complied with all laws or regulations in this regard. Failure by our employees, representatives, contractors, channel partners, agents, intermediaries or other third parties to comply with applicable laws and regulations in the collection of this information also could have negative consequences to us, including reputational harm, government investigations and penalties. Although we take precautions to prevent our information collection practices and services from being provided in violation of such laws, our information collection practices and services may have been in the past, and could in the future be, provided in violation of such laws.

Our international operations and plans for future international expansion expose us to significant risks, and failure to manage those risks could adversely impact our business, financial condition and results of operations.

We derived ~~15.2%~~17.4% and ~~11.1%~~15.2% of our total ~~revenue~~revenues from international customers for the ~~quarters~~three months ended June 30, 2022, and 2021, respectively, and ~~2020,~~17.1% and 14.6% for the six months ended June 30, 2022 and 2021, respectively. We are continuing to adapt to and develop strategies to address international markets and our growth strategy includes expansion into ~~target geographies including opportunistically through acquisitions,~~various international jurisdictions, but there is no guarantee that such efforts will be successful. We expect that our international activities will continue to grow in the future, as we continue to pursue opportunities in international markets. These international operations will require significant management attention and financial resources and are subject to substantial risks, ~~including:~~including but not limited to:

•greater difficulty in negotiating contracts with standard terms, enforcing contracts and managing collections and longer collection periods;

•higher costs of doing business internationally, including costs incurred in establishing and maintaining office space and equipment for our international operations;

•management communication and integration problems resulting from cultural and geographic dispersion;

Table of Contents

•risks associated with trade restrictions and foreign legal requirements, including any importation, certification and localization of our platform and products that may be required in foreign countries;

•greater risk of unexpected changes in regulatory practices, tariffs and tax laws and treaties;

•compliance with anti-bribery laws, including, without limitation, compliance with the U.S. Foreign Corrupt Practices Act of 1977, as amended, (the “FCPA”), the U.S. Travel Act and the UK Bribery Act 2010 (the “Bribery Act”), violations of which could lead to significant fines, penalties and collateral consequences for our company;laws;

•heightened risk of unfair or corrupt business practices ~~in certain geographies~~ and of improper or fraudulent sales ~~arrangements that may impact financial results and result in restatements of, or irregularities in, financial statements;~~arrangements;

•the uncertainty of protection for intellectual property rights in some countries;

•general economic and political conditions or events in these foreign markets, including, but not limited to, ~~Brexit;~~sanctioned countries, governments and industries around the world and other geopolitical uncertainty and instability, such as the ongoing geopolitical tensions related to Russia’s actions in Ukraine, resulting sanctions imposed by the United States and other countries, and retaliatory actions taken by Russia in response to such sanctions;

•foreign exchange controls or tax regulations that might prevent us from repatriating cash earned outside the United States;

•~~political and economic instability in some countries;~~

~~Table of~~ ~~Contents~~

•double taxation of our international earnings and potentially adverse tax consequences due to changes in the tax laws of the United States or the foreign jurisdictions in which we operate;

•unexpected costs for the localization of our services, including translation into foreign languages and adaptation for local practices and regulatory requirements;

•requirements to comply with foreign privacy, data protection and information security laws and regulations, and the risks and costs of noncompliance;

•greater difficulty in identifying, attracting and retaining local qualified personnel, and the costs and expenses associated with such activities;

•greater difficulty identifying qualified channel partners and maintaining successful relationships with such partners; and

•differing employment practices and labor relations ~~issues; and~~

•~~difficulties in managing and staffing international offices and increased travel, infrastructure and legal compliance costs associated with multiple international locations.~~issues.

As we continue to develop and grow our business globally, our success will depend in large part on our ability to anticipate and effectively manage these risks. The expansion of our existing international operations and entry into additional international markets will require significant management attention and financial resources. Our failure to successfully manage our international operations and the associated risks could limit the future growth of our business.

Increasingly, companies are subject to a wide variety of attacks on their networks and systems on an ongoing basis. These attacks include, but are not limited to, hacking, the use of phishing and other forms of social engineering, attempts to introduce malicious code (such as viruses, ransomware or other malware) into the systems and networks used in our business, employee or contractor error or intentional acts, including theft or misuse, denial of service or other brute force attacks, and sophisticated attacks perpetrated by nation-state and nation-state supported actors. Despite significant efforts to create security barriers to such threats, it is virtually impossible for us to entirely mitigate these risks, in particular, as the frequency and sophistication of cyberattacks increases. For example, cybersecurity researchers have observed increased cyberattack activity, and warned of heightened risks of cybersecurity attacks, in connection with Russia’s actions in Ukraine. The ~~nature~~security measures we have integrated into our internal networks and systems, and into our platform and products may not function as expected or may not be sufficient to protect our internal networks, platform and products against certain attacks. In addition, techniques used to sabotage or to obtain unauthorized access to networks in which data is stored or through which data is transmitted change frequently and generally are not recognized until launched against a target. As a result, we may be unable to

Table of Contents

anticipate these techniques or implement adequate measures to prevent an electronic intrusion into our networks or systems, unauthorized access to, loss or unavailability of, or unauthorized alteration, use or disclosure of data or other security breaches or incidents. This could lead to claims, litigation, governmental audits and investigations and potential liability, damage our relationships with our existing customers and have a negative impact on our ability to attract and retain new customers. We also may face difficulties or delays in identifying, remediating and responding to attacks and actual or perceived security breaches and incidents. Further, with many of our employees and other personnel working remotely, the security risks we and our service providers face are heightened.

As a well-known provider of products in the security awareness market, we may be a particularly attractive target for these or other forms of attacks which may undermine confidence in our platform or products and result in damage to our reputation, negative publicity, loss of channel partners, customer and sales, increased costs to remedy any problem and costly litigation. In addition, a security breach or incident impacting one of our key channel partners or independent software vendors could result in the exfiltration of confidential corporate information or other data that may provide additional avenues of attack.

Our customers’ storage and use of data concerning, among others, their employees, contractors, customers and partners is essential to their use of our platform and products, which store, transmit and process customers’ proprietary information and personal information. If a security breach or incident compromising the security of customer data were to occur or to be perceived to occur and the confidentiality, integrity or availability of our customers’ data was disrupted or believed to have been disrupted, we could face claims by and incur significant liability to our customers and to individuals or businesses whose information was being stored by our customers. In addition, a network, systems or other security breach or incident, whether or not impacting or being perceived to impact the confidentiality, integrity or availability of our customers’ data, could result in the loss of customers and make it more challenging to acquire new customers. Additionally, if a high profile security breach or incident occurs with respect to another SaaS provider, our customers and potential customers may lose trust in the security of the SaaS business ~~requires the application~~model generally, which could adversely impact our ability to retain existing customers or attract new ones, potentially causing a negative impact on our business. Any of ~~complex accounting rules, including revenue~~these negative outcomes could adversely impact market acceptance of our products and ~~expense recognition rules, and any significant changes in current rules, or interpretations thereof,~~ could ~~affect~~harm our business, financial ~~statements~~condition and results of operations.

~~The accounting rules~~We may be required to expend significant capital and ~~regulations~~financial resources to protect against the foregoing threats and to alleviate problems caused by actual or perceived security breaches or incidents. While we maintain insurance that ~~we must comply with are complex and~~may cover certain liabilities relating to security breaches or incidents, subject to ~~interpretation by the Financial Accounting Standards Board (“FASB”), the Securities~~applicable deductibles and ~~Exchange Commission (“SEC”), and various bodies formed~~policy limitations, our insurance may be insufficient to ~~promulgate and interpret appropriate accounting principles. Recent actions and public comments from the FASB and the SEC~~cover all liabilities incurred, which could have been focused on the integrity of financial reporting and internal controls over financial reporting. Many companies’ accounting policies and practices are being subject to heightened scrutiny by regulators and the public. In addition, the accounting rules and regulations are continually changing in ways that could materially impact our financial statements. We cannot predict the impact of future changes to accounting principles or our accounting policiesa material adverse effect on our business, financial ~~statements going forward, which could significantly affect our reported financial results~~condition and ~~could affect the reporting of transactions completed before the announcement of the change. Further, if we were to change our critical accounting estimates, our~~ results of ~~operations could~~operations. Additionally, we cannot be ~~significantly affected.~~certain that insurance coverage will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim.

We rely upon SaaS technologies from third parties to operate our business, and interruptions or performance problems with these technologies may adversely affect our business, financial condition and results of operations.

We rely on hosted SaaS applications from third parties in order to operate critical functions of our business, including platform delivery, enterprise resource planning, customer relationship management, billing, project management and accounting and financial reporting. If these services become unavailable due to extended outages, interruptions or because they are no longer available on commercially reasonable terms, our expenses could increase, our ability to manage finances could be interrupted and our processes for managing sales of our platform and products and supporting our customers could be impaired until equivalent services, if available, are identified, obtained and implemented, all of which could adversely affect our business, financial condition and results of operations.

We recognize revenues from subscriptions over the term of our customer contracts, and as such, our reported revenues and related metrics may differ significantly in a given period, and our revenues in any period may not be indicative of our financial health and future performance.

A substantial majority of our revenues are recognized over the term of our customer contracts. As a result, much of the revenues we report each quarter a derived from contracts that we entered into with customers in prior periods.

Table of Contents

~~Interruptions~~Consequently, a decline in new or ~~delays~~renewed subscriptions in any quarter will not be fully reflected in revenue or other results of operations in that quarter but will negatively affect our revenue and other results of operations across future quarters. Any increases in the ~~services provided by third-party data centers or internet service providers could impair~~average term of subscriptions would result in revenue for those contracts being recognized over longer periods of time with less positive impact on our results of operations in the ~~delivery of~~near term. Accordingly, our ~~platform and products, expose us to litigation and negatively impact our relationships with customers, adversely affecting our business.~~

We host our platform using Amazon Web Services (“AWS”), data centers, a provider of cloud infrastructure services, and, therefore, we are vulnerable to service interruptions at AWS, which could impact the ability of our customers to access our platform atrevenue in any time, without interruption or degradation of performance. All of our products reside on hardware owned or leased and operated by us in these locations. Our operations depend on protecting the virtual cloud infrastructure hosted in AWS by maintaining its configuration, architecture and interconnection specifications, as well as the information stored in these virtual data centers, which third-party internet service providers transmit. Although we have disaster recovery plans that utilize multiple AWS locations, any incident affecting their infrastructure that may be caused by fire, flood, severe storm, earthquake, power loss, telecommunications failures, unauthorized intrusion, computer viruses and disabling devices, hacking and other security attacks, natural disasters, war, criminal acts, military actions, terrorist attacks and other similar events beyond our control could negatively affect the security or availability of our platform and products. A prolonged AWS service disruption affecting our platform and products for any of the foregoing reasons could damage our reputation with current and potential customers, expose us to liability, cause us to lose customers or otherwise harm our business. We may also incur significant costs for using alternative equipment or taking other actions in preparation for, or in reaction to, events that damage the AWS services we use.

~~Our platform and products are accessed by a large number of customers, often at the same time. As we continue to expand the number of our customers and products available to our customers, we~~given period may not be able to scale our technology to accommodate the increased capacity requirements, which may result in interruptions or delays in service. In addition, the failure of AWS data centers or third-party internet service providers to meet our capacity requirements could result in interruptions or delays in access to our platform and products or impede our ability to scale our operations. In the event that our AWS service agreements are terminated, or there is a lapse of service, interruption of internet service provider connectivity or damage to such facilities, we could experience interruptions in access to our platform and products as well as delays and additional expense in arranging new facilities and services.

Although we maintain insurance for our business, the coverage under our policies may not be adequate to compensate us for all losses that may occur. In addition, we cannot provide assurance that we will continue to be able to obtain adequate insurance coverage at an ~~acceptable cost.~~

~~We depend on our executive officers and other key employees, the loss of whom could adversely affect our business.~~

~~We believe that our success is substantially dependent on our ability to attract, retain and motivate the members~~accurate indicator of our ~~management team~~financial health and ~~other key employees throughout our organization. In particular, we depend on the services of Stu Sjouwerman, our founder and Chief Executive Officer, who is critical to our~~ future vision and strategic direction. We rely on our leadership team in the areas of research and development, operations, security, marketing, sales, customer support and general and administrative functions. Although we have entered into employment agreements with our leadership team, our employees, including our executive officers, work for us on an “at-will” basis, which means they may terminate their employment with us at any time. If Mr. Sjouwerman or one or more of our key employees or members of our management team resigns or otherwise ceases to provide us with their service, and if we fail to have in place and execute an effective succession plan for key executives, our business could be harmed.

~~Table of~~ ~~Contents~~

ability to attract and retain qualified personnel with the requisite background and industry experience to drive content creation and product development. As we expand our business domestically and globally, our continued success will also depend on our ability to attract and retain qualified content development personnel capable of creating localized, culturally relevant security awareness content, as well as to attract and retain qualified sales, marketing and operational personnel capable of supporting a larger and more diverse customer base. The loss of the services of a significant number of our content, technology or sales personnel could be disruptive to our content and product development efforts, which could harm our ability to retain existing customers and to expand our global customer base.

If our platform and products fail to perform properly, our reputation could be adversely affected and our market share could decline, which could have a material adverse effect on our business, financial condition and results of operations.

Our platform and products are inherently complex and may contain material defects or errors. In the future we may experience website disruptions, outages and other performance problems. These problems may be caused by a variety of factors, including infrastructure changes, human or software errors or negligence, viruses, hacking and other security attacks, fraud, increased resource consumption from expansion or modification to our code and spikes in customer usage. In some instances, we may not be able to identify the cause or causes of these performance problems within an acceptable period of time. If we do not accurately predict our infrastructure requirements, our existing customers may experience service outages and our operations infrastructure may fail to keep pace with increased sales, causing new customers to experience delays. We may be required to issue credits or refunds for prepaid amounts related to unused services; see “—We provide service level commitments under our customer contracts. If we fail to meet these contractual commitments, we could be obligated to provide credits for future service, or face contract termination with refunds of prepaid amounts related to unused subscriptions, which could harm our business, financial condition and results of operations” above. Any defects in functionality or that cause interruptions in the availability of our platform and products could result in:

•~~loss or delayed market acceptance and sales;~~

•~~breach of warranty or other contractual claims for damages incurred by customers;~~

•~~loss of customers;~~

•~~diversion of development and customer service resources; and~~

•~~injury to our reputation;~~

any of which could have a material adverse effect on our business, financial condition and results of operations. In addition, the costs incurred in correcting any material defects or errors might be substantial.performance.

The market in which we participate is competitive, and if we do not compete effectively, our business, financial condition and results of operations could be harmed.

The market for our platform and products is rapidly evolving and fragmented, and we expect competition to increase in the future. Although we believe competitors ~~that compete with our platform and products~~who specifically attempt to manage the ongoing problem of social engineering are currently limited, a number of companies have developed, or are developing, products that currently are, or in the future may be, competitive with our offerings. For example, certain larger enterprise providers, such as Proofpoint, Mimecast and Cofense, all attempt to address human risk through a product offering that is often tied to other products and is not given a singular focus. Nevertheless, competition continues to increase in the market segments in which we operate, and we expect competition to further increase in the future. Larger competitors with more diverse product and service offerings may reduce the price of products or subscriptions that compete with ours or may bundle them with other products and subscriptions. These competitive pressures may cause our subscription prices to decline for a variety of reasons, including competitive pricing pressures, discounts, anticipation of the introduction of new products by competitors or promotional programs offered by us or our competitors. ~~If we are unable to maintain our pricing due to competitive pressures or other factors, our margins will be reduced and our gross profits, business, financial condition and results of operations~~

~~Table of~~ ~~Contents~~

~~would be adversely affected.~~ As a result, as competition in our market increases, it could result in increased pricing pressure, decreased revenue, increased sales and marketing expenses and loss of market share for us, any of which could adversely affect our business, financial condition and results of operations.

We may experience quarterly fluctuations in our results of operations due to a number of factors, ~~that~~including increasing variability in our sales cycles. These fluctuations make our future results difficult to predict and could cause our results of operations to fall below analyst or investor expectations.

Our quarterly results of operations fluctuate as a result of a number of factors, many of which are outside of our control and may be difficult to predict, including, but not limited to:

•the level of demand for our platform and products;

•the timing and success of new product introductions by us or our competitors or any other change in the competitive landscape of our market;

•pricing pressure as a result of competition or otherwise;

•the length and predictability of our sales cycle;

•seasonal buying patterns for IT spending;

•errors in forecasting the demand for our products, which could lead to lower ~~revenue,~~revenues, increased costs or both;

•increases in and timing of sales and marketing and other operating expenses that we may incur to grow and expand our operations and to remain competitive;

•credit or other difficulties confronting our channel partners;

•adverse litigation judgments, settlements or other litigation-related costs;

•changes in the legislative or regulatory environment, including with respect to privacy, data protection and security and enforcement by government regulators, including fines, orders or consent decrees;

•system failures or actual or perceived security breaches;

•fluctuations in foreign currency exchange rates;

Table of Contents

•costs related to the acquisition of businesses, talent, technologies or intellectual property, including potentially significant amortization costs and possible write-downs; and

•general economic conditions in either domestic or international markets, including geopolitical uncertainty and ~~instability.~~instability, such as the ongoing geopolitical tensions related to Russia’s actions in Ukraine, resulting sanctions imposed by the United States and other countries, and retaliatory actions taken by Russia in response to such sanctions.

Any one or more of the factors above may result in significant fluctuations in our results of operations. As we continue to focus on sales to larger organizations, we expect our sales cycles to lengthen and become less predictable. You should not rely on our past results as an indicator of our future performance. The variability and unpredictability of our quarterly results of operations or other operating metrics could result in our failure to meet our expectations or those of analysts that cover us or investors with respect to ~~revenue~~revenues or other metrics for a particular period. If we fail to meet or exceed such expectations for these or any other reasons, the market price of our Class A common stock could fall substantially, and we could face costly lawsuits, including securities class action suits.

~~We may face exposure~~If we fail to ~~foreign currency exchange rate fluctuations.~~

~~Today,~~maintain an effective system of internal controls over our international contracts are sometimes denominated in local currencies; however, the majority of our international costs are denominated in local currencies. Over time, an increasing portion of our international contracts may be denominated in local currencies. Therefore, fluctuations in the value of the U.S. dollar and foreign currencies may affect our results of operations when translated into U.S. dollars. We do not currently engage in currency hedging activities to limit the risk of exchange rate fluctuations. However, in the future, we may use derivative instruments, such as foreign currency forward and option contracts, to hedge certain exposures to

~~Table of~~ ~~Contents~~

~~fluctuations in foreign currency exchange rates. The use of such hedging activities may not offset any or more than a portion of the adverse~~ financial effects of unfavorable movements in foreign exchange rates over the limited time the hedges are in place. Moreover, the use of hedging instruments may introduce additional risks if we are unable to structure effective hedges with such instruments.

~~We may need to raise additional capital to expand our operations and invest in new products, which capital may not be available on terms acceptable to us, or at all, and which could reduce~~reporting, our ability to ~~compete~~produce timely and accurate financial statements or comply with applicable regulations could be impaired.

As a public company, we are subject to the reporting and corporate governance requirements of the Exchange Act, the listing requirements of Nasdaq and other applicable securities rules and regulations, including the Sarbanes-Oxley Act of 2002 (the “Sarbanes-Oxley Act”) and the Dodd-Frank Wall Street Reform and Consumer Protection Act. The Sarbanes-Oxley Act requires, among other things, that we maintain effective disclosure controls and procedures and internal control over financial reporting. In order to maintain and improve the effectiveness of our disclosure controls and procedures and internal control over financial reporting, we have expended and anticipate we will continue to expend significant resources, including accounting-related costs, and provide significant management oversight. Any failure to develop or maintain effective controls, or any difficulties encountered in their implementation or improvement, could harm our ~~business.~~

~~We expect that our existing cash and cash equivalents, cash provided by~~ operating ~~activities, available borrowings under a credit agreement with Bank of America for a revolving line of credit,~~results or ~~the Revolving Credit Facility, with maximum borrowings of up~~cause us to ~~$100.0 million and unbilled amounts related to contracted non-cancelable subscription agreements, which are not reflected on the balance sheet, will be sufficient~~fail to meet our ~~anticipated cash needs~~reporting obligations and may result in a restatement of our financial statements for working capital and capital expenditures for at least the next 12 months. Retaining or expanding our current levels of personnel and product offerings may require additional funds to respond to business challenges, including the need to develop new products and enhancements to our platform and products, improve our operating infrastructure or acquire complementary businesses and technologies. Ourprior periods. Any failure to ~~raise additional capital~~implement and maintain effective internal controls also could adversely affect the results of periodic management evaluations and annual independent registered public accounting firm attestation reports regarding the effectiveness of our internal control over financial reporting that we are required to include in our periodic reports that we will file with the SEC under Section 404 of the Sarbanes-Oxley Act.

We are not currently required to comply with the SEC rules that implement Section 404 of the Sarbanes-Oxley Act, and we are therefore not required to make a formal assessment of the effectiveness of our internal controls over financial reporting for that purpose. As a public company, we are required to comply with certain rules, which require management to certify financial and other information in our quarterly and annual reports and provide an annual management report on the effectiveness of our internal control over financial reporting commencing with our second Annual Report on Form 10-K. Additionally, our independent registered public accounting firm is not required to formally attest to the effectiveness of our internal control over financial reporting until after we are no longer an “emerging growth company”, as defined in the Jumpstart Our Business Startups Act of 2012 (the “JOBS Act”), which will occur on December 31, 2022. At such time, our independent registered public accounting firm may issue a report that is adverse in the event it is not satisfied with the level at which our controls are documented, designed or ~~generate the significant capital necessary~~operating. Ineffective disclosure controls and procedures and internal control over financial reporting could also cause investors to ~~expand~~lose confidence in our ~~operations~~reported financial and invest in new products could reduce our ability to compete and could harm our business. Accordingly, we may need to engage in additional equity or debt financings to secure additional funds. If we raise additional equity financing, our stockholders may experience significant dilution of their ownership interests andother information, which would likely have a negative effect on the market price of our Class A common ~~stock could decline. If~~stock.

The requirements of being a public company may strain our resources and divert management’s attention.

As a public company, we ~~engage in debt financing,~~are subject to the ~~holders of debt may have priority over the holders of our Class A common stock,~~reporting and ~~we may be required to accept terms that restrict our operations or our ability to incur additional indebtedness or to take other actions that would otherwise be in the interests~~corporate governance requirements of the ~~debt holders. Any~~Exchange Act, the listing requirements of Nasdaq and other applicable securities rules and regulations. Among other things, the ~~above could harm~~Exchange Act requires that we file annual, quarterly and current reports with respect to our business, financial condition and results of ~~operations.~~

~~Adverse economic conditions or reduced IT security spending may adversely impact our revenue and profitability.~~

~~Our~~ operations and ~~performance depend~~maintain effective disclosure controls and procedures and internal control

Table of Contents

over financial reporting. Compliance with these rules and regulations will increase our legal and financial compliance costs, make some activities more difficult, time-consuming or costly and increase demand on our systems and resources, particularly after we are no longer an “emerging growth company” as defined in ~~part on worldwide economic conditions~~the JOBS Act. In addition, as a public company, we may be subject to stockholder activism, which can lead to additional substantial costs, distract management and impact the ~~impact these conditions have on levels~~manner in which we operate our business in ways we cannot currently anticipate. As a result of ~~spending on IT networking~~disclosure of information in the filings required of a public company, our business, financial condition and ~~security solutions. Our business depends on~~results of operations will become more visible, which may result in threatened or actual litigation, including by competitors and other third parties. These new obligations and constituents will require significant attention from our senior management and could divert their attention away from the ~~overall demand for these solutions and on the economic health and general willingness~~day-to-day management of our ~~current and prospective customers to purchase our platform and products. Weak economic conditions or a reduction in IT security spending~~business, which could ~~materially and~~ adversely affect our business, financial condition and results of operations.

We depend on our executive officers and other key employees, the loss of whom could adversely affect our business.

We believe that our success is substantially dependent on our ability to attract, retain and motivate the members of our management team and other key employees throughout our organization. Although we have entered into employment agreements with our leadership team, our employees, including our executive officers, work for us on an “at-will” basis, which means they may terminate their employment with us at any time.In particular, we depend on the services of Stu Sjouwerman, our founder and Chief Executive Officer, who is critical to our future vision and strategic direction. We rely on our leadership team in the areas of research and development, operations, security, marketing, sales, customer support and general and administrative functions. If Mr. Sjouwerman or one or more of our key employees or members of our management team resigns or otherwise ceases to provide us with their service, and if we fail to have in place and execute an effective succession plan for key executives, our business could be harmed.

In addition, because our future success is dependent on our ability to continue to refresh and enhance our library of differentiated security awareness content and expand our platform features, we are heavily dependent on our ability to attract and retain qualified personnel with the requisite background and industry experience to drive content creation and product development. As we expand our business domestically and globally, our continued success will also depend on our ability to attract and retain qualified content development personnel capable of creating localized, culturally relevant security awareness content, as well as to attract and retain qualified sales, marketing and operational personnel capable of supporting a larger and more diverse customer base. The loss of the services of a significant number of our content, technology or sales personnel could be disruptive to our content and product development efforts, which could harm our ability to retain existing customers and to expand our global customer base.

The nature of our business requires the application of complex accounting rules, including revenue and expense recognition rules, and any significant changes in current rules, or interpretations thereof, could affect our financial statements and results of operations.

The accounting rules and regulations that we must comply with are complex and subject to interpretation by the Financial Accounting Standards Board (“FASB”), the SEC and various bodies formed to promulgate and interpret appropriate accounting principles. Recent actions and public comments from the FASB and the SEC have been focused on the integrity of financial reporting and internal controls over financial reporting. Many companies’ accounting policies and practices are being subject to heightened scrutiny by regulators and the public. In addition, the accounting rules and regulations are continually changing in ways ~~including by reducing sales, lengthening sales cycles~~that could materially impact our financial statements. We cannot predict the impact of future changes to accounting principles or our accounting policies on our financial statements going forward, which could significantly affect our reported financial results and ~~lowering prices for~~could affect the reporting of transactions completed before the announcement of the change. Further, if we were to change our ~~platform and products.~~critical accounting estimates, our results of operations could be significantly affected.

Table of Contents

Any future litigation against us could be costly and time-consuming to defend.

We may become subject to legal proceedings and claims that arise in the ordinary course of business, such as claims brought by our customers in connection with commercial disputes or employment claims made by our current or former employees. Litigation might result in substantial costs and may divert management’s attention and resources, which might seriously harm our business, financial condition and results of operations. Insurance might not cover such claims, might not provide sufficient payments to cover all the costs to resolve one or more such claims and might not continue to be available on terms acceptable to us (including premium increases or the imposition of large deductible or co-insurance requirements). A claim brought against us that is uninsured or underinsured could result in unanticipated costs, potentially harming our business, financial position and results of operations. In addition, we cannot be sure that our existing insurance coverage and coverage for errors and omissions will continue to be available on acceptable terms or that our insurers will not deny coverage as to any future claim.

~~Failure~~Acquisitions, strategic investments, partnerships, or alliances could be difficult to identify, pose integration challenges, divert the attention of management, disrupt our business, dilute stockholder value, and adversely affect our business, financial condition and results of operations.

We have in the past and may in the future seek to acquire or invest in businesses, joint ventures, products and platform capabilities, or technologies that we believe could complement or expand our platform and product offerings, enhance our technical capabilities, or otherwise offer growth opportunities. Any such acquisition or investment may divert the attention of management and cause us to incur various expenses in identifying, investigating and pursuing suitable opportunities, whether or not the transactions are completed, and may result in unforeseen operating difficulties and expenditures. Specifically, we may encounter difficulties integrating the businesses, technologies, platform and product capabilities, or operations of any acquired companies, particularly if the key personnel of an acquired company choose not to work for us, their software is not easily adapted to work with our platform, or we have difficulty retaining the customers of any acquired business due to changes in ownership, management or otherwise. Additionally, any such transactions that we are able to complete may not result in the synergies or other benefits we had expected to achieve, which could result in impairment charges that could be substantial. In addition, we may not be able to find and identify desirable acquisition targets or business opportunities or be successful in entering into an agreement with any particular strategic partner. These transactions could also result in dilutive issuances of equity securities or the incurrence of debt, which could adversely affect our results of operations. In addition, if the resulting business from such a transaction fails to meet our expectations, our business, financial condition and results of operations may be adversely affected or we may be exposed to unknown risks or liabilities.

We may need to raise additional capital to expand our operations and invest in new products, which capital may not be available on terms acceptable to us, or at all, and which could reduce our ability to compete and could harm our business.

While we expect that our existing cash and cash equivalents, cash provided by operating activities, available borrowings under our revolving line of credit, and unbilled amounts related to contracted non-cancelable subscription agreements, which are not reflected on the balance sheet, will be sufficient to meet our anticipated cash needs for working capital and capital expenditures for at least the next 12 months, retaining or expanding our current levels of personnel and product offerings may require additional funds. Our failure to raise additional capital or generate the significant capital necessary to expand our operations, invest in new products or acquire complementary businesses and technologies could reduce our ability to compete and could harm our business. Accordingly, we may need to engage in additional equity or debt financings to secure additional funds. If we raise additional equity financing, our stockholders may experience significant dilution of their ownership interests and the market price of our Class A common stock could decline. If we engage in debt financing, the holders of debt may have priority over the holders of our Class A common stock, and we may be required to accept terms that restrict our operations or our ability to incur additional indebtedness or to take other actions that would otherwise be in the interests of the debt holders. Any of the above could harm our business, financial condition and results of operations.

Table of Contents

Our Revolving Credit Facility contains financial covenants and other restrictions on our actions that may limit our operational flexibility or otherwise adversely affect our results of operations.

The terms of our Revolving Credit Facility include a number of covenants that limit our ability and our subsidiaries’ ability to, among other things, incur additional indebtedness, grant liens, merge or consolidate with other companies or sell substantially all of our assets, pay dividends, make redemptions and repurchases of stock, make investments, loans and acquisitions, or engage in transactions with affiliates. These terms may restrict our current and future operations and could adversely affect our ability to finance our future operations or capital needs. In addition, complying with these covenants may make it more difficult for us to successfully execute our business strategy, including potential acquisitions, and compete against companies which are not subject to such restrictions.

A failure by us to comply with the covenants or payment requirements specified in our credit agreement could result in an event of default under the agreement, which would give the lenders the right to terminate their commitments to provide additional loans and to declare all borrowings outstanding, together with accrued and unpaid interest and fees, to be immediately due and payable. If debt under our Revolving Credit Facility were to be accelerated, we may not have sufficient cash or be able to borrow sufficient funds to refinance the debt or sell sufficient assets to repay the debt, which could immediately adversely affect our business, cash flows, results of operations, and financial condition. As of June 30, 2022, there were no amounts outstanding under the Revolving Credit Facility.

If we fail to enhance our brand cost-effectively, our ability to expand our customer base will be impaired and our business, financial condition and results of operations may suffer.

We believe that developing and maintaining awareness of our brand in a cost-effective manner is critical to achieving widespread acceptance of our existing and future products and is an important element in attracting new customers. Furthermore, we believe that the importance of brand recognition will increase as competition in our market increases. Successful promotion of our brand will depend largely on the effectiveness of our marketing efforts and on our ability to provide reliable and useful products at competitive prices. In the past, our efforts to build our brand have involved significant expenses. Brand promotion activities may not yield increased revenues, and even if they do, any increased revenues may not offset the expenses we incur in building our brand. If we fail to successfully promote and maintain our brand, or incur substantial expenses in an unsuccessful attempt to promote and maintain our brand, we may fail to attract new customers or retain our existing customers to the extent necessary to realize a sufficient return on our brand-building efforts, and our business, financial condition and results of operations could suffer.

If we cannot maintain our company culture as we grow, we could lose the innovation, teamwork, passion and focus on execution that we believe contribute to our success and our business may be harmed.

We believe that our corporate culture has been a contributor to our success, which we believe fosters innovation, teamwork, passion and focus on building and marketing our platform and products. As we grow and develop the infrastructure of a public company, we may find it difficult to maintain our corporate culture. Any failure to preserve our culture could harm our future success, including our ability to retain and recruit personnel, innovate and operate effectively, attract new customers, retain existing customers and execute on our business strategy. Additionally, our productivity and the quality of our products may be adversely affected if we do not integrate and train our new employees quickly and effectively. Any of these effects could adversely affect our business, financial condition and results of operations.

Risks Related to Our Intellectual Property

Our results of operations may be harmed if we are subject to a protracted infringement claim or a claim that results in a significant damage award.

Table of Contents

use of such names, logos, marks and other content for our customers’ internal training purposes infringes upon the trademark rights or other intellectual property rights of others, some third parties have objected to such use in our training program. These third parties have sent requests or demands to remove their names, logos, marks and other content from our platform and products, and some have initiated arbitration proceedings, alleging that such use causes consumer confusion resulting in harm to their goodwill or reputation, infringes upon their trademark rights and copyrights, constitutes bad faith, or otherwise creates actionable claims under the laws of certain jurisdictions.

From time to time, we also register domain names containing typos, third-party names or marks, or variations thereof, to be used in connection with our simulated phishing emails. We register these domain names to serve a limited and specific purpose, and similar to the above-referenced simulated phishing emails, we do not believe that the limited manner and purpose in which any such third-party names, marks and other content are used in the registered domain names infringes upon their trademark rights or intellectual property rights. Some third parties have, however, sent a privacy service request or initiated a proceeding to cease use of and/or transfer the domain containing their name, mark or variations thereof, including intentional typos. We take a case-by-case approach when resolving these matters with the third parties. There is no assurance that legal actions will not result in the future from objecting third parties.

Additionally, as our presence in the market expands, we may experience such requests or demands with increasing frequency. Any legal action, regardless of their merit, may require us to expend significant financial resources and attention of management and other personnel, result in injunctions against us that prevent us from using third-party names, logos, marks and other content on our platform and products, require us to pay monetary fees to third parties and/or require transfer of the domain name registrations.

Furthermore, because any legal action would likely involve novel questions of law regarding simulated phishing activities for which there is very little or no precedent to date, and, because the outcomes of any such actions may depend on questions of laws that may vary from jurisdiction to jurisdiction, both inside the United States and internationally, the outcomes of any such legal actions are uncertain and may ultimately vary widely based on where the actions are brought. Any such outcomes may adversely impact our relationship with our customers, including prompting them to discontinue their business relationship with us. From time to time, third parties have asserted, or may assert, claims of infringement, misappropriation or other violations of intellectual property rights against us or our customers, with whom our agreements may obligate us to indemnify against these claims. Successful claims of infringement by a third party may prevent us from offering certain products or features, or require us to develop alternate non-infringing technology, which may require significant time, during which we may be unable to continue offering the affected products or solutions, required to obtain a license that may not be available on reasonable terms, or at all or forced to pay substantial damages, royalties, or other fees. The occurrence of any of these results may materially adversely affect our business, financial condition and results of operations.

If we fail to adequately protect our proprietary rights, our competitive position could be impaired and we may lose valuable assets, generate reduced revenues and incur costly litigation to protect our rights.

Our success is dependent, in part, upon protecting our proprietary information and technology. We rely on a combination of patents, copyrights, trademarks, service marks, trade secret laws and ~~regulations applicable~~contractual restrictions to establish and protect our proprietary rights. However, the steps we take to protect our intellectual property may be inadequate. We will not be able to protect our intellectual property if we are unable to enforce our rights or if we do not detect unauthorized use of our intellectual property. Despite the precautions we have implemented, it may be possible for unauthorized third parties to copy our products and use information that we regard as proprietary to create products that compete with ours. Some license provisions protecting against unauthorized use, copying, transfer and disclosure of our products may be unenforceable under the laws of certain jurisdictions and foreign countries. Further, the laws of some countries do not protect proprietary rights to the same extent as the laws of the United States or the mechanisms for enforcement of intellectual property rights in some foreign countries may be inadequate. To the extent we expand our international activities, our exposure to the unauthorized use of our products and proprietary information may increase. Accordingly, despite our efforts, we may be unable to prevent third parties from infringing upon, or misappropriating, our technology and intellectual property.

Table of Contents

We rely in part on trade secrets, proprietary know-how and other confidential information to maintain our competitive position. Although we enter into confidentiality and invention assignment agreements with our employees and consultants and enter into confidentiality agreements with the parties with whom we have strategic relationships and business alliances, no assurance can be given that these agreements will be effective in controlling access to, and distribution of, our products and proprietary information. Further, these agreements do not prevent our competitors from independently developing technologies that may be substantially equivalent or superior to our ~~business~~products.

To protect our intellectual property rights, we may be required to spend significant resources to monitor and protect these rights. Litigation may be necessary in the future to enforce our intellectual property rights and to protect our trade secrets. Such litigation may be costly, time consuming and distracting to management and may result in the impairment or loss of portions of our intellectual property. Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims and countersuits attacking the validity and enforceability of our intellectual property rights. Our inability to protect our proprietary technology against unauthorized copying or use, as well as any costly litigation or diversion of management’s attention and resources, may delay further sales, introductions of new products or implementation of existing products, may impair the functionality of our products or may result in our substituting inferior or more costly technologies into our products that may injure our reputation. In addition, we may be required to license additional technology from third parties to develop and market new products, and we cannot assure customers we will be able to license that technology on commercially reasonable terms, or at all. Our inability to license this technology may harm our ability to compete.

We use open source software in our products, which could negatively affect our ability to offer our products and subject us to ~~fines~~litigation or other actions.

We use open source software in our products and ~~penalties.~~

~~Our business~~may use more open source software in the future. From time to time, there have been claims challenging the ownership of open source software against companies that incorporate open source software into their products. However, the terms of many open source licenses have not been interpreted by U.S. courts, and there is a risk that these licenses may be construed in a way that could impose unanticipated conditions or restrictions on our ability to commercialize our products. As a result, we could be subject to ~~regulation~~lawsuits by ~~various federal, state, local~~parties claiming ownership of what we believe to be open source software. Litigation could be costly for us to defend, potentially resulting in negative effects on our business, financial condition and ~~foreign governmental agencies,~~results of operations or require us to devote additional research and development resources to change our products. In addition, if we were to combine our proprietary software products with certain open source software in a certain manner, we may, under their specific terms and conditions, be required to release the source code of our proprietary software to the public. This would allow our competitors to create similar products with less development effort and time. If we inappropriately use open source software, or if the license terms for open source software that we use should change, we may be required to re-engineer our products, incur additional costs, discontinue the sale of some or all of our products or take other remedial actions.

In addition to risks related to open source software license requirements, usage of open source software may lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or assurances of title or controls as to the origin of the software. Many of the risks associated with usage of open source software, such as the lack of warranties or assurances of title, cannot be eliminated, and could, if not properly addressed, negatively affect our business. We have established processes to help alleviate these risks, including a review process for screening requests from our development organizations for the use of open source software, but we cannot guarantee that all of our use of open source software is in a manner that is consistent with our current policies and procedures, or will not ~~limited~~subject us to ~~agencies responsible for monitoring~~liability.

We incorporate technology from third parties into our platform and ~~enforcing privacy, data protection~~products, and ~~information security laws~~our inability to obtain or maintain rights to the technology could harm our business.

We license software and ~~regulations, employment~~other technology from third parties that incorporate into, or integrate with, our platform and ~~labor laws, workplace safety, product safety, environmental laws, consumer protection laws, anti-bribery laws, import~~products. We cannot be certain that our licensors are not infringing on the intellectual property rights of third parties or that our licensors have sufficient rights to the licensed intellectual property in all jurisdictions in which we may offer our platform and ~~export controls, federal securities laws~~products. In addition, many licenses are non-exclusive, and therefore our

Table of Contents

~~and tax laws and regulations. In certain jurisdictions, these regulatory requirements~~competitors may have access to the same technology licensed to us. Some of our agreements with our licensors may be ~~more stringent than~~terminated for convenience by them, or otherwise provide for a limited term. If we are unable to continue to license any of this technology for any reason, our ability to develop and offer our platform and products containing such technology may be negatively impacted. Similarly, if we are unable to license necessary technology from third parties now or in the ~~United States. Actual~~future, we may be forced to acquire or ~~alleged noncompliance by us,~~develop an alternative technology, which we may be unable to do in a commercially feasible manner, or at all, and we may be required to use alternative technology of lower quality or performance standards. This may limit or delay our ~~employees, representatives, contractors, channel partners, agents, intermediaries~~ability to offer new or ~~other third parties with applicable regulations~~competitive products and increase our costs of production. As a result, our business and results of operations may be significantly harmed. Additionally, as part of our longer-term strategy, we may open our platform and products to third-party developers and applications to further extend their functionality. We cannot be certain that such efforts to grow our business will be successful.

Risks Related to Our Platform and Products

If we are not able to develop or ~~requirements could subject us to:~~

•~~investigations, enforcement actions~~acquire new products and/or provide successful updates, enhancements and ~~sanctions;~~

•~~mandatory changes~~features to our ~~platform, products or business practices;~~

•~~disgorgement of profits, fines and damages;~~

•~~civil and criminal penalties or injunctions;~~

•~~claims for damages by our customers or channel partners;~~

•~~termination of contracts;~~

•~~loss of intellectual property rights; and~~

•~~temporary or permanent debarment from sales to government organizations.~~

~~If any governmental sanctions are imposed, or if we do not prevail in any possible civil or criminal litigation,~~technology, our business, financial condition and results of operations could be adversely affected.

Our industry is marked by rapid technological developments and demand for new and enhanced products and features to address the evolving risks associated with social engineering. In particular, cybersecurity threats are becoming increasingly sophisticated and responsive to the new security measures designed to thwart them. If we fail to update our products, through internal development or acquisition, to address such threats, our business and reputation will suffer. Our ability to increase revenues depends in large part on our ability to develop compelling new products to sell to new customers and to cross-sell and upsell to our existing customer base. To do so, we must continue to invest in our technology and platform in order to create new adjacencies and use cases. The success of any new product developments, enhancements, or features that we introduce depends on several factors, including the timely completion, introduction and market acceptance of such enhancements, features or products and integration with our existing platform and products.

We may not be successful in either developing these modifications and enhancements or in bringing them to market in a timely fashion. Furthermore, modifications to existing technologies will increase our research and development expenses. If we are unable to successfully enhance our existing products to meet customer requirements, increase adoption and usage of our products or develop new products, enhancements and features, our business, financial condition and results of operations will be harmed.

Interruptions or delays in the services provided by third-party data centers or internet service providers could impair the delivery of our platform and products, expose us to litigation and negatively impact our relationships with customers, adversely affecting our business.

We host our platform using data centers provided by Amazon Web Services (“AWS”), a provider of cloud infrastructure services, and, therefore, we are vulnerable to service interruptions at AWS, which could impact the ability of our customers to access our platform. All of our products reside on hardware in these locations. Our operations depend on protecting the virtual cloud infrastructure hosted at AWS by maintaining its configuration, architecture and interconnection specifications, as well as the information stored in these virtual data centers, which third-party internet service providers transmit. Although we have disaster recovery plans that utilize multiple AWS locations, any incident affecting their infrastructure that may be caused by fire, flood, severe storm, earthquake, power loss, telecommunications failures, unauthorized intrusion, computer viruses and disabling devices, hacking and other security attacks, natural disasters, war, criminal acts, military actions, terrorist attacks and other similar events beyond our control could negatively affect the security or availability of our platform and products. A prolonged AWS service disruption affecting our platform and products for any reason could damage our reputation with current and potential customers, expose us to liability, cause us to lose customers or otherwise harm our business. We may also incur significant costs for using alternative equipment or taking other actions in preparation for, or in reaction to, events that damage the AWS services we use.

Table of Contents

AWS enables us to order and reserve server capacity in varying amounts and sizes distributed across multiple regions. AWS provides us with computing and storage capacity pursuant to an agreement that continues until terminated by either party. AWS may terminate the agreement by providing 30 days prior written notice and may, in some cases, terminate the agreement immediately for cause upon notice. In addition, ~~responding~~the failure of AWS data centers or third-party internet service providers to ~~any action will likely~~meet our capacity requirements could result in interruptions or delays in access to our platform and products or impede our ability to scale our operations. In the event that our AWS service agreements are terminated, or there is a ~~significant diversion~~lapse of ~~management’s attention~~service, interruption of internet service provider connectivity or damage to such facilities, we could experience interruptions in access to our platform and ~~resources~~products as well as delays and additional expense in arranging new facilities and services.

Our platform and products are inherently complex and may contain material defects or errors. In the future we may experience website disruptions, outages and other performance problems. These problems may be caused by a variety of factors, including infrastructure changes, human or software errors or negligence, viruses, hacking and other security attacks, fraud, increased resource consumption from expansion or modification to our code and spikes in customer usage. In some instances, we may not be able to identify the cause or causes of these performance problems within an ~~increase in professional fees. Enforcement actions~~acceptable period of time. If we do not accurately predict our infrastructure requirements, our existing customers may experience service outages and ~~sanctions~~our operations infrastructure may fail to keep pace with increased sales, causing new customers to experience delays. We provide service level commitments under our customer contracts, under which we guarantee specified availability of our platform and products. If we fail to meet these contractual commitments, we could be obligated to provide credits for future service, or face contract termination with refunds of prepaid amounts related to unused subscriptions, which could harm our business, financial condition and results of operations.

In addition, we endeavor to properly classify employees as exempt versus non-exempt under applicable law. Although there are no pending or threatened material claims or investigations against us asserting that some employees are improperly classified as exempt, the possibility exists that somelight of our ~~current~~historical experience with meeting our service level commitments, we do not currently have any material liabilities accrued on our balance sheet for these commitments. Additionally, any defects in functionality or ~~former employees~~that cause interruptions in the availability of our platform and products could result in:

•loss or delayed market acceptance and sales;

•breach of warranty or other contractual claims for damages incurred by customers;

•loss of customers;

•diversion of development and customer service resources; and

•injury to our reputation;

any of which could have ~~been incorrectly classified as exempt employees.~~

~~Sales to government entities are subject to~~ a ~~number of challenges and risks.~~

~~A number of~~material adverse effect on our customers are U.S., state or foreign government entities. Such entities may demand contract terms that are less favorable than standard arrangements with private sector customers and may have statutory, contractual or other legal rights to terminate contracts with us or our partners for convenience or for other reasons. Any such termination may adversely affect our ability to contract with other government customers as well as our reputation, business, financial condition and results of operations.

In addition, the costs incurred in correcting any material defects or errors might be substantial.

Risks Related to Governmental Regulations and Taxation

Laws and regulations governing data privacy and protection, information security, the use of the Internet as a ~~vendor~~commercial medium, the use of data in artificial intelligence and machine learning and data sovereignty requirements are rapidly evolving, extensive, complex and include inconsistencies and uncertainties. Examples of recent and anticipated developments that have or could impact our business include the following:

•The General Data Protection Regulation (“GDPR”), took effect in May 2018 and established several requirements applicable to the handling of personal data of individuals in the European Economic Area (“EEA”). The GDPR is wide-ranging in scope and imposes numerous requirements on companies that process personal data, including imposing accountability obligations requiring data controllers and

Table of Contents

processors to maintain a record of their data processing and implement policies and procedures as part of its mandated privacy governance framework. It also requires data controllers to be transparent and disclose to data subjects how their personal data will be used, establishes rights for ~~government entities, we~~individuals with respect to their personal data, including rights of access and deletion in certain circumstances, imposes limitations on retention of personal data, establishes data breach notification requirements and sets standards for data controllers to demonstrate that they have obtained valid consent for certain data processing activities.

•The GDPR and substantially equivalent legislation in the United Kingdom (“UK”), also imposes strict rules applied to the transfer of personal data out of the EEA, Switzerland and the UK to third countries deemed to lack adequate privacy protections (including the United States), unless an appropriate safeguard is implemented, such as the Standard Contractual Clauses (“SCCs”), approved by the European Commission, or a derogation applies. The Court of Justice of the European Union (“CJEU”), deemed the SCCs valid in July 2020. However, the CJEU ruled that transfers made pursuant to the SCCs and other alternative transfer mechanisms must ~~comply~~be analyzed on a case-by-case basis to ensure European Union (“EU”) standards of data protection are met in the jurisdiction where the data importer is based, and concerns remain about the potential for the SCCs and other mechanisms to face additional challenges. European regulators have issued guidance following the CJEU ruling that imposes significant new requirements on transferring data outside the EEA and Switzerland, including under an approved transfer mechanism. On June 4, 2021, the European Commission issued new SCCs that account for the CJEU’s decision and other developments, which need to be put in place for new contracts involving the transfer of personal data from the EEA and Switzerland to a third country as of September 27, 2021. The UK also has adopted new standard contractual clauses to support personal data transfers out of the UK, which are required to be used in new arrangements as of September 22, 2022. Complying with ~~laws, regulations~~these obligations and applicable guidance could be expensive and time consuming, may require us to modify our data handling policies ~~governing such governmental bodies,~~and procedures and undertake additional measures, including new contractual negotiations, and may ultimately prevent or restrict us from transferring personal data outside the EEA and the UK, which could cause significant business disruption.

•The EU has proposed the Regulation on Privacy and Electronic Communications (“ePrivacy Regulation”), which, if adopted, would impose new obligations on the use of personal data in the context of electronic communications, particularly with respect to online tracking technologies and direct marketing.

•In January 2020, the UK formally left the EU. The UK’s withdrawal from the EU, commonly referred to as “Brexit,” became effective December 31, 2020. The UK has implemented legislation that implements and complements the GDPR, and which provides for the implementation of GDPR requirements, including those related to cross-border data transfer. In June 2021, the European Commission announced a decision of “adequacy” concluding that the UK ensures an equivalent level of data protection to the GDPR, which provides some relief regarding the legality of continued personal data flows from the EEA to the UK. Some uncertainty remains, however, as this adequacy determination must be renewed after four years and may be modified or revoked in the interim. Further, on February 2, 2022, the UK’s Information Commissioner’s Office issued new standard contractual clauses to support personal data transfers out of the UK. These standard contractual clauses became effective March 21, 2022. We cannot predict how UK data protection laws or regulations may develop in the longer term, including those relating to data transfers. We may be required to take steps to ensure the lawfulness of our data transfers and otherwise to address UK data protection law.

•In January 2020, the California Consumer Privacy Act (“CCPA”), took effect, providing California residents increased privacy rights and protections, including the ability to opt out of sales of their ~~cybersecurity practices.~~personal information. Among other things, the CCPA requires covered companies to provide new disclosures to California consumers and afford such consumers new rights with respect to their personal information, including the right to request deletion of their personal information, the right to receive the personal information on record for them, the right to know what categories of personal information generally are maintained about them, as well as the right to opt-out of certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches that result in the loss of personal information. This private right of action may increase the likelihood of, and risks associated with, data breach litigation.

Table of Contents

•In November 2020, California voters also approved a new privacy law, the California Privacy Rights Act (“CPRA”). Effective January 1, 2023, the CPRA imposes additional obligations on covered companies and will significantly modify the CCPA, including by expanding consumers’ rights with respect to certain sensitive personal information. The CPRA also creates a new state agency that will have authority to implement and enforce the CCPA and the CPRA. The effects of the CCPA and the CPRA are significant. They increase our potential exposure to regulatory enforcement and/or litigation and may require us to modify our data collection or processing practices and policies and to incur substantial costs and expenses in an effort to comply. Other U.S. states are considering, and in certain cases have adopted, similar laws, and the U.S. federal government also is contemplating privacy legislation. Recently proposed and enacted state privacy legislation beyond the CCPA and CPRA may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies.

Global governments are considering implementing regulations that would restrict cross-border data processing. Additionally, global governments are considering regulating artificial intelligence, machine learning and other technologies. These and other similar legal and regulatory developments could contribute to legal and economic uncertainty, affect how we design, market, sell and operate our platform and products, how our customers process and share data, how we process, transfer and use data, which could negatively impact demand for our platform and products. We may incur substantial costs to comply with such laws and regulations, to meet the demands of our customers relating to their own compliance with applicable laws and regulations and to establish and maintain internal policies, self-certifications, and third-party certifications supporting our compliance programs. Our customers may bind us to certain obligations pursuant to the GDPR or other laws or regulations relating to privacy, data protection or information security, and we may be or become bound by other contractual obligations relating to privacy, data protection or information security. In addition, any actual or perceived non-compliance with applicable laws, regulations, policies, certifications or contractual or other actual or asserted obligations could result in proceedings, investigations or claims against us by regulatory authorities, customers or others, leading to reputational harm, significant fines, litigation costs and damages. For example, ~~the State of California Office of Information Security Phishing Exercise Standard (SIMM 5320-A), released in October 2020, established specific requirements for California state entities and agencies~~if regulators assert that we have failed to ~~coordinate phishing exercises~~comply with the ~~California Department~~GDPR or the UK’s legislation implementing the GDPR, we may be subject to fines of ~~Technology Office~~up to EUR 20 million (or GBP 17.5 million) or 4% of ~~Information Security~~our worldwide annual revenue, whichever is greater, as well as potential data processing restrictions. Authorities have shown a willingness to impose significant fines and issue orders preventing the ~~California Cybersecurity Integration Center~~processing of personal data on non-compliant businesses. Moreover, individuals can claim damages resulting from infringement of the GDPR and other ~~requirements for execution. Other states~~European and ~~jurisdictions may adopt versions of this standard or consider other new cybersecurity or~~UK data protection ~~measures in~~laws. The GDPR also introduces the ~~future, imposing additional compliance burdens~~right for non-profit organizations to bring claims on ~~us and our customers.~~

~~Generally,~~behalf of data subjects. In addition to the foregoing, an actual or alleged breach of the GDPR or other applicable laws, regulations ~~and policies that govern~~or other actual or asserted obligations related to privacy, data protection or information security could result in regulatory investigations, reputational damage, orders to change our ~~ability to contract with government customers impose added costs~~use of data, enforcement notices, or potential civil claims including class action type litigation.All of these impacts could have a material adverse effect on our business, financial condition and ~~failure by us,~~results of operations.

Table of Contents

contractors, channel partners, agents, intermediaries or other third parties to comply with applicable laws and regulations in the collection of this information also could have negative consequences to us, including reputational harm, government investigations and ~~requirements~~penalties. Although we take precautions to prevent our information collection practices and services from being provided in violation of such laws, our information collection practices and services may have been in the past, and could ~~lead to claims for damages, penalties, termination~~in the future be, provided in violation of ~~contracts, loss of exclusive rights in our intellectual property and temporary suspension or permanent debarment from government contracting. Any~~ such damages, penalties, disruptions or limitations in our ability to do business with the public sector could result in reduced sales of our products, reputational damage, penalties and other sanctions, any of which could harm our reputation, business, financial condition and results of operations.

~~Table of~~ ~~Contents~~

laws.

We are subject to laws and regulations, including governmental export and import controls, sanctions, anti-boycott regulations and anti-corruption laws that could impair our ability to compete in our markets and subject us to liability if we are not in full compliance with applicable laws.

We are subject to laws and regulations, including governmental export controls, that could subject us to liability or impair our ability to compete in our markets. Our products are subject to U.S. export controls, including the U.S. Department of Commerce’s Export Administration Regulations, and we and our employees, representatives, contractors, agents, intermediaries and other third parties are also subject to various economic and trade sanctions regulations administered by the U.S. Treasury Department’s Office of Foreign Assets ~~Control.~~Control (“OFAC”). Furthermore, U.S. export control laws and economic sanctions prohibit the export and provision of certain cloud-based solutions to, and other transactions and dealings with, countries, governments, entities and persons targeted by U.S. sanctions.

In connection with our March 1, 2021 acquisition of MediaPro Holdings, LLC (“MediaPro”), we identified potential violations related to limited dealings by MediaPro ~~Holdings, LLC~~ in 2016 with Sudatel, a Sudanese telecommunications and internet service provider. As a condition of closing, MediaPro ~~Holdings, LLC~~ filed voluntary self-disclosures with the ~~Office of Foreign Assets Control~~OFAC and the Office of Antiboycott Compliance ~~both~~(“OAC”). OFAC issued us a cautionary letter but did not pursue any penalties or take enforcement action. As of ~~which remain~~the date of this Quarterly Report on Form 10-Q, the OAC case is pending. Although we have technical controls, policies and procedures in place designed to ensure our compliance, there is no guarantee that we will not inadvertently provide our products and services, including our publicly available online free tools, to persons targeted by U.S. sanctions, despite our reasonable efforts to prevent it.

If we or our employees, representatives, contractors, channel partners, agents, intermediaries or other third parties fail to comply with these laws and regulations, we could be subject to civil or criminal penalties, including the possible loss of export privileges and fines. We may also be adversely affected through reputational harm, loss of access to certain markets, government investigations or otherwise. Obtaining the necessary authorizations including any required license for a particular transaction may be time-consuming, is not guaranteed and may result in the delay or loss of sales opportunities.

Various countries regulate the export and import of certain encryption technology, including through export and import permit and license requirements, and have enacted laws that could limit our ability to distribute our products or could limit our customers’ ability to implement our products in those countries. Changes in our products or changes in export and import regulations may create delays in the introduction of our products into international markets, prevent our customers with international operations from deploying our products globally or, in some cases, prevent the export or import of our products to certain countries, governments, entities or persons altogether. Any change in export or import regulations, economic sanctions or related legislation, shift in the enforcement or scope of existing regulations or change in the countries, governments, entities or persons or technologies targeted by such regulations could result in decreased use of our products by, or in our decreased ability to export or sell our products to, existing or potential customers with international operations. Any decreased use of our products or limitation on our ability to export or sell our products would likely adversely affect our business, financial condition and results of operations.

We are also subject to the FCPA, the UK Bribery Act 2010 (the “Bribery Act”) and other anti-corruption, ~~sanctions,~~ anti-bribery, anti-money laundering and similar laws in the United States and other countries in which we conduct activities. Anti-corruption and anti-bribery laws, which have been enforced aggressively and are interpreted broadly, prohibit companies and their employees, agents, intermediaries and other third parties from promising, authorizing, making or offering improper payments or other benefits to government officials and others in the private sector. We leverage third parties, including intermediaries, agents and channel partners, to conduct our business in the United States and abroad to sell subscriptions to our products and to collect information about cyber threats. We and these

Table of Contents

third parties may have direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities and we may be held liable for the corrupt or other illegal activities of these third-party business partners and intermediaries, our employees, representatives, contractors, channel partners, agents, intermediaries and other third parties, even if we do not explicitly authorize such activities. While we have policies and procedures to address compliance with the FCPA, Bribery Act and other anti-corruption, sanctions, anti-bribery, anti-money laundering and similar laws, we cannot assure you that they will be effective, or that all of our employees, representatives, contractors, channel partners, agents, intermediaries or other third parties have taken, or will not take, actions in violation of our policies and applicable law, for which we may be ultimately held responsible. As we

~~Table of~~ ~~Contents~~

increase our international sales and business, our risks under these laws may increase. Noncompliance with these laws could subject us to investigations, severe criminal or civil sanctions, settlements, prosecution, loss of export privileges, suspension or debarment from U.S. government contracts, other enforcement actions, disgorgement of profits, significant fines, damages, other civil and criminal penalties or injunctions, whistleblower complaints, adverse media coverage and other consequences. Any investigations, actions or sanctions could harm our reputation, business, financial condition and results of operations.

Failure to comply with laws and regulations applicable to our business could subject us to fines and penalties.

Our ~~ability~~business is subject to ~~use our net operating loss carryforwards~~laws, rules, and ~~certain other tax attributes may be limited.~~

~~We have incurred substantial losses during our history, do~~regulations promulgated by various federal, state, local and foreign governmental agencies, including, but not expect to become profitable in the near future, and may never achieve profitability. Unused U.S. federal net operating losses (“NOLs”), may be carried forward to offset future taxable income, if any, until such unused NOLs expire. Under the Tax Cuts and Jobs Act, or the Tax Act, enacted in 2017, as modified by the Coronavirus Aid, Relief, and Economic Security Act, or the CARES Act, enacted on March 27, 2020, U.S. federal NOLs incurred in taxable years beginning after December 31, 2017, can be carried forward indefinitely, but the deductibility of such U.S. federal NOLs in taxable years beginning after December 31, 2020 is limited to, ~~80% of taxable income.~~agencies responsible for monitoring and enforcing privacy, data protection and information security laws and regulations, employment and labor laws, workplace safety, product safety, environmental laws, consumer protection laws, anti-bribery laws, import and export controls, economic sanctions, federal securities laws and tax laws and regulations. Our ~~NOLs~~business may also be subject, indirectly, to ~~limitations under state law. For example, California recently enacted legislation suspending the use of NOLs for taxable years 2020, 2021 and 2022 for many taxpayers.~~

As of December 31, 2020, we had federal and state NOL carryforwards of $41.3 million and $33.8 million, respectively, all of which were incurred in taxable years beginning after December 31, 2017. The federal NOLs can be carried forward indefinitely and the state NOLs will begin to expire in 2022, if not utilized.

In addition, under Section 382 of the Internal Revenue Code (the “Code”), if a corporation undergoes an “ownership change,” generally defined as a greater than 50 percentage point change (by value) in its equity ownership over a three-year period, the corporation’s ability to use its pre-change NOL carryforwards and other pre-change tax attributes, such as research tax credits, to offset its post-change income may be limited. Future changes in laws, rules and regulations that may affect our stock ownership, some which are outside of our control, could result in an ownership change under Section 382 of the Code. If our existing NOLs are subject to limitations arising from an ownership change,service providers’ businesses, as well, negatively impacting our ability to ~~utilize NOLs could be limited by Section 382~~continue offering any of the Code. As a result, if we earn net taxable income, our ability to use our pre-change NOL carryforwards to offset U.S. federal taxable income may be subject to limitations, which could potentially result in increased future tax liability to us.

There is also a risk that due to regulatory changes, such as suspensions on the use of NOLs and tax credits by certain jurisdictions, including in order to raise additional revenue to help counter the fiscal impact from the COVID-19 pandemic, possibly with retroactive effect, or other unforeseen reasons, our existing NOLs and tax credits could expire or otherwise be unavailable to offset future income tax liabilities. A temporary suspension of the use of certain NOLs and tax credits has been enacted in California, and other states may enact suspensions as well. For these reasons, we may not be able to realize a tax benefit from the use of our NOLs and tax credits.

~~Changes in tax laws or regulations in the various tax jurisdictions we are subject to that are applied adversely to us or our customers could increase the costs of our products and harm our business.~~

New income, sales, use or other tax laws, statutes, rules, regulations or ordinances could be enacted at any time. Those enactments could harm our domestic and international business operations, and our business and financial performance. Further, existing tax laws, statutes, rules, regulations or ordinances could be interpreted, changed, modified or applied adversely to us. These events could require us or our customers to pay additional tax amounts on a prospective or retroactive basis, as well as require us or our customers to pay fines and/or penalties and interest for past amounts deemed to be due. If we raise our prices to offset the costs of these changes, existing and potential future customers may elect not to purchase our products in the future. Additionally, new, changed, modified or newly interpreted or applied tax laws could increase our customers’ and our compliance, operating and other costs, as well as the costs of our products. Further, these events could decrease the capital we have available to operate our business. Any or all of these events could harm our business, financial condition and results of operations.

~~Table of~~ ~~Contents~~

Our business may be subject to additional obligations to collect and remit sales tax and other taxes, and we may be subject to tax liability for past sales. Any successful action by state, foreign or other authorities to collect additional or past sales tax could harm our business.

States and some local taxing jurisdictions have differing rules and regulations governing sales and use taxes, and these rules and regulations are subject to varying interpretations that may change over time. In particular, the applicability of sales taxes to our platform and products in various jurisdictions is unclear. It is possible that we could face sales tax audits and that our liability for these taxes could exceed our estimates as state tax authorities could still assert that we are obligated to collect additional amounts as taxes from our customers and remit those taxes to those authorities. We could also be subject to audits in states and international jurisdictions for which we have not accrued tax liabilities. A successful assertion that we should be collecting additional sales or other taxes on our products in jurisdictions where we have not historically done so and do not accrue for sales taxes could result in substantial tax liabilities for past sales, discourage customers from purchasing our products or otherwise harm our business, financial condition and results of operations.

We file sales tax returns in certain states within the United States as required by law. We do not collect sales or other similar taxes in other states and many of such states do not apply sales or similar taxes to the products that we provide. However, one or more states or foreign authorities could seek to impose additional sales, use or other tax collection and record-keeping obligations on us or may determine that such taxes should have, but have not been, paid by us. Liability for past taxes may also include substantial interest and penalty charges. Any successful action by state, foreign or other authorities to compel us to collect and remit sales, use or other taxes, either retroactively, prospectively or both, could harm our business, financial condition and results of operations.

~~We are a multinational organization faced with increasingly complex tax issues in many jurisdictions, and we could be obligated to pay additional taxes in various jurisdictions.~~

As a multinational organization, we may be subject to taxation in several jurisdictions around the world with increasingly complex tax laws, the application of which can be uncertain. The amount of taxes we pay in these jurisdictions could increase substantially as a result of changes in the applicable tax principles, including increased tax rates, new tax laws or revised interpretations of existing tax laws and precedents, which could have a material adverse effect on our liquidity and results of operations. Furthermore, one or more jurisdictions in which we do not believe we are currently subject to tax payment, withholding or filing requirements could assert that we are subject to such requirements. Any of these claims or assertions could have a material impact on us and the results of our operations.

~~If we fail to enhance our brand cost-effectively, our ability to expand our customer base will be impaired and our business, financial condition and results of operations may suffer.~~

We believe that developing and maintaining awareness of our brand in a cost-effective manner is critical to achieving widespread acceptance of our existing and future products and is an important element in attracting new customers. Furthermore, we believe that the importance of brand recognition will increase as competition in our market increases. Successful promotion of our brand will depend largely on the effectiveness of our marketing efforts and on our ability to provide reliable and useful products at competitive prices. In the past, our efforts to build our brand have involved significant expenses. Brand promotion activities may not yield increased revenue, and even if they do, any increased revenue may not offset the expenses we incur in building our brand. If we fail to successfully promote and maintain our brand, or incur substantial expenses in an unsuccessful attempt to promote and maintain our brand, we may fail to attract new customers or retain our existing customers to the extent necessary to realize a sufficient return on our brand-building efforts, and our business, financial condition and results of operations could suffer.

~~Catastrophic events may disrupt our business.~~

Natural disasters or other catastrophic events may cause damage or disruption to our operations, international commerce and the global economy, and thus could harm our business. We have a large employee presence in Clearwater, Florida and the east coast of the United States is often subject to seasonal hurricanes. In the event of a major hurricane, earthquake or other catastrophic event such as fire, power loss, telecommunications failure, cyber-

~~Table of~~ ~~Contents~~

attack, war or terrorist attack, we may be unable to continue our operations and may endure system interruptions, reputational harm, delays in our application development, lengthy interruptions in our products, breaches of data security and loss, alteration or compromise of critical data, all of which could harm our business, financial condition and results of operations. In addition, the insurance we maintain may not be adequate to cover our losses resulting from disasters or other business interruptions.

~~Our Revolving Credit Facility contains financial covenants and other restrictions on our actions that may limit our operational flexibility or otherwise adversely affect our results of operations.~~

The terms of our Revolving Credit Facility include a number of covenants that limit our ability and our subsidiaries’ ability to, among other things, incur additional indebtedness, grant liens, merge or consolidate with other companies or sell substantially all of our assets, pay dividends, make redemptions and repurchases of stock, make investments, loans and acquisitions, or engage in transactions with affiliates. The terms of our Revolving Credit Facility may restrict our current and future operations and could adversely affect our ability to finance our future operations or capital needs. In addition, complying with these covenants may make it more difficult for us to successfully execute our business strategy, including potential acquisitions, and compete against companies which are not subject to such restrictions.

A failure by us to comply with the covenants or payment requirements specified in our credit agreement could result in an event of default under the agreement, which would give the lenders the right to terminate their commitments to provide additional loans under our Revolving Credit Facility and to declare all borrowings outstanding, together with accrued and unpaid interest and fees, to be immediately due and payable. If the debt under our Revolving Credit Facility were to be accelerated, we may not have sufficient cash or be able to borrow sufficient funds to refinance the debt or sell sufficient assets to repay the debt, which could immediately adversely affect our business, cash flows, results of operations, and financial condition. Even if we were able to obtain new financing, it may not be on commercially reasonable terms or on terms that are acceptable to us. As of June 30, 2021, there were no amounts outstanding under the Revolving Credit Facility.

~~Risks Related to Our Intellectual Property~~

~~Our results of operations may be harmed if we are subject to a protracted infringement claim or a claim that results in a significant damage award.~~

A key tenet of our security awareness platform and products is the ability for our customers to perform simulated social engineering attacks on their users as part of our comprehensive training program. These social engineering attacks, typically in the form of a simulated phishing email, often use actual third-party names, logos, marks and other content in order to enhance the effectiveness of the simulation. In addition, we register domain names containing third-party names or marks, or variations thereof, to be used in connection with our simulated phishing emails. Although we do not believe that the use of such names, logos, marks and other content for our customers’ internal training purposes infringes upon the trademark rights or other intellectual property rights of others, some third parties have objected to such use of training materials. These third parties have sent us requests or demands to remove their names, logos, marks and other content from our platform and products, and others have alleged that such use infringes upon their trademark rights or copyrights or otherwise creates actionable claims under state law. Also, some third parties have sent us privacy service requests or demands to cease use of and transfer domains containing their names, marks or variations thereof. To date, we have taken a case-by-case approach and worked to resolve all brand-owner demands directly with the individual brand owners. Although no legal actions have resulted from historical demands, there is no assurance that legal actions will not result in the future from objecting brand owners. Additionally, as knowledge of our business expands, we may experience such demands with increasing frequency. Such legal actions, regardless of their merit, could require us to expend significant financial resources and attention by management and other personnel, result in injunctions against us that prevent us from using third-party names, logos, marks and other content on our platform and products, require us to pay monetary awards to third parties and/or transfer domain name registrations.

Furthermore, because any legal actions could involve novel questions of law regarding simulated phishing activities for which there is no or very little precedent, and, because the outcomes of any such actions could depend

~~Table of~~ ~~Contents~~

on questions of specific state laws that vary from state to state, the outcomes of any such legal proceedings are uncertain and could vary depending on the jurisdiction in which an action is brought. Any such outcomes could adversely impact our relationship with our customers, including by prompting them to discontinue their business relationship with us.

From time to time, third parties have in the past and may in the future assert claims of infringement, misappropriation and other violations of intellectual property rights against us or our customers, with whom our agreements may obligate us to indemnify against these claims. Successful claims of infringement by a third party could prevent us from offering certain products or features, require us to develop alternate, non-infringing technology, which could require significant time and during which we could be unable to continue to offer our affected products or ~~solutions, require~~solutions. In certain jurisdictions, such laws, rules and regulations may be more stringent than they are in the United States. Actual or alleged noncompliance by us, ~~to obtain a license, which may not be available on reasonable terms or at all, or force us to pay substantial damages, royalties,~~our employees, representatives, contractors, channel partners, agents, intermediaries or other ~~fees. The occurrence~~third parties with applicable laws, regulations and requirements could subject us to:

•investigations, enforcement actions and sanctions;

•mandatory changes to our platform, products or business practices;

•disgorgement of ~~any~~profits, fines and damages;

•civil and criminal penalties or injunctions;

•claims for damages by our customers or channel partners;

•termination of ~~these results could also materially adversely affect our business, financial condition and results~~contracts;

•loss of ~~operations.~~

If we fail to adequately protect our proprietary rights, our competitive position could be impaired and we may lose valuable assets, generate reduced revenue and incur costly litigation to protect our rights.

•temporary or permanent debarment from sales to government organizations.

In addition, responding to any action will ~~not be able to protect our intellectual property if we~~likely result in a significant diversion of management’s attention and resources and an increase in professional fees. If any governmental sanctions or enforcement actions are ~~unable to enforce our rights~~imposed, or if we do not ~~detect unauthorized use of our intellectual property. Despite our precautions, it may be~~prevail in any possible for unauthorized third parties to copy our products and use information that we regard as proprietary to create products that compete with ours. Some license provisions protecting against unauthorized use, copying, transfer and disclosure of our products may be unenforceable under the laws of certain jurisdictions and foreign countries. Further, the laws of some countries do not protect proprietary rights to the same extent as the laws of the United States, and mechanisms for enforcement of intellectual property rights in some foreign countries may be inadequate. To the extent we expand our international activities, our exposure to unauthorized use of our products and proprietary information may increase. Accordingly, despite our efforts, we may be unable to prevent third parties from infringing uponcivil or ~~misappropriating our technology and intellectual property.~~

We rely in part on trade secrets, proprietary know-how and other confidential information to maintain our competitive position. Although we enter into confidentiality and invention assignment agreements with our employees and consultants and enter into confidentiality agreements with the parties with whom we have strategic relationships and business alliances, no assurance can be given that these agreements will be effective in controlling access to and distribution of our products and proprietary information. Further, these agreements do not prevent our competitors from independently developing technologies that are substantially equivalent or superior to our products.

To protect our intellectual property rights, we may be required to spend significant resources to monitor and protect these rights. Litigation may be necessary in the future to enforce our intellectual property rights and to protect our trade secrets. Suchcriminal litigation, could be costly, time consuming and distracting to management and could result in the impairment or loss of portions of our intellectual property. Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims and countersuits attacking the validity and enforceability of our intellectual property rights. Our inability to protect our proprietary technology against unauthorized copying or use, as well as any costly litigation or diversion of our management’s attention and resources, could delay further sales or the implementation of our products, impair the functionality of our products, delay introductions of new products, result in our substituting inferior or more costly technologies into our products or injure our reputation. In addition, we may be required to license additional technology from third parties to develop and market new products, and we cannot assure you that we will be able to license that technology on commercially reasonable terms or at all, and our inability to license this technology could harm our ability to compete.

~~Table of~~ ~~Contents~~

~~We use open source software in our products, which could negatively affect our ability to offer our products and subject us to litigation or other actions.~~

We use open source software in our products and may use more open source software in the future. From time to time, there have been claims challenging the ownership of open source software against companies that incorporate open source software into their products. However, the terms of many open source licenses have not been interpreted by U.S. courts, and there is a risk that these licenses could be construed in a way that could impose unanticipated conditions or restrictions on our ability to commercialize our products. As a result, we could be subject to lawsuits by parties claiming ownership of what we believe to be open source software. Litigation could be costly for us to defend, have a negative effect on our business, financial condition and results of operations or require us to devote additional research and development resources to change our products. In addition, if we were to combine our proprietary software products with open source software in a certain manner, we could, under certain of the open source licenses, be required to release the source code of our proprietary software to the public. This would allow our competitors to create similar products with less development effort and time. If we inappropriately use open source software, or if the license terms for open source software that we use change, we may be required to re-engineer our products, incur additional costs, discontinue the sale of some or all of our products or take other remedial actions.

In addition to risks related to license requirements, usage of open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or assurances of title or controls on origin of the software. In addition, many of the risks associated with usage of open source software, such as the lack of warranties or assurances of title, cannot be eliminated, and could, if not properly addressed, negatively affect our business. We have established processes to help alleviate these risks, including a review process for screening requests from our development organizations for the use of open source software, but we cannot be sure that all of our use of open source software is in a manner that is consistent with our current policies and procedures, or will not subject us to liability.

~~We incorporate technology from third parties into our platform and products, and our inability to obtain or maintain rights to the technology could harm our business.~~

We license software and other technology from third parties that incorporate into or integrate with, our platform and products. We cannot be certain that our licensors are not infringing on the intellectual property rights of third parties or that our licensors have sufficient rights to the licensed intellectual property in all jurisdictions in which we may sell our platform and products. In addition, many licenses are non-exclusive, and therefore our competitors may have access to the same technology licensed to us. Some of our agreements with our licensors may be terminated for convenience by them, or otherwise provide for a limited term. If we are unable to continue to license any of this technology for any reason, our ability to develop and sell our platform and products containing such technology could be harmed. Similarly, if we are unable to license necessary technology from third parties now or in the future, we may be forced to acquire or develop alternative technology, which we may be unable to do in a commercially feasible manner or at all, and we may be required to use alternative technology of lower quality or performance standards. This could limit and delay our ability to offer new or competitive products and increase our costs of production. As a result, our business and results of operations could be significantly harmed. Additionally, as part of our longer-term strategy, we plan to open our platform and products to third-party developers and applications to further extend their functionality. We cannot be certain that such efforts to grow our business will be successful.

~~Risks Related to Ownership of Our Class A Common Stock~~

The dual-class structure of our common stock has the effect of concentrating voting control with those stockholders who held our capital stock prior to the completion of our IPO, which will limit your ability to influence the outcome of important transactions, including a change in control.

~~Table of~~ ~~Contents~~

submitted to our stockholders for approval until the earlier of the fifth anniversary of the filing and effectiveness of our amended and restated certificate of incorporation in connection with the IPO or the affirmative vote of the holders of 66-2/3% of the voting power of our outstanding Class B common stock. This concentrated control will limit or preclude your ability to influence corporate matters, including the election of directors, amendments of our organizational documents, and any merger, consolidation, sale of all or substantially all of our assets or other major corporate transactions requiring stockholder approval. In addition, this may prevent or discourage unsolicited acquisition proposals or offers for our capital stock that you may feel are in your best interest as one of our stockholders.

Future transfers by holders of shares of our Class B common stock will generally result in those shares converting to Class A common stock, subject to limited exceptions, including but not limited to, transfers effected for estate planning purposes and transfers among affiliates, to the extent the transferee continues to remain an affiliate. The conversion of Class B common stock to Class A common stock will have the effect, over time, of increasing the relative voting power of those individual holders of Class B common stock who retain their shares in the long term.

~~The market price of our Class A common stock may be volatile, and you could lose all or part of your investment.~~

The market price of our Class A common stock could be subject to fluctuations in response to various factors, some of which are beyond our control and could cause you to lose all or part of your investment in our Class A common stock. Factors that could cause fluctuations in the market price of our Class A common stock include the following:

•~~price and volume fluctuations in the overall stock market from time to time;~~

•~~volatility in the market prices and trading volumes of technology stocks;~~

•~~changes in operating performance and stock market valuations of other technology companies generally, or those in our industry in particular;~~

•~~sales of shares of our Class A common stock by us or our stockholders, as well as the anticipation of lock-up releases associated with our IPO;~~

•failure of securities analysts to maintain coverage of us, changes in financial estimates by securities analysts who follow our company or our failure to meet these estimates or the expectations of investors;

•~~the financial projections we may provide to the public, any changes in those projections or our failure to meet those projections;~~

•~~announcements by us or our competitors of new offerings or platform features;~~

•~~the public’s reaction to our press releases, other public announcements and filings with the SEC;~~

•~~rumors and market speculation involving us or other companies in our industry;~~

•~~short selling of our Class A common stock or related derivative securities;~~

•~~actual or anticipated changes or fluctuations in our results of operations;~~

•~~actual or anticipated developments in our business, our competitors’ businesses or the competitive landscape generally;~~

•~~announced or completed acquisitions of businesses, offerings or technologies by us or our competitors;~~

•~~developments or disputes concerning our intellectual property or other proprietary rights;~~

~~Table of~~ ~~Contents~~

•~~litigation involving us, our industry or both, or investigations by regulators into our operations or those of our competitors;~~

•~~new laws or regulations or new interpretations of existing laws or regulations applicable to our business;~~

•~~system failures or actual or perceived privacy or security incidents;~~

•~~changes in accounting standards, policies, guidelines, interpretations or principles;~~

•~~any significant change in our management; and~~

•~~general economic conditions and slow or negative growth of our markets.~~

In addition, the stock market has experienced substantial price and volume volatility that is often seemingly unrelated to the operating performance of particular companies. These broad market fluctuations may cause the trading price of our Class A common stock to decline. Furthermore, the trading price of our Class A common stock may be adversely affected by third-parties trying to drive down the price. Short sellers and others, some of whom post anonymously on social media, may be positioned to profit if the trading price of our Class A common stock declines and their activities can negatively affect the trading price of our Class A common stock. In addition, in the past, following periods of volatility in the overall market and the market price of a particular company’s securities, securities class action litigation has often been instituted against these companies. This litigation, if instituted against us, would result in substantial costs and a diversion of our management’s attention and resources.

~~Sales, directly or indirectly, of shares of our Class A common stock by existing equityholders could cause our stock price to decline.~~

Sales, directly or indirectly, of a substantial number of shares of our Class A common stock, or the public perception that these sales might occur, could depress the market price of our Class A common stock and could impair our ability to raise capital through the sale of additional equity securities. Many of our existing equityholders have substantial unrecognized gains on the value of the equity they hold, and may take, or attempt to take, steps to sell, directly or indirectly, their shares or otherwise secure, or limit the risk to, the value of their unrecognized gains on those shares.

Our executive officers, directors and the holders of substantially all of our capital stock and securities convertible into or exchangeable for our capital stock entered into lock-up agreements with the underwriters of our IPO under which they have agreed, subject to specific exceptions, not to sell any of our capital stock for up to 180 days following the date of the Prospectus. However, with respect to employees and other stockholders (excluding directors and executive officers), 15% of the holder’s shares of common stock acquired more than 180 days prior to the date of the Prospectus will be released from the lock-up agreements on the day that is two trading days after the date that the closing price of our Class A common stock exceeds 133% of the initial public offering price per share for at least 10 trading days in the 15 consecutive trading day period immediately following the 90th day after the date of the Prospectus (the “Early Lock-Up Expiration Date”); provided that, if the Early Lock-Up Expiration Date would occur when we are in a blackout period or within five trading days prior to a blackout period, the Early Lock-Up Expiration Date will be delayed until immediately prior to the opening of trading on the second trading day following the first date that we are no longer in a blackout period. Notwithstanding the foregoing, in the event that at least 120 days have elapsed since the date of the Prospectus and the lock-up period is set to expire during a blackout period or five trading days prior to a blackout period, then the lock-up period will end 10 trading days prior to the commencement of the blackout period; provided that we have publicly released our earnings for the second quarter of 2021.

As these lock-up restrictions end, the market price of the Class A common stock could drop significantly if the holders of these restricted shares sell them or are perceived by the market as intending to sell them.

In addition, we filed a registration statement to register shares reserved for future issuance under our equity compensation plans. As a result, subject to the satisfaction of applicable exercise periods and the expiration or waiver of the lock-up agreements referred to above, the shares issued upon exercise of outstanding stock options will

~~Table of~~ ~~Contents~~

~~be available for immediate resale in the United States in the open market. If a large number of these shares are sold in the public market, the sales could reduce our trading price.~~

Further, record holders of our securities are typically the parties to the lock-up agreements, while holders of beneficial interests in our shares who are not also record holders in respect of such shares are not typically subject to any such agreements or other similar restrictions. Accordingly, we believe that holders of beneficial interests who are not record holders and are not bound by lock-up agreements could enter into transactions with respect to those beneficial interests that negatively impact our stock price. In addition, to the extent an equityholder does not comply with or the underwriters are unable to enforce the terms of a lock-up agreement, such equityholder may be able to sell, short sell, transfer, hedge, pledge or otherwise dispose of or attempt to sell, short sell, transfer, hedge, pledge or otherwise dispose of, their equity interests at any time, which could negatively impact the price of our Class A common stock.

~~The issuance of additional stock in connection with financings, acquisitions, investments, our equity incentive plans or otherwise will dilute all other stockholders.~~

Our amended and restated certificate of incorporation authorizes us to issue up to 1,000,000,000 shares of Class A common stock, up to 500,000,000 shares of Class B common stock and up to 100,000,000 shares of preferred stock with such rights and preferences as may be determined by our board of directors. Subject to compliance with applicable rules and regulations, we may issue shares of Class A common stock or securities convertible into shares of our Class A common stock from time to time in connection with a financing, acquisition, investment, our equity incentive plans, or otherwise. Any such issuance could result in substantial dilution to our existing stockholders and cause the market price of our Class A common stock to decline.

~~If we fail to maintain an effective system of internal controls, our ability to produce timely and accurate financial statements or comply with applicable regulations could be impaired.~~

As a public company, we are subject to the reporting requirements of the Exchange Act, the Sarbanes-Oxley Act of 2002 (the “Sarbanes-Oxley Act”), and the rules and regulations of Nasdaq. We expect that the requirements of these rules and regulations will increase our legal, accounting and financial compliance costs; make some activities more difficult, time-consuming and costly; and place significant strain on our personnel, systems and resources.

The Sarbanes-Oxley Act requires, among other things, that we maintain effective disclosure controls and procedures and internal control over financial reporting. We are continuing to develop and refine our disclosure controls, internal control over financial reporting and other procedures that are designed to ensure information required to be disclosed by us in the reports that we will file with the SEC is recorded, processed, summarized and reported within the time periods specified in SEC rules and forms, and information required to be disclosed in reports under the Exchange Act is accumulated and communicated to our principal executive and financial officers.

Any failure to develop or maintain effective controls, or any difficulties encountered in their implementation or improvement, could harm our operating results or cause us to fail to meet our reporting obligations and may result in a restatement of our financial statements for prior periods. Any failure to implement and maintain effective internal controls also could adversely affect the results of periodic management evaluations and annual independent registered public accounting firm attestation reports regarding the effectiveness of our internal control over financial reporting that we are required to include in our periodic reports we will file with the SEC under Section 404 of the Sarbanes-Oxley Act. Ineffective disclosure controls and procedures and internal control over financial reporting could also cause investors to lose confidence in our reported financial and other information, which would likely have a negative effect on the market price of our Class A common stock.

In order to maintain and improve the effectiveness of our disclosure controls and procedures and internal control over financial reporting, we have expended and anticipate we will continue to expend significant resources, including accounting-related costs, and provide significant management oversight. Any failure to maintain the adequacy of our internal controls, or consequent inability to produce accurate financial statements on a timely basis, could increase our operating costs and could materially impair our ability to operate our business. If our internal controls are perceived as inadequate or we are unable to produce timely or accurate financial statements, investors

~~Table of~~ ~~Contents~~

~~may lose confidence in our operating results and our stock price could decline. In addition, if we are unable to continue to meet these requirements, we may not be able to remain listed on Nasdaq.~~

We are not currently required to comply with the SEC rules that implement Sections 302 and 404 of the Sarbanes-Oxley Act, and we are therefore not required to make a formal assessment of the effectiveness of our internal controls over financial reporting for that purpose. As a public company, we are required to comply with certain of these rules, which require management to certify financial and other information in our quarterly and annual reports and provide an annual management report on the effectiveness of our internal control over financial reporting commencing with our second Annual Report on Form 10-K. To comply with the requirements of being a public company, we need to undertake various actions, such as implementing new internal controls and procedures and hiring accounting or internal audit staff.

Our independent registered public accounting firm is not required to formally attest to the effectiveness of our internal control over financial reporting until after we are no longer an emerging growth company. At such time, our independent registered public accounting firm may issue a report that is adverse in the event it is not satisfied with the level at which our controls are documented, designed or operating.

We are an “emerging growth company” and we cannot be certain if the reduced disclosure requirements applicable to emerging growth companies will make our Class A common stock less attractive to investors.

For so long as we remain an “emerging growth company” as defined in the JOBS Act, we may take advantage of certain exemptions from various requirements that are applicable to public companies that are not “emerging growth companies,” including, but not limited to, not being required to comply with the auditor attestation requirements of Section 404 of the Sarbanes-Oxley Act, reduced disclosure obligations regarding executive compensation in our periodic reports and proxy statements and exemptions from the requirements of holding a nonbinding advisory vote on executive compensation and stockholder approval of any golden parachute payments not previously approved. We may take advantage of these exemptions until we are no longer an emerging growth company. We would cease to be an emerging growth company upon the earliest to occur of: (i) the first fiscal year following the fifth anniversary of our IPO; (ii) the first fiscal year after our annual gross revenue is $1.07 billion or more; (iii) the date on which we have, during the previous three-year period, issued more than $1.0 billion in non-convertible debt securities; or (iv) the date we qualify as a “large accelerated filer,” which means the end of any fiscal year in which the market value of our common stock held by non-affiliates exceeded $700.0 million as of the end of the second quarter of that fiscal year. We cannot predict if investors will find our Class A common stock less attractive because we may rely on these exemptions. If some investors find our Class A common stock less attractive as a result, there may be a less active trading market for our Class A common stock and our stock price may be more volatile.

If securities or industry analysts do not publish research or publish inaccurate or unfavorable research about us, our business or our market, or if they change their recommendations regarding our Class A common stock adversely, the market price and trading volume of our Class A common stock could decline.

The trading market for our Class A common stock depends, in part, on the research and reports that securities or industry analysts publish about us, our business, our market or our competitors. The analysts’ estimates are based upon their own opinions and are often different from our estimates or expectations. If any of the analysts who cover us change their recommendation regarding our Class A common stock adversely, provide more favorable relative recommendations about our competitors or publish inaccurate or unfavorable research about our business, the price of our securities would likely decline. If few securities analysts commence coverage of us, or if one or more of these analysts cease coverage of us or fail to publish reports on us regularly, we could lose visibility in the financial markets and demand for our securities could decrease, which could cause the price and trading volume of our Class A common stock to decline.

~~We do not intend to pay dividends for the foreseeable future.~~

~~Table of~~ ~~Contents~~

contains restrictions on our ability to pay dividends. As a result, stockholders must rely on sales of their Class A common stock after price appreciation as the only way to realize any future gains on their investment.

~~The requirements of being a public company may strain our resources, divert management’s attention and affect our ability to attract and retain qualified board members.~~

As a public company, we are subject to the reporting and corporate governance requirements of the Exchange Act, the listing requirements of Nasdaq and other applicable securities rules and regulations, including the Sarbanes-Oxley Act and the Dodd-Frank Wall Street Reform and Consumer Protection Act. Compliance with these rules and regulations will increase our legal and financial compliance costs, make some activities more difficult, time-consuming or costly and increase demand on our systems and resources, particularly after we are no longer an “emerging growth company” as defined in the JOBS Act. Among other things, the Exchange Act requires that we file annual, quarterly and current reports with respect to our business, financial condition and results of operations and maintain effective disclosure controls and procedures and internal control over financial reporting.

In order to improve our disclosure controls and procedures and internal control over financial reporting to meet this standard, significant resources and management oversight may be required. As a result, management’s attention may be diverted from other business concerns, which could harm our business, financial condition and results of operations. Although we have already hired additional personnel to help comply with these requirements, we may need to further expand our legal and finance departments in the future, which will increase our costs and expenses.

In addition, changing laws, regulations and standards relating to corporate governance and public disclosure are creating uncertainty for public companies, increasing legal and financial compliance costs and making some activities more time-consuming. These laws, regulations and standards are subject to varying interpretations, in many cases due to their lack of specificity, and, as a result, their application in practice may evolve over time as new guidance is provided by regulatory and governing bodies. This could result in continuing uncertainty regarding compliance matters and higher costs necessitated by ongoing revisions to disclosure and governance practices. We intend to invest resources to comply with evolving laws, regulations and standards, and this investment may result in increased general and administrative expense and a diversion of management’s time and attention from revenue-generating activities to compliance activities. If our efforts to comply with new laws, regulations and standards differ from the activities intended by regulatory or governing bodies, regulatory authorities may initiate legal proceedings against us and our business and prospects may be harmed. As a result of disclosure of information in the filings required of a public company, our business, financial condition and results of operations will become more visible, which may result in threatened or actual litigation, including by competitors and other third parties. If such claims are successful, our business, financial condition and results of operations could be ~~materially harmed,~~adversely affected.

Sales to government entities are subject to a number of challenges and ~~even if~~risks.

A number of our customers are U.S., state or foreign government entities. Such entities may demand contract terms that are less favorable than standard arrangements with private sector customers and may have statutory, contractual or other legal rights to terminate contracts with us or our partners for convenience or for other reasons. Generally, the laws, regulations and policies that govern our ability to contract with government customers impose

Table of Contents

added costs on our business, and failure by us, our employees, representatives, contractors, channel partners, agents, intermediaries or other third parties to comply with applicable regulations and requirements could lead to claims for damages, penalties, termination of contracts, loss of exclusive rights in our intellectual property and temporary suspension or permanent debarment from government contracting. Any such damages, penalties, disruptions or limitations in our ability to do ~~not~~business with the public sector could result in ~~litigation or are resolved in our favor, these claims, and the time and resources necessary to resolve them, could divert the resources~~reduced sales of our ~~management~~products, reputational damage, penalties and ~~materially~~other sanctions, any of which could harm our reputation, business, financial condition and results of operations.

In addition, as a vendor for government entities, we must comply with laws, regulations and policies governing such governmental bodies, including those related to their cybersecurity practices. For example, the State of California Office of Information Security Phishing Exercise Standard (SIMM 5320-A), released in October 2020, established specific requirements for California state entities and agencies to coordinate phishing exercises with the California Department of Technology Office of Information Security and the California Cybersecurity Integration Center and other requirements for execution. Other states and jurisdictions may adopt versions of this standard or consider other new cybersecurity or data protection measures in the future, imposing additional compliance burdens on us and our customers.

Delaware law and provisions in our amended and restated certificate of incorporation and amended and restated bylaws could make a merger, tender offer or proxy contest difficult, thereby depressing the market price of our Class A common stock.

Our amended and restated certificate of incorporation and amended and restated bylaws contain provisions that may make the acquisition of our company more difficult, including the following:

•our board of directors is classified into three classes of directors with staggered three-year terms, and directors are only able to be removed from office for cause;

•certain amendments to our amended and restated certificate of incorporation require the approval of at least 66-2/3% of the voting power of the outstanding shares of our stock entitled to vote generally in the election of directors, voting together as a single class;

•our dual class common stock structure provides pre-IPO stockholders with the ability to significantly influence the outcome of matters requiring stockholder approval, even if they own significantly less than a majority of the shares of our outstanding capital stock;

~~Table of~~ ~~Contents~~

•our stockholders are only be able to take action at a meeting of stockholders and are not be able to take action by written consent for any matter;

•our amended and restated certificate of incorporation does not provide for cumulative voting;

•vacancies on our board of directors may be filled only by our board of directors and not by stockholders;

•a special meeting of our stockholders may only be called by the chairperson of our board of directors, our Chief Executive Officer or a majority of our board of directors;

•certain litigation against us can only be brought in Delaware;

•our amended and restated certificate of incorporation authorizes undesignated preferred stock, the terms of which may be established and shares of which may be issued without further action by our stockholders; and

•advance notice procedures apply for stockholders to nominate candidates for election as directors or to bring matters before an annual meeting of stockholders.

In addition, while we have opted out of Section 203 of the Delaware General Corporation Law ~~or the DGCL,~~(the “DGCL”), our amended and restated certificate of incorporation contains similar provisions providing that we may not engage in certain “business combinations” with any “interested stockholder” for a three year period following the time that the stockholder became an interested stockholder, unless:

Table of Contents

•prior to such time, our board of directors approved either the business combination or the transaction that resulted in the stockholder becoming an interested stockholder;

•upon consummation of the transaction that resulted in the stockholder becoming an interested stockholder, the interested stockholder owned at least 85% of the votes of our voting stock outstanding at the time the transaction commenced, excluding certain shares; or

•at or subsequent to that time, the business combination is approved by our board of directors and by the affirmative vote of holders of at least 66-2/3% of the votes of our outstanding voting stock that is not owned by the interested stockholder.

Generally, a “business combination” includes a merger, asset or stock sale or other transaction resulting in a financial benefit to the interested stockholder. Subject to certain exceptions, an “interested stockholder” is a person who, together with that person’s affiliates and associates, owns, or within the previous three years owned, 15% or more of the votes of our outstanding voting stock. For purposes of this provision, “voting stock” means any class or series of stock entitled to vote generally in the election of directors. Our amended and restated certificate of incorporation provides that any interested stockholder who became an interested stockholder prior to our IPO and Mr. Sjouwerman and any of their respective direct or indirect designated transferees (other than in certain market transfers and gifts) and any group of which such persons are a party do not constitute “interested stockholders” for purposes of this provision.

Under certain circumstances, this provision will make it more difficult for a person who would be an “interested stockholder” to effect various business combinations with our company for a three year period. This provision may encourage companies interested in acquiring us to negotiate in advance with our board of directors because the stockholder approval requirement would be avoided if our board of directors approves either the business combination or the transaction that results in the stockholder becoming an interested stockholder. These provisions also may have the effect of preventing changes in our board of directors and may make it more difficult to accomplish transactions that stockholders may otherwise deem to be in their best interests.

These provisions, alone or together, could discourage, delay or prevent a transaction involving a change in control of our company. These provisions could also discourage proxy contests and make it more difficult for stockholders to elect directors of their choosing and to cause us to take other corporate actions they desire, any of which, under certain circumstances, could limit the opportunity for our stockholders to receive a premium for their

~~Table of~~ ~~Contents~~

shares of our Class A common stock, and could also affect the price that some investors are willing to pay for our Class A common stock.

Our amended and restated bylaws designate a state or federal court located within the State of Delaware and the federal district courts of the United States as the exclusive forum for substantially all disputes between us and our stockholders, which could limit our stockholders’ ability to choose the judicial forum for disputes with us or our directors, officers or employees.

Our amended and restated bylaws provide that, unless we consent in writing to the selection of an alternative forum, to the fullest extent permitted by law, the sole and exclusive forum for (i) any derivative action or proceeding brought on our behalf, (ii) any action asserting a claim of breach of a fiduciary duty owed by any of our directors, officers or other employees to us or our stockholders, (iii) any action arising pursuant to any provision of the DGCL, our amended and restated certificate of incorporation or our amended and restated bylaws, or (iv) any other action asserting a claim that is governed by the internal affairs doctrine shall be the Court of Chancery of the State of Delaware (or, if the Court of Chancery does not have jurisdiction, the federal district court for the District of Delaware), in all cases subject to the court having jurisdiction over indispensable parties named as defendants. Our amended and restated bylaws further provide that the federal district courts of the United States will be the exclusive forum for resolving any complaints asserting a cause of action arising under the Securities Act.

Table of Contents

which may discourage lawsuits against us and our directors, officers and other employees. This exclusive forum provision will not apply to any causes of action arising under the Securities Act or the Exchange Act or any other claim for which the federal courts have exclusive jurisdiction. Further, the enforceability of similar choice of forum provisions in other companies’ charter documents has been challenged in legal proceedings, and it is possible that a court could find these types of provisions to be inapplicable or unenforceable. For example, the Court of Chancery of the State of Delaware recently determined that a provision stating that U.S. federal district courts are the exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act is not enforceable. However, this decision may be reviewed and ultimately overturned by the Delaware Supreme Court. If a court were to find either exclusive forum provision in our amended and restated bylaws to be inapplicable or unenforceable in an action, we may incur additional costs associated with resolving the dispute in other jurisdictions, which could harm our results of operations.

Our ability to use our net operating loss carryforwards and certain other tax attributes may be limited.

As of December 31, 2021, we had U.S. federal and state net operating loss carryforwards of $59.6 million and $41.8 million, respectively, and we had a U.S. federal research and development credit carryforward of $2.7 million. Realization of these net operating loss and research and development credit carryforwards depends on future income, and there is a risk that our existing carryforwards could expire unused and be unavailable to offset future income tax liabilities, which could adversely affect our results of operations.

In addition, under Sections 382 and 383 of the Internal Revenue Code, if a corporation undergoes an “ownership change,” generally defined as a greater than 50% change (by value) in ownership by “5 percent shareholders” over a rolling three-year period, the corporation’s ability to use its pre-change net operating loss carryovers and other pre-change tax attributes, such as research and development credits, to offset its post-change income or taxes may be limited. We may experience ownership changes in the future as a result of shifts in our stock ownership. As a result, if we earn net taxable income, our ability to use our pre-change net operating loss carryforwards to offset U.S. federal taxable income may be subject to limitations, which could potentially result in increased future tax liability to us.

Changes in tax laws or regulations in the various tax jurisdictions we are subject to that are applied adversely to us or our customers could increase the costs of our products and harm our business.

New income, sales, use or other tax laws, statutes, rules, regulations or ordinances could be enacted at any time. Those enactments could harm our domestic and international business operations, and our business and financial performance. Further, existing tax laws, statutes, rules, regulations or ordinances could be interpreted, changed, modified or applied adversely to us. These events could require us or our customers to pay additional tax amounts on a prospective or retroactive basis, as well as require us or our customers to pay fines and/or penalties and interest for past amounts deemed to be due. Additionally, new, changed, modified or newly interpreted or applied tax laws could increase our customers’ and our compliance, operating and other costs, as well as the costs of our products. Further, these events could decrease the capital we have available to operate our business. Any or all of these events could harm our business, financial condition and results of operations.

States and some local taxing jurisdictions have differing rules and regulations governing sales and use taxes, and these rules and regulations are subject to varying interpretations that may change over time. In particular, the applicability of sales taxes to our platform and products in various jurisdictions is unclear. It is possible that we could face sales tax audits and that our liability for these taxes could exceed our estimates as state tax authorities could still assert that we are obligated to collect additional amounts as taxes from our customers and remit those taxes to those authorities. Liability for past taxes may also include substantial interest and penalty charges. Any successful action by state, foreign or other authorities to compel us to collect and remit sales, use or other taxes, either retroactively, prospectively or both, could harm our business, financial condition and results of operations.

Table of Contents

We are a multinational organization faced with increasingly complex tax issues in many jurisdictions, and we could be obligated to pay additional taxes in various jurisdictions.

Risks Related to Ownership of Our Class A Common Stock

Our Class B common stock has ten votes per share, and our Class A common stock, has one vote per share. Because of the ten-to-one voting ratio between our Class B common stock and Class A common stock, as of June 30, 2022, the holders of our Class B common stock collectively held approximately 93.3% of the combined voting power of our outstanding capital and will therefore, if acting together, be able to control all matters submitted to our stockholders for approval until the earlier of the fifth anniversary of the filing and effectiveness of our amended and restated certificate of incorporation or the affirmative vote of the holders of 66-2/3% of the voting power of our outstanding Class B common stock. This concentrated control will limit or preclude a potential investor’s ability to influence corporate matters, including the election of directors, amendments of our organizational documents, and any merger, consolidation, sale of all or substantially all of our assets or other major corporate transactions requiring stockholder approval. In addition, this may prevent or discourage unsolicited acquisition proposals or offers for our capital stock that you may feel are in your best interest as one of our stockholders.

The market price of our Class A common stock may be volatile, and you could lose all or part of your investment.

•price and volume fluctuations in the overall stock market from time to time;

•volatility in the market prices and trading volumes of technology stocks;

•changes in operating performance and stock market valuations of other technology companies generally, or those in our industry in particular;

•sales of shares of our Class A common stock by us or our stockholders;

Table of Contents

•the financial projections we may provide to the public, any changes in those projections or our failure to meet those projections;

•announcements by us or our competitors of new offerings or platform features;

•the public’s reaction to our press releases, other public announcements and filings with the SEC;

•rumors and market speculation involving us or other companies in our industry;

•short selling of our Class A common stock or related derivative securities;

•actual or anticipated changes or fluctuations in our results of operations;

•actual or anticipated developments in our business, our competitors’ businesses or the competitive landscape generally;

•announced or completed acquisitions of businesses, offerings or technologies by us or our competitors;

•developments or disputes concerning our intellectual property or other proprietary rights;

•litigation involving us, our industry or both, or investigations by regulators into our operations or those of our competitors;

•new laws or regulations or new interpretations of existing laws or regulations applicable to our business;

•system failures or actual or perceived privacy or security incidents;

•changes in accounting standards, policies, guidelines, interpretations or principles;

•any significant change in our management; and

•general economic conditions and slow or negative growth of our markets.

In addition, the stock market has experienced substantial price and volume volatility that is often seemingly unrelated to the operating performance of particular companies. These broad market fluctuations may cause the trading price of our Class A common stock to decline. Furthermore, the trading price of our Class A common stock may be adversely affected by third-parties trying to drive down the price. In addition, in the past, following periods of volatility in the overall market and the market price of a particular company’s securities, securities class action litigation has often been instituted against these companies. This litigation, if instituted against us, would result in substantial costs and a diversion of our management’s attention and resources.

Table of Contents

us change their recommendation regarding our Class A common stock adversely, provide more favorable relative recommendations about our competitors or publish inaccurate or unfavorable research about our business, the price of our securities would likely decline. If few securities analysts commence coverage of us, or if one or more of these analysts cease coverage of us or fail to publish reports on us regularly, we could lose visibility in the financial markets and demand for our securities could decrease, which could cause the price and trading volume of our Class A common stock to decline.

We do not intend to pay dividends for the foreseeable future.

We currently intend to retain any future earnings to finance the operation and expansion of our business, and we do not expect to declare or pay any dividends in the foreseeable future. In addition, our Revolving Credit Facility contains restrictions on our ability to pay dividends. As a result, stockholders must rely on sales of their Class Acommon stock after price appreciation as the only way to realize any future gains on their investment.

The issuance of additional stock in connection with financings, acquisitions, investments, our equity incentive plans or otherwise will dilute all other stockholders.

We cannot predict the impact our dual class structure may have on the market price of our Class A common stock.

We cannot predict whether our dual class structure will result in a lower or more volatile market price of our Class A common stock or in adverse publicity or other adverse consequences. For example, certain index providers have restrictions on including companies with multiple-class share structures in certain of their indexes. In July 2017, FTSE Russell and Standard & Poor’s announced that they would cease to allow most newly public companies utilizing dual or multi-class capital structures to be included in their indices. Affected indices include the Russell 2000 and the S&P 500, S&P MidCap 400 and S&P SmallCap 600, which together make up the S&P Composite 1500. Under these policies, our dual class capital structure would make us ineligible for inclusion in certain indices, and as a result, mutual funds, exchange-traded funds and other investment vehicles that attempt to passively track those indices will not be investing in our stock. Because of our dual class structure, we will likely be excluded from certain of these indexes and we cannot assure you that other stock indexes will not take similar actions. Given the sustained flow of investment funds into passive strategies that seek to track certain indexes, exclusion from stock indexes would likely preclude investment by many of these funds and could make our Class A common stock less attractive to other investors. As a result, the market price of our Class A common stock could be adversely affected.

Risks Related to Macroeconomic Conditions

Adverse economic conditions and reduced IT security spending may adversely impact our revenues and profitability.

Our ~~amended~~operations and ~~restated bylaws designate a state or federal court located within the State of Delaware~~performance depend in part on worldwide economic conditions and the ~~federal district courts~~impact these conditions have on levels of spending on IT networking and security solutions. Our business depends on the overall demand for these solutions and on the economic health and general willingness of our current and prospective customers to purchase our platform and products. Weak economic conditions, including conditions resulting from financial and credit market fluctuations, changes in economic policy, trade uncertainty, including changes in tariffs, sanctions, international treaties and other trade restrictions, the occurrence of a natural disaster or global public health crisis, or armed conflicts, such as the ongoing geopolitical tensions related to Russia’s actions in Ukraine, resulting sanctions imposed by the United States and other countries, and retaliatory actions taken by Russia in response to such sanctions, and a reduction in IT security spending could materially and adversely affect our

Table of Contents

business, financial condition and results of operations in a number of ways, including by reducing sales, lengthening sales cycles and lowering prices for our platform and products.

We are unable to predict with certainty the extent to which the global COVID-19 pandemic may continue to impact our business, financial condition or results of operations.

The ongoing COVID-19 pandemic and efforts to mitigate its impact have caused social and economic disruption and financial market volatility. The ultimate economic impacts of the COVID-19 pandemic, including supply chain constraints, labor shortages, and inflation, as well as the effects of government efforts to mitigate such impacts, have caused and may continue to cause volatility in financial and other capital markets, which may adversely affect our stock price and our ability to access capital markets in the future.

We believe that the conditions caused by the pandemic have not significantly affected demand for our platform and products; therefore, although the COVID-19 pandemic has caused us to experience, in some cases, longer sales cycles and an increase in certain prospective and current customers seeking lower prices or other more favorable contract terms, we do not believe these developments have been substantial enough to cause a significantly negative impact on our results of operations. Additionally, we have not seen significant negative impacts on collections of accounts receivable or attrition rates of our customers. Conversely, the long term work-from-home policies, which have stemmed from the COVID-19 pandemic, have resulted in employees accessing their companies’ systems remotely, which has increased cybersecurity, privacy and data protection risks for these companies and may lead to heightened interest in our platform and products. There is no assurance that the levels of interest, demand and use of our platform and products will continue or will not decrease in the future. Any such decrease could have an adverse effect on our growth and the success of our platform and products.

We may face exposure to foreign currency exchange rate fluctuations.

Today, our international contracts are sometimes denominated in local currencies; however, the majority of our international costs are denominated in local currencies. Over time, an increasing portion of our international contracts may be denominated in local currencies. Therefore, fluctuations in the value of the U.S. dollar and foreign currencies may affect our results of operations when translated into U.S. dollars. We do not currently engage in currency hedging activities to limit the risk of exchange rate fluctuations. However, in the future, we may use derivative instruments, such as foreign currency forward and option contracts, to hedge certain exposures to fluctuations in foreign currency exchange rates. The use of such hedging activities may not offset any or more than a portion of the adverse financial effects of unfavorable movements in foreign exchange rates over the limited time the hedges are in place. Moreover, the use of hedging instruments may introduce additional risks if we are unable to structure effective hedges with such instruments.

Catastrophic events may disrupt our business.

Natural disasters or other catastrophic events may cause damage or disruption to our operations, international commerce and the global economy, and thus could harm our business. We have a large employee presence in Clearwater, Florida and the east coast of the United States asis often subject to seasonal hurricanes. In the exclusive forum for substantially all disputes between us and our stockholders, which could limit our stockholders’ ability to choose the judicial forum for disputes with us or our directors, officers or employees.

Our amended and restated bylaws provide that, unless we consent in writing to the selection of an alternative forum, to the fullest extent permitted by law, the sole and exclusive forum for (i) any derivative action or proceeding brought on our behalf, (ii) any action asserting a claim of breachevent of a ~~fiduciary duty owed by any of our directors, officers~~major hurricane, earthquake or other ~~employees to us~~catastrophic event such as fire, power loss, telecommunications failure, cyber-attack, acts of war, including Russia’s actions in Ukraine, or our stockholders, (iii) any action arising pursuant to any provision of the Delaware General Corporation Law, our amended and restated certificate of incorporation or our amended and restated bylaws, or (iv) any other action asserting a claim that is governed by the internal affairs doctrine shall be the Court of Chancery of the State of Delaware (or, if the Court of Chancery does not have jurisdiction, the federal district court for the District of Delaware), in all cases subject to the court having jurisdiction over indispensable parties named as defendants. Our amended and restated bylaws further provide that the federal district courts of the United States will be the exclusive forum for resolving any complaints asserting a cause of action arising under the Securities Act of 1933, as amended, or the Securities Act.

Any person or entity purchasing or otherwise acquiring any interest in any of our securities shall be deemed to have notice of and consented to this provision. This exclusive forum provision may limit a stockholder’s ability to bring a claim in a judicial forum of its choosing for disputes with us or our directors, officers or other employees, which may discourage lawsuits against us and our directors, officers and other employees. This exclusive forum provision will not apply to any causes of action arising under the Securities Act or the Exchange Act or any other claim for which the federal courts have exclusive jurisdiction. Further, the enforceability of similar choice of forum provisions in other companies’ charter documents has been challenged in legal proceedings, and it is possible that a court could find these types of provisions to be inapplicable or unenforceable. For example, the Court of Chancery of the State of Delaware recently determined that a provision stating that U.S. federal district courts are the exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act is not enforceable. However, this decisionterrorist attack, we may be ~~reviewed~~unable to continue our operations and ~~ultimately overturned by the Delaware Supreme Court. If a court were to find either exclusive forum provision~~may endure system interruptions, reputational harm, delays in our ~~amended~~application development, lengthy interruptions in our products, breaches of data security and ~~restated bylaws to be inapplicable~~loss, alteration or ~~unenforceable in an action, we may incur additional costs associated with resolving the dispute in other jurisdictions,~~compromise of critical data, all of which could harm our business, financial condition and results of operations. In addition, the insurance we maintain may not be adequate to cover our losses resulting from disasters or other business interruptions.

7473

Table of Contents

Item 2. Unregistered Sales of Equity Securities and Use of Proceeds.

Unregistered Sales of Equity Securities

~~During the three months ended June 30, 2021, we issued and sold the following unregistered securities:~~

•From April 1, 2021 through the filing of our Registration Statement on Form S-8 on April 23, 2021, we issued and sold to certain of our employees, directors, consultants and other service providers an aggregate of 117,167 shares of Class B common stock upon the exercise of options under our 2016 Equity Incentive Plan at a weighted average exercise price of approximately $0.97.

•From April 1, 2021 through the filing of our Registration statement on Form S-8 on April 23, 2021, we granted to our employees, directors, consultants and other service providers restricted stock units covering an aggregate of 1,718,749 shares of Class A common stock under our 2021 Equity Incentive Plan.

None of the foregoing transactions involved any underwriters, underwriting discounts or commissions, or any public offering. We believe the offers, sales, and issuances of the above securities were exempt from registration under the Securities Act (or Regulation D or Regulation S promulgated thereunder) by virtue of Section 4(a)(2) of the Securities Act because the issuance of the securities to the recipients did not involve a public offering, or in reliance on Rule 701 because the transactions were pursuant to compensatory benefit plans or contracts relating to compensation as provided under such rule. The recipients of the securities in each of these transactions represented their intentions to acquire the securities for investment only and not with a view to or for sale in connection with any distribution thereof, and appropriate legends were placed upon the stock certificates issued in these transactions. All recipients had adequate access, through their relationships with us, to information about us. The sales of these securities were made without any general solicitation or advertising.None.

Use of Proceeds

On April 26, 2021, ~~we closed~~ our IPO, in which we sold 10,925,000 shares of our Class A common stock at a price to the public of $16.00 per share, including 1,425,000 shares pursuant to the exercise in full of the underwriters’ option to purchase additional shares, and certain selling stockholders sold 500,000 shares of our Class A common stock. We received net proceeds of $153.0 million, after deducting underwriting discounts and commissions of $10.8 million and offering expenses paid by us of approximately $3.0 million. The offer and sale of the shares in our IPO were registered under the Securities Act pursuant to a registration statement on Form S-1 (File No. 333-254518)~~, which~~ was declared effective by the SEC ~~on April 21, 2021. The representatives of~~for the ~~underwriters~~IPO of our IPO were Morgan Stanley & Co. LLC, Goldman Sachs & Co. LLC, BofA Securities, Inc. and KKR Capital Markets LLC, No payments were made by us to directors, officers or persons owning ten percent or more of ourClass A common stock or to their associates, or to our affiliates, other than payments in the ordinary course of business to officers for salaries and to non-employee directors pursuant to our director compensation policy.stock. There has been no material change in the planned use of proceeds from our IPO asfrom that described in our final prospectus ~~dated April 21, 2021 and~~ filed ~~with the SEC~~ pursuant to Rule 424(b)(4) under the Securities ~~Act.~~Act and other periodic reports previously filed with the SEC.

Item 3. Defaults Upon Senior Securities

Not applicable.

Item 4. Mine Safety Disclosure

Not applicable.

Item 5. Other Information

Not applicable.

7574

Table of Contents

Item 6. Exhibit Index

The documents listed below are filed with this Quarterly Report on Form 10-Q (numbered in accordance with Item 601 of Regulation S-K).

Provided Herein

Incorporated by Reference

Provided Herein

Incorporated by Reference

Exhibit

Number

Exhibit

Number

Description

Form

File Number

Exhibit

Filing Date

Exhibit

Number

Description

Form

File Number

Exhibit

Filing Date

3.1

Amended and Restated Certificate of Incorporation of the registrant

10-Q

001-40351

10.9

May 26, 2021

3.1

Amended and Restated Certificate of Incorporation of the registrant

10-Q

001-40351

10.9

May 26, 2021

3.2

Amended and Restated Bylaws of the registrant

10-Q

001-40351

3.1

May 26, 2021

3.2

Amended and Restated Bylaws of the registrant

10-Q

001-40351

3.1

May 26, 2021

31.1

Certification of Principal Executive Officer pursuant to Exchange Act Rules 13a-14(a) and 15d-14(a), as adopted pursuant to Section 302 of the Sarbanes-Oxley Act of 2002.

31.1

Certification of Principal Executive Officer pursuant to Exchange Act Rules 13a-14(a) and 15d-14(a), as adopted pursuant to Section 302 of the Sarbanes-Oxley Act of 2002.

31.2

Certification of Principal Financial Officer pursuant to Exchange Act Rules 13a-14(a) and 15d-14(a), as adopted pursuant to Section 302 of the Sarbanes-Oxley Act of 2002.

31.2

Certification of Principal Financial Officer pursuant to Exchange Act Rules 13a-14(a) and 15d-14(a), as adopted pursuant to Section 302 of the Sarbanes-Oxley Act of 2002.

32.1+

Certifications of Principal Executive Officer and Principal Financial Officer pursuant to 18 U.S.C. Section 1350, as adopted pursuant to Section 906 of the Sarbanes-Oxley Act of 2002.

32.1+

Certifications of Principal Executive Officer and Principal Financial Officer pursuant to 18 U.S.C. Section 1350, as adopted pursuant to Section 906 of the Sarbanes-Oxley Act of 2002.

101

The following financial statements from the Company's Quarterly Report on Form 10-Q for the quarter ended June 30, 2022, formatted in Inline XBRL: (i) Consolidated Balance Sheets, (ii) Consolidated Statement of Operations, (iii) Consolidated Statements of Comprehensive Income (Loss), (iv) Consolidated Statements of Stockholders’ Equity, (v) Consolidated Statements of Cash Flows, and (vi) Notes to Consolidated Financial Statements.

104

Cover Page Interactive Data File (formatted as inline XBRL and contained in Exhibit 101).

________________

+ The certifications attached as Exhibit 32.1 that accompany this Quarterly Report on Form 10-Q are deemed furnished and not filed with the Securities and Exchange Commission and are not to be incorporated by reference into any filing of KnowBe4, Inc. under the Securities Act of 1933, as amended, or the Securities Exchange Act of 1934, as amended, whether made before or after the date of this Quarterly Report on Form 10-Q, irrespective of any general incorporation language contained in such filing.

7675

Table of Contents

SIGNATURES

Pursuant to the requirements of the Securities Act of 1934, the Registrant has duly caused this Quarterly Report on Form 10-Q to be signed on its behalf by the undersigned, thereunto duly authorized.


	KnowBe4, Inc.

Date: August ~~2, 2021~~4, 2022	By:	/s/ Sjoerd Sjouwerman
		Sjoerd Sjouwerman
		Chief Executive Officer & Director (Principal Executive Officer)

Date: August ~~2, 2021~~4, 2022	By:	/s/ ~~Shrikrishna Venkataraman~~Bob Reich
		~~Shrikrishna Venkataraman~~Bob Reich
		~~Co-President and~~ Chief Financial Officer (Principal Financial and Accounting Officer)

7776


	Convertible Preferred Stock			Common Stock			Class A Common Stock				Class B Common Stock			Additional Paid In Capital		Accumulated Other Comprehensive (Loss) Income		Accumulated Deficit		Total
	Shares	Amount		Shares	Amount		Shares		Amount		Shares	Amount
Balance, December 31, 2020	114,164,600	$	0	42,279,000	$	0	0		$	0	0	$	0	$	158,483	$	(339)	$	(161,303)	$	(3,159)
Issuance of common stock for exercise of stock options	—	—		274,720	—		—	—	—		—	—		347		—		—		347
Issuance of common stock	—	—		1,245,440	—		—	—	—		—	—		24,675		—		—		24,675
Repurchase of common stock	—	—		(97,600)	—		—	—	—		—	—		(861)		—		—		(861)
Stock compensation expense	—	—		—	—		—	—	—		—	—		1,681		—		—		1,681
Other comprehensive loss	—	—		—	—		—	—	—		—	—		—		(199)		—		(199)
Net income	—	—		—	—		—	—	—		—	—		—		—		2,200		2,200
Balance, March 31, 2021	114,164,600	0		43,701,560	0		0		0		0	0		184,325		(538)		(159,103)		24,684
Issuance of common stock for exercise of stock options	—	—		—	—		—		—		589,937	—		605		—		—		605
Conversion of convertible preferred stock and previously authorized common stock to Class B common stock	(114,164,600)	—		(43,701,560)	—		—		—		157,866,160	2		—		—		—		2
Issuance of common stock in connection with initial public offering, net of underwriting discounts and issuance costs	—	—		—	—		10,425,000		—		—	—		153,796		—		—		153,796
Issuance of restricted stock units	—	—		—	—		949,815		—		—	—		—		—		—		—
Conversion of Class B common stock to Class A common stock	—	—		—	—		758,452		—		(758,452)	—		—		—		—		—
Taxes paid related to net share settlement of equity awards	—	—		—	—		(423,865)		—		—	—		(6,782)		—		—		(6,782)
Repurchase of common stock	—	—		—	—		—		—		—	—		680		—		—		680
Stock compensation expense	—	—		—	—		—		—		—	—		18,500		—		—		18,500
Other comprehensive income	—	—		—	—		—		—		—	—		—		284		—		284
Net loss	—	—		—	—		—		—		—	—		—		—		(16,863)		(16,863)
Balance, June 30, 2021	0	0		0	0		11,709,402		0		157,697,645	2		351,124		(254)		(175,966)		174,906


			Page
Note 1 - Description of Business			10
Note 2 - Summary of Significant Accounting Policies			11
Note 3 - Revenue s , Deferred Revenue and Remaining Performance Obligation			19
Note 4 - Business Combinations			20
Note 5 - Capitalized Software and Content, Net			21
Note 6 - Property and Equipment, Net			22
Note 7 - Intangible Assets and Goodwill			23
Note 8 - Accounts Payable and Accrued Expenses			24
Note 9 - Leases			24
Note 10 - Revolving Credit Facility			25
Note 11 - Stockholders’ Equity			26
Note 12 - Stock Compensation			27
Note 13 - Net Income (Loss) per Share			30
Note 14 - Income Taxes			31
Note 15 - Commitments and Contingencies			31
Note 16 - Related Party Transactions			31
Note 17 - Subsequent Events			31