CALX US Equity☆

calx-20251231

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, DC 20549

FORM 10-K

(Mark One)

For the fiscal year ended December 31, 2025

OR

For the transition period from to

Commission File Number: 001-34674

Calix, Inc.

(Exact Name of Registrant as Specified in Its Charter)

Title of each class Trading symbol Name of each exchange on which registered

Common Stock, $0.025 par value CALX The New York Stock Exchange

Securities registered pursuant to section 12(g) of the Act:

None

(Title of class)

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes: oNo: x

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes: oNo: x

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes: x No: o

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes: x No: o

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

Large Accelerated Filer ☒ Accelerated Filer ☐

Non-accelerated filer ☐ Smaller Reporting Company ☐

Emerging Growth Company ☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act). o

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. o

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant's executive officers during the relevant recovery period pursuant to Section 240.10D-1(b).o

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes: ☐ No: x

The aggregate market value of the Common Stock held by non-affiliates of the registrant based upon the closing sale price on the New York Stock Exchange on June 27, 2025, the last business day of the Registrant’s most recently completed second fiscal quarter, was approximately $2,101 million. Shares held by each executive officer, director and by each other person (if any) who owns more than 10% of the outstanding common stock have been excluded in that such persons may be deemed to be affiliates. This determination of affiliate status is not necessarily a conclusive determination for other purposes.

As of February 9, 2026, the number of shares of the registrant’s common stock outstanding was 65,607,663.

DOCUMENTS INCORPORATED BY REFERENCE

Portions of the registrant’s 2025 annual report and definitive proxy statement for its 2026 annual meeting of stockholders are incorporated by reference in Item 5 of Part II and Items 10, 11, 12, 13 and 14 of Part III.

Calix, Inc.

Form 10-K

TABLE OF CONTENTS

PART I

Item 1. Business 4

Item 1A. Risk Factors 9

Item 1B. Unresolved Staff Comments 27

Item 1C. Cybersecurity 27

Item 2. Properties 28

Item 3. Legal Proceedings 28

Item 4. Mine Safety Disclosures 28

PART II

Item 6. [Reserved] 29

Item 7A. Quantitative and Qualitative Disclosures About Market Risk 36

Item 8. Financial Statements and Supplementary Data 38

Item 9A. Controls and Procedures 65

Item 9B. Other Information 65

Item 9C. Disclosure Regarding Foreign Jurisdictions that Prevent Inspections 66

PART III

Item 10. Directors, Executive Officers and Corporate Governance 66

Item 11. Executive Compensation 66

Item 14. Principal Accountant Fees and Services 67

PART IV

Item 15. Exhibits and Financial Statement Schedules 67

Signatures 69

2

SPECIAL NOTE REGARDING FORWARD-LOOKING STATEMENTS

Calix, Inc., together with its subsidiaries, is referred to in this document as “Calix,” “we,” “our” or “us.” This report includes forward-looking statements that involve substantial risks and uncertainties. All statements other than statements of historical facts contained in this report, including statements regarding Calix’s future financial position, business strategy and plans, product projections, anticipated market and industry trends and objectives of management for future operations, are forward-looking statements. In some cases, you can identify forward-looking statements by terminology such as “believe,” “could,” “expect,” “may,” “estimate,” “continue,” “anticipate,” “intend,” “should,” “plan,” “predict,” “will,” “would,” “project,” “potential” or the negative of these terms or other similar expressions. Forward-looking statements include Calix’s expectations concerning the outlook for its business, productivity, plans and goals for future operational improvements and capital investments, operational performance, future market conditions or economic performance and developments in the capital and credit markets and expected future financial performance.

Forward-looking statements involve a number of risks, uncertainties and assumptions, and actual results or events may differ materially from those projected or implied in those statements. Important factors that could cause such differences include:

• fluctuations in our gross margin;

• the length and unpredictability of our sales cycles and timing of orders;

• our lack of long-term, committed-volume purchase contracts with our customers;

• our exposure to the credit risks of our customers;

• the interoperability of our products with CXP networks;

• our products’ compliance with industry standards;

• our ability to expand our international operations;

• our ability to maintain proper and effective internal controls.

We caution you against placing undue reliance on forward-looking statements, which reflect our current beliefs and are based on information currently available to us as of the date a forward-looking statement is made. Forward-looking statements set forth in this Annual Report on Form 10-K speak only as of the date of its filing. We undertake no obligation to revise forward-looking statements to reflect future events, changes in circumstances or changes in beliefs. In the event that we do update any forward-looking statements, no inference should be made that we will make additional updates with respect to that statement, related matters or any other forward-looking statements.

3

Table of Contents

PART I

ITEM 1. Business

Company Overview

Calix was founded in 1999. We develop, market and sell platform, cloud and managed services, which are powered by agentic AI, that enable communication service providers (“CSPs”) of all types and sizes to innovate and transform their businesses to focus on delivering outstanding subscriber experiences and become CXPs. The platform combines the Calix Agent WorkforceTM with intelligent appliances, software, cloud and fully integrated SmartLifeTM managed services to enable simplified business models that acquire, retain and grow subscribers and revenue. Calix Customer Success guides service providers through every stage of their transformation journey with expertise across technology, business and market insights. Our partner community extends innovation so customers can grow their businesses across markets at scale. With deep broadband expertise and an end-to-end approach from the datacenters’ access edge to every residential, business and municipal subscriber location, Calix enables any service provider to simplify operations, engagement, and service; innovate for their subscribers; and grow value for members, investors, and the communities they serve. This focus on subscriber experience allows CXPs to expand their brand through increased subscriber acquisition, loyalty and revenue while reducing their operating costs.

This is our mission: to transform service providers of all types and sizes into CXPs and enable them to simplify, innovate and grow.

We believe our platform offers a competitive edge to CXPs at a critical time of increasing competition. With the increase in both private and public funding of broadband access, we anticipate at least two fiber-to-the-home providers vying for subscribers in every market. These providers have a choice: become a speed provider focused on offering the fastest speeds at the lowest price, or become an experience provider focused on delivering innovative, value-added services that improve the lives of their subscribers. Our platform enables these service providers to build next generation networks and offer higher-value, managed-service experiences that enable them to grow revenue, increase subscriber loyalty and monetize their network investments for generations.

CXPs, who embrace our platform, understand this competitive threat and that their brand’s central position in the home, the business and the town is their most valuable strategic asset. As such, they must protect and expand continually. Our Access Edge network solution and Experience Edge premises solution are designed to allow CXPs to simplify their businesses and reduce operating costs, while launching innovative new services in a matter of days and weeks instead of months and years. Our role-based cloud enables CXP teams, such as marketing, operations or customer support, to leverage our Calix Agent Workforce to anticipate and automate tasks to address the subscriber’s needs, whether they are in the home, roaming across the town or managing a small business. Our platform is built to enable CXPs to quickly and easily deploy a growing portfolio of SmartLife managed services to connect entire communities. Embracing this strategy enables CXPs to establish themselves as essential technology innovators that are enabling their communities to grow and thrive.

The CXPs’ teams can utilize AI-driven insights from Calix Cloud to rapidly scale new innovative services for those subscribers who have the propensity to buy, thereby growing revenue as they deliver a connected experience at significantly lower operating costs. This also enables them to build their brand and value proposition around innovation and subscriber experience. As a result, many of Calix’s CXP customers have experienced improved customer satisfaction scores, minimal churn and significant revenue growth. To expand our reach in the market, we will continue to pursue strategic technology and distribution relationships that align with CXPs’ strategic priorities. At the same time, we offer Calix Success Services along with a growing portfolio of award-winning market activation resources that provide CXPs with best practices and programs to strengthen and grow their brands with their subscribers, thereby increasing subscriber loyalty and opportunities to grow their subscriber bases.

Strategy Overview

Our strategy is to position Calix as the key partner providing a broadband delivery platform (agentic AI, cloud, software and appliances) and managed services to enable and facilitate the transformation of service provider networks and the residential, community and business network experience in order to innovate for all of their subscribers. Most service providers will require transformation of their business and operations to become an essential provider of data-driven, high-value managed services to their subscribers. The principal elements of our strategy are:

Start with the data – The principal way we gather, analyze and deliver actionable insights for CXPs is via the Calix Agent Workforce and Cloud. Our role-based Agents and Cloud enable critical functions within a CXP’s business, such as marketing,

4

Table of Contents

operations and support, to leverage real-time data to continually understand, optimize and automate the experience for their subscribers.

Build and evolve our platform – Our product strategy centers on our AI enabled strategic platform. Our platform simplifies CXPs’ businesses by delivering intelligence and automation across the entire subscriber facing network – from the data center edge to the subscriber’s connected devices. Our strategy is to continually augment and extend our platform with AI agents, features and services directly or through partners to allow our CXP customers to deliver cutting-edge services to their subscribers.

Engage directly with CXP customers – We continue to invest in our direct sales capabilities so that we can engage deeply with our customers to help them understand the differentiable value that our platform provides. As we deploy new solutions, we are building the expertise of our team by adding specialized resources in areas such as marketing, customer support, cloud and network operations. Our direct model is complemented with selective programs for our channel partners, who have established local market expertise and have demonstrated the ability to generate new market opportunities and support sales of cutting-edge technologies for CXPs.

Expand our customer footprint across our total addressable opportunity – Our total addressable opportunity includes service providers of any type and size, including managed service providers (“MSPs”), local and competitive exchange carriers, cable multiple system operators (“MSOs”), wireless internet service providers (“WISPs”), fiber overbuilders such as municipalities, electric cooperatives, tribal communities, multiple dwelling units (“MDU”) and hospitality providers. For the past five years, we have averaged landing 80 new customers per year purchasing directly or through our partners. Our diverse and growing customer footprint is a critical source of our future growth as we expand our portfolio and sell additional components of our platform and managed services to both new and existing customers. Our platform enables us to expand our total addressable opportunity and recurring revenue streams by allowing us to address the needs of not only traditional wireline-focused service providers, but also emerging service providers. As such, we intend to continue to engage emerging providers that are creating entirely new customer segments, including fiber overbuilders, utilities, municipalities and MSPs. We will also continue to pursue service provider segments where there is an opportunity to grow our current share, such as cable MSOs, large traditional wireline-focused service providers and international markets.

Extend portfolio of Calix services – Our Success team supports our customers as they define their transformation strategies, build new skills, implement new technologies and deploy new subscriber services. Calix Success’ capabilities address our customers’ entire network and service delivery lifecycle. These services allow our customers to benefit directly from our deep expertise working with service providers of all types and sizes to optimize their operations and leverage our advanced analytics to improve the operational efficiency of their teams.

Pursue strategic relationships – We will continue to pursue strategic technology and distribution relationships that help us align with our customers’ strategic priorities. We continue to invest to provide technical synergy across the ecosystems that support our customers’ most critical business processes through our partner program. By adding new solutions to our platform ecosystem, we significantly enhance the value that our platform delivers to our customers. In addition, we are continuing to expand our relationships with organizations that help our customers plan and execute in-market. Examples of these partners are Conexon, LLC, ePlus Technology, Inc., BroadEngagement (Refindable LLC business), Google LLC and GOCareTM (NuTEQ Solutions, LLC business).

Product Overview

Our product strategy centers on increasing the market adoption of our Calix One Platform, which consists of:

•Calix Cloud®, which comes in three role-based SaaS applications: Calix Engagement Cloud, Calix Operations Cloud and Calix Service Cloud.

•Calix Agent Workforce consists of four agent families:

◦Service Agents share best practices and contextual insights to Customer Service Representatives (“CSRs”) to solve problems faster and on the first call.

◦Subscriber Agents extend the reach of CSRs and Service Agents directly to subscribers through CommandIQ, providing personalized self-service experience optimization, upsell offers and real-time outage information.

◦Operations Agents assist network operations teams around the clock and are dedicated to uncovering and resolving issues to eliminate and reduce service outages and improve subscriber experiences.

◦Marketing Agents continuously scan and analyze market and competitor data to automate subscriber segmentation and create targeted, effective campaigns that amplify the effectiveness of marketing teams.

•Calix Access EdgeTM is our access network and subscriber service management solution for automated, intelligent next generation networks.

5

Table of Contents

•Calix Experience EdgeTM is our premises Wi-Fi and service delivery solution for subscriber managed services.

•Calix SmartLife managed service offerings, which consist of:

◦SmartHomeTM managed services and applications to enhance, operate and secure the connected experience of subscribers in their home, including managed Wi-Fi, advanced content control, network security, connected cameras and social media monitoring for kids.

◦SmartTown® managed services reimagine community Wi-Fi as a secure and managed experience across a CXP’s footprint by making their town a SmartTown. By leveraging residential and small business Wi-Fi appliances combined with strategically deployed outdoor Wi-Fi access points, CXPs can serve subscribers, schools, municipalities, organizations, planned communities, parks, marinas and more. These opportunities open new markets and relationships with the public sector to reduce reliance on and augment 5G mobile networks.

◦SmartBizTM managed services address the networking and productivity needs of small business owners with an all-in-one solution that increases staff productivity, secures critical business systems and enhances customer loyalty.

◦SmartMDUTM managed services provide purpose-built, flexible connectivity solutions for multi-family properties of any type, enabling service providers and property owners to exceed resident expectations with a simple, secure, personalized and efficient managed Wi-Fi solution.

Each subscriber managed service is complemented by real-time subscriber insights via Calix Engagement Cloud, Calix Operations Cloud offerings and Calix Service Cloud, which are configurable to display role-based insights for general management, marketing, support, operations and engineering staff. Powered by Calix Agent Workforce, these insights enable CXPs to anticipate, target and automate new revenue-generating services and applications through our smart phone applications: CommandIQ® for residents, CommandWorxTM for businesses, PropertyWorxTM for multi-dwelling unit property owners and Field Service App for CXP installers and field technicians. Calix Cloud enables simple integrations with other market-leading workflow solutions for marketing (including Facebook, Mailchimp, Constant Contact and HubSpot), support ticketing solutions, operations support systems and business support systems.

The SmartLife managed services are built on the Calix One platform and fully integrated with our Experience Edge GigaSpire® and GigaPro® family of Wi-Fi appliances to be ready for deployment as a complete market-ready subscriber experience solution for a CXP’s residential subscribers, business subscribers and community networks. Calix customers are evolving their go-to-market strategies to go beyond marketing broadband speed by delivering valuable managed services built on top of their Wi-Fi offerings. This unique portfolio gives them more opportunities to provide differentiated services to their subscribers and grow their revenue.

Our Access Edge network solutions redefine the access edge of the network by simplifying its architecture and operations and reducing energy consumption. Our platform’s access network component is provided by our E-Series family of modular, non-blocking systems, enabling CXPs to meet a wide variety of deployment scenarios. Our customers can consolidate multiple access network elements into a single system using specialized software modules that add functionality and remove complexity, thereby reducing the total cost of ownership and the time to market for new services. Our Access Edge network solutions are also some of the most energy efficient in the industry versus traditional access networks thanks to double-density PON innovations that reduce rack space, cooling requirements and overall power consumption. We offer a range of training, professional and success services to assist CXPs in every domain of network management from strategy to deployment and management.

These offerings are sold independently and offer unique entry points for new customers, who are partnering with Calix to transform their businesses. Moreover, an increased segment of our customer base is leveraging all components of our platform and managed services in an end-to-end strategy to simplify their businesses, innovate for their subscribers and grow the value that they deliver for their consumer, business and municipal subscribers.

Finally, to support these managed services, we offer market activation resources and customer support programs through our Customer Success organization to enable CXP teams to quickly deploy, manage and monetize each service that they provide to subscribers. These resources include marketing content that can be easily customized with on-line tools, training programs and success services.

6

Table of Contents

Customers

We market and sell our platform (agentic AI, cloud, software and appliances) and managed services to service providers of all types and sizes. To date, we have focused primarily on service providers in the North American market. Our customers span all sizes of broadband subscriber count from a few subscribers to more than eleven million. We currently have approximately 1,600 active service provider customers, purchasing directly and through partners, to deploy passive optical, Active Ethernet or point-to-point Ethernet access networks or subscriber premise appliances. Our service provider customers include: ALLO Communications, LLC; Connect Holding II LLC (dba Brightspeed); CityFibre Holdings Limited; Conexon Connect, LLC; Cox Communications, Inc.; Gridiron Fiber Corp. (dba Lumos, a T-Mobile Fiber company); Hunter Communications; ICS Advanced Technologies; Jade Communications, LLC; Rally Networks; South Central Telephone Association, Inc.; Tombigbee Electric Power Association and Tombigbee Fiber, LLC and Verizon Communications Inc.

The U.S. Federal government has approved programs, totaling more than $40 billion, to fund broadband and connectivity expansion across the rural parts of the U.S. Calix has a dedicated team of funding specialists, assisting customers and prospects with the most up-to-date information on broadband funding opportunities as they are introduced and personalized strategies to maximize their grants to support their growth.

We refer to service providers as large, medium and small based on the number of broadband subscribers they serve. Large service providers are those with wide geographic footprints and broadband subscribers of 2.5 million or more. Medium service providers also operate typically within a wide geographic footprint but are smaller in scale with broadband subscribers that range from 250,000 to 2.5 million. Small service providers consist primarily of over 1,000 predominantly local IOCs that are typically focused on a single community or a cluster of communities. They include a growing number of municipalities, cable MSOs, electric cooperatives, fiber overbuilders, tribal entities and WISPs. These entities range in size from a few subscribers to 250,000 broadband subscribers.

No customer represented more than 10% of revenue in 2025, 2024 or 2023. Sales to customers outside the U.S. represented 7% of our revenue in 2025, 8% of our revenue in 2024 and 9% of our revenue in 2023. Our sales outside the U.S. have been and are currently predominantly to customers in the Americas and Europe.

Customer Engagement Model

We market, sell and support the success of our platform and managed services predominantly through our direct sales force, supported by marketing, product management and customer success personnel. We have also expanded this model to include select channel partners in North America and more than 40 international channel partners. Even in circumstances where a channel partner is involved, our sales and marketing personnel are generally selling side-by-side with the channel partner. We believe that our direct customer engagement approach provides us with significant differentiation in the customer sales process and customer engagement programs by aligning us more closely with our customers’ changing needs and successful implementation of our solutions.

Research and Development

Continued investment in research and development is critical to our business. We have made significant investments in our product portfolio, and we intend to continue to dedicate significant resources to research and development to develop, enhance and deliver new platform features and capabilities, including investments in innovative technologies that support our business strategy. Our research and development team is composed of engineers with expertise in software and cloud platforms, agentic AI, optics, wireless technologies and systems engineering. Our research and development team is responsible for designing, developing and enhancing our platform, cloud and managed services, performing product and quality assurance testing and ensuring the compatibility of our products with third-party hardware and software products. Increasingly, our engineers are focused on enhancements to our cloud and software platform components. Our teams of engineers currently remain concentrated in San Jose and Petaluma, California; Nanjing, China; Bangalore, India; Minneapolis, Minnesota and Richardson, Texas. We also outsource a portion of our software and cloud development to domestic and international third parties and depend on these partners to meet our development plans.

Manufacturing and Supply Chain

We rely on CMs, ODMs and third-party logistics partners for the supply and distribution of our products. The global supply-chain organization oversees these third parties to source and procure materials, manufacture and deliver products. This organization includes order management, planning, sourcing, logistics, testing and manufacturing engineers and new product introduction teams. We integrate our supply-chain management and new product introduction activities with those outsourced to third parties. Relationships with and reliance on these third parties allow us to improve new product introduction time, conserve working capital, reduce product costs and minimize delivery lead times while maintaining product quality and scaling quickly to handle increased order volume. We continue to qualify and utilize additional vendors for various portions of the supply chain as needed.

7

Table of Contents

Seasonality

Fluctuations in our revenue occur due to many factors, including the varying budget cycles and seasonal buying patterns of our customers. More specifically, our customers tend to spend less in the first fiscal quarter as they are finalizing their annual capital spending budgets, and in certain regions, customers are also challenged by winter weather conditions that inhibit outside fiber deployment. In recent years, as our revenue from our large customers decreased, we have experienced less year-end volatility due to capital budgetary spending or freezing. This, combined with an increase in recurring revenue, has resulted in smaller seasonal fluctuations, and we expect this trend to continue.

Competition

The communications software and systems equipment markets are highly competitive. Competition is largely based on any one or a combination of the following factors: functionality and features, price, existing business and customer relationships, product quality, installation capability, service and support, long-term returns, scalability, development and manufacturing capability.

We compete with several companies within the markets that we serve, and we anticipate that competition will intensify. Vendors with which we may compete include: ADTRAN Holdings, Inc.; Ciena Corporation; CommScope Holding Company, Inc.; eero/Ring (Amazon companies); Harmonic Inc.; Huawei Technologies Co., Ltd.; Nokia Corporation; Plume Design, Inc. and Ubiquiti Inc. In various geographic or vertical markets, there are also several smaller companies with which we may compete. As we expand into adjacent markets and expand our platform, cloud and managed services offerings, we expect to encounter new competitors. Many of our competitors have the financial resources to offer competitive products at a below market price, which could prevent us from competing effectively.

Intellectual Property

We rely on a combination of IP rights, including patents, trade secrets, copyrights and trademarks as well as customary contractual protections. These rights and protections are accomplished through a combination of internal and external controls, including contractual protections with employees, contractors, customers and partners, and through a combination of U.S. and international IP laws.

As of December 31, 2025, we held 98 U.S. patents and 90 pending U.S. and international patent applications. U.S. patents generally have a term of twenty years from filing. The remaining terms on our individual patents vary from less than a year to seventeen years. U.S. patent, copyright and trade secret laws afford us only limited protection, and the laws of some foreign countries do not protect proprietary rights to the same extent.

We believe that the frequency of assertions of patent infringement has and continues to increase in our industry. Any claim of infringement from a third party, even claims without merit, could cause us to incur substantial costs defending against such claims, could require us to pay substantial damages or include an injunction or other court order that could prevent us from selling our products. In addition, we might be required to seek a license which may not be available on commercially reasonable terms or at all. Alternatively, we may be required to develop non-infringing technology, which would require significant effort and expense.

Human Capital

We employed 1,921 employees globally as of December 31, 2025 with 1,046 employees located in the U.S. and 875 outside of the U.S., primarily in Canada, China and India. Except for one employee located in France and subject to customary local collective bargaining arrangements, we do not have any employees represented by a labor union with respect to their employment with us. We have not experienced any work stoppages and consider our relations with our employees to be good. We consider our talent to be very important to our operations and execution of our business strategy as well as the overall success of our business. As such, we invest significant management attention, time and resources to attract, engage, develop and retain our talent. Our talent strategy focuses on our culture and core values, our talent programs and the overall well-being and safety of our talent.

8

Table of Contents

Corporate Information

Our principal executive offices are located at: 3155 Olsen Drive, Suite 450, San Jose, California 95117, and our telephone number is (408) 514-3000. Our website address is: www.calix.com. We do not incorporate the information on or accessible through our website into this Annual Report on Form 10-K, and you should not consider any information on, or that can be accessed through, our website as part of this Annual Report on Form 10-K. Calix®, the Calix logo design, AXOS®, Calix Cloud®, CommandIQ®, CommandWorxTM, GigaPro®, GigaSpire®, SmartTown® and other trademarks or service marks of Calix appearing in this Annual Report on Form 10-K are the property of Calix. Trade names, trademarks and service marks of other companies appearing in this Annual Report on Form 10-K are the property of the respective holders. The Securities and Exchange Commission (“SEC”) maintains a website at www.sec.gov that contains reports, proxy statements and other information regarding issuers that file electronically with the SEC. We post on the Investor Relations page of our website, www.calix.com, a link to our filings with the SEC free of charge, as soon as reasonably practical after they are filed electronically with the SEC.

ITEM 1A. Risk Factors

We have identified the following additional risks and uncertainties that may affect our business, financial condition and/or results of operations. Investors should carefully consider the risks described below, together with the other information set forth in this Annual Report on Form 10-K, before making any investment decision. The risks described below are not the only ones we face. Additional risks not currently known to us or that we currently believe are immaterial may also significantly impair our business operations. Our business could be harmed by any of these risks. The trading price of our common stock could decline due to any of these risks, and investors may lose all or part of their investment.

Summary of Material Risks Associated With Our Business

The principal risks and uncertainties affecting our business include the following:

Business and Operational Risks

•If we do not successfully increase our sales through adoption of our platform, cloud and managed service offerings, our operating results, financial condition, cash flows and long-term growth may be negatively impacted.

•If we do not successfully execute our business strategy to increase our sales to new and existing CXPs, our operating results, financial condition, cash flows and long-term growth may be negatively impacted.

•We face risks associated with being materially dependent upon third-party vendors; certain factors such as component shortages that affect our business as a result of those dependencies have and could continue to disrupt our business and adversely impact our gross margin and results of operations.

•If we fail to properly develop, invest in, and manage AI Technologies used in our products and services, our business, financial condition, and results of operations could be materially adversely affected.

•The imposition of new duties, tariffs, trade barriers and retaliatory countermeasures implemented by the U.S. and other governments and resulting impact on customer demand may have a material adverse effect on our business, financial condition and results of operations.

•Cyberattacks or other security incidents that disrupt our or our third-party providers’ operations or compromise data, may expose us to liability, harm our reputation or otherwise adversely affect our business.

•Changing market and customer requirements may adversely affect the valuation of our inventory as well as our supplier purchase commitments.

•Business and operational risks associated with expanding our international operations could harm our business.

•We may have difficulty evolving and scaling our business and operations to meet customer and market demand, which could harm our financial results or cause us to fail to execute on our business strategies.

•Litigation and regulatory proceedings could harm our business or negatively impact our results of operations.

•We have a history of fluctuations in our gross margin and operating results, which can make it difficult to predict our future performance and could cause the market price of our stock to decline.

•We are exposed to customer credit risks that could adversely affect our operating results and financial condition.

•If we lose any of our key personnel, or are unable to attract, train and retain qualified personnel, our ability to manage our business and continue our growth would be negatively impacted.

•If we experience disruptions with our enterprise resource planning system, we may not be able to effectively transact business or produce financial statements, which would adversely affect our business, results of operations and cash flows.

9

Table of Contents

Risks Related to Our Products

•Our products are highly technical and may contain undetected hardware or software defects or software bugs, which could harm our reputation and adversely affect our business.

•If we are unable to ensure that our products interoperate properly and as required within our customers’ networks, our business will be harmed.

•Our estimates regarding warranty or product obligations are highly subjective. If our estimates change, the liability for warranty or product obligations may be increased, impacting future cost of revenue.

•Our business and operations depend on proprietary technologies, and our financial performance may suffer if we cannot protect and enforce our IP rights.

•If we are unable to obtain third-party technology licenses needed for our products and platform solutions, our business and operations will be impaired, and our operating results could be adversely affected.

•Our use of open-source software could impose limitations on our ability to commercialize our products.

Macroeconomic and Industry Risks

•Our business depends upon the capital spending patterns and decisions of CXPs, and any decrease or delay in capital spending by CXPs due to the timing and availability of capital and other causes would reduce our revenue and harm our business.

•Government-sponsored programs and U.S. federal government shutdowns could impact the timing and buying patterns of CXPs, which may cause fluctuations in our operating results.

•Adverse global economic, market and industry conditions, geopolitical issues and other conditions that impact our increasingly global operations could have a negative effect on our business, results of operations and financial condition and liquidity.

•We face intense competition that could reduce our revenue and adversely affect our financial results.

•Historically, our customer base has been concentrated, and the loss of any of our key customers may adversely impact our revenue and results of operations, and any delays in payment by a key customer could negatively impact our cash flows and working capital.

•Our industry is characterized by rapid technological advancements, and if we fail to develop new products or enhancements that meet changing CXP requirements, we could experience lower sales.

•Our sales cycles can be long and unpredictable, and our sales efforts require considerable time and expense. As a result, our sales are difficult to predict and may vary substantially, which may cause our operating results to fluctuate significantly.

Government and Regulatory Risks

•Actual or perceived failure to comply with applicable data privacy, security and platform and technology regulation laws, regulations and standards could impact our business, operations, and expose us to increased liability.

•If we fail to comply with evolving industry standards, sales of our products would be adversely affected.

•Our failure or the failure of our manufacturers to comply with environmental and other legal regulations could adversely impact our results of operations.

•We are subject to governmental export and import controls that could subject us to liability or impair our ability to compete in additional international markets.

•Regulatory and physical impacts of climate change and other natural events may affect our customers and our manufacturers, resulting in adverse effects on our operating results.

•Our customers are subject to government regulation, and changes in current or future laws or regulations that negatively impact our customers could harm our business.

Risks Related to Ownership of Our Common Stock and Other Risks

•Our stock price may continue to be volatile, and the value of an investment in our common stock may decline.

•Provisions in our charter documents and under Delaware law could discourage a takeover that stockholders may consider favorable and may lead to entrenchment of our management and Board of Directors.

•We may need additional capital in the future to finance our business.

•We do not currently intend to pay dividends on our common stock and, consequently, our stockholders’ ability to achieve a return on their investment will depend on appreciation in the price of our common stock.

•Our failure to adequately address and resolve risks and uncertainties associated with acquisitions could have a material adverse impact on our financial condition and results of operations.

10

Table of Contents

•We cannot guarantee that our stock repurchase program will be utilized to the full value approved or that it will enhance long-term stockholder value. Repurchases we consummate could increase the volatility of the price of our common stock and could have a negative impact on our available cash balance.

General Risks

•As a public company, we are subject to significant accounting, legal and regulatory requirements; our failure to comply with these requirements may adversely affect our operating results and financial condition.

•If we fail to maintain proper and effective internal controls, our ability to produce accurate financial statements on a timely basis could be impaired, which would adversely affect our operating results and our stock price.

Business and Operational Risks

If we do not successfully increase our sales through adoption of our platform, cloud and managed service offerings, our operating results, financial condition, cash flows and long-term growth may be negatively impacted.

We have platform, cloud and managed service offerings, including new AI-enabled “agentic” capabilities, which are early in their product life cycles and subject to uncertain market demand. If our customers are unwilling to adopt these new offerings, install our new products or deploy our new services, or if we are unable to achieve market acceptance of our products and platform, our business and financial results may be harmed. Moreover, adoption of our platform, cloud and managed service offerings is dependent upon the success of our customers in investing, marketing, selling and deploying broader services to their subscribers, and our ability to differentiate our products from competing or substitutive product and service offerings. For example, our SmartLife managed services include AI-driven managed Wi-Fi, network security, parental controls and an ecosystem of services from partners, including Arlo and Bark. However, if subscriber demand for such services does not grow as expected or declines, or our customers are unable or unwilling to invest in our platform to deploy and market these services, demand for our products may not grow at rates as we anticipate, negatively impacting our revenue and long-term growth.

If we do not successfully execute our business strategy to increase our sales to new and existing CXPs, our operating results, financial condition, cash flows and long-term growth may be negatively impacted.

Our growth depends upon our ability to increase sales to existing and new service providers of all types and sizes, and the execution of our strategy to increase sales to CXPs involves significant risk. The majority of our revenue is not recurring, and our customers generally have no committed purchase requirements, may cancel orders or cease purchasing our products at any time. If our customers stop purchasing our products for any reason, our business and results of operations would be harmed. If we are unable to increase our sales to new and existing CXPs, our operating results, financial condition, cash flows and long-term growth may be negatively impacted. Our strategy includes investing in regional sales teams and select channel partners to sell to smaller regional broadband service providers. A large portion of our current sales are to customers with smaller regional networks and limited capital expenditure budgets. The spending patterns of many of these customers are generally less formal than larger service providers and often characterized by small and sporadic purchases, and the potential revenue from any one of these customers is limited. We rely primarily on channel partners, including value added resellers, internationally and for certain U.S. markets. We face fierce competition for business with key channel partners. If we are unable to engage channel partners, we may fail to grow our sales, or our sales may be reduced. Furthermore, we rely on our channel partners to promote and sell our products. The loss of a key channel partner or the failure of our partners to provide adequate services could have a negative effect on customer satisfaction and could cause harm to our business.

Our selling efforts to larger broadband service providers require substantial investments of technical, marketing and sales resources through lengthy equipment qualification and sales cycles without any assurance of generating sales. We may be required to invest in costly upgrades to meet more stringent performance criteria and interoperability requirements, develop new customer-specific features or adapt our products to meet required standards. We have invested and expect to continue to invest considerable time, effort and expenditures, including investment in product research and development, related to these opportunities without any assurance that our efforts will result in revenue.

The quality of our support and services offerings is important to sustain and increase our sales to new and existing customers. Our services to customers include services to help them deploy our products within their networks. Once our products are deployed within our customers’ networks, they depend on our customer success, customer support and research and development organizations to resolve any issues relating to those products. If we do not effectively assist our customers in deploying our products, succeed in helping them quickly resolve post-deployment issues, effectively utilize features or enhancements or provide effective support, it could adversely affect our ability to sell our products to existing customers and harm our reputation with potential new customers. As a result, our failure to maintain high quality support and services could result in the loss of customers, which would harm our business.

11

Table of Contents

We face risks associated with being materially dependent upon third-party vendors; certain factors such as component shortages that affect our business as a result of those dependencies have and could continue to disrupt our business and adversely impact our gross margin and results of operations.

We materially depend upon third-party vendors for our complex global supply-chain operations, including for services to develop, design and source components and materials as well as manufacture, transport and deliver our products. If any of these vendors stop providing their services, for any reason, we would have to obtain similar services from other sources, which may not be available on commercially reasonable terms, if at all. We also have limited control over disruptions that may occur at the facilities of those providers, such as supply interruptions, labor shortages, strikes, shipping backlogs at ports and similar disruptions to transportation infrastructure, design and manufacturing failures, quality control issues, systems failures or facility closures arising from pandemics, natural disasters, terrorist attacks or acts of war. In addition, switching development firms or manufacturers could delay the manufacture and availability of products and/or require us to re-qualify our products with our customers, which would be costly and time-consuming. Any interruption in the development, supply or distribution of our products would adversely affect our ability to meet scheduled product deliveries to our customers and could result in lost revenue or higher costs, which would negatively impact our gross margin and operating results and harm our business.

Particular risks associated with management of our global supply-chain operations include the following:

•Manufacturing constraints, shortages and other disruptions. We do not have internal manufacturing capabilities and we rely solely on a small number of CMs and ODMs to manufacture and supply our products. Our business operations and ability to supply our products are highly dependent upon our ability to secure adequate third-party manufacturing capabilities and capacity and to effectively manage those third parties to meet our business needs. Our dependence solely on third-party manufacturers makes us vulnerable to possible supply and capacity constraints and reduces our control over manufacturing disruptions due to component availability, extended lead times delivery schedules, quality, manufacturing yields and increased costs. Some of these risks occur from time to time in our business. If these disruptions and constraints are prolonged, or if these manufacturers do not have the ability or business continuity plans to fulfill their obligations to us, our business could be disrupted. If we cannot effectively manage our vendors or if we fail to invest adequate resources to manage our supply chain operations, our ability to meet customer orders and generate revenue may be negatively impacted. A substantial portion of our manufacturing is done at facilities outside of the U.S., largely in Asia, which presents increased supply risk, including the risk of supply interruptions, delays, shortages or reductions in manufacturing quality or controls. In addition, these supply interruptions, delays and shortages could impair our ability to meet our customer requirements, require us to pay higher prices or incur expedite fees, which would harm our business and negatively impact our gross margin and results of operations. Our international manufacturing also creates risks and uncertainties associated with regulatory changes or government actions such as local business requirements, trade restrictions and tariffs, economic sanctions or related legislation, which may complicate our export and import activities, be disruptive to the operations of our manufacturers and logistics partners or result in higher product and shipping costs and variability of supply. Manufacturing in Asia further heightens our risk of meeting customer delivery requirements as we rely upon third-party logistics companies to transport and import significant volumes of products to the U.S. where we generate a substantial majority of our revenue. These supply chain risks are further increased by periodic shipping backlogs at ports and similar disruptions to transportation infrastructure.

•Limited sources and sole-sourced supply.We are dependent upon sole-source or limited-source suppliers for some key product components such as chipsets, certain of our application-specific integrated circuit processors and memory and resistor components, including certain components sourced solely through suppliers located in China and other Asian countries. Any of these suppliers could stop producing our components, raise the prices they charge us, be subject to higher product tariffs, epidemics or other conditions that disrupt their operations, cease operations or enter into exclusive arrangements with our competitors, consequently affecting our operations and results. For example, the technology industry is currently experiencing significant supply constraints for memory components, driven in part by the reallocation of manufacturing capacity towards the global AI infrastructure build, which constraints may continue for years until new manufacturing capacity is built. These constraints have resulted in, and are expected to continue to result in, increased costs and extended lead times for the components used in our products. Being dependent upon a limited number of suppliers constrains our ability to mitigate these disruptions in our supply chain, particularly if such disruptions are prolonged. This may adversely affect our ability to obtain components and materials needed to manufacture our products at acceptable prices in a timely fashion, or at all. These risks would adversely affect our ability to meet scheduled product deliveries to our customers, increase costs and in turn harm our business and results of operations.

•Limitations on ability to manage third-party risks. Our business with certain third-party manufacturers may represent a relatively small percentage of their revenue. Consequently, our orders may not be given adequate priority if such manufacturers have to allocate limited capacity among competing customers. This could delay supplies of product to

12

Table of Contents

us or limit our ability to ramp product volumes within desired timeframes. If any of our manufacturing partners are unable or unwilling to continue manufacturing our products in required volumes and at high quality levels, we would have to identify, qualify and select acceptable alternative manufacturers. The time it takes to qualify new third-party manufacturers could disrupt our ability to maintain continuous supply of product to meet customer requirements. An alternative manufacturer may not be available to us when needed or may not be in a position to satisfy our production requirements at commercially reasonable prices and quality. In addition, we and/or our manufacturers may not be able to negotiate commercially reasonable terms and sufficient quantities of component supplies with component and materials suppliers to meet our manufacturing needs because our purchase volumes may be too low for us to be considered a priority customer for securing supplies, particularly when there are shortages or limited availability of key components and materials. As a result, suppliers could stop selling to us and our manufacturers at commercially reasonable prices, or at all. While we have worked to mitigate the cost impact from historical price increases, our efforts may not be successful with respect to increases arising from product tariffs recently announced by the U.S. Any such interruption or delay may force us and our manufacturers to seek components or materials from alternative sources, which may not be available, or result in higher prices. Switching suppliers could also force us to redesign our products to accommodate new components and could require us to re-qualify our products with our customers, which would be costly and time consuming. A significant interruption in manufacturing or supply availability for any of these reasons would reduce supply to our customers, which would result in lost revenue and harm our customer relationships.

•Ability to forecast and manage inventory liability with vendors. We have experienced increases in demand from many customers, in part as a result of higher consumer demand for better internet services and improved Wi-Fi. If we underestimate product demand from our customers, our manufacturers may have inadequate component inventory to meet our demand. If we are unable to adequately anticipate demand, this could interrupt our product manufacturing, increase our cost of revenue associated with expedite fees and air freight and/or result in delays or cancellation of customer orders. If we are unable to deliver products timely to our customers, we may lose customer goodwill or our customers may choose to purchase from other vendors, all of which may have a material negative impact on our revenue and operating results. If we overestimate our product demand, our third-party manufacturers may purchase excess components and build excess inventory, and we could be required to pay for these excess parts or products and their storage costs. Long lead times for component supply, which may be exacerbated by higher demand for certain components, and demand for our products has and is expected to continue to impact our ability to accurately forecast our production requirements. We may incur liabilities for certain component inventory purchases that have been rendered excess or obsolete, which may have an adverse effect on our gross margin, financial condition and results of operations.

If we fail to properly develop, invest in, and manage AI Technologies used in our products and services, our business, financial condition, and results of operations could be materially adversely affected.

We use AI, machine learning, and automated decision-making technologies, including proprietary AI and machine learning algorithms and models (collectively, “AI Technologies”) throughout our business, and are making significant investments in this area. For example, with the implementation of our agentic workflows within our platform, we will aim to provide both our customer success team and CXP customers with advanced automated tools to augment their operations, accelerate transformation initiatives and expand their impact independent of traditional resource constraints.

We expect that increased investment will be required in the future to continuously improve our use of AI Technologies. As with many technological innovations, there are significant risks involved in developing, maintaining and deploying these technologies, and there can be no assurance that the usage of, or our investments in, such technologies will always enhance our products or services or be beneficial to our business, including our efficiency or profitability.

In particular, if the models underlying our AI Technologies are: incorrectly designed or implemented; trained or reliant on incomplete, inadequate, inaccurate, biased or otherwise poor quality data, or on data to which we do not have sufficient rights or in relation to which we and/or the providers of such data have not implemented sufficient legal compliance measures; used without sufficient oversight and governance to ensure their responsible use; and/or adversely impacted by unforeseen defects, technical challenges, cybersecurity threats or material performance issues, the performance of our products, services and business, as well as our reputation and the reputations of our customers, could suffer or we could incur liability resulting from the violation of laws or contracts to which we are a party or civil claims.

With respect to our products or services that incorporate AI Technologies, including agentic AI, the market for such products and services is rapidly evolving and unproven in many industries, including our own, and important assumptions about the characteristics of targeted markets, pricing, sales cycles, cost, performance, and perceived value associated with our services or products may be inaccurate. We cannot be sure that the market will continue to grow or that it will grow in ways we anticipate. In addition, market acceptance and consumer perceptions of products and services that incorporate AI Technologies is uncertain.

13

Table of Contents

Additionally, the regulatory framework for AI Technologies is rapidly evolving. Existing laws and regulations may be interpreted in ways that could affect the operation of our AI Technologies, and federal, state and foreign government bodies and agencies have introduced or are currently considering additional laws and regulations applicable to AI Technologies. For example, in the U.S., legislation related to AI Technologies has been introduced at the federal level and enacted or proposed by various states, including California, Colorado, Connecticut and Texas. Some enacted or proposed frameworks include requirements focused on transparency, risk-management and accountability for AI Technologies, while others focus on high-risk uses of AI or the use of automated decision-making. Collectively, these developments signal an emerging trend towards a patchwork of state-level governance of AI in the U.S. Furthermore, the Trump administration’s approach to investment in and regulation of AI technologies has and is expected to continue to deviate from that of the previous administration, and we will need to adapt to any changes that may result from such approach, including as the result of new or changing executive orders. For instance, the U.S. federal government may seek to pre-empt state laws when they seek to govern certain topics as evidenced by the Trump administration’s “Ensuring a National Policy Framework for Artificial Intelligence” Executive Order signed on December 11, 2025. This order calls for federal standards and legislation that would preempt conflicting state AI regulations and create a federal litigation task force focused on challenging state AI laws in court. In Europe, the EU Artificial Intelligence Act (“EU AI Act”) establishes a comprehensive, risk-based governance framework for AI in the European Union (“EU”) market. The majority of the substantive requirements will apply from August 2, 2026. The EU AI Act applies to companies that develop, use and/or provide AI in the EU, with specific requirements based on the relevant AI use cases. For example, in relation to our use of generative AI, we may be subject to certain disclosure and transparency obligations, with fines up to the greater of €15 million or 3% of global revenue.

In addition, the revised EU Product Liability Directive, to be implemented into EU member state national law by December 2026, extends the EU’s existing strict product liability regime to AI and facilitates civil claims in respect of harm caused by AI. Once fully applicable, the EU AI Act and the EU Product Liability Directive, together with developing guidance and/or decisions in this area, will have a material impact on the way AI is regulated in the EU. The cost to comply with such laws, regulations, decisions and/or guidance interpreting existing laws, or to adjust our business plans based on changes to how such laws are enforced, could be significant and would increase our operating expenses (such as by imposing additional reporting obligations regarding our use of AI Technologies) or impact our ability to use, procure or commercialize AI Technologies. Such an increase in operating expenses, as well as any actual or perceived failure to comply with such laws and regulations, could adversely affect our business, financial condition and results of operations.

The imposition of new duties, tariffs, trade barriers and retaliatory countermeasures implemented by the U.S. and other governments and resulting impact on customer demand may have a material adverse effect on our business, financial condition and results of operations.

The implementation of significant changes to U.S. trade policies, sanctions, legislation, treaties and tariffs, including, but not limited to, significant new tariffs on goods imported into the U.S., have introduced uncertainty to our business and will increase the cost of our U.S. manufactured products and components sourced outside of the U.S., which will result in an increase to our cost of revenue and may cause a reduction in our gross margin. In response, China announced additional tariffs on U.S. goods and new export control restrictions. The imposition of additional tariffs or other trade barriers by countries outside of the U.S may increase our costs in these markets, and to the extent these increased costs result in increased prices for our customers, the demand for our products may decrease as our customers seek alternative sourcing, making it more difficult for us to sell our products in some markets.

The extent and duration of increased tariffs and the resulting impact on general economic conditions and on our business are uncertain and depend on various factors, such as negotiations between the U.S. and affected countries, the responses of other countries or regions, exemptions or exclusions that may be granted, availability and cost of alternative sources of supply, and demand for our products in affected markets. Other countries where we operate or sell our products may themselves change their own policies on trade as well, which may affect future business and foreign investment in their respective countries. U.S. and foreign policy changes and uncertainty about such changes has resulted in increased market volatility and currency exchange rate fluctuations. To the extent dissatisfaction with U.S. government policy results in U.S.-based suppliers being disfavored over foreign-based alternatives, it may diminish demand for our products with such customers and cause them to find alternative sourcing or otherwise make it more difficult for us to sell more products to these customers.

As a result of these dynamics, we may find it difficult to predict the impact to our business of these and future changes to the trading relationships between the U.S. or other countries or the impact on our business of new laws or regulations adopted by the U.S. or other countries.

Cyberattacks or other security incidents that disrupt our or our third-party providers’ operations or compromise data, may expose us to liability, harm our reputation or otherwise adversely affect our business.

We rely on our own and third-party hardware, software, technology infrastructure, data centers, digital networks and online sites and services for both internal and customer-facing operations that are critical to our business (collectively, “IT Systems”).

14

Table of Contents

In addition, as part of our business operations, we collect, store, process, use and/or disclose information, including sensitive data relating to our business, our business partners and our customers, and personal information about individuals such as our employees and our customers’ subscribers (collectively, “Confidential Information”). We process Confidential Information to operate our business, including in connection with the provision of our cloud services and by relying on our and our providers’ IT Systems. We also engage third-party providers to support various internal functions, such as human resources, finance, information technology and electronic communications, as well as the development and delivery of our customer-facing products and cloud services, which includes collecting, handling, processing and/or storage of data on our behalf. These internal and external functions involve an array of software and systems, including cloud-based, that enable us to conduct, monitor and/or protect our business, operations, systems and information technology assets. Our cloud-based solutions enable us to host our customers’ subscriber data in third-party data centers.

We face numerous and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our IT Systems and Confidential Information, including from diverse threat actors such as state-sponsored organizations, opportunistic hackers and hacktivists, as well as through diverse attack vectors such as social engineering/phishing, malware (including ransomware), malfeasance by insiders, human or technological error and, as a result of malicious code embedded in open-source software, bugs, misconfigurations or exploited vulnerabilities in software or hardware that is integrated into our (or our suppliers’ or service providers’) IT Systems, products or services. Threat actors could steal Confidential Information related to our business, products, employees, customers and our customers’ subscribers; hold data ransom; and/or disrupt our systems and services or those of our supply chain partners, vendors, customers or others. We expect cybersecurity attacks and security breaches to accelerate in the future, including sophisticated supply chain attacks. As we and our third-party providers continue to increase our reliance on virtual environments and communications systems and cloud-based solutions to support our work-from-anywhere culture and overall business needs, our exposures to third-party vulnerabilities and security risks also increase. Because threat actors are increasingly sophisticated and aggressive, our efforts may be inadequate to prevent, detect or recover from future attacks due, for example, to the increased use by attackers of tools and techniques (including artificial intelligence) that are specifically designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic evidence. We may also experience security breaches that may remain undetected for an extended period.

We and certain of our third-party providers have been subject to cyberattacks and other security incidents, and we expect such attacks and incidents to continue in varying degrees. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our IT Systems and Confidential Information. Accordingly, while to date no cybersecurity incidents have had a material impact on our operations or financial results, we cannot guarantee that material incidents will not occur in the future. A cyberattack or incident that affects the confidentiality, integrity or availability of our IT Systems or Confidential Information could result in legal claims or proceedings (such as class actions), regulatory investigations and enforcement actions, fines and penalties, negative reputational impacts that cause us to lose existing or future customers, and/or significant incident response, system restoration or remediation and future compliance costs. Even if we and our third-party providers allocate, implement and manage reasonable security and data protection measures, we could still experience significant data loss, unauthorized data disclosure or a breach of our IT Systems, products or those of our third-party providers (for example, data centers) that materially impact our business. The continued growth of our cloud-based platform and managed services portfolio and increased reliance on third-party development partners and third-party software and cloud-based solutions increases the likely risks arising from security breaches or data loss. Any data loss or compromise of our systems that collect and process personal information (including personal information of our customers’ subscribers), or third-party data centers where that personal information is stored, could result in loss of confidence in the security of our offerings and loss of customers or customer goodwill. Further, security incidents could subject us to obligations under privacy and data security laws and regulations around the world (including to notify governmental authorities, regulatory bodies and/or affected individuals), lead to liability given the increasing development of such strict laws and regulations, increase the risk of litigation and governmental or regulatory investigation, require us to notify our customers or other counterparties in relation to such incidents, damage our reputation and adversely affect our business, financial condition, operating results and cash flows. Although we maintain insurance that may apply to cybersecurity risks and liabilities, there can be no guarantee that any or all costs or losses incurred will be partially or fully insured or that we will be able to procure applicable insurance in the future on reasonable terms or at all.

Changing market and customer requirements may adversely affect the valuation of our inventory as well as our supplier purchase commitments.

Customer demand for our products can change rapidly in response to market and technology developments. From time to time, we adjust inventory valuations downward or end of life certain of our products in response to our assessment of our business strategy as well as consideration of demand from our customers for specific products or product lines. We also evaluate our supplier purchase commitments, which fluctuate based on lead-times, demand environment and perceived component availability. We record a liability for excess and obsolete components based on our estimated future demand for our products, potential obsolescence of technology and product life cycles. If we fail to accurately plan our inventory levels, which becomes more challenging as component lead times increase, we may have to increase write offs for excess or obsolete inventory, or

15

Table of Contents

accrue additional liabilities for component inventory held by our suppliers, both of which could have a material adverse effect on our financial condition and results of operations.

Business and operational risks associated with expanding our international operations could harm our business.

We are subject to business and operational risks associated with our international operations, including our global supply-chain operations, and our international offices located in Nanjing, China and Bangalore, India as well as dependence upon our international sales operations. In addition, we are exposed to risk arising from our dependence upon third-party development contractors in India. The risks associated with our international operations also include costs of complying with differing and changing laws and regulatory requirements, tariffs, export quotas, custom duties and other trade restrictions; effects of inflation, currency controls and/or fluctuations in currency exchange rates; limited, inadequate or non-existent IP protection; and uncertainties associated with political conflicts and instabilities, variable economic conditions, terrorist attacks or acts of war. Our development operations and activities in China and India involve these and other significant risks, including: local labor conditions and regulations; knowledge transfer related to our technology and exposure to misappropriation of IP or confidential information, including information that is proprietary to us, our customers and third parties; heightened exposure to changes in the economic, security, political and pandemic conditions; international trade agreements and U.S. tax provisions that could adversely affect our international operations; complexities of managing development timelines and deliverables from abroad; and differences in local business practices and customs that may not align with our expectations and standards.

Along with the foregoing risks, our international sales operations involve risks associated with greater costs and complexity localizing and supporting our products and platform in local markets; evolving privacy regulations, trade regulations, compliance requirements and incremental costs applicable to the qualification, production, sale and delivery of our products; longer collection periods, financial instability and other difficulties impacting collection of accounts receivable in certain jurisdictions; more intense competition including from local equipment suppliers; and our reliance on value added resellers to sell and support our products in international markets given our limited presence and infrastructure outside the U.S. To expand our international operations, we will need to invest resources to attract key talent, build operational infrastructure, execute on our international strategy and drive international market demand for our products. If we invest substantial resources to expand our international operations and are unable to do so successfully or in a timely manner, our financial condition and results of operations may suffer.

We may have difficulty evolving and scaling our business and operations to meet customer and market demand, which could harm our financial results or cause us to fail to execute on our business strategies.

In order to grow our business, we will need to continually evolve and scale our business and operations to meet customer and market demand. Evolving and scaling our business and operations places increased demands on our management as well as our financial and operational resources to effectively manage organizational change; design scalable processes; accelerate and/or refocus research and development activities; expand our manufacturing, supply chain and distribution capacity; increase our sales and marketing efforts; broaden our customer success, support and services capabilities; maintain or increase operational efficiencies; scale support operations in a cost-effective manner; implement appropriate operational and financial systems; and maintain effective financial disclosure controls and procedures. If we cannot evolve and scale our business and operations effectively, we may not be able to execute our business strategies in a cost-effective manner and our business, financial condition and results of operations could be adversely affected.

Litigation and regulatory proceedings could harm our business or negatively impact our results of operations.

In the ordinary course of business, we are subject to legal claims, litigation and regulatory proceedings related to disputes over commercial, competition, IP, labor and employment and other matters. Regardless of the merits of any such claims, litigation and regulatory proceedings are inherently uncertain, and can be costly, disruptive to our business and operations, harmful to our reputation and distracting to management. In particular, as a technology company, we are subject to IP claims asserting patent, copyright, trademark and/or other infringement claims that are costly to defend and could limit our ability to use some technologies in the future. The risk of such claims is heightened as we expand our products and services and rely on more technologies, including third-party IP rights that we license and incorporate into our products and services. Third parties from whom we license IP may be unable or unwilling to indemnify us for such claims or offer any other remedy to us. Patent infringement claims may be asserted by patent assertion entities and non-practicing entities (“NPEs”) that do not conduct business as an operating company and hold and own patents only for the purpose of aggressively pursuing royalties through infringement assertions or patent infringement litigation. Further, in our industry, the number of assertions by NPEs has continued to increase due in part to patent sales by operating companies to NPEs and availability of litigation financing. We have received and expect to continue to receive assertions from NPEs and other third parties alleging that we may be infringing their patents or other IP rights; offering licenses to such IP; and/or threatening litigation. If our products are found to infringe, these claims could also result in the suspension of our ability to import, market and sell our products and services, product shipment delays or requirements to modify our products or enter into costly settlements or licensing agreements. Such royalty or licensing agreements, if required, may not be available to us on acceptable terms, if at all. Furthermore, we may additionally

16

Table of Contents

be financially responsible for claims made against our customers, including costs of litigation and damages awarded, under indemnity obligations which could further negatively impact our results of operations. Protracted litigation could cause us to incur significant defense costs, which would negatively impact our results of operations.

We have a history of fluctuations in our gross margin and operating results, which can make it difficult to predict our future performance and could cause the market price of our stock to decline.

We have a history of fluctuations in our quarterly and annual gross margin and operating results, including fluctuations due to factors outside of our control. Factors that impact variability of our operating results include our ability to predict our revenue and reduce and control our costs, our ability to predict product functions and features desired by our customers, the impact of global economic and geopolitical events and conditions, including tariffs, trade controls, inflation, government shutdowns, market instability and economic downturns, our ability to effectively manage our global supply chain operations, our ability to effectively manage third parties upon whom we depend to conduct our business, our customers’ spending patterns and purchasing decisions, the impact of competition, customer adoption of our products, our ability to manage our legal, contractual and regulatory obligations and liabilities and other risk factors identified in “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and in this “Risk Factors” section. Our gross margin is further impacted by customer, geographic and product mix, the impact of competition on our prices, our ability to manage our costs associated with components and materials, excess and obsolescence, expedite fees and logistics-related activities, contractual commitments and other product costs. Fluctuating results make it difficult to predict our future performance and could cause the market price of our stock to decline. We expect to continue to incur significant expenses and cash outlays as we seek to expand our business and operations and target new customer opportunities. Given our growth objectives and the intense competitive pressures we face, our operating expenses may increase at unexpected levels, and we may be unable to maintain positive operating income. Comparing our operating results on a period-to-period basis may not be meaningful, and you should not rely on our past results as an indication of our future performance. If our revenue or operating results fall below the expectations of investors or securities analysts, or below any guidance we may provide to the market, the market price of our stock would likely decline.

We are exposed to customer credit risks that could adversely affect our operating results and financial condition.

We generally extend credit terms for sales to our customers which exposes us to credit risk. If we are unable to collect our accounts receivable balances as anticipated, our operating results and financial condition will be harmed. A number of factors contribute to this risk, including our ability to adequately assess a customer’s creditworthiness and financial condition, changes in a customer’s financial condition and/or liquidity, our ability to timely collect our accounts receivable from customers, disagreements with customers on invoiced balances and economic downturns or other unanticipated events impacting a customer’s ability to pay. Furthermore, some of our international customers operate in countries with developing economies, volatile financial markets or currency regulations that impact their ability to make payments in U.S. dollars. While we take measures to pursue collections on our accounts receivable, we have from time to time written down accounts receivable and written off doubtful accounts and may need to do so in future periods. The determination of allowances for doubtful accounts involves significant judgment, and if we underestimate our allowance for doubtful accounts, we will have to make further write-downs. Such write-downs or write-offs could negatively affect our operating results for the period in which they occur and could harm our cash flow or our financial condition.

If we lose any of our key personnel, or are unable to attract, train and retain qualified personnel, our ability to manage our business and continue our growth would be negatively impacted.

Our success depends, in large part, on the continued contributions of our key personnel who are highly skilled and would be difficult to replace. Competition for skilled personnel, particularly in software and cloud development and engineering, is intense. We cannot be certain that we will be successful in attracting and retaining qualified personnel, or that newly hired personnel will function effectively, both individually and as a group. If we are unable to effectively recruit, hire and utilize new employees to align with our company objectives, execution of our business strategy and our ability to react to changing market conditions may be impeded, and our business, financial condition and results of operations may suffer. We operate using a “work-from-anywhere” model, and if we do not continue to effectively manage our distributed workforce, we could face challenges maintaining our corporate culture, which could increase attrition or limit our ability to attract personnel. None of our key personnel are bound by a written employment contract to remain with us for a specified period. In addition, we do not currently maintain key person life insurance covering our key personnel. If we lose the services of any key personnel, our business, financial condition and results of operations may suffer.

If we experience disruptions with our enterprise resource planning system, we may not be able to effectively transact business or produce financial statements, which would adversely affect our business, results of operations and cash flows.

We operate our Oracle enterprise resource planning (“ERP”) system on Oracle’s cloud platform and our software billing application on Salesforce.com. With these implementations, we are highly dependent upon Oracle and Saleforce.com to host, manage and maintain our ERP system and supporting applications. Any disruptions to their business or processes, or delays in their ability to provide services to us, may in turn disrupt our business operations or increase costs. Furthermore, we receive

17

Table of Contents

quarterly system updates and enhancements on the cloud platform according to Oracle’s release timeline and change management processes, which if not managed properly may disrupt our business operations and delay our ability to process transactions and produce reports necessary to conduct our business. We are highly dependent upon our ERP system for critical business functions, including order processing and management, supply chain and procurement operations, financial planning, accounting and reporting; accordingly, protracted disruption in functionality or processing capabilities of the ERP system could materially impair our ability to process transactions timely or produce accurate financial statements on a timely basis. If our systems suffer prolonged interruption, our results of operations and cash flows would be adversely affected.

Risks Related to Our Products

Our products are highly technical and may contain undetected hardware or software defects or software bugs, which could harm our reputation and adversely affect our business.

Our products, including our platform (agentic AI, cloud, software and appliances) and SmartLifemanaged services, are highly technical and, when deployed, are critical to the operation of many networks. Our products have contained and are subject to defects, bugs or security vulnerabilities, which risks may be exacerbated as we continue to expand our cloud and software portfolio and include services from third-party partners. Some defects in our products may only be discovered after a product has been installed and used by customers and may in some cases only be detected under certain circumstances or after extended use. Any errors, bugs, defects or security vulnerabilities discovered in our products after commercial release could result in loss of revenue or delay in revenue recognition, loss of customers and increased service and warranty and retrofit costs, any of which could adversely affect our business, operating results and financial condition. In addition, we are subject to claims for security and data breach, product liability, tort or breach of warranty. Our contracts with customers contain provisions relating to warranty disclaimers and liability limitations, which may not be upheld. Defending a lawsuit, regardless of its merit, is costly and may divert management’s attention and adversely affect the market’s perception of us and our products. In addition, if our business liability insurance coverage proves inadequate or future coverage is unavailable on acceptable terms or at all, our business, operating results and financial condition could be adversely impacted.

If we are unable to ensure that our products interoperate properly and as required within our customers’ networks, our business will be harmed.

Our products must interoperate with our customers’ existing and planned networks, which often have varied and complex specifications, utilize multiple protocol standards, include software applications and customizations and products from multiple vendors and contain multiple generations of products that have been added over time. As a result, we must continually ensure that our products interoperate properly with these existing and planned networks. To meet these requirements, we must undertake development efforts, including test protocols, which require substantial capital investment and employee resources. We may not accomplish these development goals quickly or cost-effectively, if at all. If we fail to maintain interoperability, we may face substantially reduced demand for our products, which would reduce our revenue opportunities and market share. We rely upon interoperability arrangements with equipment and software vendors for the use or integration of their technology with our products. If these relationships fail, we may have to devote substantially more resources to developing alternative products and processes and our efforts may not be as effective as the combined solutions under our current arrangements. In some cases, these other vendors are either direct competitors or companies that have extensive relationships with our existing and potential customers and influence the purchasing decisions of those customers. Some of our competitors have stronger relationships with some of our interoperability partners, and as a result, our ability to have successful interoperability arrangements with these companies may be harmed, which in turn may harm our ability to successfully sell and market our products.

Our estimates regarding warranty or product obligations are highly subjective. If our estimates change, the liability for warranty or product obligations may be increased, impacting future cost of revenue.

Our products are highly complex, and our product testing may not be adequate to detect all defects, errors, failures and quality issues. Accordingly, our estimates regarding future warranty or product obligations are highly subjective, and if our estimates change, the liability for warranty or product obligations may be increased, impacting future cost of revenue. Quality or performance problems for products covered under warranty could adversely impact our reputation and negatively affect our operating results and financial position. The development and production of new products with high complexity often involves problems with software, components and manufacturing methods. Any significant warranty or other product obligations due to reliability or quality issues arising from defects in software, faulty components or improper manufacturing methods could negatively impact our operating results and financial position due to costs associated with fixing software or hardware defects; high service and warranty expenses; high inventory obsolescence expense; delays in collecting accounts receivable; payment of liquidated damages for performance failures; and loss of customer goodwill and future sales.

18

Table of Contents

Our business and operations depend on proprietary technologies, and our financial performance may suffer if we cannot protect and enforce our IP rights.

Our success and ability to compete depend on proprietary technology. We rely significantly upon patent, copyright, trademark, trade secret and other IP laws, IP registration rights and agreements with our employees, customers, partners, suppliers and other parties, to establish and maintain IP rights necessary for our business and operations. U.S. IP laws afford us only limited protection, and the laws of some foreign countries do not protect proprietary rights to the same extent or at all. Our patent applications may not result in issued patents, and our issued patents may not be enforceable. Our IP rights could be challenged, invalidated, infringed or circumvented, any of which could impair or harm our business and operations and be costly to defend. Our failure to adequately protect our IP rights could result in our competitors offering similar products, resulting in the loss of our competitive advantage and decreased sales.

We and our third-party providers may be unable to adequately prevent unauthorized third-party copying or use of our IP. For example, contractual provisions protecting our IP are subject to breach, and our IP is subject to reverse engineering and unlawful distribution. It may become more difficult to adequately protect our IP as we expand our reliance on third parties for the design, development and/or manufacture of our products. In addition, we may become subject to increased risks arising from or related to security breaches, data loss or theft of our data or our IP, and have greater difficulty protecting our IP as our work-from-anywhere workforce and work product become more distributed. Policing the unauthorized use and distribution of our IP is difficult and costly. Litigation, which could result in substantial costs, diversion of resources and harm to our business, may be necessary to enforce our IP rights, protect our trade secrets or determine the validity and scope of proprietary rights.

If we are unable to obtain third-party technology licenses needed for our products and platform solutions, our business and operations will be impaired, and our operating results could be adversely affected.

We increasingly rely on technology licensed from third parties for our products and platform solutions. We may not be able to secure or maintain necessary technology licenses from these third parties on commercially reasonable terms or at all. Third parties may also choose not to renew licenses with us, demand unreasonable license fees or cease to offer technologies that we require. The inability to obtain necessary third-party licenses or to secure reasonable license terms at a cost acceptable to us could harm the competitiveness of our products and solutions, result in lost revenue and adversely affect our operating results. For example, we may be forced to forego product features or platform offerings, including features and offerings we believe are critical to our strategy, accept substitute technology of lower quality or performance standards or incur higher costs, or the time-to-market of our products or product features could be delayed. Furthermore, our ability to utilize third-party technology may be disrupted by disputes over IP rights, including claims of IP infringement, which could prevent us from offering or selling the products that utilize the disputed technology and adversely affect our operating results.

Our use of open-source software could impose limitations on our ability to commercialize our products.

We incorporate open-source software into our products. The terms of many open-source software licenses have not been interpreted by the courts, and there is a risk that such licenses could be construed in a manner that could impose unanticipated conditions or restrictions on our ability to sell our products. In such event, we could be required to make our proprietary software generally available to third parties, including competitors, at no cost, to seek licenses from third parties in order to continue offering our products, to re-engineer our products or to discontinue the sale of our products in the event re-engineering cannot be accomplished on a timely basis or at all, any of which could adversely affect our revenue and operating expenses.

Macroeconomic and Industry Risks

Our business depends upon the capital spending patterns and decisions of CXPs, and any decrease or delay in capital spending by CXPs due to the timing and availability of capital and other causes would reduce our revenue and harm our business.

Demand for our products depends on the magnitude and timing of capital spending by CXPs as they construct, expand, upgrade and maintain their access networks as well as CXPs’ adoption of our platform and managed services. Capital spending is cyclical in our industry, sporadic among individual CXPs and can change on short notice, which gives us little visibility into changes in spending behavior in any particular quarter. Capital spending for network infrastructure projects could be delayed or canceled in response to factors outside our control, such as reduced consumer spending, challenging capital markets or declining liquidity trends. CXP spending is also affected by reductions in budgets, including as a result of a general economic downturn, delays in purchasing cycles, access to or timing of government funding programs or capital markets, government shutdowns and seasonality and delays in capital allocation decisions. Historically, our customers may spend less or have less deployments in the first quarter due to pending annual budgets or, in certain regions, due to weather conditions that inhibit outside fiber deployment, resulting in weaker demand for our products in the first quarter. Softness in demand in any of our customer markets, including due to macroeconomic conditions beyond our control or uncertainties associated with regulatory reforms, has and could in the future lead to unexpected decline or slowdown in customer capital expenditures. Further, CXPs may pursue capital investment in network technologies other than those offered by us or may choose not to adopt our products

19

Table of Contents

and platform solutions in their networks. Reductions in capital expenditures by CXPs would have a material negative impact on our revenue and results of operations and slow our rate of revenue growth. As a consequence, our results for a particular period may be difficult to predict, and our prior results are not necessarily indicative of results in future periods.

Government-sponsored programs and U.S. federal government shutdowns could impact the timing and buying patterns of CXPs, which may cause fluctuations in our operating results.

We sell to broadband service providers and CXPs, including U.S.-based IOCs, which rely significantly upon interstate and intrastate access charges and federal and state subsidies in the form of grants and other funding, such as the Federal Communications Commission’s (“FCC”), Rural Digital Opportunity Fund, the CARES Act Enhanced Alternative Connect America Cost Model, or the American Rescue Plan Act. The FCC and some states may change such payments and subsidies, which could reduce IOC revenue. Furthermore, many IOCs use or expect to use government-supported loan programs or grants, such as U.S. Department of Agriculture’s Rural Utility Service or National Telecommunications and Information Administration’s (“NTIA”) Broadband Equity, Access and Deployment (“BEAD”) program loans and grants, to finance capital spending. These government-supported loan programs and grants generally include conditions such as deployment criteria, domestic preference provisions and other requirements that apply to the project and selected equipment as conditions for funding. For example, the U.S. government passed The Infrastructure Investment Jobs Act, which charged the NTIA with establishing the BEAD program and ensuring that BEAD-funded infrastructure projects comply with the Buy America Domestic Content Procurement Preference (“Buy America Preference”) of the Build America, Buy America Act (“BABA”). In accordance with BABA, the U.S. Department of Commerce has issued a limited, general applicability, nonavailability waiver of the Buy America Preference to recipients of federal financial assistance under the NTIA’s BEAD Program. Notwithstanding this waiver, certain of our products will be required to meet BABA domestic content requirements to enable certain customers to qualify for grant funding under the BEAD program. Any failure of such products to meet BABA domestic content requirements would result in those products being ineligible for purchase and use by certain customers under the BEAD program, and could result in lost sales, lost business opportunity, breach of warranty claims, and damage to our reputation and customer relationships.

Changes to the terms or administration of these programs, including uncertainty from government and administrative change, increasing focus on domestic requirements by the U.S. that may require re-assessment of compliance, potential funding limitations that impact our ability to meet program requirements or delays due to U.S. federal government shutdowns could reduce the ability of IOCs to access capital or secure funding under these programs to purchase our products and services and thus reduce our revenue opportunities. In addition, compliance with these requirements may significantly increase our record-keeping, accounting and production costs. As a result of these risks, the domestic content requirements may have a material adverse impact on our U.S. sales, business and results of operations. Customers may curtail purchases if they receive less funding than planned, are negatively impacted by federal government shutdowns or changes in government regulations and subsidies, or as funding winds down, any of which could have an adverse effect on our operating results and financial condition.

Adverse global economic, market and industry conditions, geopolitical issues and other conditions that impact our increasingly global operations could have a negative effect on our business, results of operations and financial condition and liquidity.

As a global company, our performance is affected by global economic, market and industry conditions as well as geopolitical issues and other conditions with global reach. In recent years, concerns about the global economic outlook, inflation and increased interest rates have adversely affected market and business conditions in general. Macroeconomic weakness and uncertainty make it more difficult for us to manage our operations and accurately forecast revenue, gross margin and operating expenses. Further, bank failures and other adverse developments that affect financial institutions, transactional counterparties, or other third parties, or concerns or rumors about these events, have led to market-wide liquidity problems.

Geopolitical issues such as armed conflicts, relations between the U.S. and China, tariff and trade policy changes and increasing potential of conflict involving countries in Asia that are critical to our supply-chain operations, such as Taiwan and China, have resulted in increasing global tensions and create uncertainty for global commerce. New or increased tariffs and other changes in U.S. trade policy, including new sanctions, have triggered and may continue to trigger retaliatory actions by affected countries or changes in demand from customers displeased with U.S. tariff and trade policy changes. U.S. executive orders have resulted in tariffs on imports from numerous countries, including China and other Asian countries where our sole-source or limited-source suppliers are located. Consequently, absent policy changes, these actions will increase our cost of revenue. To the extent dissatisfaction with U.S. government policy results in U.S.-based suppliers being disfavored over foreign-based alternatives, it may diminish demand for our products with such customers and cause them to find alternative sourcing or otherwise make it more difficult for us to sell more products to these customers. The imposition of additional tariffs or other trade barriers by countries other than the U.S., including China and other Asian countries, will increase our costs in these markets, and to the extent these increased costs result in increased prices for our customers, we expect the demand for products in these markets to decrease as some of our customers seek alternative sources, making it more difficult for us to sell our products in these markets.

20

Table of Contents

In addition, inflation in the U.S. has affected businesses across many industries, including ours, by increasing the costs of labor, employee healthcare, components and freight and shipping, which may further constrain our customers’ or prospective customers’ budgets. To the extent there is a sustained general economic downturn, and our platform and services are perceived by customers or potential customers as costly, or too difficult to deploy or migrate to, our revenue may be disproportionately affected by delays or reductions in spending. Sustained or worsening of global economic conditions and geopolitical issues may increase our cost of doing business, materially disrupt our supply chain operations, cause our customers to reduce or delay spending and intensify pricing pressures. We cannot predict the timing, strength or duration of any economic slowdown, instability or recovery, generally or within any particular industry. If the economic conditions of the general economy or markets in which we operate worsen from present levels, demand for our products, and our business, financial condition and results of operations, could be adversely affected.

We face intense competition that could reduce our revenue and adversely affect our financial results.

The market for our products is highly competitive, and we expect competition from both established and new companies to increase. Our ability to compete successfully depends on a number of factors, including our ability to successfully develop new products and solutions that anticipate CXP and market requirements and changes in technology and industry standards; CXP acceptance and adoption of our products and solutions; our ability to differentiate our products from our competitors’ offerings based on performance, features, cost-effectiveness or other factors; our product capabilities to meet customer network requirements and preferences; and our success in marketing and selling our products and platform solutions.

Many of our current or potential competitors have longer operating histories, greater name recognition, broader product lines, larger customer bases and significantly greater financial, technical, sales, marketing and other resources than we do and are better positioned to acquire and offer complementary products and services. As the broadband access equipment market has undergone and continues to undergo consolidation, our competitors have merged, grown and been able to offer more comprehensive solutions than they individually had offered. Potential customers may also prefer to purchase from their existing suppliers rather than a new supplier, regardless of product performance or features, because the products that we and our competitors offer require a substantial investment of time and funds to qualify and install. The demand on network capacity due to remote workforces may attract new market entrants with competitive or substitutive products, which may lead to increased sales cycles, cause pricing pressure and impact adoption of our platform due to the broader availability of product offerings. Some of our competitors may offer substantial discounts or rebates to win or retain customers. If we are forced to reduce prices to retain existing customers or win new customers, we may be unable to sustain gross margin at desired levels or obtain or sustain profitability. Competitive pressures could result in increased pricing pressure, reduced profit margin, increased sales and marketing expenses and failure to increase, or the loss of, market share, any of which could reduce our revenue and adversely affect our financial results.

Historically, our customer base has been concentrated, and the loss of any of our key customers may adversely impact our revenue and results of operations, and any delays in payment by a key customer could negatively impact our cash flows and working capital.

Although we have not had a greater-than-10%-of-revenue customer since 2020, a large portion of our sales has been, and in the future may be, to a limited number of customers. Changes in the broadband service provider market, such as financial difficulties, spending cuts or corporate consolidations that impact purchasing decisions by these customers have and may again negatively impact our revenue, and as a result, revenue from such customers may remain flat or decline. There are no assurances that the demand for our products will remain strong from our key customers, and any decrease or delay in purchases of any of our key customers, particularly if prolonged or sustained, or our inability to grow our sales with them, may have a material negative impact on our revenue and results of operations.

In addition, some larger customers may demand discounts and rebates or desire to purchase their access systems and software from multiple providers. As a result of these factors, our future revenue opportunities may be limited, and we may face pricing pressures, which in turn could adversely impact our gross margin and our financial results. The loss of, reduction in, or pricing discounts associated with orders from any larger customer could significantly reduce our revenue and harm our business. Furthermore, delays in payment and/or extended payment terms from any of our larger customers could have a material negative impact on our cash flows and working capital to support our business operations.

Our industry is characterized by rapid technological advancements, and if we fail to develop new products or enhancements that meet changing CXP requirements, we could experience lower sales.

Our industry is characterized by rapid technological change, changing needs of CXPs, evolving industry standards and frequent introductions of new products and platform offerings. We invest significant amounts to pursue innovative technologies that we believe will be adopted by CXPs. For example, we have invested and plan to continue to invest resources in our platform offerings and agentic AI. In addition, on an ongoing basis, we expect to reposition our product and service offerings and introduce new offerings as we encounter rapidly changing CXP requirements and increasing competitive pressures. If we cannot increase sales of our new platform and services, keep pace with rapid technological developments to meet customer

21

Table of Contents

needs and compete with evolving standards or if the technologies we choose to invest in fail to meet customer needs or are not adopted by customers in the timeframes that we expect, our financial condition and results of operations would be adversely affected.

Developing our products is complex and involves uncertainties, including pricing risks for key materials, component shortages and limited suppliers. We may experience design, manufacturing, software development quality, support, marketing and other difficulties that could delay or prevent the development, introduction or marketing of new products and enhancements. If we fail to meet our development targets, demand for our products will decline. If we are unable to anticipate and develop new products or enhancements to our existing products on a timely and cost-effective basis, our products may become technologically obsolete more rapidly than anticipated over time, resulting in lower sales which would harm our business. Furthermore, the introduction of new or enhanced products also requires that we manage the transition from older products in accordance with customer requirements. If we fail to maintain compatibility requirements in our customers’ networks, demand for our products would decline, which would reduce our revenue opportunities and market share.

We use third-party development partners both for their key skills and to augment our employee developers. Using third-party development partners for our broadband platform and managed services allow us to accelerate development and leverage the third parties’ expertise, but increases our risks due to reduced direct control over the third party’s work. This product development approach may cause unforeseen issues in product design, as well as challenges arising from integration and support of third-party features in our products. In addition, our revenue based on the third parties’ product development work may take several years to cover our out-of-pocket expenses, if ever.

Our sales cycles can be long and unpredictable, and our sales efforts require considerable time and expense. As a result, our sales are difficult to predict and may vary substantially, which may cause our operating results to fluctuate significantly.

The timing of our revenue is difficult to predict. Our sales efforts often involve educating broadband service providers about the use and benefits of our platform (agentic AI, cloud, software and appliances) and managed services, and the desirability of transforming into a CXP. CXPs typically undertake a significant evaluation process, which frequently involves not only our platform and managed services, but also those of our competitors and results in a lengthy sales cycle. Sales cycles for larger customers are relatively longer and require considerably more time and expense. We spend substantial time, effort and money in our sales efforts without any assurance that our efforts will produce sales. In addition, product purchases are frequently subject to budget constraints, multiple approvals and unplanned administrative, processing and other delays. The timing of revenue related to sales of products and services that have installation requirements may be difficult to predict due to interdependencies that may be beyond our control, such as new customer testing and turn-up protocols or other vendors’ products, services or installations of equipment upon which our products and services rely. Such delays may result in fluctuations in our quarterly revenue. If sales expected from a specific customer for a particular quarter are not realized in that quarter or at all, we may not achieve our revenue forecasts, and our financial results would be adversely affected.

Government and Regulatory Risks

Actual or perceived failure to comply with applicable data privacy, security and platform and technology regulation laws, regulations and standards could impact our business, operations, and expose us to increased liability.

Government authorities in the U.S. and around the world have implemented and are continuing to implement broader and more stringent laws and regulations concerning data protection. The interpretation and application of these data protection laws and regulations are often uncertain and changing, and it is possible that they may be interpreted and applied in a manner that is inconsistent with our data practices.

For example, in the U.S., certain states have adopted or modified privacy and security laws and regulations which govern the privacy, processing and protection of personal information. Such laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us and our future customers and strategic partners. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (collectively, the “CCPA”) requires covered businesses that process the personal information of California residents to, among other things: (i) provide certain disclosures to California residents regarding the business’s collection, use and disclosure of their personal information; (ii) receive and respond to requests from California residents to access, delete and correct their personal information or to opt out of certain disclosures of their personal information; and (iii) enter into specific contractual provisions with service providers that process California resident personal information on the business’s behalf. Additional compliance investment and potential business process changes may also be required. Similar laws have been passed in other states, and are continuing to be proposed at the state and federal level, reflecting a trend toward more stringent privacy legislation in the U.S. Most of the new or proposed laws include restrictions on processing consumer information for targeted advertising, which could negatively affect our marketing cloud products. The enactment of such laws could have potentially conflicting requirements that would make compliance challenging. If we are subject to or affected by the CCPA, or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition.

22

Table of Contents

In 2024, the National Security Division of the U.S. Department of Justice (“DOJ”) issued a new rule—referred to as the “Data Security Program” (“DSP”) aimed at preventing access to “bulk U.S. sensitive personal data” and “government-related data” by “countries of concern” (including China, Russia, Iran, North Korea, Cuba, and Venezuela) and “covered persons” (as all such terms are defined in the DSP). Effective as of April 8, 2025, and fully enforceable as of July 9, 2025, the DSP imposes stringent obligations on companies within its scope and prohibits or restricts “covered data transactions” that grant countries of concern or covered persons access to bulk U.S. sensitive personal data or any amount of government-related data. The DSP is new, complex and has yet to be enforced, and as such, there is a risk that our interpretation of its applicability, scope and requirements is incorrect, incomplete or misapplied.

Compliance with the DSP may require us to invest heavily in data security and compliance measures such as implementing and complying with the Cybersecurity and Infrastructure Security Agency’s guidelines and other burdensome recordkeeping, reporting and auditing requirements. It may also require us to implement new processes, stop or restrict certain data transfers, alter the geographic scope of our operations, cease doing business with certain third parties or using certain tools or vendors, or change how data flows throughout our business, any of which could materially impact our business operations or hinder our ability to grow our business. Finally, non-compliance with the DSP could result in significant civil or criminal penalties, which could materially adversely affect our business, results of operations and financial condition.

Furthermore, the Federal Trade Commission (“FTC”) and many state Attorneys General continue to enforce federal and state consumer protection laws against companies for online collection, use, dissemination and security practices that appear to be unfair or deceptive. For example, according to the FTC, failing to take appropriate steps to keep consumers’ personal information secure can constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities.

The General Data Protection Regulation (“EU GDPR”) adopted by the EU, and the UK General Data Protection Regulation (“UK GDPR”) adopted by the United Kingdom (“UK”) (the EU GDPR and UK GDPR hereinafter referred to as the “GDPR”) and national data protection supplementing laws in these jurisdictions impose specific duties and requirements upon companies that are subject to their provisions and collect, process or control personal data of individuals. Although we currently do not have material operations or business in the EU or the UK, we are in the process of expanding in these jurisdictions, and we have incurred and will continue to incur substantial costs in this respect. Furthermore, the GDPR imposes significant penalties for noncompliance which can amount to the greater of €20 million for the EU GDPR or £17.5 million for the UK GDPR or 4% of the total worldwide annual turnover of the preceding financial year; thus, any non-compliance with the GDPR could result in a material adverse effect on our business, financial condition and results of operations.

The GDPR regulate cross-border transfers of personal data out of the European Economic Area (the “EEA”) and the UK. There is currently legal complexity and uncertainty regarding international personal data transfers, and we expect this to continue. For example, there are number of decisions and proceedings in the EU where the legality of data transfers to China is being challenged. As the regulatory guidance and enforcement landscape in relation to data transfers further develops, our business, operations and financial condition could be adversely affected and we could suffer additional costs, complaints and/or regulatory investigations or fines. We may also have to stop using certain tools and vendors and make other operational changes. Further, our customers may not use our services in a manner that is compliant with applicable data privacy laws and regulations and our services may not be competitive in certain markets. We may also become subject to new laws that regulate both personal and non-personal data. For example, the Data Act came into effect on September 12, 2025, establishing new requirements for providers of data processing services (including cloud, SaaS) into the EU. The Data Act requires providers to facilitate customers switching to other providers/ on-premise solutions and porting their data within certain timeframes; remove technical, contractual, and commercial obstacles to service switching (including switching charges); and include certain mandatory terms in customer contracts. Failure to comply with the Data Act can result in regulatory enforcement and fines, civil claims, and reputational damage. The Data Act, together with developing guidance in this area, may require changes to our customer contracts, products, operations and business practices, increase our compliance costs, require adjustments to our revenue recognition practices and adversely affect our financial condition, business and operations.

In addition, security regulations such as the EU’s Network and Information Security 2 Directive (“NIS2”) and its EU Member State transpositions, and the UK’s Telecommunications (Security) Act 2021 together with its implementing regulations impose further security obligations, including on electronic communications networks and services. We may be required to implement (and contractually commit to) additional security measures to remain a competitive vendor, as customers will need to ensure their vendors are able to meet the obligations that they are themselves subject to, or customers may choose different vendors due to our security measures. This could result in additional costs and require operational changes which could adversely affect our business, operations and financial condition.

In light of the complex and evolving nature of EU, EU Member State and UK data and security laws, there can be no assurances that we will be successful in our efforts to comply with such laws; violations of such laws could result in regulatory

23

Table of Contents

investigations, fines, orders to cease/change our use of technologies and/or our processing activities, enforcement notices and assessment notices (for a compulsory audit), as well as lead to civil claims including class actions and reputational damage.

Complying with new and changing laws could cause us to incur substantial costs in order to market and sell our cloud-based solutions in the U.S. and internationally, deter customers from adopting our cloud-based solutions or require us to redesign our platform in order to meet customer requirements related to such laws. Regulatory actions or claims involving our practices in the collection, storage, processing, use or disclosure of consumer information or other personal data, even if unfounded, could damage our reputation and adversely affect our operating results. The failure or perceived failure to comply may result in government or civil proceedings or actions against us, or could cause us to lose customers, which could have an adverse effect on our business.

If we fail to comply with evolving industry standards, sales of our products would be adversely affected.

Our products are subject to a significant number of domestic and international standards, which evolve as new technologies are developed and deployed. As we expand into new global markets, we are likely to encounter additional standards. Our products must comply with these standards in order to be widely marketable. In some cases, we are required to obtain certifications or authorizations before our products can be introduced, marketed or sold in new markets or to new customers. For example, our ability to maintain Operations System Modification for Intelligent Network Elements certification for our products will affect our ongoing ability to continue to sell our products to large broadband service providers. In addition, our ability to expand our international operations may be limited by standards in countries or may require us to redesign our products or develop new products to meet local standards. We may not be able to design our products to comply with local requirements, which would impede or prevent our ability to grow our business in those locations. Moreover, as we expand our business and operations globally, we must increase investments to maintain compliance with evolving standards across all of our markets. The costs of complying with evolving standards or failure to obtain timely authorizations or certification could prevent us from selling our products where these standards or regulations apply, which would result in lower revenue and lost market share.

Our failure or the failure of our manufacturers to comply with environmental and other legal regulations could adversely impact our results of operations.

The manufacture, assembly and testing of our products may require the use and disposal of hazardous materials that are subject to environmental, health and safety regulations, or materials subject to laws restricting the use of conflict minerals. We substantially depend upon our third-party manufacturers to comply with these requirements. Any failure by us or our third-party manufacturers to comply with these requirements could result in regulatory penalties, legal claims or disruption of production of our products. In addition, any failure to properly manage the use, transportation, emission, discharge, storage, recycling or disposal of hazardous materials could subject us to increased costs or liabilities. Existing and future environmental regulations and other legal requirements may restrict our use of certain materials to manufacture, assemble and test products. Any of these consequences could adversely impact our results of operations by increasing our expenses and/or requiring us to alter our manufacturing processes.

We are subject to governmental export and import controls that could subject us to liability or impair our ability to compete in additional international markets.

Our products are subject to U.S. export and trade controls and restrictions. International shipments of certain of our products may require export licenses or are subject to additional export requirements. In addition, the import laws of other countries may limit our ability to distribute our products, or our customers’ ability to buy and use our products, in those countries. Changes in our products or changes in export and import regulations or duties may create delays in the introduction of our products in international markets, prevent our customers with international operations from deploying our products or, in some cases, prevent the export or import of our products to certain countries altogether. Any change in export or import regulations, duties or related legislation, shift in approach to the enforcement or scope of existing regulations, or change in the countries, persons or technologies targeted by such regulations, could negatively impact our ability to sell, profitably or at all, our products to existing or potential international customers.

Regulatory and physical impacts of climate change and other natural events may affect our customers and our manufacturers, resulting in adverse effects on our operating results.

As emissions of greenhouse gases continue to alter the composition of the atmosphere, affecting large-scale weather patterns and the global climate, any new regulation of greenhouse gas emissions may result in additional costs to our customers and our manufacturers. In addition, the physical impacts of climate change and other natural events, including changes in weather patterns, drought, rising ocean and temperature levels, earthquakes and tsunamis may impact our customers, suppliers and manufacturers and our operations. These potential physical effects may adversely affect our revenue, costs, production and delivery schedules, and cause harm to our results of operations and financial condition.

Our customers are subject to government regulation, and changes in current or future laws or regulations that negatively impact our customers could harm our business.

24

Table of Contents

Many of our customers are subject to state and federal regulation of their businesses, and adoption of regulations that affect providers of broadband Internet access services could impede the penetration of our customers into certain markets. For example, the FCC has jurisdiction over many of our U.S. customers, and FCC regulatory policies that create disincentives for investment in access network infrastructure or impact the competitive environment in which our customers operate may harm our business. Moreover, various international regulatory bodies have jurisdiction over certain of our customers outside the U.S. Changes in any of these standards, laws and regulations, or judgments in favor of plaintiffs in lawsuits against broadband service providers based on changed standards, laws and regulations could adversely affect the development of broadband networks and services. This, in turn, could directly or indirectly adversely impact the industries in which our customers operate.

Risks Related to Ownership of Our Common Stock and Other Risks

Our stock price may continue to be volatile, and the value of an investment in our common stock may decline.

The trading price of our common stock has been, and is likely to continue to be, volatile, which means that it could decline substantially within a short period of time and could fluctuate widely in response to various factors, some of which are beyond our control. These factors include those discussed above and others such as quarterly variations in our results of operations or those of our competitors; failure to meet any guidance that we have previously provided regarding our anticipated results; changes in earnings estimates or recommendations by securities analysts; failure to meet securities analysts’ estimates; announcements by us or our competitors of new products, significant contracts, commercial relationships, acquisitions or capital commitments; developments with respect to IP rights; our ability to develop and market new and enhanced products on a timely basis; our commencement of, or involvement in, litigation and developments relating to such litigation; changes in governmental regulations; and a slowdown in the communications industry or the general economy.

The stock market in general, and the market for technology companies in particular, has experienced extreme price and volume fluctuations that have often been unrelated or disproportionate to the operating performance of those companies. Broad market and industry factors may seriously affect the market price and volatility of our common stock, regardless of our actual operating performance. Historically, following periods of volatility in the market price of a company’s securities, there is increased risk that stockholders may initiate securities class action litigation against the company. Such litigation, if instituted against us, could result in substantial costs and a diversion of our management’s attention and resources.

Provisions in our charter documents and under Delaware law could discourage a takeover that stockholders may consider favorable and may lead to entrenchment of our management and Board of Directors.

Our amended and restated certificate of incorporation and amended and restated bylaws contain provisions that could have the effect of delaying or preventing changes in control or changes in our management or our Board of Directors. These provisions include: (i) a classified Board of Directors with three-year staggered terms, which may delay the ability of stockholders to change the membership of a majority of our Board of Directors; (ii) no cumulative voting in the election of directors, which limits the ability of minority stockholders to elect director candidates; (iii) the exclusive right of our Board of Directors to elect a director to fill a vacancy created by the expansion of the Board of Directors or the resignation, death or removal of a director, which prevents stockholders from being able to fill vacancies on our Board of Directors; (iv) the ability of our Board of Directors to issue shares of preferred stock and to determine the price and other terms of those shares, including preferences and voting rights, without stockholder approval, which could be used to significantly dilute the ownership of a hostile acquirer; (v) a prohibition on stockholder action by written consent, which forces stockholder action to be taken at an annual or special meeting of our stockholders; (vi) the requirement that a special meeting of stockholders may be called only by the chairman of the Board of Directors, the chief executive officer or the Board of Directors, which may delay the ability of our stockholders to force consideration of a proposal or to take action, including the removal of directors; and (vii) advance notice procedures that stockholders must comply with in order to nominate candidates to our Board of Directors or to propose matters to be acted upon at a stockholders’ meeting, which may discourage or deter a potential acquirer from conducting a solicitation of proxies to elect the acquirer’s own slate of directors or otherwise attempting to obtain control of us. We are also subject to certain anti-takeover provisions under Delaware law, which prohibits a corporation, in general, from engaging in a business combination with any holder of 15% or more of its capital stock unless the holder has held the stock for three years or, among other things, the Board of Directors has approved the transaction.

We may need additional capital in the future to finance our business.

While our working capital needs to support our business operations and growth have been funded from operating cash flows and through issuance of our common stock under our equity incentive plans, we may need additional capital if our current plans and assumptions change. If our financial position deteriorates, we may not be able to secure a source of financing to support our working capital needs on acceptable terms or at all. If future financings involve the issuance of equity securities, our then-existing stockholders will suffer dilution. If we raise debt financing, we may be subject to restrictive covenants that limit our ability to conduct our business. If we are unable to obtain and sustain operating income and positive cash flows from operations, our liquidity, results of operations and financial condition may be adversely affected. Furthermore, if we are unable to generate sufficient cash flows to support our operational needs, we may need to cease our common stock repurchase program

25

Table of Contents

or seek additional sources of liquidity, including borrowings, to support our working capital needs, even if we believe we have generated sufficient cash flows to support our operational needs. There is no assurance that any other sources of liquidity may be available to us on acceptable terms or at all. If we are unable to generate sufficient cash flows or obtain other sources of liquidity, we will be forced to limit our development activities, reduce our investment in growth initiatives and institute cost-cutting measures, all of which would adversely impact our business and growth.

We do not currently intend to pay dividends on our common stock and, consequently, our stockholders’ ability to achieve a return on their investment will depend on appreciation in the price of our common stock.

We do not currently intend to pay a cash dividend on our common stock for the foreseeable future. We currently intend to invest our future earnings, if any, to fund our growth. Therefore, our stockholders are not likely to receive any dividends on our common stock for the foreseeable future.

Our failure to adequately address and resolve risks and uncertainties associated with acquisitions could have a material adverse impact on our financial condition and results of operations.

We may acquire businesses, products or technologies to expand our product offerings and capabilities, customer base and business. We have evaluated and expect to continue to evaluate a wide array of potential strategic transactions. Such investments may involve significant risks and uncertainties, including distraction of management from current operations, unanticipated costs, and legal and regulatory challenges, all of which could have a material adverse impact on our financial condition and results of operations. In addition, the anticipated benefit of any acquisition may never materialize or the process of integrating acquired businesses, products or technologies may create unforeseen operating difficulties and expenditures.

We cannot guarantee that our stock repurchase program will be utilized to the full value approved or that it will enhance long-term stockholder value. Repurchases we consummate could increase the volatility of the price of our common stock and could have a negative impact on our available cash balance.

We have a common stock repurchase program of which $109.3 million was available as of December 31, 2025. Furthermore, the Board of Directors authorized an increase to the common stock repurchase program by $125.0 million in January 2026. Under the repurchase program, repurchases can be made from time to time using a variety of methods, which may include open market purchases, privately negotiated transactions or otherwise, all in accordance with the rules of the SEC and other applicable legal requirements. The specific timing, price and size of the purchases will depend on prevailing stock prices, general economic and market conditions, and other considerations consistent with our capital allocation strategy. Stock repurchases could have an impact on our common stock trading prices, increase the volatility of the price of our common stock, or reduce our available cash balance such that we will be required to seek financing to support our operations. The repurchase program does not obligate us to acquire a particular amount of common stock, and the repurchase program may be suspended or discontinued at any time at our discretion, which may result in a decrease in the trading prices of our common stock. Even if our share repurchase program is fully implemented, it may not enhance long-term stockholder value.

General Risks

As a public company, we are subject to significant accounting, legal and regulatory requirements; our failure to comply with these requirements may adversely affect our operating results and financial condition.

We are subject to significant accounting, legal and regulatory requirements, including requirements and rules under the Sarbanes-Oxley Act and the Dodd-Frank Wall Street Reform and Consumer Protection Act among other rules and regulations implemented by the SEC as well as listing requirements of the New York Stock Exchange (“NYSE”). We incur significant accounting, legal and other expenses and must invest substantial time and resources to comply with public company reporting and compliance requirements, including costs to ensure we have adequate internal controls over accounting and financial reporting, proper documentation and testing procedures among other requirements. We cannot be certain that the actions we have taken to implement internal controls over financial reporting will be sufficient. We have in the past discovered, and may in the future discover, areas of our internal financial and accounting controls and procedures that need improvement, particularly as we enhance, automate and improve functionality of our processes and internal applications. New laws and regulations as well as changes to existing laws and regulations affecting public companies would likely result in increased costs to us as we respond to their requirements. We continue to invest resources to comply with evolving laws and regulations, and this investment may result in increased general and administrative expense.

If we fail to maintain proper and effective internal controls, our ability to produce accurate financial statements on a timely basis could be impaired, which would adversely affect our operating results and our stock price.

Our management is responsible for establishing and maintaining adequate internal control over financial reporting to provide reasonable assurance regarding the reliability of our financial reporting and the preparation of financial statements in accordance with U.S. generally accepted accounting principles. Our management does not expect that our internal control over financial reporting will prevent or detect all error and all fraud. A control system, no matter how well designed and operated,

26

Table of Contents

can provide only reasonable, not absolute, assurance that the control system’s objectives will be met. Because of the inherent limitations in all control systems, no evaluation of controls can provide absolute assurance that misstatements due to error or fraud will not occur or that all control issues and instances of fraud, if any, within our company will have been detected. If we are unable to produce accurate financial statements on a timely basis, investors could lose confidence in the reliability of our financial statements, which could cause the market price of our common stock to decline and make it more difficult for us to finance our operations and growth.

ITEM 1B. Unresolved Staff Comments

None.

ITEM 1C. Cybersecurity

Cybersecurity Risk Management and Strategy

We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information.

We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (“NIST CSF”) and the MITRE ATT&CK® framework. This does not imply that we meet any particular technical standards, specifications or requirements, only that we use the NIST CSF and MITRE ATT&CK® as guides to help us identify, assess and manage cybersecurity risks relevant to our business.

Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas.

Key aspects of our cybersecurity risk management program include the following:

•risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise information-technology environment;

•a security team principally responsible for managing; (i) our cybersecurity risk assessment processes, (ii) our security controls and (iii) our response to cybersecurity incidents;

•the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls and processes;

•cybersecurity awareness training of our employees, incident response personnel and senior management;

•a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and

•a third-party risk management process for key service providers, suppliers and vendors.

We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A “Risk Factors – Cyberattacks or other security incidents that disrupt our operations or compromise data, may expose us to liability, harm our reputation or otherwise adversely affect our business.”

Cybersecurity Governance

Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the AI and Cybersecurity Committee (the “Committee”), since its formation in 2017, the oversight of business continuity, cybersecurity, privacy and other IT risks. In 2025, the Board further delegated to the Committee oversight of AI risks. The Committee oversees management’s implementation of our AI and cybersecurity risk management program.

The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any significant cybersecurity incidents.

The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also periodically receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our management team, internal security staff or external experts as part of the Board’s continuing education on topics that impact public companies.

Our Chief Operating Officer and Chief Product Officer are primarily responsible for assessing and managing our material risks from cybersecurity threats and supervise both our internal cybersecurity personnel and our retained external cybersecurity

27

Table of Contents

consultants. Our former Chief Commercial Operations Officer played a pivotal role in enhancing our cybersecurity frameworks across the enterprise through his experience in risk management and IT governance. He oversaw the implementation of data governance and data protection policies and was instrumental in fostering a culture of cybersecurity awareness across the organization. Our Chief Operating Officer has assumed these responsibilities. Our Chief Product Officer has significantly contributed to our cybersecurity efforts through his experience in product management and development. He has been instrumental in integrating security by design and privacy by design into our products, helping to ensure that cybersecurity is a core component of our product strategy. Collectively, they stay informed about and monitor the prevention, detection, mitigation and remediation of key cybersecurity risks and incidents through various means, which may include briefings with internal and external security team members, threat intelligence and other information obtained from public or private sources and alerts and reports produced by security tools deployed in the IT environment.