RISK FACTORS

Investing in our common stock involves a high degree of risk. You should carefully consider the following risks, together with all of the other information contained in this prospectus, including our consolidated financial statements and related notes, before making a decision to invest in our common stock. Any of the following risks could have an adverse effect on our business, operating results, financial condition and prospects, and could cause the trading price of our common stock to decline, which would cause you to lose all or part of your investment. Our business, operating results, financial condition and prospects could also be harmed by risks and uncertainties not currently known to us or that we currently do not believe are material.

Risks Related to Our Business and Industry

We have a history of losses, and we may not be able to generate sufficient revenue to achieve and sustain profitability.

We have incurred net losses in each year since our inception, including net losses of $10.8 million, $3.2 million and $7.6 million for the years ended December 31, 2015, 2016 and 2017, respectively. We expect our operating expenses to increase significantly as we continue to expand our sales and marketing efforts, continue to invest in research and development, and expand our operations in existing and new geographies and vertical markets. We also expect to continue to devote significant research and development resources to our on-premises solutions; if our customers and potential customers shift their IT infrastructures to the cloud faster than we anticipate, we may not realize our expected return from the costs we incur. In addition, we expect to incur significant additional legal, accounting and other expenses related to being a public company as compared to when we were a private company. While our revenue has grown in recent years, if our revenue declines or fails to grow at a rate faster than these increases in our operating expenses, we will not be able to achieve and maintain profitability in future periods. As a result, we may continue to generate losses. We cannot assure you that we will achieve profitability in the future or that, if we do become profitable, we will be able to sustain profitability.

We have experienced rapid growth in recent periods, and our recent growth rates may not be indicative of our future growth.

We have experienced rapid growth in recent years. From the year ended December 31, 2012 to the year ended December 31, 2017, we grew our business at a revenue compound annual growth rate of over 36%, and our revenue grew from $95.4 million to $186.1 million from the year ended December 31, 2015 to the year ended December 31, 2017. In future periods, we may not be able to sustain revenue growth consistent with recent history, or at all. We believe our revenue growth depends on a number of factors, including, but not limited to:

If we are unable to achieve any of these requirements, our revenue growth will be adversely affected.

15

Our future revenues and operating results will be harmed if we are unable to acquire new customers, if our customers do not renew their arrangements with us, or if we are unable to expand sales to our existing customers or develop new solutions that achieve market acceptance.

To continue to grow our business, it is important that we continue to acquire new customers to purchase and use our solutions. Our success in adding new customers depends on numerous factors, including our ability to (i) offer a compelling identity governance platform and solutions, (ii) execute our sales and marketing strategy, (iii) attract, effectively train and retain new sales, marketing, professional services and support personnel in the markets we pursue, (iv) develop or expand relationships with technology partners, systems integrators, resellers and other channel partners, (v) expand into new geographies and vertical markets, (vi) deploy our platform and solutions for new customers and (vii) provide quality customer support once deployed.

It is important to our continued growth that our customers renew their arrangements when existing contract terms expire. Our customers have no obligation to renew their maintenance, SaaS and/or term-license agreements, and our customers may decide not to renew these agreements with a similar contract period, at the same prices and terms or with the same or a greater number of identities. Although our customer retention rate has historically been strong, some of our customers have elected not to renew their agreements with us, and it is difficult to accurately predict long-term customer retention and expansion rates. Our customer retention and expansion may decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with our solutions, our customer support and professional services, our prices and pricing plans, the competitiveness of other software products and services, reductions in our customers’ spending levels, user adoption of our solutions, deployment success, utilization rates by our customers, new product releases and changes to our product offerings. If our customers do not renew their maintenance, SaaS and/or term-license agreements, or renew on less favorable terms, our business, financial condition and operating results may be adversely affected.

Our ability to increase revenue also depends in part on our ability to increase the number of identities governed with our solutions and sell more modules and solutions to our existing and new customers. Our ability to increase sales to existing customers depends on several factors, including their experience with implementing and using our platform and the existing solutions they have implemented, their ability to integrate our solutions with existing technologies, and our pricing model.

If our new solutions do not achieve adequate acceptance in the market, our competitive position could be impaired, and our potential to generate new revenue or to retain existing revenue could be diminished. The adverse effect on our financial results may be particularly acute because of the significant research, development, marketing, sales and other expenses we will have incurred in connection with the new solutions, and our ability to introduce compelling new solutions that address the requirements of our customers in light of the dynamic identity governance market in which we operate.

If we are unable to successfully acquire new customers, retain our existing customers, expand sales to existing customers or introduce new solutions, our business, financial condition and operating results could be adversely affected.

If we are unable to maintain successful relationships with our channel partners, our ability to market, sell and distribute our solutions will be limited and our business, financial condition and operating results could be adversely affected .

We derive a significant portion of our revenue from sales influenced or made through our channel partner network and expect these sales to continue to grow for the foreseeable future. Our channel partners provide implementation and other services to our customers in exchange for fees paid by those customers. We may not achieve anticipated revenue growth from our channel partners if we are unable to retain our existing channel partners and expand their sales or add additional motivated channel partners.

Our arrangements with our channel partners are generally non-exclusive, meaning they may offer customers the products of several different companies, including products that compete with our platform and solutions. If

16

our channel partners do not effectively market and sell our solutions, choose to use greater efforts to market and sell our competitors’ products or services, or fail to meet the needs of our customers, our ability to grow our business and sell our solutions may be adversely affected. Our channel partners may cease marketing our products with limited or no notice and with little or no penalty. In addition, certain of our channel partners are subject to independence requirements that may prevent them from providing services to us or cooperating with us in our go-to-market efforts if they also provide services for affiliates of our affiliates. One of our affiliates, Thoma Bravo, the ultimate general partner of the Thoma Bravo Funds, is a leading private equity investment firm that holds control investments in over 20 businesses, some of which engage certain of our channel partners to provide services, and it intends to continue making control investments in the future. If one or more of our channel partners determines that it is unable to both provide services to us or cooperate with us in our go-to-market efforts and also provide services to affiliates of Thoma Bravo, those channel partners may cease marketing our products or otherwise cease providing services to us or cooperating with us in our go-to-market efforts.

We also collaborate with adjacent technology vendors to offer comprehensive solutions to our customers. If we do not effectively collaborate with them, or if they elect to terminate their relationship with us or develop and market solutions that compete with our solutions, our growth may be adversely affected.

Our ability to generate revenue in the future will depend in part on our success in maintaining effective working relationships with our channel partners, in expanding our indirect sales channel, in training our channel partners to independently sell and/or deploy our solutions and in continuing to integrate our solutions with the products and services offered by our technology partners. If we are unable to maintain our relationships with these channel partners, our business, financial condition and operating results could be adversely affected.

Our quarterly results fluctuate significantly and may not fully reflect the underlying performance of our business.

We believe our quarterly revenue and operating results may vary significantly in the future. As a result, you should not rely on the results of any one quarter as an indication of future performance and period-to-period comparisons of our revenue and operating results may not be meaningful and, as a result, may not fully reflect the underlying performance of our business.

Our quarterly operating results may fluctuate as a result of a variety of factors, including, but not limited to, those listed below, many of which are outside of our control:

17

Our sales cycle is long and unpredictable, and our sales efforts require considerable time and expense.

The timing of our sales and related revenue recognition is difficult to predict because of the length and unpredictability of the sales cycle for our platform before a sale. We and our channel partners are often required to spend significant time and resources to better educate and familiarize potential customers with the value proposition of our platform and solutions. Customers often view the purchase of our solutions as a strategic decision and significant investment and, as a result, frequently require considerable time to evaluate, test and qualify our platform and solutions prior to purchasing our solutions. During the sales cycle, we expend significant time and money on sales and marketing and contract negotiation activities, which may not result in a sale. Additional factors that may influence the length and variability of our sales cycle include:

If our efforts in pursuing sales and customers are unsuccessful, or if our sales cycles lengthen, our revenue could be lower than expected, which would have an adverse effect on our business, operating results and financial condition.

We recognize some of our revenue ratably over the term of our agreements with customers, and as a result, downturns or upturns in sales may not be immediately reflected in our operating results.

We recognize revenue from our IdentityNow subscription offering ratably over the terms of our agreements with customers, which generally occurs over a three-year period. As a result, a portion of the revenue that we report in each period will be derived from the recognition of deferred revenue relating to agreements entered into during previous periods. Consequently, a decline in new sales or renewals in any one period may not be immediately reflected in our revenue results for that period. This decline, however, will negatively affect our revenue in future periods. Accordingly, the effect of significant downturns in sales and market acceptance of our

18

products and potential changes in our rate of renewals may not be fully reflected in our operating results until future periods. Our model also makes it difficult for us to rapidly increase our subscription revenue through additional sales in any period, as revenue from new customers generally will be recognized over the term of the applicable agreement.

We also intend to increase our investment in research and development, sales and marketing, and general and administrative functions and other areas to grow our subscription-related business. These subscription-related costs are generally expensed as incurred (with the exception of sales commissions), as compared to the corresponding revenue, substantially all of which is recognized ratably in future periods. We are likely to recognize the costs associated with these increased investments earlier than some of the anticipated benefits and the return on these investments may develop more slowly, or may be lower, than we expect, which could adversely affect our operating results.

We face intense competition in our market, especially from larger, well established companies, and we may lack sufficient financial and other resources to maintain and improve our competitive position.

The market for identity and data governance solutions is intensely competitive and is characterized by constant change and innovation. We face competition from both traditional, larger software vendors offering enterprise-wide software frameworks and services and smaller companies offering point solutions for specific identity and data governance issues. We also compete with IT equipment vendors and systems management solution providers whose products and services address identity and data governance requirements. Our principal competitors vary depending on the product we offer and include CA Technologies, IBM, Oracle and Varonis and several smaller vendors. Many of our existing competitors have, and some of our potential competitors could have, substantial competitive advantages such as:

Given their larger size, greater resources and existing customer relationships, our competitors may be able to compete and respond more effectively than we can to new or changing opportunities, technologies, standards or customer requirements. Our competitors may also seek to extend or supplement their existing offerings to provide identity and data governance solutions that more closely compete with our offerings. Potential customers may also prefer to purchase, or incrementally add solutions, from their existing suppliers rather than a new or additional supplier regardless of product performance or features.

In addition, with the recent increase in large merger and acquisition transactions in the technology industry, particularly transactions involving cloud-based technologies, there is a greater likelihood that we will compete with other large technology companies in the future. Some of our competitors have made acquisitions or entered into strategic relationships to offer a more comprehensive product than they individually had offered. Companies and alliances resulting from these possible consolidations and partnerships may create more compelling product offerings and be able to offer more attractive pricing, making it more difficult for us to compete effectively. In addition, continued industry consolidation may adversely impact customers’ perceptions of the viability of small and medium-sized technology companies and consequently their willingness to purchase from those companies.

19

New start-up companies that innovate and large competitors that are making significant investments in research and development may invent similar or superior products and technologies that compete with our products, and our business could be materially and adversely affected if such technologies or products are widely adopted. Conditions in our market could change rapidly and significantly as a result of technological advancements, partnering by our competitors or continuing market consolidation. These competitive pressures in our market or our failure to compete effectively may result in price reductions, fewer orders, reduced revenue and gross margins, increased net losses, and loss of market share. Any failure to meet and address these factors could adversely affect our business, financial condition and operating results.

We anticipate that our operations will continue to increase in complexity as we grow, which will add additional challenges to the management of our business in the future.

Our business has experienced significant growth and is becoming increasingly complex. We increased the number of our employees from 514 at December 31, 2015 to 835 at March 31, 2018. We have also experienced growth in the number of customers of our solutions from 520 at December 31, 2015 to 984 at March 31, 2018. At March 31, 2018, we had personnel in 23 countries, and we expect to expand into additional countries in the future. We expect this growth to continue and for our operations to become increasingly complex. To effectively manage this growth, we have made and continue to make substantial investments to improve our operational, financial and management controls as well as our reporting systems and procedures. Our success will depend in part on our ability to manage this complexity effectively without undermining our corporate culture, which we believe has been central to our success. If we are unable to manage this complexity, our business, operations, operating results and financial condition may suffer.

As our customer base continues to grow, we will need to expand our professional services and other personnel, and maintain and enhance our existing partner network, to provide a high level of customer service. We also will need to effectively manage our direct and indirect sales processes as the number and type of our sales personnel and partner network continues to grow and become more complex and as we continue to expand into new geographies and vertical markets. This complexity is further driven by the various ways in which we sell our solutions, including on a per identity and per module basis through perpetual licenses and SaaS. If we do not effectively manage the increasing complexity of our business and operations, the quality of our solutions and customer service could suffer, and we may not be able to adequately address competitive challenges. These factors could impair our ability, and our channel partners’ ability, to attract new customers, retain existing customers, expand our customers’ use of existing solutions and adoption of more of our solutions and continue to provide high levels of customer service, all of which would adversely affect our reputation, overall business, operations, operating results and financial condition.

Interruptions with the delivery of our SaaS solutions, or third-party cloud-based systems that we use in our operations, may adversely affect our business, operating results and financial condition.

Our continued growth depends in part on the ability of our existing customers and new customers to access our platform and solutions, particularly our cloud-based deployments, at any time and within an acceptable amount of time. In addition, our ability to access certain third-party SaaS solutions is important to our operations and the delivery of our customer support and professional services, including our online training for customers, professional services partners and channel partners. We have experienced, and may in the future experience, service disruptions, outages and other performance problems both in the delivery of our SaaS solutions and in third-party SaaS solutions we use due to a variety of factors, including infrastructure changes, malicious actors, human or software errors or capacity constraints. In some instances, we may not be able to identify the cause or causes of these performance problems within an acceptable period of time. It may become increasingly difficult to maintain and improve the performance of our SaaS solutions as they become more complex. If our SaaS solutions are unavailable or if our customers are unable to access features of our SaaS solutions within a reasonable amount of time or at all, our business would be negatively affected. In addition, if any of the third-party SaaS solutions that we use were to experience a significant or prolonged outage or security breach, our business could be adversely affected.

20

We host our SaaS solutions using Amazon Web Services (“AWS”) data centers, a provider of cloud infrastructure services. All of our SaaS solutions reside on hardware owned or leased and operated by us in these locations. Our SaaS operations depend on protecting the virtual cloud infrastructure hosted in AWS by maintaining its configuration, architecture, features and interconnection specifications, as well as the information stored in these virtual data centers and which third-party internet service providers transmit. Although we have disaster recovery plans that utilize multiple AWS locations, any incident affecting their infrastructure that may be caused by fire, flood, severe storm, earthquake or other natural disasters, cyber attacks, terrorist or other attacks, and other similar events beyond our control could negatively affect our SaaS platform. A prolonged AWS service disruption affecting our SaaS platform for any of the foregoing reasons would negatively impact our ability to serve our customers and could damage our reputation with current and potential customers, expose us to liability, cause us to lose customers or otherwise harm our business. We may also incur significant costs for using alternative equipment or taking other actions in preparation for, or in reaction to, events that damage the AWS services we use. In addition, AWS may terminate the agreement by providing 30 days’ prior written notice and may, in some cases, terminate the agreement immediately for cause upon notice. In the event that our AWS service agreements are terminated, or there is a lapse of service, elimination of AWS services or features that we utilize, interruption of internet service provider connectivity or damage to such facilities, we could experience interruptions in access to our platform as well as significant delays and additional expense in arranging or creating new facilities and services and/or re-architecting our SaaS solutions for deployment on a different cloud infrastructure service provider, which may adversely affect our business, operating results and financial condition.

If we fail to adapt and respond effectively to rapidly changing technology, evolving industry standards, changing regulations and changing customer needs, requirements or preferences, our platform and solutions may become less competitive.

The market in which we compete is relatively new and subject to rapid technological change, evolving industry standards and changing regulations, as well as changing customer needs, requirements and preferences. The success of our business will depend, in part, on our ability to adapt and respond effectively to these changes on a timely basis. In addition, as our customers’ technologies and business plans grow more complex, we expect them to face new and increasing challenges. Our customers require that our solution effectively identifies and responds to these challenges without disrupting the performance of our customers’ IT systems. As a result, we must continually modify and improve our products in response to changes in our customers’ IT infrastructures.

We may be unable to anticipate future market needs and opportunities or be able to develop enhancements to our platform or existing solutions or new solutions to meet such needs or opportunities in a timely manner, if at all. Even if we are able to anticipate, develop and commercially introduce enhancements to our platform and existing solutions and new solutions, those enhancements and new solutions may not achieve widespread market acceptance. Our enhancements or new solutions could fail to attain sufficient market acceptance for many reasons, including:

If we were unable to enhance our platform or existing solutions or develop new solutions that keep pace with rapid technological and industry change, our business, operating results and financial condition could be

21

adversely affected. If new technologies emerge that are able to deliver competitive products and services at lower prices, more efficiently, more conveniently or more securely, such technologies could adversely impact our ability to compete effectively.

Our failure to achieve and maintain an effective system of disclosure controls and internal control over financial reporting could adversely affect our financial position and lower our stock price.

As a public company, we are subject to the reporting requirements of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), the Sarbanes-Oxley Act and the rules and regulations of the applicable listing standards of NYSE. The Sarbanes-Oxley Act requires, among other things, that we maintain effective disclosure controls and procedures and internal control over financial reporting. In order to maintain and improve the effectiveness of our disclosure controls and procedures and internal control over financial reporting, we have expended, and anticipate that we will continue to expend, significant resources, including accounting-related costs and significant management oversight.

In connection with the audit of our consolidated financial statements for the year ended December 31, 2015, our independent registered public accounting firm identified a material weakness related to insufficient documentation evidencing the revenue recognition decisions that we made when allocating revenue to specific customer agreements, which we remediated by December 31, 2016. In finalizing our financial statements for our initial public offering, our independent registered public accounting firm identified a material weakness in our internal control over financial reporting related to our accounting for certain complex, non-routine transactions affecting our presentation of amortization expense related to acquisitions, equity transactions and related disclosure and earnings per share calculations. We are taking measures to remediate the material weakness, including establishing more robust accounting policies and procedures, reviews on the adoption of new accounting positions and financial statement disclosures, and selection and engagement of consultants to assist us in determining positions and evaluating new accounting policies. We have not yet remediated this material weakness as of March 31, 2018, and we cannot assure you that these measures and any further measures that we implement will be sufficient to remediate our existing material weakness or to identify or prevent additional material weaknesses.

Our internal resources and personnel may in the future be insufficient to avoid accounting errors, and there can be no assurance that we will not have additional material weaknesses in the future. Any failure to develop or maintain effective controls or any difficulties encountered implementing required new or improved controls could harm our operating results or cause us to fail to meet our reporting obligations and may result in a restatement of our financial statements for prior periods. Any failure to implement and maintain effective internal control over financial reporting also could adversely affect the results of periodic management evaluations and annual independent registered public accounting firm attestation reports regarding the effectiveness of our internal control over financial reporting that we will eventually be required to include in our periodic reports that will be filed with the Securities and Exchange Commission (the “SEC”). Ineffective disclosure controls and procedures and internal control over financial reporting could also cause investors to lose confidence in our reported financial and other information, which would likely have a negative effect on the trading price of our common stock. In addition, if we are unable to continue to meet these requirements, we may not be able to remain listed on the NYSE. As a public company, we are required to comply with the SEC rules that implement Section 404 of the Sarbanes-Oxley Act and are therefore required to make a formal assessment of the effectiveness of our internal control over financial reporting for that purpose, but we are not required to provide an annual management report on the effectiveness of our internal control over financial reporting until our second Annual Report on Form 10-K.

Our independent registered public accounting firm is not required to formally attest to the effectiveness of our internal control over financial reporting until after we are no longer an emerging growth company as defined in the JOBS Act. At such time, our independent registered public accounting firm may issue a report that is adverse in the event it is not satisfied with the level at which our internal control over financial reporting is

22

documented, designed or operating. Any failure to maintain effective disclosure controls and internal control over financial reporting could have an adverse effect on our business and operating results and could cause a decline in the price of our common stock.

Forecasting our estimated annual effective tax rate for financial accounting purposes is complex and subject to uncertainty, and there may be material differences between our forecasted and actual tax rates.

Forecasts of our income tax position and effective tax rate for financial accounting purposes are complex and subject to uncertainty because our income tax position for each year combines the effects of a mix of profits earned and losses incurred by us in various tax jurisdictions with a broad range of income tax rates, as well as changes in the valuation of deferred tax assets and liabilities, the impact of various accounting rules and changes to these rules and tax laws, the results of examinations by various tax authorities, and the impact of any acquisition, business combination or other reorganization or financing transaction. To forecast our tax rate, we estimate our pre-tax profits and losses by jurisdiction and forecast our tax expense by jurisdiction. If the mix of profits and losses, our ability to use tax credits, or effective tax rates by jurisdiction is different than those estimated, our actual tax rate could be materially different than forecasted, which could have a material impact on our results of business, financial condition and results of operations.

On December 22, 2017, U.S. federal tax reform was enacted with the signing of the Tax Cuts and Jobs Act (the “TCJA”). Notable provisions of the TCJA include significant changes to corporate taxation, including reduction of the corporate tax rate from a top marginal rate of 35% to a flat rate of 21%, limitation of the tax deduction for interest expense to 30% of adjusted earnings (except for certain small businesses), limitation of the deduction for net operating losses (“NOLs”) to 80% of current year taxable income and elimination of NOL carrybacks, one time taxation of offshore earnings at reduced rates regardless of whether they are repatriated, elimination of U.S. tax on foreign earnings (subject to certain important exceptions), immediate deductions for certain new investments instead of deductions for depreciation expense over time, and modifying or repealing many business deductions and credits.

The U.S. Department of Treasury has broad authority to issue regulations and interpretative guidance that may significantly impact how we will apply the law and impact our results of operations in the period issued. As additional regulatory guidance is issued by the applicable taxing authorities, as accounting treatment is clarified, as we perform additional analysis on the application of the law, and as we refine estimates in calculating the effect, our final analysis, which will be recorded in the period completed, may be different from our current provisional amounts, which could materially affect our tax obligations and effective tax rate.

If we are not able to maintain and enhance our brand or reputation as an industry leader and innovator, our business and operating results may be adversely affected.

We believe that maintaining and enhancing our reputation as a leader and innovator in the market for identity and data governance solutions is critical to our relationship with our existing customers and commercial relationships and our ability to attract new customers and commercial relationships. The successful promotion of our brand attributes will depend on a number of factors, including our marketing efforts, our ability to continue to develop high-quality features and solutions for our platform and our ability to successfully differentiate our platform and solutions from competitive products and services. Our brand promotion activities may not be successful or yield increased revenue. In addition, independent industry analysts often provide reports of our platform and solutions, as well as products and services of our competitors, and perception of our platform and solutions in the marketplace may be significantly influenced by these reports. If these reports are negative, or less positive as compared to those of our competitors’ products and services, our reputation may be adversely affected. Additionally, the performance of our channel partners may affect our brand and reputation if customers do not have a positive experience with our solutions as implemented by our channel partners or with the implementation generally. The promotion of our brand requires us to make substantial expenditures, and we anticipate that the expenditures will increase as our market becomes more competitive, as we expand into new

23

geographies and vertical markets, and as more sales are generated through our channel partners. To the extent that these activities yield increased revenue, this revenue may not offset the increased expenses we incur. If we do not successfully maintain and enhance our brand and reputation, our business and operating results may be adversely affected.

Real or perceived errors, failures or disruptions in our platform and solutions could adversely affect our customers’ satisfaction with our solutions and/or our industry reputation and business could be harmed.

Our platform and solutions are very complex and have contained and may contain undetected defects or errors, especially when solutions are first introduced or enhanced. Our platform and solutions are often used in connection with large-scale computing environments with different operating systems, system management software, equipment and networking configurations, which may cause errors or failures of products, or other aspects of the computing environment into which our products are deployed. If our platform and solutions are not implemented or used correctly or as intended, inadequate performance and disruption in service may result. In addition, deployment of our platform and solutions into complicated, large-scale computing environments may expose errors, failures or vulnerabilities in our products. Any such errors, failures, or vulnerabilities may not be found until after they are deployed to our customers. We have experienced from time to time errors, failures and bugs in our platform that have resulted in customer downtime. While we were able to remedy these situations, we cannot assure you that we will be able to mitigate future errors, failures or bugs in a quick or cost-effective manner.

If we or our channel partners or one or more customers were to suffer a highly publicized breach, even if our platform and solutions perform effectively, such a breach could cause us to suffer reputational harm, lose existing commercial relationships and customers or deter them from purchasing additional solutions and prevent new customers from purchasing our solutions.

Since our customers use our platform and solutions for important aspects of their business, any real or perceived errors, failures or vulnerabilities in our products, or disruptions in service or other performance problems, could hurt our reputation and may damage our customers’ businesses. Furthermore, defects, errors or failures in our platform or solutions may require us to implement design changes or software updates. Any defects or errors in our platform or solutions, or the perception of such defects or errors, could result in:

Although we have contractual protections, such as warranty disclaimers and limitation of liability provisions, in our standard terms and conditions of sale, they may not fully or effectively protect us from claims by customers, commercial relationships or other third parties. Any insurance coverage we may have may not adequately cover all claims asserted against us or cover only a portion of such claims. In addition, even claims that ultimately are unsuccessful could result in our expenditure of funds in litigation and divert management’s time and other resources.

24

If our platform and solutions do not effectively interoperate with our customers’ existing or future IT infrastructures, installations could be delayed or cancelled, which would harm our business.

Our success depends on the interoperability of our platform and solutions with third-party operating systems, applications, data and devices that we have not developed and do not control. Any changes in such operating systems, applications, data or devices that degrade the functionality of our platform or solutions or give preferential treatment to competitive software could adversely affect the adoption and usage of our platform. We may not be successful in adapting our platform or solutions to operate effectively with these applications, data or devices. If it is difficult for our customers to access and use our platform or solutions, or if our platform or solutions cannot connect a broadening range of applications, data and devices, then our customer growth and retention may be harmed, and our business and operating results could be adversely affected.

Our success depends on the experience and expertise of our senior management team and key employees. If we are unable to hire, retain, train and motivate our personnel, our business, operating results and prospects may be harmed.

Our success has depended, and continues to depend, on the efforts and talents of our senior management team and key employees, including our engineers, product managers, sales and marketing personnel and professional services personnel. Our future success will also depend upon our continued ability to identify, hire and retain additional skilled and highly qualified personnel, which will require significant time, expense and attention.

Our officers and key employees are employed on an at-will basis, which means that they could terminate their employment with us at any time. The loss of one or more members of our senior management team, particularly if closely grouped, could adversely affect our ability to execute our business plan and thus, our business, operating results and prospects. We do not maintain key man insurance on any of our officers or key employees, and we may not be able to find adequate replacements. If we fail to identify, recruit and integrate strategic hires, our business, operating results and financial condition could be adversely affected.

We have from time to time experienced, and we expect to continue to experience, difficulty in hiring, and may in the future have difficulty retaining, employees with appropriate qualifications, and many of the companies with which we compete for experienced personnel have greater resources than we have. In addition to hiring new employees, we must continue to focus on training, motivating and retaining our best employees, substantially all of whom are at-will employees, which means they may terminate their employment relationship with us at any time. Many of our employees may be able to receive significant proceeds from sales of our common stock in the public markets, which may reduce their motivation to continue to work for us. Conversely, employees may be more likely to leave us if the exercise prices of the stock options that they hold are significantly above the market price of our common stock. Competition for highly skilled personnel is intense, and we may need to invest significant amounts of cash and equity to attract and retain new employees, and we may never realize returns on these investments.

Competition for well-qualified employees in all aspects of our business, including sales personnel, professional services personnel and software engineers, is intense. Our primary recruiting competition are well-known, high-paying firms. Our continued ability to compete effectively depends on our ability to attract new employees and to retain and motivate existing employees. If we do not succeed in attracting well-qualified employees or retaining and motivating existing employees, our business would be adversely affected.

Our corporate culture has contributed to our success, and if we cannot maintain this culture as we grow, we could lose the innovation, creativity and teamwork fostered by our culture, which could adversely affect our business.

We believe that our culture has been and will continue to be a key contributor to our success. From January 1, 2016 to March 31, 2018, we have increased the size of our workforce by 232 employees domestically and 90

25

employees internationally, and we expect to continue to hire aggressively as we expand. In addition, we plan to continue to expand our international operations, which may affect our culture as we seek to find, hire and integrate additional international employees while maintaining our corporate culture. If we do not continue to maintain our corporate culture as we grow, we may be unable to continue to foster the innovation, integrity, and collaboration we believe we need to support our growth. Our substantial anticipated headcount growth, international expansion and our transition from a private company to a public company may result in a change to our corporate culture, which could adversely affect our business.

Because our long-term success depends, in part, on our ability to expand the sales and marketing of our platform and solutions to customers located outside of the United States, and we perform a significant portion of our development outside of the United States, our business will be susceptible to risks associated with international operations.

As of March 31, 2018, we had sales and marketing and product development personnel outside the United States in Australia, Brazil, Canada, Denmark, France, Germany, Hong Kong, India, Israel, Italy, the Netherlands, Singapore, South Africa, Spain, Sweden, Switzerland, Taiwan, the United Arab Emirates and the United Kingdom, and we intend to expand our international sales and marketing operations.

Conducting international operations subjects us to risks that we do not generally face in the United States. These risks include:

26

The occurrence of any one of these risks could harm our international business and, consequently, our operating results. Additionally, operating in international markets requires significant management attention and financial resources. We cannot be certain that the investment and additional resources required to operate in other countries will produce desired levels of revenue or net income.

Adverse economic conditions may negatively impact our business.

Our business depends on the overall demand for information technology and on the economic health of our current and prospective customers. Any significant weakening of the economy in the United States or Europe and of the global economy, more limited availability of credit, a reduction in business confidence and activity, decreased government spending, economic uncertainty and other difficulties may affect one or more of the sectors or countries in which we sell our solutions. Global economic and political uncertainty may cause some of our customers or potential customers to curtail spending generally or IT and identity and data governance spending specifically and may ultimately result in new regulatory and cost challenges to our international operations. In addition, a strong dollar could reduce demand for our products in countries with relatively weaker currencies. These adverse conditions could result in reductions in sales of our solutions, longer sales cycles, slower adoption of new technologies and increased price competition. Any of these events could have an adverse effect on our business, operating results and financial position.

Forecasts of our market and market growth may prove to be inaccurate, and even if the markets in which we compete achieve the forecasted growth, there can be no assurance that our business will grow at similar rates or at all.

Growth forecasts included in this prospectus relating to our market opportunity and the expected growth in that market are subject to significant uncertainty and are based on assumptions and estimates which may prove to be inaccurate. Even if this market meets our size estimate and experiences the forecasted growth, we may not grow our business at a similar rate, or at all. Our growth is subject to many factors, including our success in implementing our business strategy, which is subject to many risks and uncertainties. Accordingly, the forecasts of market growth included in this prospectus should not be taken as indicative of our future growth.

Any failure to offer high-quality customer support may adversely affect our relationships with our customers and our financial results.

We typically bundle customer support with arrangements for our solutions. In deploying and using our platform and solutions, our customers typically require the assistance of our support teams to resolve complex technical and operational issues. We may be unable to modify the nature, scope and delivery of our customer support to compete with changes in product support services provided by our competitors. Increased customer demand for support, without corresponding revenue, could increase costs and adversely affect our operating results. We may also be unable to respond quickly enough to accommodate short-term increases in customer demand for support. Our sales are highly dependent on our reputation and on positive recommendations from our existing customers. Any failure to maintain high-quality customer support, or a market perception that we do not maintain high-quality product support, could adversely affect our reputation, and our ability to sell our solutions to existing and new customers.

27

If we fail to meet contractual commitments related to response time, service level commitments or quality of professional services, we could be obligated to provide credits for future service, or face contract termination, which could adversely affect our business, operating results and financial condition.

Depending on the products purchased, our customer agreements contain service level agreements, under which we guarantee specified availability of our platform and solutions. If we are unable to meet the stated service level commitments to our customers or suffer extended periods of unavailability of our SaaS platform or solutions, we may be contractually obligated to provide affected customers with service credits or customers could elect to terminate and receive refunds for prepaid amounts. In addition, if the quality of our professional services do not meet contractual requirements, we may be required to re-perform the services at our expense or refund amounts paid for the services. Any failure to meet these contractual commitments could adversely affect our revenue, operating results and financial condition and any failure to meet service level commitments or extended service outages of our SaaS solutions could adversely affect our business and reputation as customers may elect not to renew and we could lose future sales.

Our business depends, in part, on sales to the public sector, and significant changes in the contracting or fiscal policies of the public sector could have an adverse effect on our business.

We derive a portion of our revenue from sales of our solutions to federal, state, local and foreign governments, and we believe that the success and growth of our business will continue to depend in part on our successful procurement of government contracts. Factors that could impede our ability to maintain or increase the amount of revenue derived from government contracts include:

The occurrence of any of the foregoing could cause governments and governmental agencies to delay or refrain from purchasing our solutions or otherwise have an adverse effect on our business, operating results and financial condition.

Any actual or perceived failure by us to comply with our privacy policy or legal or regulatory requirements in one or multiple jurisdictions could result in proceedings, actions or penalties against us.

Our customers’ storage and use of data concerning, among others, their employees, contractors, customers and partners is essential to their use of our platform and solutions. We have implemented various features intended to enable our customers to better comply with applicable privacy and security requirements in their collection and use of data, but these features do not ensure their compliance and may not be effective against all potential privacy and data security concerns.

A wide variety of domestic and foreign laws and regulations apply to the collection, use, retention, protection, disclosure, transfer, disposal and other processing of personal data. These data protection and privacy-related laws and regulations are evolving and may result in regulatory and public scrutiny and escalating levels of enforcement and sanctions. Our failure to comply with applicable laws and regulations, or to protect any personal data, could result in enforcement action against us, including fines, claims for damages by customers and other affected individuals, damage to our reputation and loss of goodwill (both in relation to existing customers and prospective customers), any of which could adversely affect our business, operating results, financial performance and prospects.

In jurisdictions outside of the United States, we may face data protection and privacy requirements that are more stringent than those in place in the United States. In the EU, for example, Directive 95/46/EC (the “Directive”)

28

has required EU member states to implement data protection laws to meet the strict privacy requirements of the Directive. Among other requirements, the Directive regulates transfers of personal data that is subject to the Directive (“Personal Data”) to third countries, such as the United States, that have not been found to provide adequate protection to such Personal Data. The safe harbor framework previously relied on to ensure compliance with the Directive is no longer deemed to be a valid method of compliance with requirements set forth in the Directive, and so we face uncertainty as to whether our efforts to comply with our obligations under European privacy laws are sufficient. We and our customers are at risk of enforcement actions taken by certain EU data protection authorities until such point in time that we may be able to ensure that all transfers of Personal Data to us in the United States from the EU are conducted in compliance with all applicable regulatory obligations, the guidance of data protection authorities and evolving best practices. The Directive will be replaced in time with the GDPR, which will enter into force on May 25, 2018, and which may impose additional obligations, costs and risk upon our business. The GDPR may increase substantially the penalties to which we could be subject in the event of any non-compliance. In addition, we may incur substantial expense in complying with the new obligations to be imposed by the GDPR and we may be required to make significant changes in our business operations, all of which may adversely affect our revenues and our business overall.

In addition, we are subject to certain contractual obligations and privacy policies and practices regarding the collection, use, storage, transfer, disclosure, disposal or processing of personal data. Even the perception of a failure by us to comply with such contractual obligations and/or privacy policies and practices or other privacy concerns, whether or not valid, may harm our reputation, inhibit adoption of our solutions by current and future customers or adversely impact our ability to attract and retain workforce talent.

Loss, retention or misuse of certain information and alleged violations of laws and regulations relating to privacy and data security, and any relevant claims, may expose us to potential liability and may require us to expend significant resources on data security and in responding to and defending such allegations and claims. In addition, future laws, regulations, standards and other obligations, and changes in the interpretation of existing laws, regulations, standards and other obligations could impair our customers’ ability to collect, use or disclose data relating to individuals, which could decrease demand for our platform and solutions, increase our costs and impair our ability to maintain and grow our customer base and increase our revenue.

Around the world, there are numerous lawsuits in process against various technology companies that process personal data. If those lawsuits are successful, it could increase the likelihood that our company may be exposed to liability for our own policies and practices concerning the processing of personal data and could hurt our business. Furthermore, the costs of compliance with, and other burdens imposed by laws, regulations and policies concerning privacy and data security that are applicable to the businesses of our customers may limit the use and adoption of our platform or solutions and reduce overall demand for them. Privacy concerns, whether or not valid, may inhibit market adoption of our platform. Additionally, concerns about security or privacy may result in the adoption of new legislation that restricts the implementation of technologies like ours or requires us to make modifications to our platform, which could significantly limit the adoption and deployment of our technologies or result in significant expense to modify our platform.

We publicly post our privacy policies and practices concerning our processing, use and disclosure of the personally identifiable information provided to us by our website visitors. Our publication of our privacy policies and other statements we publish that provide promises and assurances about privacy and security can subject us to potential state and federal action if they are found to be deceptive or misrepresentative of our actual policies and practices or if our practices are found to be unfair.

Evolving and changing definitions of what constitutes personal information and personal data within the EU, the United States and elsewhere, especially relating to classification of IP addresses, machine or device identification numbers, location data and other information, may limit or inhibit our ability to operate or expand our business, including limiting technology alliance relationships that may involve the sharing of data.

29

We use third-party licensed software in or with our solutions, and the inability to maintain these licenses or issues with the software we license could result in increased costs or reduced service levels, which would adversely affect our business.

Our solutions include software or other intellectual property licensed from third parties, and we otherwise use software and other intellectual property licensed from third parties in our business. We anticipate that we will continue to rely on such third-party software and intellectual property in the future. This exposes us to risks over which we may have little or no control. The third-party software we currently license may not always be available, and we may not have access to alternative third-party software on commercially reasonable terms. In addition, a third party may assert that we or our customers are in breach of the terms of a license, which could, among other things, give such third party the right to terminate a license or seek damages from us, or both. Our inability to obtain or maintain certain licenses or other rights or to obtain or maintain such licenses or rights on favorable terms, or the need to engage in litigation regarding these matters, could result in delays in releases of new solutions, and could otherwise disrupt our business, until equivalent technology can be identified, licensed or developed, if at all. Also, to the extent that our platform and solutions depend upon the successful operation of third-party software in conjunction with our software, any undetected errors or defects in such third-party software could prevent the deployment or impair the functionality of our platform, delay new feature introductions, result in a failure of our platform and injure our reputation.

Our failure to raise additional capital or generate cash flows necessary to expand our operations and invest in new technologies in the future could reduce our ability to compete successfully and harm our operating results.

We may need to raise additional funds, and we may not be able to obtain additional debt or equity financing on favorable terms, if at all. If we raise additional equity financing, our security holders may experience significant dilution of their ownership interests. If we engage in debt financing, we may be required to accept terms that restrict our ability to incur additional indebtedness, force us to maintain specified liquidity or other ratios or restrict our ability to pay dividends or make acquisitions. If we need additional capital and cannot raise it on acceptable terms, or at all, we may not be able to, among other things:

Our debt obligations contain restrictions that impact our business and expose us to risks that could adversely affect our liquidity and financial condition.

At March 31, 2018, the balance outstanding under our term loan facility was $70.0 million, and we had a $7.5 million revolving credit facility (under which we had no outstanding borrowings and $6.0 million outstanding under a letter of credit sub-facility). Our interest expense during the years ended December 31, 2015, 2016 and 2017 and the three months ended March 31, 2018 was approximately $3.9 million, $7.3 million, $14.8 million and $1.2 million, respectively, which includes non-cash amortization of loan origination fees and loss on the modification and partial extinguishment of debt as well as $1.4 million in cash charges for an early prepayment penalty in 2017.

The credit and guaranty agreement (as amended, restated, amended and restated, supplemented or otherwise modified from time to time, the “Credit Agreement”) governing our term loan facility and our revolving credit facility (collectively, our “credit facility”) contains various covenants that are operative so long as our credit facility remains outstanding. The covenants, among other things, limit our and certain of our subsidiaries’ abilities to:

30

Our credit facility also contains numerous affirmative covenants, including financial covenants. Even if our credit facility is terminated, any additional debt that we incur in the future could subject us to similar or additional covenants.

If we experience a decline in cash flow due to any of the factors described in this “Risk Factors” section or otherwise, we could have difficulty paying interest and principal amounts due on our indebtedness and meeting the financial covenants set forth in our credit facility. If we are unable to generate sufficient cash flow or otherwise to obtain the funds necessary to make required payments under our credit facility, or if we fail to comply with the various requirements of our indebtedness, we could default under our credit facility. Any such default that is not cured or waived could result in an acceleration of indebtedness then outstanding under our credit facility, an increase in the applicable interest rates under our credit facility, and a requirement that our subsidiaries that have guaranteed our credit facility pay the obligations in full, and would permit the lenders to exercise remedies with respect to all of the collateral that is securing our credit facility, including substantially all of our and our subsidiary guarantors’ assets. Thus, any such default could have a material adverse effect on our liquidity and financial condition.

We may acquire or invest in companies, which may divert our management’s attention and result in additional dilution to our stockholders. We may be unable to integrate acquired businesses and technologies successfully or achieve the expected benefits of such acquisitions.

Our success will depend, in part, on our ability to expand our solutions and services and grow our business in response to changing technologies, customer demands and competitive pressures. In some circumstances, we may choose to do so through the acquisition of, or investment in, new or complementary businesses and technologies rather than through internal development. The identification of suitable acquisition or investment candidates can be difficult, time-consuming and costly, and we may not be able to successfully complete identified acquisitions or investments. The risks we face in connection with acquisitions and/or investments include:

31

The occurrence of any of these risks could adversely affect our business, operating results and financial condition.

If we fail to adequately protect our proprietary rights, our competitive position could be impaired and we may lose valuable assets, generate reduced revenue and incur costly litigation to protect our rights.

We rely on copyrights and trade secret laws, confidentiality procedures, employment proprietary information and inventions assignment agreements, trademarks and patents to protect our intellectual property rights. However, the steps we take to protect our intellectual property may not be adequate. To protect our trade secrets and proprietary information, we rely in significant part on confidentiality arrangements with our employees, licensees, independent contractors, advisers, channel partners, resellers and customers. These arrangements may not be effective to prevent disclosure of confidential information, including trade secrets, and may not provide an adequate remedy in the event of unauthorized disclosure of confidential information. In addition, if others independently discover trade secrets and proprietary information, we would not be able to assert trade secret rights against such parties. To protect our intellectual property, we may be required to spend significant resources to obtain, monitor and enforce such rights. Litigation brought to enforce our intellectual property could be costly, time-consuming and distracting to management and could be met with defenses, counterclaims and countersuits attacking the validity and enforceability of our intellectual property, which may result in the impairment or loss of portions of our intellectual property. The laws of some foreign countries do not protect our intellectual property to the same extent as the laws of the United States, and effective intellectual property protection and mechanisms may not be available in those jurisdictions. We may need to expend additional resources to defend our intellectual property in these countries, and our inability to do so could impair our business or adversely affect our international expansion. Even if we are able to secure intellectual property, there can be no assurances that such rights will provide us with competitive advantages or distinguish our platform or solutions and services from those of our competitors or that our competitors will not independently develop similar technology.

We may be subject to intellectual property rights claims by third parties, which may be costly to defend, could require us to pay significant damages and could limit our ability to use certain technologies.

Companies in the software and technology industries, including some of our current and potential competitors, own large numbers of patents, copyrights, trademarks and trade secrets and frequently enter into litigation based on allegations of infringement, misappropriation or other violations of intellectual property rights. We have received, and may in the future be subject to, notices that claim we have infringed, misappropriated or misused the intellectual property of our competitors or other third parties, including patent holding companies whose sole business is to assert such claims. For example, International Business Machines Corporation (“IBM”) has alleged that we have infringed one of its patents and has invited us to negotiate a business resolution of this allegation. We are in the early stages of analyzing this matter, and there can be no assurance that we will reach a business resolution that is satisfactory to us or that we will avoid litigation in

32

connection with IBM’s allegation. To the extent we increase our visibility in the market, we face a higher risk of being the subject of intellectual property claims. Additionally, we do not have a significant patent portfolio, which could prevent us from deterring patent infringement claims through our own patent portfolio, and our competitors and others may now or in the future have significantly larger and more mature patent portfolios than we do.

Any intellectual property claims, with or without merit, could be time-consuming and expensive and could divert our management’s attention and other resources. These claims could also subject us to significant liability for damages, potentially including treble damages if we are found to have willfully infringed patents or copyrights. These claims could also result in our having to stop using technology found to be in violation of a third party’s rights. We might be required to seek a license for the intellectual property, which may not be available on reasonable terms or at all. Even if a license is available, we could be required to pay significant royalties, which would increase our operating expenses. As a result, we may be required to develop alternative non-infringing technology, which could require significant effort and expense. If we cannot license or develop technology for any aspect of our business that may ultimately be determined to infringe on or misappropriate the intellectual property rights of another party, we could be forced to limit or stop sales of licenses to our platform and solutions and may be unable to compete effectively. Furthermore, we may be subject to indemnification obligations with respect to third-party intellectual property pursuant to our agreements with our channel partners or customers. Any of these results would adversely affect our business, operating results and financial condition.

Indemnity provisions in various agreements potentially expose us to substantial liability for intellectual property infringement and other losses.

Our agreements with customers and other third parties may include indemnification provisions under which we agree to indemnify them or otherwise be liable for losses suffered or incurred as a result of claims of intellectual property infringement or misappropriation, damages caused by us to property or persons, or other liabilities relating to or arising from our platform, solutions, services or other contractual obligations. Some of these indemnity agreements provide for uncapped liability for which we would be responsible, and some indemnity provisions survive termination or expiration of the applicable agreement.

From time to time, customers also require us to indemnify or otherwise be liable to them for breach of confidentiality, violation of applicable law or failure to implement adequate security measures with respect to their data stored, transmitted or accessed using our platform. Although we normally seek contractual limitations to our liability with respect to the foregoing obligations, the existence of such a dispute may have adverse effects on our customer relationship and reputation and even if we contractually limit our liability with respect to such obligations, we may still incur substantial liability related to them. Any assertions by a third party, whether or not successful, with respect to any of these indemnification obligations could subject us to costly and time-consuming litigation, expensive remediation and licenses, divert management attention and financial resources, harm our relationship with that customer and other current and prospective customers, reduce demand for our platform and solutions, and harm our brand, business, operating results and financial condition. Any dispute with a customer with respect to such obligations could have adverse effects on our relationship with that customer and other existing customers and new customers and adversely affect our business and operating results.

We may be subject to damages resulting from claims that our employees or contractors have wrongfully used or disclosed alleged trade secrets of their former employers or other parties.

We could in the future be subject to claims that we, our employees or our contractors have inadvertently or otherwise used or disclosed trade secrets or other proprietary information of our competitors or other parties. Litigation may be necessary to defend against these claims. If we fail in defending against such claims, a court could order us to pay substantial damages and prohibit us from using technologies or features that are essential to our solutions, if such technologies or features are found to incorporate or be derived from the trade secrets or other proprietary information of these parties. In addition, we may lose valuable intellectual property rights or

33

personnel. A loss of key personnel or their work product could hamper or prevent our ability to develop, market and support potential solutions or enhancements, which could severely harm our business. Even if we are successful in defending against these claims, such litigation could result in substantial costs and be a distraction to management.

Our use of “open source” software could negatively affect our ability to sell our solutions and subject us to possible litigation.

Some aspects of our platform and solutions are built using open source software, and we intend to continue to use open source software in the future. From time to time, we contribute software source code to open source projects under open source licenses or release internal software projects under open source software licenses, and anticipate doing so in the future. The terms of certain open source licenses to which we are subject have not been interpreted by U.S. or foreign courts, and there is a risk that open source software licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to monetize our products. Additionally, we may from time to time face claims from third parties claiming ownership of, or demanding release of, the open source software or derivative works that we developed using such software, which could include our proprietary source code, or otherwise seeking to enforce the terms of the applicable open source software license. These claims could result in litigation and could require us to make our software source code freely available, purchase a costly license or cease offering the implicated services unless and until we can re-engineer them to avoid infringement or violation. This re-engineering process could require significant additional research and development resources, and we may not be able to complete it successfully. In addition to risks related to license requirements, use of certain open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or controls on the origin of software and, thus, may contain security vulnerabilities or broken code. Additionally, because any software source code we contribute to open source projects is publicly available, our ability to protect our intellectual property rights with respect to such software source code may be limited or lost entirely, and we may be unable to prevent our competitors or others from using such contributed software source code. Any of these risks could be difficult to eliminate or manage, and if not addressed, could have a negative effect on our business, operating results and financial condition.

We may be required to defer recognition of some of our license revenue, which may harm our operating results in any given period.

We may be required to defer recognition of license revenue for a significant period of time after entering into an agreement due to a variety of factors, including, among other things, whether:

Although we strive to enter into agreements that meet the criteria under GAAP for current revenue recognition on delivered elements, our agreements are often subject to negotiation and revision based on the demands of our customers. The final terms of our agreements sometimes result in deferred revenue recognition well after the time of delivery, which may adversely affect our financial results in any given period.

Furthermore, the presentation of our financial results requires us to make estimates and assumptions that may affect revenue recognition. In some instances, we could reasonably use different estimates and assumptions, and changes in estimates are likely to occur from period to period. Accordingly, actual results could differ significantly from our estimates.

34

If our estimates or judgments relating to our critical accounting policies prove to be incorrect, our operating results could be adversely affected.

The preparation of financial statements in conformity with GAAP requires management to make estimates and assumptions that affect the amounts reported in our consolidated financial statements and accompanying notes. We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as provided in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations.” The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities and equity, and the amount of revenue and expenses that are not readily apparent from other sources. Significant assumptions and estimates used in preparing our consolidated financial statements include those related to revenue recognition, capitalized internal-use software costs, income taxes, other non-income taxes, business combinations and valuation of goodwill and purchased intangible assets and stock-based compensation. Our operating results may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our operating results to fall below the expectations of securities analysts and investors, resulting in a decline in the trading price of our common stock.

Changes in existing financial accounting standards or practices, or taxation rules or practices, may harm our operating results.

Changes in existing accounting or taxation rules or practices, new accounting pronouncements or taxation rules, or varying interpretations of current accounting pronouncements or taxation practice could harm our operating results or the manner in which we conduct our business. Further, such changes could potentially affect our reporting of transactions completed before such changes are effective.

GAAP is subject to interpretation by the Financial Accounting Standards Board (“FASB”), the SEC and various bodies formed to promulgate and interpret appropriate accounting principles. A change in these principles or interpretations could have a significant effect on our reported financial results and could affect the reporting of transactions completed before the announcement of a change.

For example, in May 2014 the FASB issued ASU No. 2014-09, Revenue from Contracts with Customers (“Topic 606”), for which certain elements may impact our accounting for revenue and costs incurred to acquire contracts. We will be required to implement this guidance for our annual reporting period beginning after December 15, 2018, unless we are no longer an emerging growth company on December 31, 2018. See “—If we lose emerging growth company status on December 31, 2018, we will incur substantial costs and significant demands will be placed upon management in connection with complying with non-emerging growth company requirements earlier than we had planned.” Application of Topic 606 may significantly impact the amount and timing of revenue recognition, such as recognizing revenue from existing contracts in periods other than when historically reported under existing GAAP or the revenue recognized under existing GAAP could be eliminated as part of the effect of adoption. Further, adoption of Topic 606 could result in changes to the periods when revenue is recognized in the future compared with management’s current expectations under existing GAAP. In addition, Topic 606 may significantly change the timing of when expense recognition will occur related to costs to obtain and fulfill customer contracts. While the adoption of Topic 606 does not change the cash flows received from our contracts with customers, the adoption of Topic 606 could have a material adverse effect on our financial position or results of operations.

Our business may be subject to additional obligations to collect and remit sales tax and other taxes, and we may be subject to tax liability for past sales. Any successful action by state, foreign or other authorities to collect additional or past sales tax could adversely affect our business.

States and some local taxing jurisdictions have differing rules and regulations governing sales and use taxes, and these rules and regulations are subject to varying interpretations that may change over time. In particular, the

35

applicability of sales taxes to our platform in various jurisdictions is unclear. It is possible that we could face sales tax audits and that our liability for these taxes could exceed our estimates as state tax authorities could still assert that we are obligated to collect additional amounts as taxes from our customers and remit those taxes to those authorities. We could also be subject to audits in states and international jurisdictions for which we have not accrued tax liabilities. A successful assertion that we should be collecting additional sales or other taxes on our services in jurisdictions where we have not historically done so and do not accrue for sales taxes could result in substantial tax liabilities for past sales, discourage customers from purchasing our products or otherwise adversely affect our business, operating results and financial condition.

We file sales tax returns in certain states within the United States as required by law and certain customer contracts for a portion of the products that we provide. We do not collect sales or other similar taxes in other states and many of such states do not apply sales or similar taxes to the vast majority of the products that we provide. However, one or more states or foreign authorities could seek to impose additional sales, use or other tax collection and record-keeping obligations on us or may determine that such taxes should have, but have not been, paid by us. Liability for past taxes may also include substantial interest and penalty charges. Any successful action by state, foreign or other authorities to compel us to collect and remit sales tax, use tax or other taxes, either retroactively, prospectively or both, could adversely affect our business, operating results and financial condition.

If our products fail to help our customers achieve and maintain compliance with certain government regulations and industry standards, our business and operating results could be materially and adversely affected.

We believe we generate a portion of our revenues from our products and services because our customers use our products and services as part of their efforts to achieve and maintain compliance with certain government regulations and industry standards, and we expect that will continue for the foreseeable future. Examples of industry standards and government regulations include the Payment Card Industry Data Security Standard (“PCI-DSS”); the Federal Information Security Management Act (FISMA) and associated National Institute for Standards and Testing (NIST) Network Security Standards; the Sarbanes-Oxley Act; Title 21 of the U.S. Code of Federal Regulations, which governs food and drugs industries; the North American Electric Reliability Corporation Critical Infrastructure Protection Plan (NERC-CIP); the GDPR; the German Federal Financial Supervisory Authority (BaFin) Minimum Requirements for Risk Management; and the Monetary Authority of Singapore’s Technology Risk Management Notices. These industry standards may change with little or no notice, including changes that could make them more or less onerous for businesses. In addition, governments may also adopt new laws or regulations, or make changes to existing laws or regulations, that could affect whether our customers believe our solution assists them in maintaining compliance with such laws or regulations. If our solutions fail to expedite our customers’ compliance initiatives, our customers may lose confidence in our products and could switch to products offered by our competitors. In addition, if government regulations and industry standards related to IT security are changed in a manner that makes them less onerous, our customers may view compliance as less critical to their businesses, and our customers may be less willing to purchase our products and services. In either case, our sales and financial results would suffer.

Failure to comply with anti-bribery, anti-corruption and anti-money laundering laws could subject us to penalties and other adverse consequences.

We are subject to the Foreign Corrupt Practices Act (“FCPA”), the U.K. Bribery Act and other anti-corruption, anti-bribery and anti-money laundering laws in various jurisdictions both domestic and abroad. The FCPA prohibits any U.S. individual or business from paying, offering, authorizing payment or offering of anything of value, directly or indirectly, to any foreign official, political party or candidate for the purpose of influencing any act or decision of the foreign entity in order to assist the individual or business in obtaining or retaining business. The U.K. Bribery Act is similar but even broader in scope in that it prohibits bribery of private (non-government) persons as well. The FCPA also obligates companies whose securities are listed in the

36

United States to comply with certain accounting provisions requiring the company to maintain books and records that accurately and fairly reflect all transactions of the corporation, including international subsidiaries, and to devise and maintain an adequate system of internal accounting controls for international operations. Our sales model presents some risk under these laws. We leverage third parties, including channel partners, to sell our solutions and conduct our business abroad. We and our third-party intermediaries may have direct or indirect interactions with officials and employees of government agencies, state-owned or affiliated entities and non-governmental commercial entities, and may be held liable for the corrupt or other illegal activities of these third-party intermediaries, our employees, representatives, contractors, channel partners and agents, even if we do not explicitly authorize such activities. While we have policies and procedure to address compliance with these laws, we cannot assure you that all of our employees and agents will not take actions in violation of our policies and applicable law, for which we may be ultimately held responsible. Noncompliance with these laws could subject us to investigations, sanctions, settlements, prosecution, other enforcement actions, disgorgement of profits, significant fines, damages, other civil and criminal penalties or injunctions, adverse media coverage and other consequences. Any investigations, actions or sanctions could adversely affect our business, operating results and financial condition.

We are subject to governmental export controls and economic sanctions laws that could impair our ability to compete in international markets and subject us to liability if we are not in full compliance with applicable laws.

Our business activities are subject to various restrictions under U.S. export controls and trade and economic sanctions laws, including the U.S. Commerce Department’s Export Administration Regulations and economic and trade sanctions regulations maintained by the U.S. Treasury Department’s Office of Foreign Assets Control. The U.S. export control laws and U.S. economic sanctions laws include prohibitions on the sale or supply of certain products and services to U.S. embargoed or sanctioned countries, governments, persons and entities and also require authorization for the export of encryption items. We are also subject to Israeli export controls on encryption technology for SecurityIQ. If the applicable U.S. or Israeli requirements regarding export of encryption technology were to change or if we change the encryption means in our products, we may need to satisfy additional requirements in the United States or Israel. There can be no assurance that we will be able to satisfy any additional requirements under these circumstances in either the United States or Israel.

In addition, various countries regulate the import of certain encryption technology, including through import permitting and licensing requirements, and have enacted laws that could limit our ability to distribute our services or could limit our customers’ ability to implement our services in those countries. Although we take precautions to prevent our products from being provided in violation of such laws, our products may have been in the past, and could in the future be, provided inadvertently in violation of such laws, despite the precautions we take. If we fail to comply with these laws and regulations, we and certain of our employees could be subject to civil or criminal penalties, including the possible loss of export privileges and monetary penalties. Obtaining the necessary authorizations, including any required license, for a particular transaction may be time-consuming, is not guaranteed, and may result in the delay or loss of sales opportunities. Although we take precautions to prevent transactions with U.S. sanction targets, we could inadvertently provide our products to persons prohibited by U.S. sanctions. This could result in negative consequences to us, including government investigations, penalties and harm to our reputation.

Our corporate structure and intercompany arrangements are subject to the tax laws of various jurisdictions, and we could be obligated to pay additional taxes, which would harm our operating results.

Based on our current corporate structure, we may be subject to taxation in several jurisdictions around the world with increasingly complex tax laws, the application of which can be uncertain. The amount of taxes we pay in these jurisdictions could increase substantially as a result of changes in the applicable tax principles, including increased tax rates, new tax laws or revised interpretations of existing tax laws and precedents. In addition, the authorities in these jurisdictions could challenge our methodologies for valuing developed technology or intercompany arrangements,

37

including our transfer pricing. The relevant taxing authorities may determine that the manner in which we operate our business does not achieve the intended tax consequences. If such a disagreement were to occur, and our position were not sustained, we could be required to pay additional taxes, interest and penalties. Such authorities could claim that various withholding requirements apply to us or our subsidiaries or assert that benefits of tax treaties are not available to us or our subsidiaries. Any increase in the amount of taxes we pay or that are imposed on us could increase our worldwide effective tax rate and adversely affect our business and operating results.

Our ability to use NOLs and other tax attributes to offset future taxable income may be subject to certain limitations.

In general, under Sections 382 and 383 of the Internal Revenue Code of 1986, as amended (the “Internal Revenue Code”), a corporation that undergoes an “ownership change” is subject to limitations on its ability to utilize its pre-change NOLs, tax credits or other tax attributes to offset future taxable income or taxes. For these purposes, an ownership change generally occurs where the aggregate stock ownership of one or more stockholders or groups of stockholders who owns at least 5% of a corporation’s stock increases its ownership by more than 50 percentage points over its lowest ownership percentage within a specified testing period. Our existing NOLs may be subject to substantial limitations arising from previous ownership changes, and if we undergo an ownership change in the future, our ability to utilize NOLs could be further limited by Sections 382 and 383 of the Internal Revenue Code. In addition, this offering or future changes in our stock ownership, many of which are outside of our control, could result in an ownership change under Sections 382 and 383 of the Internal Revenue Code. Our NOLs may also be impaired under state law. Accordingly, we may not be able to utilize a material portion of our NOLs. Furthermore, our ability to utilize our NOLs is conditioned upon our attaining profitability and generating U. S. federal and state taxable income.

We function as a HIPAA “business associate” for certain of our customers and, as such, are subject to strict privacy and data security requirements. If we fail to comply with any of these requirements, we could be subject to significant liability, all of which can adversely affect our business as well as our ability to attract and retain new customers.

The Health Insurance Portability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and their respective implementing regulations (“HIPAA”), imposes specified requirements relating to the privacy, security and transmission of individually identifiable health information. Among other things, HITECH makes HIPAA’s security standards directly applicable to “business associates.” We function as a business associate for certain of our customers that are HIPAA covered entities and service providers, and in that context we are regulated as a business associate for the purposes of HIPAA. If we are unable to comply with our obligations as a HIPAA business associate, we could face substantial civil and even criminal liability. Modifying the already stringent penalty structure that was present under HIPAA prior to HITECH, HITECH created four new tiers of civil monetary penalties and gave state attorneys general new authority to file civil actions for damages or injunctions in federal courts to enforce the federal HIPAA laws and seek attorneys’ fees and costs associated with pursuing federal civil actions. In addition, many state laws govern the privacy and security of health information in certain circumstances, many of which differ from HIPAA and each other in significant ways and may not have the same effect.

The HIPAA covered entities and service providers to which we provide services require us to enter into HIPAA-compliant business associate agreements with them. These agreements impose stringent data security obligations on us. If we are unable to meet the requirements of any of these business associate agreements, we could face contractual liability under the applicable business associate agreement as well as possible civil and criminal liability under HIPAA, all of which can have an adverse impact on our business and generate negative publicity, which, in turn, can have an adverse impact on our ability to attract and retain new customers.

38

Risks Related to This Offering and Ownership of Our Common Stock

The requirements of being a public company, including compliance with the reporting requirements of the Exchange Act and the requirements of the Sarbanes-Oxley Act and the NYSE, may strain our resources, increase our costs and distract management, and we may be unable to comply with these requirements in a timely or cost-effective manner.

As a public company, we are subject to laws, regulations and requirements with which we were not required to comply as a private company, including compliance with reporting requirements of the Exchange Act and the requirements of the Sarbanes-Oxley Act and the NYSE. As a newly public company, complying with these statutes, regulations and requirements occupies a significant amount of time of our board of directors and management and has significantly increased our costs and expenses as compared to when we were a private company. For example, as a newly public company, we have had to institute a more comprehensive compliance function, establish new internal policies, such as those relating to insider trading, and involve and retain to a greater degree outside counsel and accountants. In addition, being a public company subject to these rules and regulations has made it more expensive for us to obtain director and officer liability insurance, and we may be required to accept reduced policy limits and coverage or incur substantially higher costs to obtain the same or similar coverage. As a result, it may be more difficult for us to attract and retain qualified individuals to serve on our board of directors or as executive officers as compared to when we were a private company.

Furthermore, while we generally must comply with Section 404 of the Sarbanes-Oxley Act for our fiscal year ending December 31, 2018, we are not required to have our independent registered public accounting firm attest to the effectiveness of our internal controls until our first annual report subsequent to our ceasing to be an emerging growth company. Accordingly, we may not be required to have our independent registered public accounting firm attest to the effectiveness of our internal controls until as late as our annual report for the fiscal year ending December 31, 2022. Once it is required to do so, our independent registered public accounting firm may issue a report that is adverse in the event it is not satisfied with the level at which our controls are documented, designed, operated or reviewed. Compliance with these requirements may strain our resources, increase our costs and distract management, and we may be unable to comply with these requirements in a timely or cost-effective manner.

The trading price of our common stock could be volatile, which could cause the value of your investment to decline.

Our initial public offering occurred in November 2017. Therefore, there has only been a public market for our common stock for a short period of time. Although our common stock is listed on the NYSE, an active trading market for our common stock may not develop or, if developed, be sustained. Technology stocks have historically experienced high levels of volatility. The trading price of our common stock may fluctuate substantially. Since shares of our common stock were sold in our initial public offering in November 2017 at a price of $12.00 per share, our stock price has fluctuated significantly, ranging from an intraday low of $12.82 to an intraday high of $26.92 through May 18, 2018. Factors that could cause fluctuations in the trading price of our common stock include the following:

39

In addition, if the market for technology stocks or the stock market in general experiences a loss of investor confidence, the trading price of our common stock could decline for reasons unrelated to our business, operating results or financial condition. The trading price of our common stock might also decline in reaction to events that affect other companies in our industry even if these events do not directly affect us. If the market price of our common stock after this offering does not exceed the public offering price, you may lose some or all of your investment.

In the past, following periods of volatility in the trading price of a company’s securities, securities class action litigation has often been brought against that company. If our stock price is volatile, we may become the target of securities litigation. Securities litigation could result in substantial costs and divert our management’s attention and resources from our business. This could have an adverse effect on our business, operating results and financial condition.

An active public trading market may not continue to develop or be sustained.

Prior to the completion of our initial public offering in November 2017, no public market for our common stock existed. An active public trading market for our common stock may not continue to develop or be sustained. The lack of an active market may impair your ability to sell your shares of our common stock at the time you wish to sell them or at a price that you consider reasonable. The lack of an active market may also reduce the fair value of your shares. An inactive market may also impair our ability to raise capital by selling shares and may impair our ability to acquire other companies or technologies by using our shares as consideration.

If securities analysts or industry analysts were to downgrade our stock, publish negative research or reports or fail to publish reports about our business, our competitive position could suffer, and our stock price and trading volume could decline.

The trading market for our common stock, to some extent, depends on the research and reports that securities or industry analysts publish about us or our business. We do not have any control over these analysts. If one or more of the analysts who cover us should downgrade our stock or publish negative research or reports, cease coverage of our company or fail to regularly publish reports about our business, our competitive position could suffer, and our stock price and trading volume could decline.

Sales of substantial amounts of our common stock in the public markets, or the perception that such sales could occur, could reduce the market price of our common stock.

Sales of a substantial number of shares of our common stock in the public market, or the perception that such sales could occur, could adversely affect the market price of our common stock and may make it more difficult for

40

you to sell your common stock at a time and price that you deem appropriate. We are unable to predict the effect that such sales may have on the prevailing market price of our common stock.

As of May 10, 2018, we had outstanding 87,201,627 shares of common stock. Of these shares, the 23,000,000 shares of common stock sold in our initial public offering are freely tradable, and the 15,000,000 shares of common stock sold in this offering will be freely tradable immediately upon consummation of this offering. Also, recently, on May 15, 2018, the 180-day lock-up period applicable to our other shares of common stock expired; however, pursuant to lock-up agreements entered into in connection with this offering, 39,235,226 of these shares are subject to a 90-day lock-up period, as discussed below, as of the date hereof.

Subject to certain exceptions described in the section titled “Underwriting,” we, our directors, chief executive officer, chief financial officer and principal accounting officer and the Thoma Bravo Funds have agreed, or will agree, to enter into lock-up agreements with the underwriters of this offering pursuant to which we and they have agreed, or will agree, that we and they will not dispose of or hedge any shares of our common stock or any securities convertible into or exchangeable for shares of our common stock for a period of 90 days after the date of this prospectus. As of May 10, 2018, our directors, chief executive officer, chief financial officer and principal accounting officer and Thoma Bravo held, directly or indirectly, 54,694,842 shares of our common stock in the aggregate. The underwriters may, in their sole discretion, permit our stockholders who are subject to the 90-day lock-up period to sell shares prior to the end of such period. Sales of a substantial number of such shares upon expiration of, or the perception that such sales may occur, or early release of the securities subject to, the lock-up agreements, could cause our stock price to fall or make it more difficult for you to sell your common stock at a time and price that you deem appropriate. Pursuant to the lock-up agreements, sales as part of trading plans adopted pursuant to Rule 10b5-1 under the Exchange Act prior to the effective date of the lock-up agreements are not subject to the 90-day lock-up period. Our Section 16 officers have adopted Rule 10b5-1 trading plans to sell, directly or indirectly, up to 1,197,616 shares of our common stock in the aggregate on a periodic basis to diversify their assets and investments. During the 90-day lock-up period related to this offering, our Section 16 officers may sell, directly or indirectly, up to 659,616 shares of our common stock in the aggregate pursuant to these Rule 10b5-1 trading plans.

As of May 10, 2018, there were 3,451,581 shares of common stock subject to outstanding options and 1,274,168 shares of common stock to be issued upon the vesting of outstanding restricted stock units. We have registered all of the shares of common stock issuable upon the exercise of outstanding options, upon the vesting of outstanding restricted stock units and upon exercise of settlement of any options or other equity incentives we may grant in the future for public resale under the Securities Act of 1933, as amended (the “Securities Act”). Accordingly, these shares may be freely sold in the public market upon issuance as permitted by any applicable vesting requirements, subject to the lock-up agreements described above and compliance with applicable securities laws. Furthermore, holders of 70,115,454 shares of our common stock, as of immediately following the completion of our initial public offering offering, have certain rights with respect to the registration of such shares (and any additional shares acquired by such holders thereafter) under the Securities Act; the selling stockholders are offering shares in this offering pursuant to the exercise of such rights. See the section titled “Certain Relationships and Related Party Transactions—Registration Rights” for more information.

Our issuance of additional capital stock in connection with financings, acquisitions, investments, our stock incentive plans or otherwise will dilute all other stockholders.

We may issue additional capital stock in the future that will result in dilution to all other stockholders. We may also raise capital through equity financings in the future. As part of our business strategy, we may acquire or make investments in complementary companies, products or technologies and issue equity securities to pay for any such acquisition or investment. Any such issuances of additional capital stock may cause stockholders to experience significant dilution of their ownership interests and the per share value of our common stock to decline.

41

We do not intend to pay dividends on our common stock, and consequently, your ability to achieve a return on your investment will depend on appreciation in the price of our common stock.

We have never declared or paid any dividends on our common stock. We intend to retain any earnings to finance the operation and expansion of our business, and we do not anticipate paying any cash dividends in the foreseeable future. As a result, you may only receive a return on your investment in our common stock if the market price of our common stock increases.

Our charter and bylaws contain anti-takeover provisions that could delay or discourage takeover attempts that stockholders may consider favorable.

Our Third Amended and Restated Certificate of Incorporation (our “charter“) and our Second Amended and Restated Bylaws (our “bylaws”) contain provisions that could delay or prevent a change in control of our company. These provisions could also make it difficult for stockholders to elect directors who are not nominated by the current members of our board of directors or take other corporate actions, including effecting changes in our management. These provisions include:

42

Our charter also contains a provision that provides us with protections similar to Section 203 of the Delaware General Corporation Law (“DGCL”) and prevents us from engaging in a business combination, such as a merger, with an interested stockholder (i.e., a person or group who acquires at least 15% of our voting stock) for a period of three years from the date such person became an interested stockholder, unless (with certain exceptions) the business combination or the transaction in which the person became an interested stockholder is approved in a prescribed manner. However, our charter also provides that Thoma Bravo, including the Thoma Bravo Funds, and any persons to whom any Thoma Bravo Fund sells its common stock will be deemed not to be interested stockholders.

Thoma Bravo has significant influence over matters requiring stockholder approval, which could delay or prevent a change of control.

Thoma Bravo, as the ultimate general partner of the Thoma Bravo Funds, beneficially owned in the aggregate 58% of our common stock as of May 10, 2018 and, immediately after this offering, will beneficially own in the aggregate 41% of our common stock (or, if the underwriters’ option to purchase additional shares is exercised in full, 38% of our common stock) (which shares are or will be held directly by the Thoma Bravo Funds or their affiliates). As a result, Thoma Bravo will continue to be able to exert significant influence over our operations and business strategy as well as matters requiring stockholder approval. These matters may include:

Additionally, for so long as Thoma Bravo beneficially owns at least (i) 30% of our outstanding shares of common stock, Thoma Bravo will have the right to designate the chairman of our board of directors and of each committee of our board of directors as well as nominate a majority of our board of directors (provided that, at such time as we cease to be a controlled company under the NYSE corporate governance standards, which we expect will occur in connection with the completion of this offering, the majority of our board of directors will be “independent” directors, as defined under the rules of the NYSE, and provided further, that, the membership of each committee of our board of directors will comply with the applicable rules of the NYSE); (ii) 20% (but less than 30%) of our outstanding shares of common stock, Thoma Bravo will have the right to nominate a number of directors to our board of directors equal to the lowest whole number that is greater than 30% of the total number of directors (but in no event fewer than two directors); (iii) 10% (but less than 20%) of our outstanding shares of common stock, Thoma Bravo will have the right to nominate a number of directors to our board of directors equal to the lowest whole number that is greater than 20% of the total number of directors (but in no event fewer than one director); and (iv) at least 5% (but less than 10%) of our outstanding shares of common stock, Thoma Bravo will have the right to nominate one director to our board of directors. For so long as Thoma Bravo beneficially owns at least 30% of our outstanding shares of common stock, the directors nominated by Thoma Bravo are expected to constitute a majority of each committee of our board of directors, other than the audit committee.

This concentration of ownership of our common stock could delay or prevent proxy contests, mergers, tender offers, open-market purchase programs or other purchases of our common stock that might otherwise result in the opportunity to realize a premium over the then-prevailing market price of our common stock. This concentration of ownership may also adversely affect our share price.

43

Thoma Bravo may pursue corporate opportunities independent of us that could present conflicts with our and our stockholders’ interests.

Thoma Bravo is in the business of making or advising on investments in companies and holds (and may from time to time in the future acquire) interests in or provides advice to businesses that directly or indirectly compete with certain portions of our business or are suppliers or customers of ours. Thoma Bravo may also pursue acquisitions that may be complementary to our business and, as a result, those acquisition opportunities may not be available to us.

Our charter provides that no officer or director of the Company who is also a principal, officer, director, member, manager, partner, employee and/or independent contractor of Thoma Bravo will be liable to us or our stockholders for breach of any fiduciary duty by reason of the fact that any such individual pursues or acquires a corporate opportunity for its own account or the account of an affiliate, as applicable, instead of us, directs a corporate opportunity to any other person, instead of us or does not communicate information regarding a corporate opportunity to us.

We may issue preferred stock whose terms could adversely affect the voting power or value of our common stock.

Our charter authorizes us to issue, without the approval of our stockholders, one or more classes or series of preferred stock having such designations, preferences, limitations and relative rights, including preferences over our common stock respecting dividends and distributions, as our board of directors may determine. The terms of one or more classes or series of preferred stock could adversely impact the voting power or value of our common stock. For example, we might grant holders of preferred stock the right to elect some number of our directors in all events or on the happening of specified events or the right to veto specified transactions. Similarly, the repurchase or redemption rights or liquidation preferences we might assign to holders of preferred stock could affect the residual value of our common stock.

Our charter designates the Court of Chancery of the State of Delaware as the sole and exclusive forum for certain types of actions and proceedings that may be initiated by our stockholders, which could limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us or our directors, officers, employees or agents.

Our charter provides that, unless we consent in writing to the selection of an alternative forum, the Court of Chancery of the State of Delaware will, to the fullest extent permitted by applicable law, be the sole and exclusive forum for (i) any derivative action or proceeding brought on our behalf, (ii) any action asserting a claim of breach of a fiduciary duty owed by any of our directors, officers, employees or agents to us or our stockholders, (iii) any action asserting a claim arising pursuant to any provision of the DGCL, our charter or bylaws, or (iv) any action asserting a claim against us that is governed by the internal affairs doctrine, in each such case subject to such Court of Chancery of the State of Delaware having personal jurisdiction over the indispensable parties named as defendants therein. Any person or entity purchasing or otherwise acquiring any interest in shares of our capital stock will be deemed to have notice of, and consented to, the provisions of our charter described in the preceding sentence. This choice of forum provision may limit a stockholder’s ability to bring a claim in a judicial forum that it finds favorable for disputes with us or our directors, officers, employees or agents, which may discourage such lawsuits against us and such persons. Alternatively, if a court were to find these provisions of our charter inapplicable to, or unenforceable in respect of, one or more of the specified types of actions or proceedings, we may incur additional costs associated with resolving such matters in other jurisdictions, which could adversely affect our business, financial condition or operating results.

For as long as we are an emerging growth company, we will not be required to comply with certain requirements that apply to other public companies.

We are an emerging growth company, as defined in the JOBS Act. For as long as we are an emerging growth company, which may be up to five full fiscal years, unlike other public companies, we are not required to,

44

among other things: (i) provide an auditor’s attestation report on management’s assessment of the effectiveness of our system of internal control over financial reporting pursuant to Section 404(b) of the Sarbanes-Oxley Act; (ii) comply with any new requirements adopted by the Public Company Accounting Oversight Board (the “PCAOB”) requiring mandatory audit firm rotation or a supplement to the auditor’s report in which the auditor would be required to provide additional information about the audit and the financial statements of the issuer; (iii) provide certain disclosures regarding executive compensation required of larger public companies; or (iv) hold nonbinding advisory votes on executive compensation and any golden parachute payments not previously approved. In addition, the JOBS Act provides that an emerging growth company can take advantage of the extended transition period provided in Section 7(a)(2)(B) of the Securities Act for adopting new or revised financial accounting standards. We have elected to take advantage of the longer phase-in periods for the adoption of new or revised financial accounting standards permitted under the JOBS Act until we are no longer an emerging growth company. If we were to subsequently elect instead to comply with these public company effective dates, such election would be irrevocable pursuant to the JOBS Act.

We will remain an emerging growth company for up to five years after our initial public offering, although we will lose that status sooner if we have more than $1.07 billion of revenues in a fiscal year, have more than $700.0 million in market value of our common stock held by non-affiliates, or issue more than $1.0 billion of non-convertible debt over a three-year period.

To the extent that we rely on any of the exemptions available to emerging growth companies, you will receive less information about our executive compensation and internal control over financial reporting than issuers that are not emerging growth companies. We cannot predict if investors will find our common stock less attractive because we will rely on these exemptions. If some investors find our common stock to be less attractive as a result, there may be a less active trading market for our common stock and our stock price may be more volatile.

If we lose emerging growth company status on December 31, 2018, we will incur substantial costs and significant demands will be placed upon management in connection with complying with non-emerging growth company requirements earlier than we had planned.

Assuming the completion of this offering prior to June 29, 2018, we expect to become a large accelerated filer on December 31, 2018. Based on the transition provisions outlined in Exchange Act Rule 12b-2, if we become a large accelerated filer on December 31, 2018, we will lose emerging growth company status on the same date, which will require us to significantly accelerate our compliance efforts to, for example, allow our independent registered public accounting firm to attest to the effectiveness of our internal controls as required by Section 404(b) of the Sarbanes-Oxley Act in our Annual Report on Form 10-K for the year ending December 31, 2018.

Additionally, if we cease to be an emerging growth company on December 31, 2018, we will be required to implement Topic 606 for the year ending December 31, 2018 instead of December 31, 2019, which is the date that emerging growth companies are first required to implement Topic 606. Because our revenue recognition process is complex, this accelerated timeframe would result in significant additional costs beyond that comprehended in our 2018 financial plan and require substantially burdensome efforts, which would include maintaining additional accounting records to allow us to track transactions on two revenue recognition standards, significantly accelerating our planned timeline for implementing appropriate policies and procedures for recording transactions on the new basis, and hiring additional personnel and consultants. Moreover, because it will take us a significant amount of time to fully implement Topic 606, we anticipate that such implementation will not be complete, and all historical transactions will not be analyzed under Topic 606, until after our Quarterly Report on Form 10-Q for the quarter ending September 30, 2018. Therefore, we do not expect to be able to provide investors with quantitative guidance regarding our expected financial results based on the new reporting standard in advance of releasing such results in connection with our Annual Report on Form 10-K for

45

the year ending December 31, 2018. Consequently, our actual financial results for the year ending December 31, 2018, as reported in accordance with Topic 606, may differ substantially from what you may anticipate based on our historical results of operations and guidance.

In addition to the substantial additional expenses beyond what we had planned, our management would need to devote significant time and efforts to implement and comply with the additional standards, rules and regulations that would apply to us as a result of becoming a large accelerated filer and losing our emerging growth company status, diverting such time from the day-to-day conduct of our business operations.

Furthermore, due to the complexity and logistical difficulty of implementing the standards, rules and regulations that apply to non-emerging growth companies, such as Section 404(b) of the Sarbanes-Oxley Act and Topic 606, on an accelerated timeframe, there is an increased risk that we may be found to be in non-compliance with such standards, rules and regulations or to have significant deficiencies or material weaknesses in our internal controls over financial reporting.

We expect that upon completion of this offering, we will no longer be a controlled company within the meaning of the NYSE rules ; however, we will continue to qualify for and may rely on exemptions from certain corporate governance requirements that would otherwise provide protection to our stockholders during a one-year transition period.

Upon completion of this offering, it is expected that the Thoma Bravo Funds will cease to own a majority of our common stock. Accordingly, upon completion of this offering, we expect that we will cease to be a controlled company within the meaning of the corporate governance standards of the NYSE and we will, subject to certain transition periods permitted by NYSE rules, no longer rely on exemptions from corporate governance requirements that are available to controlled companies. As a result, we will be required to have at least one independent director on each of our nominating and corporate governance committee and compensation committee upon completion of this offering, a majority of independent directors on those committees within 90 days after the completion of this offering, and fully independent nominating and corporate governance committee and compensation committee within one year after the completion of this offering. We will also be required to have a majority independent board of directors within one year after the completion of this offering and to perform an annual performance evaluation of our nominating and corporate governance and compensation committees. Prior to this offering, our board of directors has determined that six of the seven members of our board of directors are independent for purposes of the NYSE corporate governance standards and that both of the members of our nominating and corporate governance committee, both of the members of our compensation committee and two of the three members of our audit committee meet the independence standards of the NYSE and the SEC applicable to such committee members. However, during our controlled company transition period, our stockholders will not have the same protection afforded to stockholders of companies that are subject to all of the NYSE corporate governance standards and we may use some exemptions during such period.

46