Investing in our securities involves a high degree of risk. You should carefully consider the risks and uncertainties described below, together with all of the other information in this Quarterly Report on Form 10-Q, including in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our condensed consolidated financial statements and related notes, before making a decision to invest in our securities. If any of the risks actually occur, our business, financial condition, operating results and prospects could be materially and adversely affected. In that event, the market price of our Class A common stock could decline, and you could lose part or all of your investment. Risk Factors Summary Our business is subject to a number of risks and uncertainties, including those risks discussed at length below. These risks include, among others, the following: •If we do not compete effectively, our customers do not renew their subscriptions or expand their use of our services, or if we are unable to attract new customers or expand deployments with existing customers to our higher-tiered Enterprise Advanced plan or at rates that are consistent with our expectations, or if the market for cloud-based enterprise services declines or develops more slowly than we expect, our business could be adversely affected. •Because we recognize revenue from subscriptions for our services over the term of the subscription, downturns or upturns in new business may not be immediately reflected in our operating results. •Adverse economic conditions have in the past and may in the future result in reduced sales, longer sales cycles, reduced renewal rates, slower adoption of new technologies and increased price competition, any of which could negatively impact our business. •As a substantial portion of our sales efforts are increasingly focused on cloud content management use cases and are targeted at enterprise and highly-regulated customers, our sales cycles may become longer and more expensive and we may encounter greater pricing pressure and implementation and customization challenges, all of which could harm our business and operating results. •Issues relating to the use of artificial intelligence and machine learning in Box solutions could adversely affect our business and operating results. •If we fail to meet the service level commitments we provide under our subscription agreements, we could be obligated to provide credits or refunds for prepaid amounts related to unused subscription services or face subscription terminations, which could adversely affect our revenue. Furthermore, any failure in our delivery of high-quality customer support services may adversely affect our relationships with our customers and our financial results. •Our international operations expose us to significant risks, including the impact of fluctuations in currency exchange rates. •Actual or perceived security vulnerabilities in our services or any breaches of our security controls and unauthorized access to our or a customer’s data could harm our business and operating results. •Privacy concerns and laws or other domestic or foreign regulations may reduce the effectiveness of our services and harm our business, and we may not be able to satisfy data protection, security, privacy, and other government- and industry-specific requirements, which may harm our growth. •Our platform must integrate with a variety of operating systems, software applications and technologies that are developed by others, and if we are unable to ensure that our solutions interoperate with such systems, applications and technologies, our service may become less competitive, and our operating results may be harmed. •If we fail to effectively manage our technical operations infrastructure or suffer from interruptions or delays in service from our third-party providers, the delivery of our services may be harmed, which may adversely affect our business. •Interruptions or delays in service from our third-party cloud computing and hosting providers could impair the delivery of our services and harm our business. 35 •Our services are becoming increasingly mission-critical for our customers and if these services fail to perform properly or if we are unable to scale our services to meet the needs of our customers, our reputation could be adversely affected, our market share could decline and we could be subject to liability claims. •Our growth depends in part on the success of our strategic relationships with third parties. •We depend on our key employees and other highly skilled personnel to grow and operate our business, and if we are unable to hire, retain and motivate our personnel, including expanding and optimizing our direct sales force, we may not be able to grow effectively. •We may be sued by third parties for alleged infringement of their proprietary rights. •Any failure to protect our intellectual property rights could impair our ability to protect our proprietary technology and brand. •Our Series A Convertible Preferred Stock has rights, preferences and privileges that are not held by, and are preferential to the rights of, our Class A common stockholders, which could adversely affect our liquidity and financial condition. Risks Related to Our Business and Our Industry The market in which we participate is intensely competitive, and if we do not compete effectively, our operating results could be harmed. The market for cloud content management services is fragmented, rapidly evolving and highly competitive, with relatively low barriers to entry for certain applications and services. Many of our competitors and potential competitors are larger and have greater brand recognition, longer operating histories, and significantly greater resources than we do. Our primary competitors in the enterprise content management market include Microsoft (SharePoint) and OpenText (Documentum). In the enterprise file sync and share market, our primary competitors include Microsoft (OneDrive), Google (Drive) and, to a lesser extent, Dropbox. We also compete with companies in the e-signature, content collaboration, workflow automation, artificial intelligence, and security and governance markets. With the introduction of new technologies and market entrants, we expect competition to intensify in the future and our primary competitors may change. For example, disruptive technologies such as generative AI may fundamentally alter the market for our services in unpredictable ways, including reduced customer demand and increased costs of doing business. As AI becomes increasingly integrated into our markets, competitors may be able to incorporate AI capabilities more efficiently or achieve faster adoption than we do, which could adversely affect demand for our offerings. If we fail to compete effectively, our business will be harmed. Some of our competitors offer their products or services at lower prices or for free as part of a broader bundled product sale or enterprise license arrangement, which has placed pricing pressure on our business. If we are unable to achieve our target pricing levels, our operating results will be negatively impacted. For us to compete effectively, we need to introduce new products and services in a timely and cost-effective manner, meet customer expectations and needs at prices that customers are willing to pay, and continue to enhance the features and functionalities of our intelligent content management platform. In addition, pricing pressures and increased competition could result in reduced sales, lower margins, losses or the failure of our services to achieve or maintain widespread market acceptance, any of which could harm our business. Many of our competitors are able to devote greater resources to the development, promotion and sale of their products or services, including larger sales and customer support teams and broader distribution relationships with channel partners, consultants, system integrators, and resellers. Competitors may offer products or services at lower prices or with greater depth than our services. Our competitors may be able to respond more quickly and effectively to new or changing opportunities, technologies, standards or customer requirements. Furthermore, some potential customers, particularly large enterprises, may elect to develop their own internal solutions. To remain competitive, we must continue to invest in product development, go-to-market capabilities and technology upgrades, and we may need to allocate significant resources to address rapid technological change and frequent new product introductions. If we are unable to make these investments or otherwise compete effectively, our business and operating results could be harmed. Our business depends substantially on customers renewing their subscriptions with us and expanding their use of our services. Any decline in our customer renewals or failure to convince our customers to broaden their use of our services would harm our future operating results. To improve our operating results, it is important that our customers renew their subscriptions with us when their existing subscription term expires. We cannot assure you that customers will renew their subscriptions upon expiration at the same or higher level of service, for the same number of seats or for the same duration of time, if at all. Our net retention rate has fluctuated from 36 period to period and it may decrease again in the future if our customers do not renew their subscriptions with us or decrease their use of our services. Our net retention rate was approximately 106% and 103% as of July 31, 2026 and 2025, respectively. Our net retention rate may decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with our services, the effectiveness of our customer support services, the performance of our partners and resellers, our pricing, the prices of competing products or services, mergers and acquisitions affecting our customer base, our ability to successfully integrate new or acquired technology into our products, our ability to execute on our product roadmap, our customers’ budgets and spending levels, and the effects of global economic conditions, especially if challenging macroeconomic conditions continue. If our customers do not renew their subscriptions, renew them on less favorable terms, purchase fewer seats, or fail to purchase new product offerings, our revenue may decline, and we may not realize improved operating results from our customer base. Our future success depends on our customers’ adoption of our intelligent content management platform and purchase of our higher-tiered Suites plan, including our Enterprise Advanced plan. In addition, our business growth depends in part on our customers expanding their use of our services. The use of our cloud content management platform often expands within an organization as new users are added or as additional services are purchased by or for other departments within an organization. Further, as we have introduced new services throughout our operating history, our existing customers have constituted a significant portion of the users of such services. If our customers do not expand their use of our services, our operating results may be adversely affected. If the market for cloud-based enterprise services declines or develops more slowly than we expect, our business could be adversely affected. Since we derive, and expect to continue to derive, substantially all of our revenue and cash flows from sales of our cloud content management solutions, our success will depend to a substantial extent on the widespread adoption of cloud computing in general and of cloud-based content management services in particular. Many organizations have invested substantial personnel and financial resources to integrate traditional enterprise software into their organizations and may be reluctant or unwilling to migrate to a cloud-based model for managing their content. It is difficult to predict customer adoption rates and demand for our services, the future growth rate and size of the cloud computing market or the entry of competitive services. The expansion of the cloud content management market depends on a number of factors, including the cost, performance and perceived value associated with cloud computing, as well as the ability of companies that provide cloud-based services to address security and privacy concerns. If there is a reduction in demand for cloud-based services, it could result in decreased revenue, harm our growth rates, and adversely affect our business and operating results. Because we recognize revenue from subscriptions for our services over the term of the subscription, downturns or upturns in new business may not be immediately reflected in our operating results. We generally recognize revenue from customers ratably over the terms of their subscription agreements, which range from one month to three years or more. As a result, most of the revenue we report in each quarter is the result of subscription agreements entered into during prior quarters. Consequently, a decline in new or renewed subscriptions in any one quarter may not be reflected in our revenue results for that quarter. However, any such decline will negatively affect our revenue in future quarters. Accordingly, the effect of significant downturns in sales, our failure to achieve our internal sales targets, a decline in the market acceptance of our services, or a decrease in our net retention rate may not be fully reflected in our operating results until future periods. Our subscription model also makes it difficult for us to rapidly increase our revenue through additional sales in any period, as revenue from additional sales must be recognized over the applicable subscription term. If we are unable to attract new customers, or expand deployments with existing customers, at rates that are consistent with our expectations, our future revenue and operating results could be adversely impacted. To improve our operating results and continue growing our business, it is important that we continue to attract new customers and expand deployments of our solutions and products with existing customers. To the extent we are successful in increasing our customer base, we could incur increased losses because costs associated with new customers are generally incurred up front, while revenue is recognized ratably over the term of our subscription services. Alternatively, to the extent we are unsuccessful in increasing our customer base, we could also incur increased losses as costs associated with marketing programs and new products intended to attract new customers would not be offset by incremental revenue and cash flow. Changes in economic conditions may financially impact our existing and prospective customers and cause them to delay or reduce their technology spending, which may adversely affect our ability to attract new customers. For example, our business continues to be impacted by pressure from customers’ lower headcount growth and greater budget scrutiny on IT decisions. All of these factors could negatively impact our future revenue and operating results. 37 Adverse economic conditions have in the past and may in the future result in reduced sales, longer sales cycles, reduced renewal rates, slower adoption of new technologies and increased price competition, any of which could negatively impact our business. Our business depends on the overall demand for cloud content management services and on the economic health of our current and prospective customers. The U.S. and other key international economies have experienced cyclical downturns from time to time that have resulted in a significant weakening of the economy, more limited availability of credit, a reduction in business confidence and activity, and other difficulties that may affect the industries to which we sell our services. An economic downturn, recession, or uncertainty about economic conditions, including volatility in the credit, equity and foreign exchange markets, inflation, changing interest rates, tariffs, potential U.S. sovereign default, bank failures and financial instability, supply chain disruptions, poor liquidity, reduced corporate profitability, unemployment trends, the adverse effects of pandemics and geopolitical issues, such as the ongoing Russia-Ukraine conflict and conflicts in the Middle East, could cause customers to delay or reduce their information technology spending. This has in the past and may in the future result in reduced sales, longer sales cycles, reduced renewal rates, slower adoption of new technologies, and increased price competition. These conditions can arise suddenly and the full impact can be difficult to predict. Any of these events would likely have an adverse effect on our business, operating results and financial position. We continue to face challenges from customers scrutinizing deals more closely due to the economic environment. In addition, there can be no assurance that enterprise content management and collaboration spending levels will increase following any recovery. If we are not able to successfully launch new products and services or provide enhancements or new features to our existing products and services, our business could be adversely affected. Our industry is marked by rapid technological developments and new and enhanced applications and services. If we are unable to enhance our existing services or offer new services that achieve market acceptance or keep pace with rapid technological developments, our business could be adversely affected. The success of any new services or enhancements to our existing services, such as Box AI, Box Apps, Box Automate, Box Extract, Box Shield Pro, Box Hubs, Box Doc Gen and Box Forms, depends on several factors, including their timely completion, introduction and market acceptance. We also may experience business or economic disruptions that could adversely affect the productivity of our employees and result in delays in our product development process. We maintain a hybrid workforce (with a mix of employees working from offices and others working remotely), which may lead to disruptions and decreased productivity that could result in delays in our product development process. Failure in this regard may significantly impair our revenue growth and our future financial results. Our product development efforts could also be impacted by our workforce location strategy as we hire an increasing number of our employees in international locations, such as Poland. In addition, because our services are designed to operate on a variety of systems, we must continuously modify and enhance our services to keep pace with changes in internet-related hardware, mobile operating systems, and other software, communication, browser and database technologies. We may not be successful in developing these modifications and enhancements or bringing them to market in a timely fashion, which may negatively impact our customer renewal rates, limit the market for our solutions, or impair our ability to attract new customers. Furthermore, modifications to existing platforms or technologies will increase our research and development expenses. Any failure of our services to operate effectively with existing or future network platforms and technologies could reduce the demand for our services, result in customer dissatisfaction and adversely affect our business. Issues relating to the use of artificial intelligence and machine learning could adversely affect our business and operating results. Issues relating to the use of new and evolving technologies, including generative AI, autonomous agentic AI, large language models, and machine learning—whether integrated into our customer-facing product offerings or deployed internally across our software development, business operations, and administrative functions—may cause us to experience operational disruptions, brand or reputational harm, competitive harm, legal liability, new or enhanced governmental or regulatory scrutiny, and to incur additional costs to resolve such issues. As with many innovations, AI presents risks and challenges that could undermine or slow its adoption, and therefore harm our business. For example, perceived or actual technical, legal, compliance, privacy, security, ethical or other issues relating to the use of AI, including risks related to accuracy, bias, toxicity, privacy and security, data provenance, and the adequacy of AI development, deployment, content labeling and governance, may cause public confidence in AI to be undermined, which could slow our customers’ adoption of our products and services that use AI. AI technologies, including generative AI, may produce outputs that appear correct but are factually inaccurate or flawed, and customers or others may rely on such outputs to their detriment, which could expose us to reputational harm, competitive harm, and/or legal liability. Generative AI may also produce content that includes copyrighted or other protected material, and if we or our customers use such content or rights holders seek to enforce their rights, we may be exposed to claims and associated costs. In addition, litigation or government regulation related to the use of AI may also adversely impact our and others’ abilities to develop and offer products that use AI, as well as increase the cost and complexity of doing so. For example, in May 2024, the European Council adopted the AI Act (the “EU AI Act”), which imposes significant obligations related to the use of AI systems and is anticipated to impact the entire AI ecosystem in the European Union. Additionally, as the EU AI Act is implemented, subsequent guidance, standards and regulations, as well as regulatory bodies within respective member states are expected, which may present unforeseen risks and related challenges. In January 2025, President Trump issued an Executive Order on AI along with various additional measures that followed, including additional assessments and/or restrictions that could impact or constrain our AI product offerings. With this shift in AI policy at the federal level, it is unclear the 38 extent to which this may present opportunities or risks to Box in the adoption of AI, including integrating with AI systems developed outside the U.S. that may be, for example, more cost effective. Conversely, at the state level, states such as Arkansas, California, Colorado, Illinois, Maryland, Montana, New York, and Texas have enacted several AI-specific bills covering the deployment and regulation of AI technology, which may impact Box. Developing, testing, deploying and maintaining third-party AI systems may increase the cost profile of our product offerings and our operational and computing expenses, which could impact our margins and adversely affect our business and operating results. Our business may be disrupted if any of the third-party AI services we use become unavailable due to extended outages or interruptions or if they are no longer available on commercially reasonable terms or prices. Further, market demand and acceptance of AI technologies are uncertain, and we may be unsuccessful in our product development efforts. Our sales to government entities are subject to a number of additional challenges and risks. We sell to government customers, which can be highly competitive, often requiring significant upfront time and expense without any assurance that these efforts will generate a sale. Government certification requirements may change, or we may lose one or more government certifications, and in doing so restrict our ability to sell into the government sector or maintain existing government customers until we attain revised certifications. Government demand and payment for our products and services are affected by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our solutions. Moreover, an extended federal government shutdown, ongoing efforts to reduce U.S. federal spending and to make the federal government operate more efficiently, a prolonged continuing resolution, breach of the federal debt ceiling, or potential U.S. sovereign default may limit or delay federal government spending on our solutions and adversely affect our revenue. For example, prior government shutdowns have caused some federal customers to delay purchases of our solutions. Government entities may also have statutory, contractual or other legal rights to terminate contracts with us for convenience or due to a default, and any such termination may adversely affect our future operating results. As our sales efforts are increasingly focused on cloud content management use cases and are targeted at enterprise and highly-regulated customers, our sales cycles may become longer and more expensive, and we may encounter greater pricing pressure and implementation and customization challenges, all of which could harm our business and operating results. As our sales efforts are increasingly focused on cloud content management use cases and are targeted at enterprise and highly-regulated customers, we face greater costs, longer sales cycles and less predictability in the completion of some of our sales. In this market segment, a customer’s decision to use our services may be an enterprise-wide decision. These types of sales opportunities require us to provide greater levels of customer education regarding the uses and benefits of our services, as well as education regarding security, privacy, and data protection laws and regulations, especially for customers in more heavily regulated industries or with significant international operations. In addition, larger enterprises may demand more customization, integration, support services, and features. These factors could increase our costs, lengthen our sales cycles and leave fewer sales support and professional services resources for other customers. Professional services may also be performed by a third party or a combination of our own staff and a third party. Our strategy is to work with third parties to increase the breadth of capability and depth of capacity for delivery of these services to our customers. If a customer is not satisfied with the quality or interoperability of our services with their own IT environment, we could incur additional costs to address the situation, which could adversely affect our margins. Moreover, any customer dissatisfaction with our services could damage our ability to encourage broader adoption of our services by that customer. In addition, any negative publicity resulting from such situations, regardless of its accuracy, may further damage our business by affecting our ability to compete for new business with current and prospective customers. 39 If we fail to meet the service level commitments we provide under our subscription agreements, we could be obligated to provide credits or refunds for prepaid amounts related to unused subscription services or face subscription terminations, which could adversely affect our revenue. Furthermore, any failure in our delivery of high-quality customer support services may adversely affect our relationships with our customers and our financial results. Our customer subscription agreements provide service level commitments. If we are unable to meet our service level commitments or suffer periods of downtime that exceed the periods allowed under our subscription agreements, we may be obligated to provide customers with service credits, which could significantly impact our revenue in the period in which the downtime occurs and the credits could be due. We have experienced, and may in the future experience, disruptions, outages, and other performance or quality problems with our platform and with the public cloud and internet infrastructure on which our platform relies. We have encountered issues in the past that have caused Box services to be temporarily unavailable that resulted in our issuing service credits to some of our customers, and we cannot assure you that we will not experience interruptions or delays in our service in the future. We could also face subscription terminations, which could significantly impact our current and future revenue. Any extended or frequent service outages could also adversely affect our reputation, which would also impact our future revenue and operating results. Our customers depend on us to resolve technical issues relating to our services. We may be unable to respond quickly enough to accommodate short-term increases in customer demand for support services. Increased customer demand for these services, without corresponding revenue, could increase costs and adversely affect our operating results. In addition, our sales process is highly dependent on the ease of use of our services, our reputation and positive recommendations from our existing customers. Any failure to maintain, or a market perception that we do not maintain, high-quality customer support could adversely affect our reputation and our ability to sell our services to existing and prospective customers. We are in the process of expanding our international operations, which exposes us to significant risks. A key element of our growth strategy is to expand our international operations and develop a worldwide customer base. In addition, we have opened, and may continue to open, international offices and hire employees to work at these offices in order to gain access to additional talent. We have continued to migrate a larger portion of our development to lower cost regions to support our growth. Operating in international markets requires significant resources and management attention and will subject us to regulatory, economic, geographic, social, and political risks that differ from those in the U.S. Because of significant differences between international and U.S. markets, we may not succeed in creating demand for our services outside of the U.S. or in effectively selling our services in all of the international markets we enter. In addition, we will face challenges in doing business internationally that could adversely affect our business, including: •the need to localize and adapt our services for specific countries, including translation into foreign languages and associated expenses; •laws (and changes to such laws) relating to privacy, data protection and data transfer that, among other things, could require that customer data be stored and processed in a designated territory; •difficulties in staffing and managing foreign operations especially in new markets with diverse cultures, languages, customs and legal systems; •different pricing environments, longer sales cycles and longer accounts receivable payment cycles and collections issues; •differing labor regulations, especially in Europe, where labor laws are generally more advantageous to employees as compared to the U.S.; •new and different sources of competition; •weaker protection for intellectual property and other legal rights than in the U.S. and practical difficulties in enforcing intellectual property and other rights outside of the U.S.; •laws and business practices favoring local competitors, including economic tariffs; •changes in the geopolitical environment, the perception of doing business with U.S. based companies, and changes in regulatory requirements that impact our operating strategies, access to global markets or hiring; •compliance challenges related to the complexity of multiple, conflicting and changing governmental laws and regulations, including employment, tax, AI, privacy and data protection laws and regulations; •increased financial accounting and reporting burdens and complexities; •currency exchange rate fluctuations; •restrictions on the transfer of funds; 40 •reliance on third-party resellers and other parties; •adverse tax consequences; and •unstable regional, economic, social and political conditions, such as the Russia-Ukraine conflict and conflicts in the Middle East. We are exposed to fluctuations in currency exchange rates, which could adversely affect our operating results or financial position. We sell our services and incur operating expenses in various currencies. Fluctuations in the relative value of the U.S. dollar and foreign currencies, particularly the Japanese Yen, and to a lesser extent, the British Pound, the Euro, and the Polish Zloty, have in the past and may in the future negatively impact our operating results. We manage our exchange rate risk by maintaining offsetting foreign currency assets and liabilities, minimizing non-U.S. dollar cash balances, and through our foreign currency hedging programs that we began implementing in fiscal year 2025. Such practices may not ultimately be available and/or effective at mitigating the foreign currency risk to which we are exposed. If we are unsuccessful in detecting material exposures in a timely manner, any hedging strategies we deploy are not effective, or there are no hedging strategies available for certain exposures that are prudent given the associated risks and the potential mitigation of the underlying exposure achieved, our operating results or financial position could be negatively affected in the future. If we are unable to maintain and promote our brand, our business and operating results may be harmed. We believe that maintaining and promoting our brand is critical to expanding our customer base. Maintaining and promoting our brand will depend largely on our ability to continue to provide useful, reliable and innovative services, which we may not do successfully. We may introduce new features, products, services or terms of service that our customers do not like, which may negatively affect our brand and reputation. Additionally, the actions of third parties may affect our brand and reputation if customers do not have a positive experience using third-party apps or other services that are integrated with Box. Maintaining and enhancing our brand may require us to make substantial investments, and these investments may not achieve the desired goals. If we fail to successfully promote and maintain our brand or if we incur excessive expenses in this effort, our business and operating results could be adversely affected. Our quarterly results may fluctuate significantly and may not fully reflect the underlying performance of our business. Our quarterly operating results may vary significantly in the future, and period-to-period comparisons of our operating results may not be meaningful. Accordingly, the results of any one quarter should not be relied upon as an indication of future performance. Our quarterly financial results may fluctuate as a result of a variety of factors, and as a result, may not fully reflect the underlying performance of our business. Factors that may cause fluctuations in our quarterly financial results include, but are not limited to: •our ability to attract and retain new customers; •our ability to convert users of our limited free version to paying customers; •the addition or loss of large customers, including through acquisitions or consolidations; •changes in our net retention rate; •the timing of revenue recognition; •the timing and amount of contract renewals; •the impact on billings of customer shifts between payment frequencies; •the timing of cash collections and payments and its impact on cash flows; •the amount and timing of operating expenses related to the maintenance and expansion of our business, operations and infrastructure; •network or service outages, internet disruptions, disruptions to the availability of our service, or actual or perceived security breaches, incidents and vulnerabilities; •general economic, industry and market conditions, including those caused by the Russia-Ukraine conflict and conflicts in the Middle East, and as a result of inflation, fluctuations in foreign currency exchange rates, fluctuations in interest rates, tariffs, or bank failures and financial instability; •changes in our go-to-market strategies and/or pricing policies and/or those of our competitors; 41 •seasonal variations in our billings results and sales of our services, which have historically been highest in the fourth quarter of our fiscal year; •the timing and success of new services and product introductions by us and our competitors or any other change in the competitive dynamics of our industry, including consolidation or new entrants among competitors, customers or strategic partners; •changes in usage or adoption rates of content management services; •the success of our strategic partnerships, including the performance of our resellers; and •the timing of expenses related to the development or acquisition of technologies or businesses and potential future charges for impairment of goodwill from acquired companies. Risks Related to Data Privacy and Data Security Actual or perceived security vulnerabilities in our services or any breaches of our security controls and unauthorized access to our or a customer’s data could harm our business and operating results. The services we offer involve the storage of large amounts of our and our customers’ sensitive and proprietary information, some of which may be considered personal information, personal data, or other forms of regulated information. Cyberattacks and other malicious internet-based activity, including ransomware, malware and viruses, continue to increase in frequency and magnitude and we face security threats from malicious third parties that could obtain unauthorized access to, or disrupt, our systems, infrastructure and networks. These threats may come from a variety of sources including nation-state sponsored espionage and hacking activities, industrial espionage, organized crime, sophisticated organizations, hacking groups and individuals and insider threats. These sources can also implement social engineering techniques, such as “phishing,” “smishing” or “vishing” attacks, to induce our partners, users, employees or customers to disclose passwords or other sensitive information or take other actions to gain access to our data or our users’ data. Hackers that acquire user account information at other companies can attempt to use that information to compromise the accounts of our personnel, or our users’ accounts if an account shares the same sensitive information such as passwords. As we increase our customer base, our brand becomes more widely known and recognized, and our service is used in more heavily regulated industries where there may be a greater concentration of sensitive and protected data, such as healthcare, government, life sciences, and financial services, we have become more of a target for these malicious third parties. In addition, because Box is configured by administrators and users to select their default settings, the third-party integrations they enable, and their privacy and permissions settings, an administrator or user could intentionally or inadvertently configure settings to share their sensitive data. For example, a Box user can choose to share the content they store in Box with third parties by creating a link that can be customized to be accessible by anyone with the link. While this feature is designed to be used for a variety of legitimate use cases in which a user wishes to share non-sensitive content with a broad or public audience, if a user were to intentionally or inadvertently configure a setting that allowed public access to their sensitive data, that data could be discovered and accessed by an unintended third party. We have also incorporated AI technologies into certain product offerings, and may continue to incorporate additional AI technologies into our product offerings, and to otherwise use AI technologies within our business, in the future. Our use of AI technologies may create additional cybersecurity risks or increase cybersecurity risks, including risks of security breaches and incidents. Further, AI technologies may be used in connection with certain cybersecurity attacks, resulting in heightened risks of security breaches and incidents. We cannot guarantee that any security measures that we or third parties on which we have implemented will be completely effective against current or future security threats, or that our systems and networks or those of such third parties have not been breached or otherwise compromised, or that they and any software in our or their supply chains do not contain bugs, vulnerabilities, or compromised code that could result in a breach of or disruption to our systems and networks or the systems and networks of third parties that support us or our products or services. Given that our customers manage significant amounts of sensitive and proprietary information on our platform, and many of our customers are in heavily regulated industries where there may be a greater concentration of sensitive and proprietary data, our reputation and market position are particularly sensitive to impacts from actual or perceived security breaches or incidents, security vulnerabilities, or concerns regarding security. If our security measures or those of third parties on which we rely are or are believed to be inadequate or breached or otherwise compromised as a result of third-party action, employee negligence, error or malfeasance, product defects, social engineering techniques, improper user configuration or otherwise, and this results in, or is believed to result in, unauthorized access to or disclosure, modification, misuse, loss, corruption, unavailability, or destruction of our data or our customers’ data, or any other disruption of the confidentiality, integrity or availability of our data or our customers’ data, we could incur significant liability to various parties, including our customers and individuals or organizations whose information is stored by our customers, and our business, reputation or competitive position may be harmed. Techniques used to obtain unauthorized access to, or to sabotage, systems or networks, are constantly evolving and generally are not recognized until launched against a target. Therefore, we may be unable to anticipate these techniques, react in a timely manner, or 42 implement adequate preventive measures, and we may face delays in our detection or remediation of, or other responses to, security breaches and other security-related incidents or vulnerabilities. We have observed increased levels of sophistication in the types of techniques, including social engineering techniques, that malicious third parties may use in an attempt to gain access to our or our users’ data. Due to the Russia-Ukraine conflict and conflicts in the Middle East, or other areas of geopolitical tension around the world, we and the third parties on which we rely are vulnerable to a heightened risk of cybersecurity attacks, social engineering attacks, viruses, malware, ransomware, hacking or similar breaches and incidents from nation-state and affiliated actors, including attacks that could materially disrupt our supply chain and our systems, operations and platform. Additionally, many of our personnel and personnel of the third parties on which we rely work remotely at least part of the time, which imposes additional risks to our business, including increased risk of industrial espionage, theft of assets, phishing, and other cybersecurity attacks, and inadvertent or unauthorized access to or dissemination of sensitive, proprietary, or confidential information. We also expect to incur significant costs in our ongoing efforts to detect and prevent security breaches and other security-related incidents, and in the event of actual or perceived security breaches or other security-related incidents. Additionally, our service providers and other third parties on which we rely may suffer, or be perceived to suffer, security breaches or other incidents that may compromise data stored or processed for us that may give rise to any of the foregoing. Our customer contracts often include (i) specific obligations that we maintain the availability of the customer’s data through our service and that we secure customer content against unauthorized access or loss, and (ii) provisions whereby we indemnify our customers for third-party claims asserted against them that result from our failure to maintain the availability of their content or securing the same from unauthorized access or loss. While our customer contracts generally contain limitations on our liability in connection with these obligations and indemnities, if an actual or perceived security breach or incident occurs, the market perception of the effectiveness of our security measures could be harmed, we could be subject to indemnity or damage claims in certain customer contracts, and we could lose future sales and customers, any of which could harm our business and operating results. Furthermore, while our errors and omissions insurance policies include liability coverage for certain of these matters, if we experience a security breach or other incident, we could be subject to indemnity claims or other damages that exceed our insurance coverage. We also cannot be certain that our insurance coverage will be adequate for data handling or data security liabilities actually incurred, that insurance will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could have a material adverse effect on our business, including our financial condition, operating results, and reputation. Privacy concerns and laws or other regulations may reduce the effectiveness of our services and harm our business. Users can use our services to store identifying information or information that otherwise is considered personal information. Federal, state and foreign government bodies and agencies have adopted or are considering adopting laws and regulations regarding the collection, use and disclosure of personal information obtained from consumers, businesses and other individuals and entities. Data protection, privacy, consumer protection, cybersecurity and other laws and regulations, particularly in Europe, are often more restrictive than those in the U.S. The costs of compliance with, and other burdens imposed by, such laws, policies and regulations that apply to our business or our customers’ businesses may limit the use and adoption of our services and reduce overall demand for them. These laws and regulations, which may be enforceable by private parties and/or governmental entities, are constantly evolving and can be subject to significant change. A number of existing data protection and privacy laws and regulations, as well as new laws and regulations coming into effect and/or proposals pending before federal, state and foreign legislative and regulatory bodies could affect our business. For example, the European Union’s General Data Protection Regulation (GDPR) imposes significant obligations on companies regarding the handling of personal data and provides for penalties for noncompliance of up to the greater of 20 million Euros or four percent of a company’s global revenue. Further, local data protection authorities in Europe may adopt regulations and/or guidance more stringent than the GDPR, which may impose additional compliance costs or other burdens that impact our business. Additionally, developments relating to cross-border data transfer may result in the European Commission (EC), European Data Protection Board and/or other regulators applying differing standards for, and requiring ad hoc verification of, transfers of personal data across borders, including transfers from the European Economic Area (EEA), Switzerland, or the U.K. to the U.S. For example, revised standard contractual clauses were published by regulators in EEA, Switzerland and the U.K., which we adopted in our data processing addenda. However, we cannot guarantee that our relevant policies and measures will ensure compliance due to possible fluctuations in these laws and regulations and related frameworks and their interpretation and enforcement. Moreover, European governments and the U.S. government have cooperated to adopt the EU-U.S. Data Privacy Framework, the U.K. extension to the EU-U.S. Data Privacy Framework and Swiss-U.S. Data Privacy Framework (together, the “Data Privacy Framework”), replacing the EU-U.S. Privacy Shield Framework. While the Data Privacy Framework could benefit the industry as a whole, and we presently maintain self-certification under the Data Privacy Framework, maintaining compliance with the Data Privacy Framework could result in additional costs. The EU-U.S. Data Privacy Framework has also already faced legal challenges, and more generally, the Data Privacy Framework may be subject to future reviews, and subject to suspension, amendment, repeal, or limitations. 43 The U.K. made targeted amendments to its data protection regime in the U.K. Data (Use and Access) Act, effective June 19, 2025. Furthermore, additional or modified guidance regarding, or changes to, U.K. cross border data transfers and/or overall U.K. data protection laws and/or guidance could occur. Any of these may require us to change our policies, practices and engage in additional contractual negotiations. Such legislative and regulatory changes may result in increased costs of compliance and limitations on our customers and us. We may also be or become subject to new laws and regulations that regulate non-personal information. For example, the European Union’s Data Act (EU Data Act) imposes certain data and cloud service interoperability and switching obligations to enable users to switch between cloud service providers without undue delay or cost, as well as certain requirements concerning cross-border international transfers of, and governmental access to, non-personal information outside the European Economic Area. Depending on how the EU Data Act and any similar laws or regulations are implemented, interpreted and enforced, we may have to adapt our business practices, contractual arrangements, and services in the EEA to comply with such obligations, which could impact our regional revenue and results of operations. In 2018, the State of California enacted the California Consumer Privacy Act (CCPA), which became operative on January 1, 2020. The CCPA requires covered companies to, among other things, provide new disclosures to California consumers and afford such consumers new abilities to opt-out of certain sales of personal information. Additionally, the California Privacy Rights Act (CPRA) was approved by California voters in November 2020 and amended and expanded the CCPA. The CPRA’s substantive provisions became effective on January 1, 2023, and the California Privacy Protection Agency has adopted regulations implementing the CPRA. Our CPRA compliance efforts are subject to change and may result in continued uncertainty and require additional costs and expenses to ensure readiness, compliance and decrease risks. Further, other states have been considering, and in some cases enacting, laws relating to privacy and cybersecurity, many of which are comprehensive privacy statutes imposing obligations similar to the CCPA and CPRA. For example, laws enacted in Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia are currently effective, and Alabama and Oklahoma have enacted such laws that are scheduled to become effective in 2027. Other U.S. states are anticipated to follow suit. Other states have also enacted privacy laws relating to particular subject matter, such as Washington's enactment of the My Health, My Data Act, which includes a private right of action. The U.S. Department of Justice has also issued regulations restricting, and imposing obligations in connection with, certain transfers of sensitive personal information. Efforts to comply with these laws and regulations and related fluctuations in laws and regulations relating to privacy and cybersecurity at the federal, state and local levels may impact readiness and compliance, along with the potential to incur additional costs. We cannot fully predict the impact of these laws and regulations and other proposed federal and state laws and regulations relating to privacy and cybersecurity on our business or operations, but they may require us to modify our data processing practices and policies and incur substantial costs and expenses in an effort to comply. In addition, some countries, such as member states of the EEA are considering or have enacted legislation requiring storage localization and/or the processing of more regulated types of data in region, along with other limitations that could impact U.S. technology companies (e.g., cloud service providers) and more specifically, Box. If we are unable to develop and offer services that meet these obligations or help our customers meet their requirements under the laws, regulations, case law or guidance issued relating to privacy, data protection, or information security, we may become unable to provide services in these regions and/or be subject to significant fines and penalties, which would harm our business. We also expect laws, regulations, industry standards, and other obligations worldwide relating to privacy, data protection, and cybersecurity to continue to evolve, and that there will continue to be new, modified, and re-interpreted laws, regulations, standards, and other obligations in these areas. For example, the Network and Information Security Directive II (NIS2), adopted in 2023, aims to enhance cybersecurity across critical infrastructure and essential services in the European Union. It expands on the 2016 NIS Directive and broadens its scope to include additional sectors while enforcing stricter governance and accountability requirements. NIS2 requires all 27 EU member states to have issued implementing legislation by October 2024; however, some EU member states have not finalized their respective legislation and guidance. Additionally, the Digital Operational Resilience Act (DORA), which became effective in January 2025, establishes a universal framework for managing and mitigating information and communication technology risk that applies to entities in the financial sector and their third-party cloud service providers, such as Box. Under DORA, third-party cloud service providers can face significant penalties for non-compliance, including fines of up to $5 million euros for violations. However, the specific impact and effects of these new and evolving laws and regulations are uncertain and subject to change over time as they are implemented. As a result, we cannot yet determine the impact such future laws, regulations and standards, or amendments to or re-interpretations of, existing laws and regulations, industry standards, or other obligations may have on us or our business. Moreover, these existing and proposed laws, regulations, standards, and other actual or asserted obligations can be difficult and costly to comply with, delay or impede the development or adoption of our products and services, reduce the overall demand for our products and services, increase our operating costs, require modifications to our policies, practices, or products or services, require significant management time and attention, and slow the pace at which we close (or prevent us from closing) sales transactions. Additionally, any actual or alleged noncompliance with these laws, regulations, standards, or other actual or asserted obligations could result in negative publicity and subject us to investigations and other proceedings by regulatory authorities, claims, demands, and 44 litigation by private entities, or other requested remedies or demands, including demands that we modify or cease existing business practices, and expose us to significant fines, penalties and other damages and liabilities. In addition to the possibility of fines, proceedings, demands, claims, and litigation, we may find it necessary or appropriate to fundamentally change our business activities and practices, including the establishment of in-region data storage or other data processing operations, or modify or cease offering certain products or services, any of which could have an adverse effect on our business. We may be unable to make such changes and modifications in a commercially reasonable manner or at all, and our ability to develop new offerings and features could be limited. Furthermore, government agencies may seek to access sensitive information that our users upload to Box, or restrict users’ access to Box. Laws and regulations relating to government access and restrictions are evolving, and compliance with such laws and regulations could limit adoption of our services by users and create burdens on our business. Moreover, regulatory investigations into, or other proceedings by regulators or private entities involving, our compliance with privacy-related laws and regulations could increase our costs and divert management attention. If we are not able to satisfy data protection, security, privacy, and other government- and industry-specific requirements, our growth could be significantly harmed. There are a number of data protection, security, privacy and other government- and industry-specific requirements, including those that require companies to notify individuals of data security incidents involving certain types of personal data. Security compromises experienced by our competitors, by our customers or by us may lead to public disclosures, which could harm our reputation, erode customer confidence in the effectiveness of our security measures, negatively impact our ability to attract new customers, or cause existing customers to elect not to renew their agreements with us. Our customers also expect, and in some instances require, us to meet voluntary certifications or adhere to guidelines or standards established by third parties, to offer particular controls, or otherwise support customer-specific requirements. Although we currently have certain certifications such as AICPA SOC 1, 2 and 3 reports, and ISO/IEC 27001, 27017, 27018, and 27701 we may not be successful in continuing to maintain these certifications or in obtaining other certifications or otherwise being able to adhere to or comply with all customer requirements. In addition, some of the industries and/or regions that we serve have specific requirements relating to security and regulatory standards, such as GxP, FedRAMP and StateRAMP, and those required by HIPAA, FINRA, the HITECH Act, the Data Privacy Framework and Asia-Pacific Economic Cooperation Privacy Recognition for Processors and Cross Border Privacy Rules. As we expand into new industries and regions, we will likely need to comply with these and other new requirements to compete effectively. We may not always be able to support or comply with all of these customer requirements. If we cannot adequately comply with these requirements, our growth could be adversely impacted, we may face a loss of customers or difficulty attracting new customers in impacted industries, and we could incur significant liability and our reputation and business could be significantly harmed. In addition, as regulations in the EU and the U.K. continue to shift, this could impact our ability to comply with and maintain EU and U.K. Processor and Controller Binding Corporate Rules. Risks Related to Our Technical Operations Infrastructure and Dependence on Third Parties If we are unable to ensure that our solutions interoperate with operating systems, software applications and technologies developed by others, our service may become less competitive, and our operating results may be harmed. We offer our services across a variety of operating systems and through the internet. We are dependent on the interoperability of our platform with third-party mobile devices, tablets, desktop and mobile operating systems, as well as web browsers that we do not control. Any changes in such systems, devices or web browsers that degrade the functionality of our services or give preferential treatment to competitive services could adversely affect usage of our services and our ability to deliver high quality services. We may not succeed in developing relationships with key participants in the mobile industry or in developing services that operate effectively with these operating systems, networks, infrastructure, devices, web browsers and standards. In the event that our users experience difficulty accessing and using our services, our user growth may be harmed, and our business and operating results could be adversely affected. If we fail to effectively manage our technical operations infrastructure, our customers may experience service outages and delays in the deployment of our services, which may adversely affect our business. We have experienced significant growth in the number of users and the amount of data that our operations infrastructure supports. We need to properly manage our technological operations infrastructure in order to support version control, changes in hardware and software parameters and the evolution of our services. We have experienced, and may in the future experience, website disruptions, incidents of data corruption and loss, service outages and other performance problems. These problems may be caused by a variety of factors, including infrastructure changes, changes to our core services architecture, changes to our infrastructure necessitated by legal and compliance requirements governing the storage and transmission of data, human or software errors, viruses, cybersecurity attacks, fraud, spikes in customer usage, connectivity failures, and other third-party service provider failures and denial 45 of service issues. Additionally, any limitation on the capacity or performance of our third-party cloud computing and hosting providers, including due to technical failures, shifts in product capabilities or licensing models, natural disasters, fraud, or cybersecurity attacks, could impede our ability to fulfill our current contractual commitments or expand our services. In some instances, we may not be able to identify the cause or causes of these performance problems within an acceptable period of time, which may harm our reputation and operating results. Furthermore, if we encounter any of these problems in the future, our customers may lose access to important data or experience data corruption or service outages that may subject us to financial penalties, other liabilities and customer losses. Interruptions or delays in service from our third-party cloud computing and hosting providers could impair the delivery of our services and harm our business. We currently store and process our customers’ information in third-party cloud computing and hosting facilities inside and outside of the U.S. Following migration of our storage and processing operations to cloud computing and hosting facilities operated by third parties, our service has become more susceptible to interruptions or delays that are out of our direct control. These third parties are vulnerable to operational and technological disruptions, including from cyber-attacks and security breaches and incidents, which may negatively impact our ability to provide services to our customers and operate our business. Similarly, as part of our disaster recovery arrangements, our production environment and all of our customers’ data is typically replicated on third-party storage platforms located inside and outside of the U.S. These facilities may be located in areas prone to natural disasters and may experience events such as earthquakes, floods, fires, power loss, telecommunications failures and similar events. They may also be subject to break-ins, sabotage, intentional acts of vandalism, cyber-attacks and similar misconduct, including by state-sponsored or otherwise well-funded actors. Any damage to, or lack of availability or failure of, our systems generally, or those of the third-party cloud computing and hosting providers, could result in interruptions in our service, which may reduce our revenue, cause us to issue credits or pay penalties, cause customers to terminate their subscriptions and adversely affect our renewal rate and our ability to attract new customers. We may only have limited remedies against third-party providers in the event of any service disruptions. In addition, we may not have adequate insurance coverage to compensate for losses from a major interruption. Our business will also be harmed if our customers and potential customers believe our service is unreliable. Despite precautions taken by these third-party providers, the occurrence of disasters, security issues (including an act of terrorism or an armed conflict), certain geopolitical events, labor or trade disputes, or pandemics, could lead to a decision to close the facilities without adequate notice or other unanticipated problems that result in lengthy interruptions in our service or cause us to not comply with certification requirements. Even with the disaster recovery arrangements, we have never performed a full live failover of our services and, in an actual disaster, we could learn our recovery arrangements are not sufficient to address all possible scenarios and our service could be interrupted for a longer period than expected. We have encountered issues in the past that have caused Box services to be temporarily unavailable that resulted in our issuing service credits to some of our customers, and we cannot assure you that we will not experience interruptions or delays in our service in the future. If third parties are unable to perform services for us because of service interruptions or extended outages, or because those services are no longer available on commercially reasonable terms, our expenses could increase and our customers’ use of our products could be impaired until equivalent services, if available, are identified, obtained and implemented, all of which could adversely affect our business. Our services are becoming increasingly mission-critical for our customers and if these services fail to perform properly or if we are unable to scale our services to meet our customers’ needs, our reputation could be adversely affected, our market share could decline and we could be subject to liability claims. Our services are becoming increasingly mission-critical to our customers’ business operations, as well as their ability to comply with legal requirements, regulations, and standards such as GxP, FINRA, HIPAA, FedRAMP and StateRAMP. These services and offerings are inherently complex and may contain material defects or errors that could cause interruptions in the availability of our services, as well as user error, which could result in loss or delayed market acceptance and sales, breach of contract or warranty claims, issuance of sales credits or refunds for prepaid amounts related to unused subscription services, loss of customers, diversion of development and customer service resources, and harm to our reputation. The costs incurred in correcting any material defects or errors might be substantial and could adversely affect our operating results. Further, our errors and omissions insurance may be inadequate or may not be available in the future on acceptable terms, or at all. In addition, our insurance may not cover all claims made against us and defending a lawsuit, regardless of its merit, could be costly and divert management’s attention. Because of the large amount of data that we collect and manage, it is possible that hardware failures, software errors, errors in our systems, or by third-party service providers, user errors, or internet outages could result in significant data loss or corruption. Furthermore, the availability or performance of our services could be adversely affected by a number of factors, including customers’ inability to access the internet, the failure of our network or software systems, security breaches or variability in customer traffic for our services. We have been, and in the future may be, required to issue credits or refunds for prepaid amounts related to unused services or otherwise be liable to our customers for damages they may incur resulting from some of these events. 46 Furthermore, we will need to ensure that our services can scale to meet the needs of our customers, particularly as we continue to focus on larger enterprise customers. If we are not able to provide our services at the scale required by our customers, potential customers may not adopt our solution and existing customers may not renew their agreements with us. We rely on third parties for certain financial and operational services essential to our ability to manage our business. A failure or disruption in these services could materially and adversely affect our ability to manage our business effectively. We rely on third parties for certain essential financial and operational services. We receive many of these services on a subscription basis from various SaaS companies that are smaller and have shorter operating histories than traditional software vendors. Moreover, these vendors provide their services to us via a cloud-based model instead of software that is installed on our premises. We depend upon these vendors to provide us with services that are always available and are free of errors or defects that could cause disruptions in our business processes, and any failure by these vendors to do so, or any disruptions in networks or the availability of the internet, would adversely affect our ability to operate and manage our operations. We employ third-party software for use in or with our services, and the inability to maintain licenses to this software, or errors in the software, could result in increased costs, or reduced service levels, which would adversely affect our business. Our services incorporate certain third-party software obtained under open source licenses or licenses from other companies. We anticipate that we will continue to rely on such third-party software and development tools in the future. Although we believe that there are commercially reasonable alternatives to the third-party software we currently license, this may not always be the case, or it may be difficult or costly to replace. In addition, integration of the software used in our services with new third-party software may require significant work and require substantial investment of our time and resources. Also, to the extent that our services depend upon the successful operation of third-party software in conjunction with our software, any undetected errors or defects in this third-party software could prevent the deployment or impair the functionality of our services, delay the introduction of new services, result in a failure of our services, and injure our reputation. Our use of additional or alternative third-party software would require us to enter into additional license agreements with third parties. If we are unable to maintain licenses to software necessary to operate our business, or if third-party software that we use contains errors or defects, our costs may increase, or the services we provide may be harmed, which would adversely affect our business. Our growth depends in part on the success of our strategic relationships with third parties. To grow our business and to expand our reach in the market, we expect to be more dependent on our relationships with third parties, such as alliance partners, resellers, distributors, system integrators and developers. For example, we have entered into agreements with partners such as Adobe, Apple, Carahsoft, Cisco, CrowdStrike, Google, Guidewire, IBM, Macnica, Microsoft, Mitsui Knowledge Industry, Okta, Oracle-NetSuite, Palo Alto Networks, Salesforce, ServiceNow, Slack, USDM, Workday, and Zoom to market, resell, or integrate with our services. Identifying partners and resellers, and negotiating and documenting relationships with them, requires significant time and resources. We also depend on our ecosystem of system integrators, partners and developers to create applications that will integrate with our platform or permit us to integrate with their product offerings. This presents certain risks to our business, including: •we cannot provide any assurance that these third-party applications and products meet the same quality standards that we apply to our own development efforts, and to the extent that they contain bugs or defects or otherwise fail to perform as expected, they may create disruptions in our customers’ use of our services or negatively affect our brand and reputation; •we do not currently provide support for software applications developed by our partner ecosystem, and users may be left without support and potentially cease using our services if these system integrators and developers do not provide adequate support for their applications; •we cannot provide any assurance that we will be able to successfully integrate our services with our partners’ products or that our partners will continue to provide us the right to do so; and •these system integrators, partners and developers may not possess the appropriate intellectual property rights to develop and share their applications. In addition, our competitors may be effective in providing incentives to third parties to favor their products or services, or to prevent or reduce subscriptions to our services. In some cases, we also compete directly with our partners’ product offerings, and if these partners stop reselling or endorsing our services or impede our ability to integrate our services with their products, our business and operating results could be adversely affected. Moreover, competitor acquisitions of our partners could result in a decrease in the 47 number of current and potential customers, as our partners may no longer facilitate the adoption of our services by potential customers. If we are unsuccessful in establishing or maintaining our relationships with third parties, or realizing the anticipated benefits from such partnerships, our ability to compete in the marketplace or to grow our revenue could be impaired and our operating results may suffer. Even if we are successful, we cannot assure you that these relationships will result in increased customer usage of our services or increased revenue. Our business is subject to the risks of natural disasters, pandemics and other catastrophic events that could disrupt our business operations and our business continuity and disaster recovery plans may not adequately protect us from a serious disaster. The occurrence of any catastrophic event, including a pandemic, earthquake, fire, flood, tsunami, or other weather event, power loss, telecommunications failure, software or hardware malfunctions, cyber-attack, war, or terrorist attack, could result in lengthy interruptions in our service. Our corporate headquarters is located in the San Francisco Bay Area, a region known for seismic activity. Our insurance coverage may not compensate us for losses that may occur in the event of an earthquake or other significant natural disaster. In addition, pandemics, acts of terrorism or war could cause disruptions to the internet or the economy as a whole, which could have a significant impact on our business and operating results. If our or our partners’ business continuity and disaster recovery arrangements prove to be inadequate, our services could be interrupted. Our partners, suppliers, and customers are also subject to the risk of catastrophic events. In those events, our ability to deliver our services in a timely manner, as well as the demand for our services, may be adversely impacted by factors outside our control. If our systems were to fail or be negatively impacted as a result of a natural disaster, pandemic or other catastrophic event, our ability to deliver our services to our customers would be impaired, we could lose critical data, our reputation could suffer and we could be subject to contractual penalties. In addition, while the long-term effects of climate change on the global economy and the technology industry in particular are unclear, we recognize that there are inherent climate related risks wherever business is conducted. Any of our primary locations may be vulnerable to the adverse effects of climate change. For example, our California corporate offices have historically experienced, and are projected to continue to experience, physical climate change risks, including drought and water scarcity, warmer temperatures, rising sea levels, wildfires and air quality impacts and power shut-offs associated with wildfire prevention. Climate-related events, including the increasing frequency of extreme weather events and their impact on critical infrastructure in the U.S. and elsewhere, have the potential to disrupt our business, our third-party suppliers, and/or the business of our customers, and may cause us to experience higher attrition, losses and additional costs to maintain and resume operations. Transitional climate change risks may subject us to increased regulations, reporting requirements, standards, or expectations regarding the environmental impacts of our business and untimely or inaccurate disclosure could adversely affect our reputation, business or financial performance. If we overestimate or underestimate our cloud-based server capacity requirements, our operating results could be adversely affected. We continuously evaluate our short- and long-term cloud-based server capacity requirements to ensure adequate capacity for new and existing customers while minimizing unnecessary excess capacity costs. If we overestimate the demand for our cloud content management services and therefore secure excess cloud-based server capacity, our operating margins could be reduced. If we underestimate our cloud-based server capacity requirements or if we are unable to meet our contractual minimum commitments, we may not be able to service the expanding needs of customers and may be required to limit new customer acquisition or provide credits or refunds to existing customers, which would impair our revenue growth and harm our operating results. We outsource a substantial majority of our cloud hosting to Google Cloud Platform (GCP), which hosts our products and platform. Industry-wide supply constraints—including shortages or extended lead times for high-performance AI processors, memory components, and optical networking hardware, as well as data center power delivery and utility capacity bottlenecks—have intensified competition for hosting and compute resources. To the extent we do not effectively address capacity constraints, either through GCP or alternative providers of cloud hosting, or other risks are realized that may result in interruptions, delays and outages in service and availability of our products and/or services, our business and operating results may be adversely affected. Furthermore, regardless of our ability to appropriately manage our cloud-based server capacity requirements, only a small percentage of our customers currently use Box to organize all of their internal files, and an increase in the number of organizations, in particular large businesses and enterprises, that use our service as a larger component of their content storage requirements, could result in lower gross and operating margins or otherwise have an adverse impact on our financial condition and operating results. 48 Changes in laws and regulations related to the internet or changes in the internet infrastructure itself, or disruption in access to the internet or critical services on which the internet depends, may diminish the demand for our services, and could have a negative impact on our business. The future success of our business depends upon the continued use and availability of the internet as a primary medium for commerce, communication and business services. Federal, state or foreign government bodies or agencies have in the past adopted, and may in the future adopt, laws or regulations affecting the use of the internet as a commercial medium. The adoption of any laws or regulations that adversely affect the growth, popularity or use of the internet, including laws or practices limiting internet neutrality, could decrease the demand for, or the usage of, our services, increase our cost of doing business, adversely affect our operating results, and require us to modify our services in order to comply with these changes. In addition, government agencies or private organizations may begin to impose taxes, fees or other charges for accessing the internet or commerce conducted via the internet. These laws or charges could limit the growth of internet-related commerce or communications generally, or result in reductions in the demand for internet-based services such as ours. In addition, the use of the internet and, in particular, the cloud as a business tool could be adversely affected due to delays in the development or adoption of new standards and protocols to handle increased demands of internet activity, security, reliability, cost, ease of use, accessibility, and quality of service. The performance of the internet and its acceptance as a business tool have been adversely affected by “viruses,” “worms,” “denial of service attacks” and similar malicious activity. The internet has also experienced a variety of outages, disruptions and other delays as a result of this malicious activity targeted at critical internet infrastructure. These service disruptions could diminish the overall attractiveness to existing and potential customers of services that depend on the internet and could cause demand for our services to suffer. Risks Related to Employees and Managing Our Growth We depend on our key employees and other highly skilled personnel to grow and operate our business, and if we are unable to hire, retain and motivate our personnel, we may not be able to grow effectively. Our future success depends upon our continued ability to identify, hire, develop, motivate and retain highly skilled personnel, representing diverse backgrounds, experiences, and skill sets, including senior management, software engineers, and sales representatives. Identifying, recruiting, training and integrating qualified individuals will require significant time, expense and attention. In addition to hiring new employees, we must continue to focus on retaining our best employees, and fostering a diverse and inclusive work environment that enables all of our employees to prosper. Competition for highly skilled personnel is intense, particularly in the San Francisco Bay Area, where our headquarters is located. We may need to invest significant amounts of cash and equity to attract new employees and retain existing employees, and we may never realize returns on these investments. Moreover, changes to immigration laws or the availability of work visas, including recent changes to the H1-B visa program, could adversely affect our ability to attract, hire, and retain qualified personnel. Furthermore, as some of our employees work remotely from geographic areas across the globe and more of our employees work remotely on a permanent basis, we may need to reallocate our investment of resources and closely monitor a variety of local regulations and requirements, and we may experience unpredictability in our expenses and employee work culture. If we are not able to effectively add and retain employees, or if our employees do not perform to the standards we expect of them, our ability to achieve our strategic objectives will be adversely impacted, and our business will be harmed. Our success is also dependent upon contributions from our executive officers and other key employees and, in particular, Aaron Levie, our co-founder and Chief Executive Officer. In addition, occasionally, there may be changes in our senior management team that could disrupt our business. The loss of one or more of our executive officers or key employees, or the failure of our senior management team to work together effectively and execute our plans and strategies, could harm our business. Failure to adequately expand and optimize our direct sales force and successfully maintain our online sales experience could impede our growth. We will need to continue to optimize our sales infrastructure in order to grow our customer base and business. As a result of weakened economic conditions, we have significantly curtailed our employees’ business-related travel, which may negatively impact our ability to recruit and train our sales force. Our business may be adversely affected if our efforts to expand and train our direct sales force do not generate a corresponding increase in revenue. If we are unable to hire, develop and retain talented sales personnel or if new direct sales personnel are unable to achieve desired productivity levels in a reasonable period of time, we may not realize the intended benefits of this investment or increase our revenue. We maintain our Box website to efficiently service our high volume, low dollar customer transactions and certain customer inquiries. Our goal is to continue to evolve this online experience so it effectively serves the increasing and changing needs of our growing customer base. If we are unable to maintain an effective online solution to meet the future needs of our online customers and 49 to eliminate fraudulent transactions occurring in this channel, we could see reduced online sales volumes as well as a decrease in our sales efficiency, which could adversely affect our results of operations. Any acquisitions and investments we make could disrupt our business and harm our financial condition and operating results. We have acquired, and may in the future acquire, other companies, employee teams, or technologies to complement or expand our services and grow our business. We may not be able to successfully complete or integrate identified acquisitions. Moreover, we may not successfully evaluate or utilize the acquired technology or personnel, or accurately forecast the financial impact of an acquisition. The risks we face in connection with acquisitions include: •diversion of management time and focus from operating our business to addressing acquisition integration challenges; •coordination of research and development and sales and marketing functions; •retention of key employees from the acquired company; •cultural challenges associated with integrating employees from the acquired company into our organization; •integration of the acquired company’s technology and products into our business, particularly if the acquired company’s software and services are not easily adapted to work with our products; •integration of the acquired company’s accounting, management information, human resources and other administrative systems, as well as the acquired operations, and any unanticipated expenses related to such integration; •the need to implement or improve controls, procedures, and policies at a business that prior to the acquisition may have lacked effective controls, procedures and policies; •liability for activities of the acquired company before the acquisition, including intellectual property infringement claims, violations of laws, commercial disputes, tax liabilities and other known and unknown liabilities; •completing the transaction and achieving the anticipated benefits of the acquisition within the expected timeframe or at all; •unanticipated write-offs, expenses, charges or risks associated with the transaction; •litigation or other claims in connection with the acquired company, including claims from terminated employees, customers, former stockholders, tax authorities or other third parties, which may differ from or be more significant than the risks our business faces; and •acquisitions could result in dilutive issuances of equity securities or the incurrence of debt. Our failure to address these risks or other problems encountered in connection with our past or future acquisitions and investments could cause us to fail to realize the anticipated benefits of these acquisitions or investments, cause us to incur unanticipated liabilities, and harm our business generally. Future acquisitions could also result in dilutive issuances of our equity securities, the incurrence of debt, contingent liabilities, amortization expenses, incremental operating expenses or the write-off of goodwill, any of which could harm our financial condition or operating results. Our company culture has contributed to our success, and if we cannot maintain this culture, we could lose the innovation, creativity and teamwork fostered by our culture, and our business may be harmed. We believe that our culture has been and will continue to be a key contributor to our success. We expect to continue to hire additional employees as we expand our business. As our organization expands globally and as employees’ workplace expectations develop, we may find it increasingly difficult to maintain the beneficial aspects of our corporate culture globally. These difficulties may be further amplified by our decision to maintain a hybrid workforce. If we do not continue to develop our company culture or maintain our core values as we grow and evolve both in the U.S. and abroad, we may be unable to foster the innovation, creativity and teamwork we believe we need to support our growth. Risks Related to Our Intellectual Property We may be sued by third parties for alleged infringement of their proprietary rights. There is considerable patent and other intellectual property development activity in our industry. Our success depends on developing or licensing our own intellectual property and not infringing upon the valid intellectual property rights of others. Our 50 competitors, as well as a number of other entities, including non-practicing entities, and individuals, may own or claim to own intellectual property relating to our industry. From time to time, third parties have claimed, and in the future may claim, that we are infringing upon their intellectual property rights, and we may be found to be infringing upon such rights. We may be unaware of the intellectual property rights that others may claim cover some or all of our technology or services. Additionally, the intellectual property rights surrounding AI technologies have not been fully addressed by U.S. courts or other federal or state laws or regulations, and the use or adoption of AI technologies in our products and services may expose us to copyright infringement or other intellectual property misappropriation claims. Any claims or litigation could cause us to incur significant expenses and, if successfully asserted against us, could require that we pay substantial damages or ongoing royalty payments, prevent us from offering our services, or require that we comply with other unfavorable terms. We may also be obligated to indemnify our customers or business partners or pay substantial settlement costs, including royalty payments, in connection with any such claim or litigation and to obtain licenses, modify services, or refund fees, which could be costly. Even if we were to prevail in such a dispute, any litigation regarding our intellectual property could be costly and time consuming and divert the attention of our management and key personnel from our business operations. During the course of any litigation, we may make announcements regarding the results of hearings and motions, and other interim developments. If securities analysts or investors regard these announcements as negative, the market price of our Class A common stock may decline. Any failure to protect our intellectual property rights could impair our ability to protect our proprietary technology and brand. Our success and ability to compete depend in part on our intellectual property. We primarily rely on copyright, patent, trade secret and trademark laws, trade secret protection and confidentiality or license agreements with our employees, customers, partners and others to protect our intellectual property rights. However, the steps we take to protect our intellectual property rights may be inadequate. We may not be able to obtain any further patents, and our pending applications may not lead to the issuance of patents. We may also have to expend significant resources to obtain additional patents as we expand our international operations. In order to protect our intellectual property rights, we may spend significant resources to monitor and protect these rights. Litigation brought to protect and enforce our intellectual property rights could be costly, time-consuming and distracting to management and may result in the impairment or loss of portions of our intellectual property. Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims and countersuits attacking the validity and enforceability of our intellectual property rights. Accordingly, we may not be able to prevent third parties from infringing upon or misappropriating our intellectual property. Our failure to secure, protect and enforce our intellectual property rights could materially adversely affect our brand and adversely impact our business. Our services contain open source software, and we license some of our software through open source projects, which may pose particular risks to our proprietary software, products, and services in a manner that could have a negative impact on our business. We use open source software in our services and will use open source software in the future. In addition, we regularly contribute software source code to open source projects under open source licenses or release internal software projects under open source licenses, and anticipate doing so in the future. The terms of many open source licenses to which we are subject have not been interpreted by U.S. or foreign courts, and there is a risk that open source software licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to provide or distribute our services. Additionally, from time to time third parties may claim ownership of, or demand release of, the open source software or derivative works that we developed using such software, which could include our proprietary source code, or otherwise seek to enforce the terms of the applicable open source license. These claims could result in litigation and could require us to make our software source code freely available, purchase a costly license or cease offering the implicated services unless and until we can re-engineer them to avoid infringement. This re-engineering process could require significant additional research and development resources, and we may not be able to complete it successfully. In addition to risks related to license requirements, use of certain open source software can lead to greater risks than use of third-party commercial software, as open source code may contain bugs or other defects and open source licensors generally do not provide warranties or controls on the functionality or origin of software. Additionally, because any software source code we contribute to open source projects is publicly available, our ability to protect our intellectual property rights with respect to such software source code may be limited or lost entirely, and we cannot prevent our competitors or others from using such contributed software source code. Any of these risks could be difficult to eliminate or manage and could have a negative effect on our business, financial condition and operating results. 51 Risks Related to Our Financial Position and Need for Additional Capital We may require additional capital to support our liabilities, operations or the growth of our business, and we cannot be certain that this capital will be available on reasonable terms when required, or at all. On occasion, we may need additional financing for a variety of reasons, including servicing our liabilities, operating or growing our business, responding to business opportunities, undertaking acquisitions, funding stock repurchases, satisfying our dividend or share redemption obligations of our Series A Convertible Preferred Stock, or repaying and/or settling conversions of our 1.50% convertible senior notes due September 15, 2029. For example, in September 2024, we issued $460.0 million aggregate principal amount of 2029 Convertible Notes. We may require additional capital to satisfy our obligations to pay cash upon conversion or at maturity of the 2029 Convertible Notes or to repurchase the 2029 Convertible Notes in the event of a fundamental change. Additionally, in May 2021, we issued and sold 500,000 shares of our Series A Convertible Preferred Stock for an aggregate purchase price of $500 million. Our ability to refinance or obtain additional financing, if and when required, will depend on investor and lender demand, our operating performance, the condition of the capital markets and other factors. We cannot guarantee that additional financing will be available to us on favorable terms when required, or at all. If we raise additional funds through the issuance of equity, equity-linked or debt securities, those securities may have rights, preferences or privileges senior to the rights of our Class A common stock, and our existing stockholders may experience dilution. If we are unable to obtain adequate financing or financing on terms satisfactory to us when we require it, our ability to continue to support the operation or growth of our business could be significantly impaired and our operating results may be harmed. Rising interest rates may reduce our access to equity-linked or debt capital and increase our cost of borrowings, which could adversely impact our business, operating results and financial position. Financing agreements we are party to or may become party to may contain operating and financial covenants that restrict our business and financing activities. Our senior credit facility contains certain operating and financial restrictions and covenants that may restrict our and our subsidiaries’ ability to, among other things, incur indebtedness, grant liens on our assets, make loans or investments, consummate certain merger and consolidation transactions, dispose of assets, incur contractual obligations and commitments and enter into affiliate transactions, subject in each case to customary exceptions. We are also required to comply with a maximum senior secured leverage ratio, a maximum total leverage ratio and a minimum interest coverage ratio. These restrictions and covenants, as well as those contained in any future financing agreements that we may enter into, may restrict our ability to finance our operations, engage in, expand or otherwise pursue our business activities and strategies. Our ability to comply with these covenants may be affected by events beyond our control, and breaches of these covenants could result in a default under the senior credit facility and any future financial agreements that we may enter into and under other arrangements containing cross-default provisions. If not waived, defaults could cause our outstanding indebtedness under our senior credit facility and any future financing agreements that we may enter into to become immediately due and payable, and permit our lenders to terminate their lending commitments and to foreclose upon any collateral securing such indebtedness. Risks Related to Financial, Accounting, Tax and Other Legal Matters If we fail to maintain an effective system of disclosure controls and internal control over financial reporting, our ability to produce timely and accurate financial statements or comply with applicable regulations could be impaired. As a public company, we are subject to the reporting requirements of the Securities Exchange Act of 1934, the Sarbanes-Oxley Act and the listing standards of the New York Stock Exchange (NYSE). We have expended, and anticipate that we will continue to expend, significant resources to comply with these rules and regulations. The Sarbanes-Oxley Act requires, among other things, that we maintain effective disclosure controls and procedures, and internal control over financial reporting. Our current controls and any new controls that we develop may become inadequate because of changes in conditions in our business, including increased complexity resulting from our international expansion. Further, weaknesses in our disclosure controls or our internal control over financial reporting may be discovered in the future. Additionally, to the extent that we acquire other businesses, the acquired company may not have a sufficiently robust system of internal controls and we may uncover new deficiencies. Any failure to develop or maintain effective controls, or any difficulties encountered in their implementation or improvement, could harm our operating results or cause us to fail to meet our reporting obligations and may result in a restatement of our financial statements for prior periods. Any failure to implement and maintain effective internal control over financial reporting could also adversely affect the results of management reports and independent registered public accounting firm audits of our internal control over financial reporting that we are required to include in our periodic reports that we file with the SEC. Ineffective disclosure controls and procedures, and internal control over financial reporting could also cause investors to lose confidence in our reported financial and other information, which would likely have a negative effect on the market price of our Class 52 A common stock. In addition, if we are unable to continue to meet these requirements, we may not be able to remain listed on the NYSE. Any failure to maintain effective disclosure controls and internal control over financial reporting could have a material and adverse effect on our business and operating results, and cause a decline in the market price of our Class A common stock. Our reported financial results may be adversely affected by changes in accounting principles generally accepted in the U.S. Generally accepted accounting principles in the U.S. are subject to interpretation by the FASB, the SEC and various bodies formed to promulgate and interpret appropriate accounting principles. A change in these principles or interpretations could have a significant effect on our reported financial results, and could affect the reporting of transactions completed before the announcement of a change. These or other changes in accounting principles could adversely affect our financial results. Any difficulties in implementing these pronouncements could cause us to fail to meet our financial reporting obligations, which could result in regulatory discipline and harm investors’ confidence in us. Tax laws or regulations could be enacted or changed and existing tax laws or regulations could be applied to us or to our customers in a manner that could increase the costs of our services and adversely impact our business. The application of federal, state, local and international tax laws to services provided electronically is complex and continuously evolving. Income, sales, use, value added or other tax laws, statutes, rules, regulations or ordinances could be enacted or amended at any time, possibly with retroactive effect, and could be applied solely or disproportionately to services provided over the internet. These enactments or amendments could adversely affect our sales activity due to the inherent cost increase the taxes would represent and ultimately result in a negative impact on our operating results and cash flows. Our future effective tax rates and results from operations could be unfavorably affected by changes in the tax rates in jurisdictions where our income is earned, by changes to limitations on our utilization of net operating losses, or by changes in the tax rules and regulations in the jurisdictions in which we do business. For example, on July 4, 2025, the U.S. enacted federal tax legislation commonly referred to as the One Big Beautiful Bill Act (OBBBA). This legislation extends and modifies provisions from the 2017 Tax Cuts and Jobs Act and introduces new tax measures affecting both businesses and individuals. We are continuing to evaluate the long-term implications of this legislation on us. The Inflation Reduction Act of 2022 also imposed a 1% excise tax on certain repurchases of stock and a 15% alternative minimum tax on adjusted financial statement income. Further, in 2021, the Organization for Economic Cooperation and Development (OECD) introduced a framework, referred to as Pillar Two, which contemplates a global minimum effective tax rate of 15%. In 2023, Pillar Two was implemented by the Council of the European Union and its member states. Similar directives under Pillar Two are already adopted or expected to be adopted by taxing authorities in other countries where we do business, including the U.K. The OECD and participating jurisdictions have recently agreed to a “side-by-side” solution that would exempt U.S.-parented multinational businesses from certain provisions of Pillar Two for fiscal years beginning on or after January 1, 2026. We have evaluated the impact of the side-by-side solution to our financial position and concluded it to be not material. We will continue to monitor OECD-related developments to the side-by-side solution in countries where we do business. These enactments or amendments could adversely affect our tax rate and ultimately result in a negative impact on our operating results and cash flows. In addition, existing tax laws, statutes, rules, regulations or ordinances could be interpreted or applied adversely to us, possibly with retroactive effect, which could require us or our customers to pay additional tax amounts, as well as require us or our customers to pay fines or penalties, as well as interest for past amounts. For example, we are subject to examination regarding our interpretation of tax laws by domestic and foreign tax authorities. If the taxing authorities do not agree with our interpretations, or if we become subject to an adverse tax assessment, we may incur significant liabilities and/or be required to change our practices going forward. Further, to the extent it is determined that our customers should have paid certain taxes, and if we are unsuccessful in collecting such taxes due from our customers, we could be held liable for such costs and/or interest and penalties, thereby adversely impacting our operating results and cash flows. We may be subject to additional tax liabilities resulting from changes in our provision for income taxes or an adverse tax ruling. Judgment is required in determining our worldwide provision for income taxes. These determinations are highly complex and require detailed analysis of the available information and applicable statutes and regulatory materials. In the ordinary course of our business, there are many transactions and calculations where the ultimate tax determination is uncertain. Although we believe our tax estimates are reasonable, the final determination of tax audits and any related litigation could be materially different from our historical tax practices, provisions and accruals. If we receive an adverse ruling as a result of an audit, or we unilaterally determine that we have misinterpreted provisions of the tax regulations to which we are subject, there could be a material effect on our tax 53 provision, net loss or cash flows in the period or periods for which that determination is made. In addition, liabilities associated with taxes are often subject to an extended or indefinite statute of limitations period. Therefore, we may be subject to additional tax liability (including penalties and interest) for a particular year for extended periods of time. Our ability to use our net operating loss carryforwards and certain other tax attributes may be limited. As of January 31, 2026, we had U.S. federal net operating loss carryforwards of approximately $111.1 million, state net operating loss carryforwards of approximately $462.6 million, and foreign net operating loss carryforwards of approximately $239.9 million. Under Sections 382 and 383 of the Internal Revenue Code of 1986, as amended (the “Code”), if a corporation undergoes an “ownership change,” the corporation’s ability to use its pre-change net operating loss carryforwards and other pre-change tax attributes, such as research tax credits, to offset its post-change income and taxes may be limited. In general, an “ownership change” occurs if there is a cumulative change in our ownership by “5% shareholders” that exceeds 50 percentage points over a rolling three-year period. Similar rules may apply under state tax laws. If we experience ownership changes as a result of future transactions in our stock, then we may be further limited in our ability to use our net operating loss carryforwards and other tax assets to reduce taxes owed on the net taxable income that we earn. Any such limitations on the ability to use our net operating loss carryforwards and other tax assets could adversely impact our business, financial condition and operating results. We are subject to governmental export controls that could impair our ability to compete in international markets due to licensing requirements and economic sanctions programs that subject us to liability if we are not in full compliance with applicable laws. Certain of our services are subject to export controls, including the U.S. Department of Commerce’s Export Administration Regulations and various economic and trade sanction regulations administered by the U.S. Treasury Department’s Office of Foreign Assets Controls. The provision of our products and services must comply with these laws. The U.S. export control laws and U.S. economic sanctions laws include prohibitions on the sale or supply of certain products and services to U.S. embargoed or sanctioned countries, governments, persons and entities and also require authorization for the export of encryption items. In addition, various countries regulate the import of certain encryption technology, including through import permitting and licensing requirements, and have enacted laws that could limit our ability to distribute our services or could limit our customers’ ability to implement our services in those countries. Although we take precautions to prevent our services from being provided in violation of such laws, our solutions may have been in the past, and could in the future be, provided inadvertently in violation of such laws, despite the precautions we take. If we fail to comply with these laws, we and our employees could be subject to civil or criminal penalties, including the possible loss of export privileges, monetary penalties, and, in extreme cases, imprisonment of responsible employees for knowing and willful violations of these laws. We may also be adversely affected through penalties, reputational harm, loss of access to certain markets, or otherwise. Changes in tariffs, sanctions, international treaties, export/import laws and other trade restrictions or trade disputes may delay the introduction and sale of our services in international markets, prevent our customers with international operations from deploying our services or, in some cases, prevent the export or import of our services to certain countries, governments, persons or entities altogether. Any change in export or import regulations, economic sanctions or related laws, shift in the enforcement or scope of existing regulations, or change in the countries, governments, persons or technologies targeted by such regulations, could result in decreased use of our services, or in our decreased ability to export or sell our services to existing or potential customers with international operations. Any decrease in the use of our services, limitations on our ability to export or sell our services, or increased costs resulting from changes in tariffs or other trade restrictions, would likely adversely affect our business, financial condition and operating results. Failure to comply with anti-bribery, anti-corruption, and anti-money laundering laws could subject us to penalties and other adverse consequences. We are subject to the Foreign Corrupt Practices Act (FCPA), the U.K. Bribery Act and other anti-corruption, anti-bribery and anti-money laundering laws in various jurisdictions both domestic and abroad. In addition to our own sales force, we also leverage third parties to sell our products and services and conduct our business abroad. We and our third-party intermediaries may have direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities and may be held liable for the corrupt or other illegal activities of these third-party business partners and intermediaries, our employees, representatives, contractors, channel partners, and agents, even if we do not explicitly authorize such activities. While we have policies and procedures to address compliance with such laws, we cannot assure you that our employees and agents will not take actions in violation of our policies or applicable law, for which we may be ultimately held responsible. Any violation of the FCPA or other applicable anti-bribery, anti-corruption, and anti-money laundering laws could result in whistleblower complaints, adverse media coverage, investigations, loss of export privileges, severe criminal or civil sanctions, or suspension or debarment from U.S. government contracts, all of which may have an adverse effect on our reputation, business, operating results and prospects. 54 Risks Related to Ownership of Our Class A Common Stock Anti-takeover provisions contained in our amended and restated certificate of incorporation and amended and restated bylaws, as well as provisions of Delaware law, could impair a takeover attempt. Our amended and restated certificate of incorporation, amended and restated bylaws and Delaware law contain provisions which could have the effect of rendering more difficult, delaying or preventing an acquisition deemed undesirable by our Board of Directors. Among other things, our amended and restated certificate of incorporation and amended and restated bylaws include provisions: •authorizing a classified board of directors whose members serve staggered three-year terms; •authorizing “blank check” preferred stock, which could be issued by our Board of Directors without stockholder approval and may contain voting, liquidation, dividend and other rights superior to our Class A common stock; •limiting the liability of, and providing indemnification to, our directors and officers; •limiting the ability of our stockholders to call and bring business before special meetings; •requiring advance notice of stockholder proposals for business to be conducted at meetings of our stockholders and for nominations of candidates for election to our Board of Directors; and •controlling the procedures for the conduct and scheduling of board directors and stockholder meetings. These provisions, alone or together, could delay or prevent hostile takeovers and changes in control or changes in our management. As a Delaware corporation, we are also subject to provisions of Delaware law, including Section 203 of the Delaware General Corporation Law, which prevents certain stockholders holding more than 15% of the voting power of our outstanding capital stock from engaging in certain business combinations without approval of the holders of at least two-thirds of the voting power of our outstanding capital stock not held by such stockholder. Any provision of our amended and restated certificate of incorporation, amended and restated bylaws or Delaware law that has the effect of delaying, preventing or deterring a change in control could limit the opportunity for our stockholders to receive a premium for their shares of our capital stock, and could also affect the price that some investors are willing to pay for our Class A common stock. Our bylaws designate a state or federal court located within the State of Delaware as the exclusive forum for substantially all disputes between us and our stockholders and also provide that the federal district courts will be the exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act of 1933, as amended, each of which could limit our stockholders’ ability to choose the judicial forum for disputes with us or our directors, officers, stockholders or employees. Our bylaws provide that, unless we consent in writing to the selection of an alternative forum, the sole and exclusive forum for (1) any derivative action or proceeding brought on our behalf, (2) any action asserting a claim of breach of a fiduciary duty owed by any of our directors, stockholders, officers or other employees to us or our stockholders, (3) any action arising pursuant to any provision of the Delaware General Corporation Law, our certificate of incorporation or our bylaws or (4) any other action asserting a claim that is governed by the internal affairs doctrine shall be the Court of Chancery of the State of Delaware (or, if the Court of Chancery does not have jurisdiction, another State court in Delaware or the federal district court for the District of Delaware), except for any claim as to which such court determines that there is an indispensable party not subject to the jurisdiction of such court (and the indispensable party does not consent to the personal jurisdiction of such court within ten days following such determination), which is vested in the exclusive jurisdiction of a court or forum other than such court or for which such court does not have subject matter jurisdiction. This provision would not apply to any action brought to enforce a duty or liability created by the Securities Exchange Act of 1934, as amended, and the rules and regulations thereunder. Section 22 of the Securities Act of 1933 establishes concurrent jurisdiction for federal and state courts over Securities Act claims. Accordingly, both state and federal courts have jurisdiction to hear such claims. To prevent having to litigate claims in multiple jurisdictions and the threat of inconsistent or contrary rulings by different courts, among other considerations, our bylaws also provide that, unless we consent in writing to the selection of an alternative forum, the federal district courts of the U.S. will be the sole and exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act against any person in connection with an offering of our securities. Any person or entity purchasing or otherwise acquiring or holding or owning (or continuing to hold or own) any interest in any of our securities shall be deemed to have notice of and consented to the foregoing bylaw provisions. Although we believe these 55 exclusive forum provisions benefit us by providing increased consistency in the application of Delaware law and federal securities laws in the types of lawsuits to which each applies, the exclusive forum provisions may limit a stockholder’s ability to bring a claim in a judicial forum of its choosing for disputes with us or our current or former directors, officers, stockholders or other employees, which may discourage such lawsuits against us and our current and former directors, officers, stockholders and other employees. Our stockholders will not be deemed to have waived our compliance with the federal securities laws and the rules and regulations thereunder as a result of our exclusive forum provisions. Further, the enforceability of similar exclusive forum provisions in other companies’ organizational documents have been challenged in legal proceedings, and it is possible that a court of law could rule that these types of provisions are inapplicable or unenforceable if they are challenged in a proceeding or otherwise. If a court were to find either exclusive forum provision contained in our bylaws to be inapplicable or unenforceable in an action, we may incur significant additional costs associated with resolving such action in other jurisdictions, all of which could harm our results of operations. We cannot guarantee that our stock repurchase program will be fully implemented or that it will enhance long-term stockholder value. We repurchase shares of our Class A common stock in open market transactions from time to time pursuant to publicly announced stock repurchase program approved by our Board of Directors. During fiscal year 2026, we repurchased 9.7 million shares for a total amount of $292.9 million and during fiscal year 2025, we repurchased 7.6 million shares for a total amount of $211.5 million. For the six months ended July 31, 2026, we repurchased 7.4 million shares for a total amount of $180.7 million. Any share repurchases remain subject to the circumstances in place at that time, including prevailing market prices, and we are not obligated to repurchase a specified number or dollar value of shares. As a result, there can be no guarantee around the timing or volume of our share repurchases or that we will have adequate cash flow to fund any repurchases. In addition, as part of the Inflation Reduction Act signed into law in August 2022, the U.S. implemented a 1% excise tax on the value of certain stock repurchases by publicly traded companies. This tax could increase the costs to us of any share repurchases. The stock repurchase program could affect the price of our Class A common stock, increase volatility and diminish our cash reserves. Our repurchase program may be suspended or terminated at any time and, even if fully implemented, may not enhance long-term stockholder value. The market price of our Class A common stock has been and may continue to be volatile, and you could lose all or part of your investment. The market price of our Class A common stock has been and may continue to be subject to wide fluctuations in response to various factors, some of which are beyond our control and may not be related to our operating performance. In addition to the factors discussed in this “Risk Factors” section and elsewhere in this Quarterly Report on Form 10-Q, factors that could cause fluctuations in the market price of our Class A common stock include the following: •price and volume fluctuations in the overall stock market from time to time; •volatility in the market prices and trading volumes of technology or other public company stocks; •changes in operating performance and stock market valuations of other technology companies generally or those in our industry in particular; •general economic conditions and slow or negative growth of our markets; •purchases and sales of shares of our Class A common stock by us or our stockholders; •whether our results of operations meet the expectations of securities analysts or investors and changes in actual or future expectations of investors or securities analysts; •the financial projections we may provide to the public, any changes in those projections or our failure to meet those projections; •announcements by us or our competitors of new products or services; •the public’s reaction to our press releases, other public announcements and filings with the SEC; •rumors and market speculation involving us or other companies in our industry; •actual or anticipated changes in our operating results or fluctuations in our operating results; •actual or anticipated developments in our business, our competitors’ businesses or the competitive landscape generally; •litigation involving us, our industry or both, or investigations by regulators into our operations or those of our competitors; 56 •developments or disputes concerning our intellectual property or other proprietary rights; •announced or completed acquisitions of businesses or technologies by us or our competitors; •new laws or regulations or new interpretations of existing laws or regulations applicable to our business; •network or service outages, internet disruptions, the availability of our service, security breaches or perceived security breaches and vulnerabilities; •changes in accounting standards, policies, guidelines, interpretations or principles; •actions instituted by activist shareholders or others, and our response to such actions; •any significant change in our management; •fluctuations in foreign currency exchange rates; and •catastrophic events, including pandemics, earthquakes, fires, floods, tsunamis or other weather events, power loss, telecommunications failures, software or hardware malfunctions, cyber-attacks, wars, or terrorist attacks. In addition, in the past, following periods of volatility in the overall market and the market price of a particular company’s securities, securities class action litigation has often been instituted against these companies. Any future securities litigation could result in substantial costs and a diversion of our management’s attention and resources. Servicing our existing and future debt may require a significant amount of cash, and we may not have sufficient cash flow from our business to settle conversions of our convertible notes in cash, repay the convertible notes at maturity, or repurchase the convertible notes as required following a fundamental change. As of July 31, 2026, we had outstanding debt, including an aggregate principal amount of $460.0 million issued under the 2029 Convertible Notes. During specified periods, the 2029 Convertible Notes are convertible at the option of the holders under certain conditions or upon occurrence of certain events as described in Note 9, Part II, Item 8 of our Annual Report on Form 10-K for the year ended January 31, 2026. If one or more holders of the 2029 Convertible Notes elect to convert their notes, we are required to settle the principal of the 2029 Convertible Notes in cash upon any conversion of such notes, which could adversely affect our liquidity. In addition, even if holders of the 2029 Convertible Notes do not elect to convert their notes, we may be required under applicable accounting standards to reclassify the carrying value of the 2029 Convertible Notes as current, rather than long-term, if any of the conditions to the convertibility of the 2029 Convertible Notes are satisfied. This reclassification could materially reduce our reported working capital. Holders of the 2029 Convertible Notes also have the right to require us to repurchase all or a portion of their notes upon the occurrence of a fundamental change (as defined in the indenture governing the 2029 Convertible Notes) at a repurchase price equal to 100% of the principal amount of the 2029 Convertible Notes to be repurchased, plus accrued and unpaid special interest, if any. If the 2029 Convertible Notes have not previously been converted or repurchased, we will be required to repay the outstanding principal amount of the 2029 Convertible Notes, plus accrued and unpaid special interest, if any, in cash at maturity. The 2029 Convertible Notes are scheduled to mature on September 15, 2029. Our ability to make required cash payments in connection with conversions of the 2029 Convertible Notes, repurchase the 2029 Convertible Notes in the event of a fundamental change, or to repay or refinance the 2029 Convertible Notes will depend on market conditions and our past and expected future performance, which is subject to economic, financial, competitive, and other factors beyond our control. We also may not use the cash proceeds we raised through the issuance of the 2029 Convertible Notes in an optimally productive and profitable manner. Since inception, our business has generated net losses, and while we were profitable in fiscal years 2026, 2025 and 2024, we may incur significant losses in the future and may not maintain profitability on a consistent basis. As a result, we may not have enough available cash or be able to obtain financing, or financing at acceptable terms, at the time we are required to repurchase or repay the 2029 Convertible Notes or pay cash with respect to 2029 Convertible Notes being converted. 57 In addition, our ability to repurchase or pay cash upon conversion or at maturity of the 2029 Convertible Notes may be limited by law or regulatory authority. Our ability to service our debt also depends on the operating results of our subsidiaries and upon the ability of such subsidiaries to provide us with cash generated by the subsidiaries. Any dividends, loans or other distributions to us from our subsidiaries may be subject to legal, contractual or other restrictions and are subject to other business and tax considerations. Our failure to repurchase 2029 Convertible Notes following a fundamental change or to pay cash upon conversion or at maturity of the 2029 Convertible Notes as required by the indenture would constitute a default under such indenture. A default under the indenture or the fundamental change itself could also lead to a default under our senior credit facility, our other outstanding indebtedness, or agreements governing our future indebtedness and could have a material adverse effect on our business, results of operations, and financial condition. If the payment of the related indebtedness were to be accelerated after any applicable notice or grace periods, we may not have sufficient funds to repay the indebtedness and repurchase the 2029 Convertible Notes or to pay cash upon conversion or at maturity of the 2029 Convertible Notes. The capped call transactions we entered into in connection with the issuance of the 2029 Convertible Notes may affect the value of our Class A common stock. In connection with the issuance of the 2029 Convertible Notes, we entered into capped call transactions with various counterparties. The 2029 Capped Calls cover, subject to customary adjustments, the number of shares of our Class A common stock initially underlying the 2029 Convertible Notes. The 2029 Capped Calls are expected generally to reduce or offset the potential dilution to our Class A common stock upon any conversion of the 2029 Convertible Notes with such reduction or offset, as the case may be, subject to a cap based on the cap price. From time to time, the counterparties to the 2029 Capped Calls or their respective affiliates may modify their hedge positions by entering into or unwinding various derivatives with respect to our Class A common stock and/or purchasing or selling our Class A common stock or other securities of ours in secondary market transactions prior to the maturity of the 2029 Convertible Notes. This activity could also cause or prevent an increase or a decrease in the market price of our Class A common stock. We are subject to counterparty risk with respect to the 2029 Capped Calls. The counterparties to the 2029 Capped Calls that we entered into are financial institutions, and we will be subject to the risk that one or more of the counterparties may default or otherwise fail to perform, or may exercise certain rights to terminate, their obligations under the 2029 Capped Calls. Our exposure to the credit risk of the counterparties will not be secured by any collateral. Global economic conditions have in the past resulted in the actual or perceived failure or financial difficulties of many financial institutions. If a counterparty to one or more 2029 Capped Calls becomes subject to insolvency proceedings, we will become an unsecured creditor in those proceedings with a claim equal to our exposure at the time under such transaction. Our exposure will depend on many factors but, generally, our exposure will increase if the market price or the volatility of our Class A common stock increases. In addition, upon a default or other failure to perform, or a termination of obligations, by a counterparty, the counterparty may fail to deliver the consideration required to be delivered to us under the 2029 Capped Calls and we may experience more dilution than we currently anticipate with respect to our Class A common stock. We can provide no assurances as to the financial stability or viability of the counterparties. The holders of Series A Convertible Preferred Stock are entitled to vote on an as-converted to Class A common stock basis and have rights to approve certain actions. In May 2021, we issued 500,000 shares of our Series A Convertible Preferred Stock to a group of investors led by KKR. The holders of our Series A Convertible Preferred Stock are generally entitled to vote with the holders of our Class A common stock on all matters submitted for a vote of holders of shares of Class A common stock (voting together with the holders of shares of Class A common stock as one class) on an as-converted basis. Pursuant to that certain Investment Agreement dated April 7, 2021, by and among Box, Inc. and Powell Investors III L.P., KKR-Milton Credit Holdings L.P., KKR-NYC Credit C L.P., Tailored Opportunistic Credit Fund, and CPS Holdings (US) L.P. (the “Investment Agreement”), KKR had the right to designate one candidate for nomination for election to our Board of Directors and preemptive rights to participate in certain future offering of securities of Box for so long as KKR and its permitted transferees maintained a minimum aggregate holdings of our stock as described in further detail in the Investment Agreement; however, KKR has waived both its rights to designate or nominate an Investor Designee (as defined in the Investment Agreement) to the Board and its preemptive rights pursuant to the Investment Agreement. 58 Additionally, the consent of the holders of a majority of the outstanding shares of Series A Convertible Preferred Stock is required in order for us to take certain actions, including issuances of securities that are senior to, or equal in priority with, the Series A Convertible Preferred Stock, and payments of special dividends in excess of an agreed upon amount. As a result, the holders of Series A Convertible Preferred Stock may in the future have the ability to influence the outcome of certain matters affecting our governance and capitalization. The issuance of shares of our Series A Convertible Preferred Stock reduces the relative voting power of holders of our Class A common stock, and the conversion of those shares into shares of our Class A common stock has in the past diluted, and may further dilute, the ownership of Class A common stockholders and may adversely affect the market price of our Class A common stock. The holders of our Series A Convertible Preferred Stock are entitled to vote, on an as-converted basis, together with holders of our Class A common stock on all matters submitted to a vote of the holders of our Class A common stock, which reduces the relative voting power of the holders of our Class A common stock. In addition, the conversion of our Series A Convertible Preferred Stock into Class A common stock has in the past diluted, and may further dilute, the ownership interest of existing holders of our Class A common stock, and any conversion of the Series A Convertible Preferred Stock increases the number of shares of our Class A common stock available for public trading, which could adversely affect prevailing market prices of our Class A common stock. Our Series A Convertible Preferred Stock has rights, preferences and privileges that are not held by, and are preferential to the rights of, our Class A common stockholders, which could adversely affect our liquidity and financial condition. The holders of our Series A Convertible Preferred Stock have the right to receive a payment on account of the distribution of assets on any voluntary or involuntary liquidation, dissolution or winding up of our business before any payment may be made to holders of any other class or series of capital stock. In addition, dividends on the Series A Convertible Preferred Stock accrue and are cumulative at the rate of 3.0% per annum, compounding quarterly, and paid-in-kind or paid in cash, at our election. The holders of our Series A Convertible Preferred Stock also have certain redemption rights, including the right to require us to repurchase all or any portion of the Series A Convertible Preferred Stock at any time following the seventh anniversary of the original issuance date, at 100% of the liquidation preference thereof plus all accrued but unpaid dividends. In addition, upon prior written notice of certain change of control events, the shares of the Series A Convertible Preferred Stock will automatically be redeemed by us for (i) a repurchase price equal to the stock at the then-current conversion price and (ii) an amount in cash equal to 100% of the then-current liquidation preference thereof plus all accrued but unpaid dividends. In the case of clause (ii) above, we will also be required to pay the holders of our Series A Convertible Preferred Stock a “make-whole” premium consisting of dividends that would have otherwise accrued from the effective date of such change of control through the fifth anniversary of the original issuance date. These dividend and share repurchase obligations could impact our liquidity and reduce the amount of cash flows available for working capital, capital expenditures, growth opportunities, acquisitions, and other general corporate purposes. Our obligations to the holders of our Series A Convertible Preferred Stock could also limit our ability to obtain additional financing, which could have an adverse effect on our financial condition. The preferential rights could also result in divergent interests between the holders of our Series A Convertible Preferred Stock and holders of our Class A common stock. If securities or industry analysts do not publish or cease publishing research or reports about us, our business, our market or our competitors, or if they adversely change their recommendations regarding our Class A common stock, the market price of our Class A common stock and trading volume could decline. The trading market for our Class A common stock is influenced, to some extent, by the research and reports that securities or industry analysts publish about us, our business, our market or our competitors. If any of the analysts who cover us adversely change their recommendations regarding our Class A common stock or provide more favorable recommendations about our competitors, the market price of our Class A common stock would likely decline. If any of the analysts who cover us cease coverage of our company or fail to regularly publish reports on us, we could lose visibility in the financial markets, which in turn could cause the market price of our Class A common stock or trading volume to decline. We do not expect to declare any dividends to holders of our Class A common stock in the foreseeable future. We do not anticipate declaring any cash dividends to holders of our Class A common stock in the foreseeable future. Consequently, investors may need to rely on sales of our Class A common stock after price appreciation, which may never occur, as the only way to realize any future gains on their investment. Investors seeking cash dividends should not purchase shares of our Class A common stock. 59