UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

(Mark One)

For the fiscal year ended January 31, 2023

OR

Commission File Number 001-39722

ZeroFox Holdings, Inc.

(Exact name of Registrant as specified in its Charter)

Registrant’s telephone number, including area code: (855) 936-9369

Securities registered pursuant to Section 12(b) of the Act:

Securities registered pursuant to Section 12(g) of the Act: None

Indicate by check mark if the Registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. YES ☐ No ☒

Indicate by check mark if the Registrant is not required to file reports pursuant to Section 13 or 15(d) of the Act. YES ☐ No ☒

Indicate by check mark whether the Registrant: (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the Registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ NO ☐

Indicate by check mark whether the Registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the Registrant was required to submit such files). Yes ☒ NO ☐

Indicate by check mark whether the Registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

If an emerging growth company, indicate by check mark if the Registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the Registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☐

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the Registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the Registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). ☐

Indicate by check mark whether the Registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). YES ☐ NO ☒

As of June 30, 2022, the last business day of the Registrant’s most recently completed second fiscal quarter, the aggregate market value of the Class A Ordinary Shares of L&F Acquisition Corp. (the former name of the Registrant) other than shares held by persons who may be deemed to be affiliates of the Registrant, computed by reference to the closing price of the Class A Ordinary Shares on June 30, 2022, as reported on the New York Stock Exchange American LLC, was approximately $19.6 million.

On August 3, 2022, the Registrant’s Common Stock and Public Warrants began trading on the Nasdaq Global Market and the Nasdaq Capital Market under the symbols “ZFOX” and “ZFOXW,” respectively.

The number of shares of Registrant’s Common Stock outstanding as of March 28, 2023, was 118,579,679.

Explanatory Note

This Annual Report on Form 10-K of ZeroFox Holdings, Inc. (the Company) includes the consolidated financial statements of:

As of August 3, 2022, the Company merged with ZeroFox, Inc. and IDX (the Business Combination) at which time ZeroFox, Inc. and IDX became indirect, wholly-owned subsidiaries of the Company. The consolidated financial statements of the Company as of January 31, 2023, and for the period August 4, 2022, to January 31, 2023, include the financial results of both ZeroFox, Inc. and IDX for the same period. As the consolidated financial results of the Company as of January 31, 2023, and for the period August 4, 2022, to January 31, 2023, are presented alongside the financial results of its predecessor, ZeroFox, Inc., there is a lack of comparability between the periods presented. Therefore, the discussion of the Company’s results of operations, cash flows, and financial condition set forth in this report does not include a comparison of the Company's results with the prior period results of ZeroFox, Inc. Moreover, the financial statements for the Company’s predecessors are not necessarily indicative of the Company’s results of operations, cash flows, or financial position following the completion of the Business Combination.

The terms "ZeroFox", "the Company", "Successor", refer to ZeroFox Holdings, Inc. and its subsidiaries, including ZeroFox, Inc. and ID Experts Holdings, Inc. after the Closing Date. The term "the Successor Period" refers to the duration of time including the finalization of the Business Combination through the end of current reporting period i.e., August 3, 2022, to January 31, 2023. The term "Predecessor" refers to ZeroFox, Inc. and its subsidiaries prior to the Closing Date. The term "the Year to Date Predecessor Period" refers to the duration of time from the first day of the current fiscal year to just prior to the finalization of the Business Combination i.e., February 1, 2022, to August 3, 2022.

In the Company's Current Report on Form 8-K filed on August 9, 2022, the Company disclosed that it would file transition period financial statements for the Registrant due to the change in fiscal year of the Registrant from December 31 to January 31. The audited transition period financial statements as of and for the period January 1, 2023, to January 31, 2023 will be filed in a future registration statement.

i

Forward-Looking Statements

This Annual Report, including, without limitation, statements contained under the heading “Management’s Discussion and Analysis of Financial Condition and Results of Operations of ZeroFox Holdings, Inc.” and Management’s Discussion and Analysis of Financial Condition and Results of Operations of ID Experts Holdings, Inc.” in Item 7 of Part II, contains “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995. All statements, other than statements of historical fact, that address activities, events or developments that we expect, believe or anticipate will or may occur in the future, are forward-looking statements. Forward-looking statements involve risks and uncertainties that could cause actual results to differ materially from those anticipated by these forward-looking statements. The inclusion of any statement in this Annual Report does not constitute an admission by the Company or any other person that the events or circumstances described in such statement are material. These risks and uncertainties include, but are not limited to, the following:

ii

Additional information concerning these, and other risks, is described in Part I, Item 1A, “Risk Factors” and in “Management’s Discussion and Analysis of Financial Condition and Results of Operations of ZeroFox Holdings, Inc.” and “Management’s Discussion and Analysis of Financial Condition and Results of Operations of ID Experts Holdings, Inc.” in Part II, Item 7 of this Annual Report and in the “Risk Factors” discussion under Part I, Item 1A of this Annual Report. We expressly disclaim any obligation to update any of these forward-looking statements, except to the extent required by applicable law.

iii

Table of Contents

iv

Part I

ITEM 1. BUSINESS

Unless the context otherwise requires, all references in this section to “we,” “us” and “our” generally refer to ZeroFox Holdings, Inc. following the consummation of the Business Combination.

Overview

ZeroFox is a leading provider of SaaS-based external cybersecurity solutions. External cybersecurity focuses on exposing, disrupting, and responding to threats outside the traditional corporate perimeter. These are threats targeting organizations’ growing public attack surface as well as broader external threats.

With digital transformation continuing to accelerate, the primary way that organizations interact and transact is now through digital channels and mediums. This has led to the proliferation of digital assets and data residing on external platforms that are outside the control of an organization. These external platforms include the surface web, deep and dark web, social media sites, collaboration platforms, code sharing sites, and mobile app stores (also referred to as "public attack service"). These external platforms are largely ungoverned, unmonitored, and unprotected by existing perimeter and internal security technologies. This public attack surface exposes organizations and their respective communities to threats to their organizations, brands, digital assets, and people. These threats include targeted phishing attacks, account takeovers, credential theft, data leakage, domain spoofing, and impersonations. The overall volume of external cyber threats targeting organizations in general continues to increase, driving a need for organizations to continuously monitor the external threat environment and incorporate threat intelligence into their security operations.

ZeroFox provides customers with an innovative, comprehensive, SaaS-based platform for external cybersecurity (our Platform) that protects organizations from threats outside the traditional corporate perimeter. Our Platform combines protection, intelligence, adversary disruption, and response services into an integrated solution.

Powered by patented technology and artificial intelligence innovations, our Platform collects and processes millions of pieces of content, rich media, posts, messages, global intelligence, and threat actor activity across the digital landscape, including social media sites, public, deep and dark web forums, mobile app stores, code repositories, representing thousands of digital platforms and discrete content sources. We apply advanced analytics to the data we collect and process to detect external threats to brands, people, systems, assets and data across a customer’s public attack surface. Our adversary disruption services allow organizations to disrupt and remediate these threats.

As a result of internal efforts and our August 2022 acquisition of IDX, we also offer comprehensive response services, including breach response, incident response, and intelligence and investigative services. Our data breach solutions include prevention, detection, forensic services, notification, and recovery assistance. We also offer membership subscriptions that include credit and non-credit monitoring, prevention tools, and unlimited recovery assistance.

1

Industry Background

The focus of the cybersecurity industry has traditionally been protecting internal assets that are owned and controlled by the organization. Owned assets include laptops, networks, systems, and cloud workloads. With digital transformation continuing to accelerate, the primary way that companies interact and transact is now through digital channels and mediums.

An increasingly large number of businesses, including those in industries that were slower to adopt digital technologies, have adopted social media, mobile applications, and cloud computing resulting in more critical digital assets now residing outside of traditional firewalls. These organizations now offer mobile and web applications as a key driver of their revenue production in order to make customer access easier, transactions smoother, and their services more engaging. These same organizations have aggressively embraced social media and digital channels to interact and transact with customers, vendors, and partners.

The dramatic shift to digital channels has created an enormous digital footprint on the “public” internet, expanding the attack surface to include all externally available digital platforms. These public platforms are largely ungoverned, unmonitored and unprotected by existing perimeter and internal security technologies.

Adversaries are increasingly targeting organizations’ public attack surface which is reflected in increased threats including targeted phishing attacks, account takeovers, credential theft, data leakage, domain spoofing, and impersonations. All of these threats pose significant risk to organizations, their brands, and their assets. The volume of external cyber threats targeting organizations continues to increase, driving a need for organizations to continuously monitor the external threat environment and to incorporate threat intelligence into their security operations.

Protecting the public attack surface and defending against external threats is challenging. Organizations have limited visibility into their public attack surface. Traditional internal cybersecurity controls, including endpoint and perimeter solutions, do not provide visibility into or protection of the public attack surface and provide a limited view of the external threat environment. Continuously monitoring and protecting the public attack surface is difficult given its size and dynamic, unstructured nature. Additionally, many organizations continue to struggle with a scarcity of in-house cybersecurity expertise and resources.

We believe that securing the public attack surface and protecting organizations from external threats requires a platform-based approach that combines protection, intelligence, adversary disruption, and comprehensive response capabilities, including investigative, incident response and breach response services into a single solution. An external cybersecurity platform needs to provide continuous visibility into an organization’s public attack surface and threat environment, continuous monitoring and protection, and the ability to take action to prevent attacks, limit exposure, remediate an incident, and disrupt an adversary. We believe protecting organizations from external threats, requires comprehensive response capabilities including investigative, incident response, and breach response services.

2

Our Solutions

We provide external cybersecurity solutions to customers around the world. Customers rely on us to address important cybersecurity problems and challenges that they face today and look for our guidance regarding the problems they will face tomorrow. Our Platform is a cloud-native enterprise software-as-a-service application focused on providing external cybersecurity teams with comprehensive solutions to address external cybersecurity threats and risks. Our Platform employs continuous digital identification and detection, comprehensive threat intelligence and persistent adversary disruption to support a wide variety of cybersecurity use cases that address pervasive business challenges. Our customers’ adoption of the ZeroFox Platform often begins with the purchase of one or two core components and grows over time. Our Platform currently provides key capabilities across four strategic platform pillars: ZeroFox Protection, ZeroFox Intelligence, ZeroFox Disruption, and ZeroFox Response.

ZeroFox Protection: Powered by proprietary artificial intelligence, ZeroFox Protection gives customers real-time asset and vulnerability awareness of their external-facing internet accessible digital footprint and enables organizations to configure protective capabilities to continuously protect their external assets.

ZeroFox Protection provides technical capabilities to execute continuous attack surface identification and detection, which empowers the customer to gain an up-to-date picture of its internet accessible digital footprint. The digital presence typically includes social media accounts, collaboration platform accounts, domains, and internet-facing infrastructure, such as port, data, content, and images.

ZeroFox Protection’s digital risk protection capabilities cast a digital net around owned assets across the internet including digital representations for the customer’s brands, identities, systems, executives, accounts, domains, and mobile applications to secure their digital presence against targeted attacks, protect privacy, and decrease fraudulent activity across the internet.

ZeroFox Protection's capabilities include:

3

ZeroFox Intelligence: ZeroFox Intelligence provides customers with a broad array of global threat intelligence solutions that assist with predicting emerging new threat vectors. We provide threat intelligence solutions that enable customers to directly search across our data lake of global threat indicators, tactics, adversary intelligence, exploits, and vulnerabilities. Additionally, customers can request advanced cyber-criminal investigations or engagement, or customers can directly integrate data into their existing security tools to improve prevention, detection, investigations, and response efforts.

ZeroFox Intelligence's capabilities include:

ZeroFox Disruption: ZeroFox Disruption leverages our Platform to report, block, and take down an attack’s core components across the internet. Disrupting threats often takes a significant amount of time and cost to comprehensively identify and then remove from the internet. We support customers by decreasing this significant cost through automation and leveraging technology-enabled solutions to report, block, sinkhole, and take down the components of an attack across the internet. By working with our Global Disruption Network, we are able to block and redirect traffic from malicious and nefarious locations. Our disruption capabilities also provide the ability to remove personally identifiable information from numerous data broker sites to disrupt phishing, social engineering attacks, doxxing, swatting, and impersonation attacks.

ZeroFox Disruption's capabilities include:

4

ZeroFox Response: ZeroFox Response enables organizations to provide the required 24x7 level of support necessary to quickly respond to cyber incidents including external attacks, data loss or exfiltration, ransomware, and potential breaches. With the global increase in computer generated information and data that is stored in the cloud, nearly every organization is more vulnerable to some level of external cyber threats and risk. These threats and risks are often exploited by persistent, malicious actors and criminals around the world, resulting in breaches, other types of disruption, or compromise of varying intensity and scale.

ZeroFox Response includes incident response services as well as a comprehensive data breach notification and response solution as a managed service for the breached enterprise. Our breach response solution is designed to comply with federal and state privacy and data breach notification laws and regulations in order to reduce overall risks to the breached enterprise. ZeroFox Response enables our customers to reduce overall enterprise risk by responding to these situations responsibly, in a timely manner, and in compliance with regulatory requirements.

ZeroFox Response's capabilities includes:

Our Platform

The ZeroFox Platform is powered by patented artificial intelligence capabilities and is built on a modern, cloud-native technology architecture that supports our core capabilities and solutions. Our engineering teams, which are aligned by scrum development methodology, deploy code updates and improvements to our Platform on a continual delivery basis. Our customers and partners can easily use and implement integrations to our Platform with other vendors. This integrated ecosystem, which is built on top of our Platform APIs, enables us to extend an organization’s technology investment in ZeroFox, thereby maximizing our customers’ investments in other cybersecurity categories such as endpoint, network, identity, security event management, security orchestration and automation, and IT service management. Our App Library has hundreds of connected applications, or “apps”, that allow our customers to integrate our Platform into their operational and security processes. We also provide our Platform capabilities to customers via enterprise mobile apps available from the Google Play and Apple App Stores.

5

The ZeroFox Platform’s transparent, artificial-intelligence-powered, engine curates content and distills the most critical issues of open source intelligence. We also leverage our research analysts to provide context and review of additional platforms, forums, and marketplaces to create a complete view of the threat landscape. Our customers’ cybersecurity teams utilize this intelligence to make informed decisions regarding remediation actions.

The patented, artificial-intelligence-powered engines in the ZeroFox Platform enable automation and analysis-at-scale in several key areas. The ZeroFox Platform has implemented artificial intelligence capabilities in machine learning, natural language processing, computer vision, and deep learning. An example of our computer vision capabilities includes embedded image identification where we can train our algorithms to find images within images. This is particularly useful when looking for objects like company logos and credit cards. An additional example of our approach and implementation of advanced optical character recognition (OCR) enables us to extract characters and words regardless of language from images for further automated computer analysis. Our modular approach to artificial intelligence design and implementation has enabled us to use our components individually or in combination with each other to help address external cybersecurity challenges.

We employ a proprietary technology backend and have optimized our Platform to provide a customer-centric turnkey user experience from a customer’s initial onboarding and configuration to ongoing use, reporting, analytics, and maintenance. Our platform can be quickly configured, effectively optimizing our customer’s experience by minimizing their time-to-value and time to implement enhanced security controls.

Our around-the-clock OnWatch managed security team strives to become a natural extension of our customer’s security operations center. The ZeroFox Platform is coupled with internal runbook integrations and workflows that enable global reach, response, and capacity. OnWatch teams are deployed in locations around the world to provide customers a prompt operational experience regardless of the time of day or night.

We have extended the ZeroFox App Library to integrate our Platform with the essential vendors within an organization’s security and information technology tech stack. These integrations add value to our customers by providing enhanced visibility and threat intelligence context.

We expanded the capabilities of our Platform with the acquisition of IDX in August 2022. The integration of IDX’s breach response solutions to our Platform provides a holistic offering to meet the growing demand for identity monitoring and breach response services.

Growth Strategy

We deliver exceptional and innovative external cybersecurity solutions that prioritize customer satisfaction and business resiliency. Embracing these priorities, we are pursuing the following growth strategies:

6

Our Customers

As of January 31, 2023, we had over 2,100 customers, including over 1,200 subscription customers. We have key reference customers in many industry verticals including education, energy, entertainment, financial services, government healthcare, media, retail, services, and technology that we believe validate our solutions in the market. Our customers range from small and medium-sized organizations to Fortune 500 companies.

We have a single government customer that accounted for 47% of our revenue for the Successor Period. Excluding this customer, no single customer accounted for more than 3% percent of our revenue for the Successor Period.

Sales and Marketing

Our sales team is bifurcated into two sub-organizations: a new customer acquisition team and a customer success team. These teams are further structured into named-account sales teams that focus on targeted customer verticals, regions, and customer size. Most of our current business is in North America and as such, the team structure is proportionate in size and focus to the geographic distribution of our existing customer base. Members of the account management team are focused on creating successful customer outcomes, renewing customer subscriptions, and expanding platform adoption to drive customer upsell values.

7

In alignment with our corporate strategy, we are a channel-first organization. Our go-to-market strategy leverages our partner community to reach our desired customer cohorts. In North America, we generally rely on a single tier, value-added reseller and partner community. In other regions, we may employ a two-tiered approach by leveraging a network of distributors who then manage the various channel partners within desired territories or regions.

Our comprehensive marketing strategy focuses on an inbound marketing model designed to efficiently deliver high contact-to-opportunity conversion rates and pipeline velocity. We execute field, partner, and demand programs to drive ongoing engagement with prospects and leverage our sales development organization to mature those engagements into sales pipeline opportunities. Once prospects become customers, we continue engagement with solution-oriented content created by ZeroFox experts and executives through numerous collaboration channels designed to drive increased customer revenue and optimize our customers’ long-term value. Additionally, we conduct webinars and podcasts, participate in cybersecurity industry events, and utilize our product marketing team to drive market awareness through thought leadership. The sophistication and experience of the ZeroFox threat intelligence enables us to package our thought leadership into daily and weekly threat intelligence reports, quarterly threat landscape reports, and annual threat reports. Other tactics leveraged to maximize inbound traffic include paid media, content syndication, social media, outbound campaigns, public relations, and remarketing advertising. These tactics frequently rely on the ZeroFox website to drive awareness, education, and opportunity conversion on the ZeroFox Platform’s broad set of artificial intelligence capabilities. Furthermore, the website has been optimized to assist with lead conversion in mobile, tablet, and traditional desktop engagements. Marketing automation workflows continuously engage prospects throughout the buyers’ journey with thought leadership and solution-centric content to advance their understanding of our Platform's value proposition.

Our global field and partner marketing strategy is designed to maximize the leverage of partner ecosystems and build brand engagement at regional and territory levels to drive and accelerate pipeline growth. We have strong participation in many prominent cybersecurity conferences and trade shows across many global geographies to expand our brand reach. In alignment with our sales approach, we have a channel-first sales and marketing strategy. We utilize technology-enabled communication and collaboration with partners at all sales lifecycle stages, from demand generation through technical validation and close. We believe that we have a state-of-the-art partner portal that allows global partners to take advantage of all aspects of our marketing strategy and content. The content on the partner portal provides partners with accelerated readiness through rapid product innovations to drive demand within their customer base and ensures their sales and technical teams are familiar with the latest capabilities of our Platform.

Research and Development

We devote significant resources to improve and enhance our solutions and maintain the effectiveness of our Platform. We work closely with our customers to gain valuable insights into their threat environments and security management practices to assist in designing new solutions and features that extend the capabilities of our Platform. Our engineering staff monitors and tests our software on a regular basis. We maintain a continuous integration and continuous delivery release framework to update and enhance our Platform and its modular capabilities. We can seamlessly deploy real-time upgrades with no downtime by leveraging our on-demand platform model.

8

Competition

The market for external cybersecurity solutions is competitive and characterized by rapid changes in technology, customer requirements, industry standards, and by frequent new product and service offerings and improvements. We see competition from the following categories:

We believe that our external cybersecurity solutions offer advantages as compared to products offered by our competitors based on the following factors:

9

Intellectual Property

The intellectual property rights we hold are a foundational asset in our portfolio and are core to our long-term strategy to create stockholder value. We rely on intellectual property protection under law (patents, trademarks, copyrights, and trade secrets) and leverage our rights through various agreements, including license agreements, confidentiality and non-disclosure agreements, employee non-disclosure, and assignment of inventions agreements. We believe all these intellectual property rights enable us to be a leading provider of innovative, cloud-based external cybersecurity solutions. We attract both customers and employee talent from our market leadership position in innovation.

From inception, we anchored our business’ value proposition to the rapid creation of intellectual property; today this objective remains central to our Platform, capabilities, technology, and go-to-market strategy. Since then, we have ambitiously expanded our intellectual property portfolio by creating new inventions, tradecraft, and proprietary know-how stemming from our operational experience and research and development efforts.

We will continue to invest in the innovation and development of our intellectual property portfolio through business acquisitions, technology alliance and strategic licensing relationships, and ongoing research and development. Our intellectual property rights will be at risk because invalidation, circumvention and third-party intellectual property claims, and litigation remain possible. In addition, our industry is competitive so the intellectual property created by our competitors could limit the adoption of our technologies and products.

We believe competitors may try to develop products that are similar to ours and that they may infringe our intellectual property rights. Competitors or other third parties may also claim that our Platform and other solutions infringe their intellectual property rights. Third parties may in the future assert claims of infringement, misappropriation, and other violations of intellectual property rights against us or our customers, with whom our agreements may obligate us to indemnify against these claims.

10

Despite our best efforts to protect and aggressively expand our intellectual property rights, there is always the potential that they may not be respected in the future or may be invalidated, circumvented, or challenged. The cybersecurity industry is characterized by the existence of a large and expanding number of patents and frequent claims and related litigation based on allegations of patent infringement or other violations of intellectual property rights. We believe our approach to constantly invest in intellectual property is a meaningful component of our corporate strategy to mitigate intellectual property risk and liability. As an organization, we may elect to protect our intellectual property rights and challenge our competitor’s infringing use of such rights. Successful claims of infringement by a third party could prevent us from offering certain products or features, require us to develop alternate, non-infringing technology, which could require time and during which we could be unable to continue to offer our affected products or solutions, require us to obtain a license, which may not be available on reasonable terms or at all, or force us to pay damages, royalties, or other fees.

For additional information, see the section titled “Risk Factors-Risks Related to Legal and Regulatory Matters.”

Backlog

We enter into both single and multi-year subscription contracts for our solutions. We generally invoice the entire amount at contract signing prior to commencement of the subscription period. Until such time as these amounts are invoiced, they are not recorded in deferred revenue or elsewhere in our consolidated financial statements, and are considered backlog. As of January 31, 2023, we had $54.0 million in total deferred revenue, which excluded backlog of approximately $61.5 million. Of this amount, approximately $54.2 million is expected to be billed in fiscal year 2024. We expect backlog will change from period to period for several reasons, including the timing and duration of customer agreements, varying billing cycles of subscription agreements, and the timing and duration of customer renewals. Because revenue for any period is a function of revenue recognized from deferred revenue under contracts in existence at the beginning of the period, as well as new and renewing contracts during the period, backlog at the beginning of any period is not necessarily indicative of future revenue performance.

Human Capital

As of January 31, 2023, we employed 721 employees and 18 contractors. Our workforce is geographically distributed across the United States and various other locations around the world. None of our current employees are represented by a labor union and we have not experienced work stoppages. We consider our employee relations to be in good standing and we invest in them. We value our employees as a meaningful asset to our Company.

Attracting, Retaining, and Developing Talent

Our people team designs and implements key initiatives and employs business-driven human resources programs to recruit, hire, empower, develop, assess, and retain industry talent. First, we aim to build an effective team by leveraging our global footprint to find the right people, in the right geographies and place them into the right roles. Next, we empower employees to take ownership in their work while providing them with the tools, resources, and time to do their jobs well. We invest in our staff, offering coaching, training, and other support to develop short- and long-term skills and provide them with opportunities for career growth. Our semi-annual performance management cycle, which is purposefully decoupled from compensation discussions to encourage non-biased dialogue, encompasses both look back and look ahead elements to celebrate success, make improvements, and develop competencies to address future business needs.

11

Diversity and Inclusion

Our corporate culture is built on the goal of creating a diverse and inclusive environment where employees’ unique opinions and feedback are respected, desired, and acted upon. As a team, employees constantly collaborate and work together to set policy, communicate openly, and drive an environment of transparency. For example, we frequently have global town hall meetings where the agenda is set by employees, hosted by employees that volunteer to emcee each event, and where multiple regions and business units are always recognizing their achievements and successes.

Each global town hall has a segment referred to as "Fellow Foxes", where employees have the opportunity to thank and recognize their peers anonymously or openly in front of the entire company. It is not uncommon to see dozens of Fellow Foxes recognized in a single town hall; Fellow Foxes love to work hard and recognize their teammates.

The Fellow Foxes practice is an example of the framework and value system that has been built to recognize and reward employees based upon meritocracy. We believe that most talent not only wants to be listened to but also challenged and rewarded where they can rise to their full potential and deliver their top performance in a healthy, fun work environment. Our workforce’s ability to execute relentlessly in pursuit of company objectives is both a primary differentiator and a critical component contributing to our success.

To ensure that we retain a highly capable workforce that represents a variety of diverse backgrounds and complies with contractual obligations and local compliance regulations, we regularly benchmark our program against industry standards, diversity objectives, and key employee drivers.

Employee Health & Safety / COVID-19

We are committed to protecting the physical well-being of our employees, families, and customers. To address the evolving complexities introduced by COVID-19, we have and will continue to take multiple steps to promote safety, realign workforce planning strategy, and support employee needs while continuing to drive customer satisfaction. We regularly review and update our health and safety plan based on guidelines, rules and capabilities issued by local, regional, and countrywide healthcare organizations. At present, a large majority of employees work from home. In select geographies some employees can optionally work out of a local office in a hybrid environment, and there is another group of employees that work primarily in the office. As the world reopens and employees potentially transition back toward an office setting, our offices have reopened with modified configurations based on requirements and recommendations from local, state, national government, and health institutions. Concurrently, we have used a phased approach that entails re-classifying ongoing work locations across all roles and implementing a flexible hybrid work model where appropriate.

While onsite, we have protocols in place to help keep employees, customers, and other visitors safe. We exercise an abundance of caution where safety is concerned and are ultimately prepared, resourced and equipped to exceed customer expectations, whether working onsite or remote.

12

Government Regulation

As a provider of external cybersecurity solutions, our business is potentially subject to a variety of domestic and international laws and regulations relating to the collection, use, retention, protection, transfer, and processing of business data, personal data, and other sensitive information. Certain aspects of our offerings may involve access to and use of personally identifiable information and other sensitive data. The nature of cybersecurity product, identity offerings and related services requires the collection of various types of data. In the operation of our business, we may collect the types of data covered by these laws and regulations including personally identifiable information, information about an individual’s health and financial information about individuals. To the extent we are in possession of such data and these various laws and regulations are determined to apply to us, this could require us to adopt additional operational, technological and security measures to protect and manage such information which could increase our costs of operations. Our failure to comply with such laws and regulations could also result in monetary fines and reputational damage which would have a negative impact on our business. These laws and regulations include, but are not limited to, GDPR, CCPA, CPRA, the Electronic Communication Privacy Act (“ECPA”), Computer Fraud and Abuse Act (“CFAA”), the Gramm-Leach-Bliley Act (“GBLA”), and the HIPAA/HITECH Act. In addition to these, other laws and regulations relating to cloud computing, cross-border data transfer restrictions, data collection and data localization may apply to our business as we expand outside of the U.S. market.

Our business is also subject to laws relating to import and export control such as U.S. export licensing requirements, trade and economic sanctions administered by the U.S. Office of Foreign Assets Control and anti-bribery laws such as the FCPA and the U.K. Anti-Bribery Act.

We believe that we are in material compliance with the laws and regulations that are applicable to us.

Many of these laws and regulations, such as those related to data protection and privacy, are frequently being revised and new laws in different jurisdictions are being adopted. Therefore, we must continually evolve our business practices to satisfy these regulatory obligations. We have policies and procedures that we rely on to satisfy these requirements and are transparent with our customers regarding our business practices, product features and types of data that are collected when a customer uses our security solutions. In addition to the existing regulatory framework applicable to our business, some governments are considering whether to take a more active role in regulating the cybersecurity industry and, in the U.S., there are efforts to have the federal government regulate digital platform companies. New regulations in these two areas could impact our go-to-market model. Therefore, we keep abreast of these potential changes and how they may impact our business.

See the section titled “Risk Factors” for additional information about the laws and regulations we are subject to and the risks of our business associated with such laws and regulations.

Corporate Information

ZeroFox Holdings, Inc. is a holding company incorporated in the state of Delaware. ZeroFox Holdings, Inc. was formerly known as L&F Acquisition Corp. (L&F) and was a blank check, Cayman Islands exempted company, incorporated on August 20, 2020. The Company conducts its business through its wholly-owned, consolidated subsidiaries, primarily ZeroFox, Inc. and Identity Theft Guard Solutions, Inc.

13

On August 3, 2022, L&F, ZeroFox, Inc., and ID Experts Holdings, Inc. (IDX), consummated the Business Combination as contemplated by the Business Combination Agreement, dated as of December 17, 2021. In connection with the finalization of the Business Combination, L&F changed its name to ZeroFox Holdings, Inc. and changed its jurisdiction of incorporation from the Cayman Islands to the state of Delaware and changed its fiscal year end to January 31.

Our principal executive offices are located at 1834 S. Charles Street, Baltimore, Maryland 21230, and our telephone number is (855) 936-9369. Our website is www.zerofox.com. The information found on, or that can be accessed from or that is hyperlinked to, our website is not part of Annual Report on Form 10-K.

Available Information

Our Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, and amendments to these reports are filed with the SEC pursuant to Sections 13(a) and 15(d) of the Securities Exchange Act of 1934 (the Exchange Act). Such reports and other information filed or furnished by us with the SEC are available free of charge on our website at https://ir.zerofox.com/ as soon as reasonably practicable after we file such material with, or furnish it to, the SEC. The SEC maintains a website that contains the materials we file with or furnish to the SEC at www.sec.gov.

Investors and other interested parties should note that we use our media and investor relations website and our social media channels to publish important information about us, including information that may be deemed material to investors. We encourage investors and other interested parties to review the information we may publish through our media and investor relations website and the social media channels listed on our media and investor relations website, in addition to our SEC filings, press releases, conference calls and webcasts.

ITEM 1A. RISK FACTORS

Investing in our securities involves a high degree of risk. Before making an investment decision, you should consider carefully the risks and uncertainties described below. Our business, operating results, financial condition and prospects could also be harmed by risks and uncertainties not currently known to us or that we currently do not believe are material. If any of the risks actually occur, our business, operating results, financial condition and prospects could be adversely affected. In that event, the market price of our Common Stock and Warrants could decline, and you could lose part or all of your investment.

Summary of Risk Factors

Our business is subject to numerous risks and uncertainties, including those outside of our control, that could cause our actual results to be harmed. These risks include the following:

14

15

Risks Related to Our Technology, Products and Solutions

Defects, errors, or vulnerabilities in our Platform, the failure of our Platform to block malware or prevent a security breach, misuse of our Platform, or risks of product liability claims would harm our reputation and adversely impact our business, operating results, and financial condition.

Our platform is multi-faceted and may be deployed with material defects, software “bugs” or errors that are not detected until after commercial release and deployment to our customers. Our platform provides our customers with the ability to customize a multitude of settings and it is possible that a customer could misconfigure our Platform or otherwise fail to configure our products in an optimal manner. Such defects and misconfigurations of our Platform could cause our Platform to operate at suboptimal efficacy and increase the risk of cyberattacks on our customers. In addition, because the techniques used by computer hackers to access or sabotage target computing environments change frequently and generally are not recognized until launched against a target, there is a risk that an advanced attack could emerge that we do not anticipate and that our Platform is unable to detect or prevent.

As a well-known provider of external cybersecurity products and solutions, we may in the future be specifically targeted by bad actors for attacks intended to circumvent our security capabilities or to exploit our Platform as an entry point into customers’ endpoints, networks, or systems. The risk of cybersecurity attacks related to political and economic conditions, war, and terrorism may increase, including from retaliatory cybersecurity attacks as a result of Russia’s invasion of Ukraine and related political, economic and counter-responses. In addition, defects or errors in our Platform could result in a failure to effectively alert customers of potential threats. Our data centers and platform may experience technical failures and downtime, may fail to distribute appropriate updates, or may fail to meet the increased requirements of a growing customer base, any of which could temporarily or permanently reduce the efficacy of our solutions and expose our customers to cyber threats. Any of these situations could result in negative publicity to us, damage our reputation, and increase expenses and customer relations issues, which would adversely impact our business, financial condition, and operating results.

16

Advances in computer capabilities, discoveries of new weaknesses and other developments with software generally used by the internet community may increase the risk we will suffer a security breach. Furthermore, our Platform may fail to detect malware, ransomware, viruses, worms or similar threats for any number of reasons, including our failure to enhance and expand our Platform to reflect industry trends, new technologies and new operating environments, the complexity of the environment of our customers and the sophistication of malware, viruses and other threats. We or our service providers may also suffer security breaches or unauthorized access to personal information, financial account information, and other confidential information due to employee error, rogue employee activity, or unauthorized access by third parties either by mistake or acting with malicious intent. If we experience any breaches of security measures or sabotage or otherwise suffer unauthorized use or disclosure of, or access to, personal information, financial account information or other confidential information, we might be required to expend significant capital and resources to address these problems. We may not be able to remedy any problems caused by hackers or other similar actors in a timely manner, or at all. Any real or perceived defects, errors or vulnerabilities in our Platform, or any other failure of our Platform to detect an advanced threat, could result in:

If a high-profile cybersecurity incident occurs with respect to another SaaS provider, customers may lose trust in the security of the SaaS business model generally, which could adversely impact our ability to retain existing customers or attract new ones. In the last few years there have been many successful advanced external cybersecurity incidents that have damaged several prominent companies in spite of strong information security measures. We expect that the risks associated with cybersecurity incidents and the costs of preventing such external cybersecurity attacks will continue to increase in the future.

We cannot assure you that any limitation of liability provisions in our customer agreements, contracts with third-party vendors and service providers, or other contracts would be enforceable or adequate or would otherwise protect us from any liabilities or damages with respect to any particular claim relating to a breach of contract, security breach or other security-related matter as a result of federal, state, or local laws or ordinances, or unfavorable judicial decisions in the U.S. or other countries.

17

While we maintain insurance policies that may cover certain liabilities in connection with a cybersecurity incident, we cannot be certain that our insurance coverage will be adequate for liabilities actually incurred, that insurance will continue to be available to us on commercially reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could have a material adverse effect on our business, including our financial condition, results of operations and reputation. Even claims that ultimately are unsuccessful could result in our expenditure of significant funds in litigation, divert management’s time and other resources, and harm our reputation.

If our enterprise platform offerings do not interoperate with our customers’ network and security infrastructure, or with third-party products, websites or services, our results of operations may be harmed.

Our enterprise product offerings must interoperate with our customers’ existing network and security infrastructure. These complex systems are developed, delivered, and maintained by the customer, their employees and a myriad of vendors and service providers. As a result, the components of our customers’ infrastructure have different specifications, rapidly evolve, utilize multiple protocol standards, include multiple versions and generations of products and may be highly customized. Our platform must be able to interoperate with highly complex and customized networks, which requires careful planning and execution between our customers, our customer support teams and our channel partners. Further, when our customers add new or updated elements to their infrastructure, when new usage trends emerge (such as remote work during the COVID-19 pandemic), or new industry standards or protocols are introduced, we may have to update or enhance our Platform and our other solutions to allow us to continue to provide service to customers. Our competitors or other vendors may refuse to work with us to allow their products to interoperate with our solutions, which could make it difficult for our Platform to function properly in customer networks that include these third-party products.

We may not deliver or maintain interoperability quickly, cost-effectively, or at all. These efforts require capital investment and engineering resources. If we fail to maintain compatibility of our Platform and solutions with our customers’ network and security infrastructures, our customers may not be able to fully utilize our products and solutions, and we may, among other consequences, lose or fail to increase our market share and experience reduced demand for our services, which would materially harm our business, operating results, and financial condition.

18

We may not timely and cost-effectively scale and adapt our existing technology to meet our customers’ performance and other requirements.

Our future growth is dependent upon our ability to continue to meet the needs of new customers and the expanding needs of our existing customers as their use of our products and solutions grow. As our customers gain more experience with our products and solutions, the amount of data transferred, processed and stored by us, the number of locations where our Platform and services are being accessed, have in the past, and may in the future, expand rapidly. In order to meet the performance and other requirements of our customers, we intend to continue to make material investments to increase capacity and to develop and implement new technologies in our service and cloud infrastructure operations. These technologies, which include databases, applications and server optimizations, network and hosting strategies, and automation, are often advanced, complex, new and untested. We may not be successful in developing or implementing these technologies. In addition, it takes a significant amount of time to plan, develop and test improvements to our technologies and infrastructure, and we may not be able to accurately forecast demand or predict the results we will realize from such improvements. To the extent that we do not effectively scale our operations to meet the needs of our growing customer base and to maintain performance as our customers expand their use of our products and solutions, we may not be able to grow as quickly as we anticipate, our customers may reduce or cancel use of our solutions and we may be unable to compete as effectively, and our business and results of operations may be harmed.

Our success depends, in part, on the integrity and scalability of our systems and infrastructure. System interruption and the lack of integration, redundancy, and scalability in these systems and infrastructure may adversely affect our business, financial condition, and results of operations.

Our success depends, in part, on our ability to maintain the integrity of our systems and infrastructure, including websites and related systems. System interruption and a lack of integration and redundancy in our information systems and infrastructure may adversely affect our ability to operate our Platform, respond to customer inquiries, and generally maintain cost-efficient operations. We may experience occasional system interruptions that make some or all systems or data unavailable or prevent us from efficiently providing access to our Platform.

Our ability to introduce new products and solutions and features is dependent on adequate research and development resources and our ability to successfully complete acquisitions. If we do not adequately fund our research and development efforts or complete acquisitions successfully, we may not be able to compete effectively and our business, financial condition, and results of operations may be harmed.

To remain competitive, we must continue to offer new products and solutions and enhancements to our existing platform. This is particularly true as we further expand and diversify our capabilities. Maintaining adequate research and development resources, such as the appropriate personnel and development technology, to meet the demands of the market is essential. We may also choose to expand into a certain market or strategy via an acquisition for which we could potentially pay too much or fail to successfully integrate into our operations.

19

Further, many of our competitors expend a considerably greater amount of funds on their respective research and development programs, and those that do not may be acquired by larger companies that would allocate greater resources to our competitors’ research and development programs. Our failure to maintain adequate research and development resources or to compete effectively with the research and development programs of our competitors would give an advantage to such competitors and our business, financial condition, and results of operations could be adversely affected. Moreover, there is no assurance that our research and development or acquisition efforts will successfully anticipate market needs and result in significant new marketable solutions or enhancements to our existing platform and solutions, design improvements, cost savings, revenue, or other expected benefits. If we are unable to generate an adequate return on such investments, we may not be able to compete effectively and our business, financial condition, and results of operations may be materially and adversely affected.

We rely on third-party cloud providers to host and operate our Platform, and any disruption of or interference with our use of these facilities or technologies may negatively affect our ability to maintain the performance and reliability of our Platform which could cause our business to suffer.

Our customers depend on the continuous availability of our Platform. We currently host our Platform and serve our customers using a mix of third-party cloud providers. Consequently, we may be subject to service disruptions as well as failures to provide adequate support for reasons that are outside of our direct control. We have experienced and expect that in the future we may experience interruptions, delays and outages in service and availability from time to time due to a variety of factors, including infrastructure changes, human or software errors, website hosting disruptions, and capacity constraints.

The following factors, many of which are beyond our control, can affect the delivery, platform availability, and the performance of our products:

20

The adverse effects of any service interruptions on our reputation, results of operations, and financial condition may be disproportionately heightened due to the nature of our business and the fact that our customers have a low tolerance for interruptions of any duration. Interruptions or failures in our service delivery could result in a cyberattack or other security threat to our customers during such periods of interruption or failure. Additionally, interruptions or failures in our service could cause customers to terminate their subscriptions with us, adversely affect our renewal rates, and harm our ability to attract new customers. Our business would also be harmed if our customers believe that a cloud-based SaaS-delivered security solution is unreliable. We have experienced, and may in the future experience, service interruptions and other performance problems due to a variety of factors. The occurrence of any of these factors, or if we are unable to rapidly and cost-effectively fix such errors or other problems that may be identified, could damage our reputation, negatively affect our relationship with our customers or otherwise harm our business, results of operations, and financial condition.

In addition, because of the importance of cloud services to our business and our cloud providers’ positions in the cloud-based server industry, any renegotiation or renewal of our agreements may be on terms that are significantly less favorable to us than our current agreements. If our cloud-based server costs were to increase, our business, results of operations, and financial condition may be adversely affected. Although we expect that we could receive similar services from other cloud providers, if any of our arrangements with our cloud providers are terminated, we could experience interruptions on our Platform and in our ability to make our products and solutions available to customers, as well as delays and additional expenses in arranging alternative cloud infrastructure services. Ongoing improvements to cloud infrastructure may be more expensive than we anticipate and may not yield the expected savings in operating costs or the expected performance benefits. In addition, we may be required to re-invest any cost savings achieved from prior cloud infrastructure improvements in future infrastructure projects to maintain the levels of service required by our customers. We may not be able to maintain or achieve cost savings from our investments, which could harm our financial results.

21

We rely on data, software and services from other parties. Defects in or the loss of access to software or services from third parties could increase our costs and adversely affect the quality of our solutions.

We rely on third-party computer systems, broadband and other communications systems and service and data providers to provide customers with access to our Platform. Any interruptions, outages or delays in our systems, infrastructure or business, or the systems, infrastructure, or business of such third parties, or deterioration in the performance of these systems and infrastructure, could impair our ability to provide access to our Platform. Our business would be disrupted if any of the third-party software, data or services we utilize, particularly with respect to third-party software, data or services embedded in our solutions, or functional equivalents thereof, were unavailable due to extended outages or interruptions or because they are no longer available on commercially reasonable terms or prices or at all.

In each case, we would be required to either seek licenses to software, data or services from other parties and redesign our solutions to function with such other parties’ software, data or services or develop these components ourselves, which would result in increased costs and could result in delays in our solution and solution package launches and the release of new solution and solution package offerings until equivalent technology can be identified, licensed or developed, and integrated into our solutions. Furthermore, we might be forced to limit the features available in our current or future solutions. If these delays and feature limitations occur, our business, results of operations and financial condition could be adversely affected.

Risk Factors Related to our Business and Industry

ZeroFox (including the Predecessor and the Successor) has a history of losses and we may not be able to achieve or sustain profitability in the future.

The Predecessor incurred net losses in all periods since its inception, including net losses of $38.4 million, $22.7 million and $22.7 million for fiscal 2022, 2021 and 2020, respectively. The Successor experienced a net loss of $720.6 million in the Successor Period. As of January 31, 2023, ZeroFox had an accumulated deficit of $754.7 million. Following the Business Combination, we cannot predict when or whether we will reach or maintain profitability. We also expect that our operating expenses will increase over our historical expenses in the future as we continue to invest for future growth, including expanding our research and development activities to enhance our Platform, expanding our sales and marketing activities and reaching customers in new geographic locations, which will negatively affect our operating results if our total revenue does not increase. We cannot assure you that these investments will result in substantial increases in our revenue or improvements in our operating results. In addition to the anticipated costs to grow our business, we also expect to incur significant additional legal, accounting, and other expenses as a newly public operating company. Any failure to increase our revenue as we invest in our business or to manage our costs could prevent us from achieving or maintaining profitability.

22

If we are not able to maintain and enhance our brand and our reputation as a provider of external cybersecurity products and solutions, our business and results of operations may be adversely affected.

We believe that maintaining and enhancing our brand and our reputation as a provider of external cybersecurity products and solutions is critical to our relationship with existing customers, channel partners, and technology alliance partners and our ability to attract new customers and partners. The successful promotion of our brand will depend on a number of factors, including our marketing efforts, our ability to continue to develop additional features for our Platform and our ability to successfully differentiate our Platform from competitive cloud-based or legacy security solutions. Although we believe it is important for our growth, our brand promotion activities may not be successful or yield increased revenue.

In addition, independent industry or financial analysts and research firms often test our products and solutions and provide reviews of our Platform, as well as the products of our competitors, and the perception of our Platform in the marketplace may be significantly influenced by these reviews. If these reviews are negative, or less positive as compared to those of our competitors’ products, our brand may be adversely affected. Our products and solutions may fail to detect or prevent threats in any particular test for a number of reasons that may or may not be related to the efficacy of our products and solutions in real world environments. To the extent potential customers, industry analysts or testing firms believe that the occurrence of a failure to detect or prevent any particular threat is a flaw or indicates that our products and solutions or services do not provide significant value, we may lose customers, and our reputation, financial condition and business would be harmed. Additionally, the performance of our channel partners and technology alliance partners may affect our brand and reputation if customers do not have a positive experience with these partners. In addition, we have in the past worked, and continue to work, with high profile customers as well as assist in analyzing and remediating high profile cyberattacks. Our work with such customers has exposed us to publicity and media coverage. Negative publicity about us, including about our management, the efficacy and reliability of our Platform, our product offerings, our professional services, and the customers we work with, even if inaccurate, could adversely affect our reputation and brand.

23

If organizations do not adopt external cybersecurity solutions that may be based on new and untested security concepts, our ability to grow our business and results of operations may be adversely affected.

Our future success depends on the growth in the market for cloud and/or SaaS-delivered external cybersecurity products and solutions. The use of SaaS products and solutions to manage and automate security and IT operations is rapidly evolving. As such, it is difficult to predict our potential growth, customer adoption and retention rates, customer demand for our products and solutions, or the success of existing or future competitive products. Any expansion in our market depends on several factors, including the cost, performance and perceived value associated with our products and solutions and those of our competitors. If our solutions do not achieve widespread adoption or there is a reduction in demand for our products and solutions due to a lack of customer acceptance, technological challenges, competing products, privacy or other liability concerns, decreases in corporate spending, weakening economic conditions, or otherwise, it could adversely affect our business, results of operations and financial results, resulting in early terminations, reduced customer retention rates, or decreased sales. We do not know whether the trend in adoption of cloud-enabled and/or SaaS-delivered cybersecurity solutions that we have experienced in the past will continue in the future. Furthermore, if we or other SaaS security providers experience security incidents, loss or disclosure of customer data, disruptions in delivery, or other problems, the market for SaaS solutions as a whole, including our security solutions, could be negatively affected.

Historically, information sharing related to cybersecurity has been a very well accepted concept from a theoretical perspective but very difficult to implement in practice. Companies are generally reluctant to share their sensitive cyber information with other entities, despite knowing the advantages of doing so. Misperceptions may exist, however, about what information gets shared, with whom that information is shared, and the jurisdictions (including foreign countries) of the companies with which the information gets shared. Further, concerns of existing or potential customers may exist related to the ability to completely remove any indicia of the source company, general market rejection of information sharing, or specific market skepticism of our approach, which may further add to a lack of customer acceptance.

In addition to the potential concerns related to sharing sensitive information in a system consisting of commercial or potentially competitive entities, additional concerns can arise when governments become involved as participants in the collective defense ecosystem. From a commercial perspective, companies frequently view information sharing on platforms with governments that are also customers as risky, based on perceptions that the governments might use such shared information to take action against the companies or to otherwise utilize it in a way that will expose such companies to liability. Such perceptions could lead commercial entities to stop sharing, not procure our services in the first place, or terminate their relationship with us altogether. Similarly, governments (as customers) may be unable to properly process such data or utilize it in a meaningful way, or share useful information back into our solutions. Any of these concerns could lead to reduced sales or contribute to a lack of customer acceptance. In addition, the mere involvement of one or more government entities as customers may harm our reputation with certain companies.

24

We (including the Predecessor and the Successor) have experienced rapid growth in recent periods, and if we do not manage our future growth, our business and results of operations will be adversely affected.

ZeroFox experienced rapid revenue growth in recent periods, and we expect to continue to invest broadly across our organization to support our growth. For example, ZeroFox’s actual employee headcount grew from 158 employees as of January 31, 2019 to 721 employees as of January 31, 2023. Additionally, ZeroFox's revenue grew from $8.9 million in fiscal 2019 to $117.6 million in fiscal 2023. Although ZeroFox experienced rapid growth historically, we may not sustain these growth rates, nor can we assure you that our investments to support our growth will be successful. The growth and expansion of our business will require us to invest significant financial and operational resources and the continuous dedication of our management team. We have encountered and will continue to encounter risks and difficulties frequently experienced by rapidly growing companies in evolving industries, including market acceptance of our Platform, adding new customers, intense competition, and our ability to manage our costs and operating expenses. Our future success will depend in part on our ability to manage our growth effectively, which will require us to, among other things:

If we fail to achieve these objectives effectively, our ability to manage our expected growth, ensure uninterrupted operation of our Platform and key business systems, and comply with the rules and regulations applicable to our business could be impaired. Additionally, the quality of our Platform and services could suffer and we may not be able to adequately address competitive challenges. Any of the foregoing could adversely affect our business, results of operations, and financial condition.

We face intense competition and could lose market share to our competitors, which could adversely affect our business, financial condition, and results of operations.

The market for security solutions is intensely competitive, fragmented, and characterized by rapid changes in technology, customer requirements and industry standards, increasingly sophisticated attackers, and by frequent introductions of new or improved products to combat security threats. We expect to continue to face intense competition from current competitors, as well as from new entrants into the market given the relatively low barriers to entry in the industry. If we are unable to anticipate or react to these challenges, our competitive position could weaken, and we could experience a decline in revenue or reduced revenue growth, and loss of market share that would adversely affect our business, financial condition, and results of operations. Our ability to compete effectively depends upon numerous factors, many of which are beyond our control, including, but not limited to:

25

Our competitors include the following, by general category:

26

Many of these competitors have greater financial, technical, marketing, sales, and other resources, greater name recognition, longer operating histories, and a larger base of customers than we do. They may be able to devote greater resources to the development, promotion, and sale of services than we can, and they may offer lower pricing than we do. Further, they may have greater resources for research and development of new technologies, the provision of customer support, and the pursuit of acquisitions, or they may have other financial, technical, or other resource advantages. Our larger competitors have substantially broader and more diverse product and service offerings as well as routes to market, which allows them to leverage their relationships based on other products and to incorporate functionality into existing products to gain business in a manner that discourages users from purchasing our Platform. Conditions in our market could change rapidly and significantly because of technological advancements, partnering or acquisitions by our competitors or continuing market consolidation. Some of our competitors have recently made acquisitions of businesses or have established cooperative relationships that may allow them to offer more directly competitive and comprehensive solutions than were previously offered and adapt more quickly to new technologies and customer needs. As a result of such acquisitions or arrangements, our current or potential competitors may be able to devote greater resources to bring these solutions and services to market, initiate or withstand substantial price competition or develop and expand their product and service offerings more quickly than we do. These competitive pressures in our market or our failure to compete effectively may result in price reductions, fewer orders, reduced revenue and gross margins, increased net losses and loss of market share. Further, many competitors that specialize in providing protection from a single type of security threat may be able to deliver these targeted security products to the market quicker than we can or convince organizations that these limited products meet their needs. Even if there is significant demand for cloud-based security solutions like ours, if our competitors include functionality that is, or is perceived to be, equivalent to or better than ours in legacy products that are already generally accepted as necessary components of an organization’s security architecture, we may have difficulty increasing the market penetration of our Platform. Furthermore, even if the functionality offered by other security providers is different and more limited than the functionality of our Platform, organizations may elect to accept such limited functionality in lieu of adding products from additional vendors like us.

For all of these reasons, competition may negatively impact our ability to maintain and grow consumption of our Platform and solutions or put downward pressure on our prices and gross margins, any of which could materially harm our reputation, business, financial condition, and results of operations.

27

Competitive pricing pressure may reduce revenue, gross profits, and adversely affect our financial results.

If we are unable to maintain our pricing due to competitive pressures or other factors, our revenue and margins may be reduced and our revenue and gross profits, business, results of operations and financial condition may be adversely affected. The prices for our Platform, products and solutions, and professional services may decline for a variety of reasons, including competitive pricing pressures, discounts, anticipation of the introduction of new solutions by competitors, or promotional programs offered by us or our competitors. Competition continues to increase in the market segments in which we operate, and we expect competition to further increase in the future. Larger competitors with more diverse product and service offerings may reduce the price of products or subscriptions that compete with ours or may bundle them with other products and subscriptions in an effort to leverage their existing market share to make it harder for newer companies, like us, to effectively compete.

Adverse general and industry-specific economic and market conditions and reductions in customer spending, in either the private or public sector, including as a result of geopolitical uncertainty such as the ongoing conflict between Russia and Ukraine, may reduce demand for our Platform or products and solutions, which could harm our business, financial condition and results of operations.

Our business, financial condition, and results of operations depend on the overall demand for our Platform and products and solutions. Negative conditions in the general economy both in the United States and abroad, including conditions resulting from the COVID-19 pandemic, changes in gross domestic product growth, financial and credit market fluctuations, energy costs, international trade relations, geopolitical issues, such as the conflict between Russia and Ukraine, or the availability and cost of credit could lead to increased market volatility, decreased consumer confidence, and diminished growth expectations in the U.S. economy and abroad, which in turn could result in reductions in information technology, software, and security spending by our existing and prospective customers. Negative economic conditions in both the public and private sectors, including macroeconomic, political and market conditions, government shutdowns or reduction in government spending, the availability of short-term and long-term funding and capital, the level and volatility of interest rates, currency exchange rates, and inflation, may cause customers to reduce their spending. Prolonged economic slowdowns may result in customers delaying or canceling projects, choosing to focus on in-house development efforts or seeking to lower their costs by requesting us to renegotiate existing contracts on less advantageous terms or defaulting on payments due on existing contracts or not renewing at the end of the contract term.

28

We employ multiple and evolving pricing models, which subject us to various pricing challenges that could make it difficult for us to derive value from our customers and may adversely affect our business, financial condition, and results of operations.

We employ multiple and evolving pricing models for our offerings. Our pricing models may ultimately result in a higher total cost to our customers generally as data volumes increase over time, or may cause our customers to limit or decrease usage in order to stay within the limits of their existing licenses or lower their costs, making it more difficult for us to compete in our markets or negatively impacting our business, financial condition, and results of operations. As the amount of data within our customers’ organizations grows, we face downward pressure from our customers regarding our pricing, which could adversely affect our revenue and operating margins. In addition, our pricing models may allow competitors with different pricing models to attract customers unfamiliar or uncomfortable with our pricing models, which would cause us to lose business or modify our pricing models, both of which could adversely affect our revenue and operating margins. We have introduced and expect to continue to introduce variations to our pricing models, including but not limited to usage-based, tiered pricing based on number of users, flat upfront fee, fixed price, level of effort, cost plus fee, utility-based pricing and other pricing programs. We also must determine the appropriate price to enable us to compete effectively internationally. Although we believe that these pricing models and variations to these models will drive net new customers, and increase customer adoption, it is possible that they will not and may potentially cause customers to decline to purchase or renew contracts with us or confuse customers and reduce their lifetime value, which could negatively impact our business, financial condition, and results of operations.

If we fail to adapt to rapid technological change, evolving industry standards and changing customer needs, requirements or preferences, our ability to remain competitive could be impaired.

The market for our Platform and solutions is characterized by rapid technological change, evolving industry standards and changing regulations, as well as changing customer needs, requirements, and preferences. The success of our business will depend, in part, on our ability to anticipate, adapt and respond effectively to these changes on a timely and cost-effective basis. In addition, as our customers’ data infrastructure needs grow more complex, we expect them to face new and increasing challenges. Our customers require that our Platform and products and solutions effectively identify and respond to these challenges without disrupting the performance of our customers’ information technology and data systems or interrupting their operations. As a result, we must continually modify and improve our offerings in response to changes in our customers’ data infrastructures and operational needs or end-user preferences. The success of any enhancement to our existing offerings or the deployment of new offerings depends on several factors, including the timely completion and market acceptance of our enhancements or new offerings. Any enhancement to our existing offerings or new offerings that we develop and introduce involves significant commitment of time and resources and is subject to a number of risks and challenges, including, but not limited to:

29

If we are not successful in managing these risks and challenges, or if our Platform or products and solutions (including any upgrades thereto) are not technologically competitive or do not achieve market acceptance, our business, financial condition, and results of operations could be adversely affected.

If we are unable to maintain successful relationships with our channel partners, or if our channel partners fail to perform, our ability to market, sell and distribute our Platform will be limited, and our business, financial position and results of operations will be harmed.

In addition to our direct sales force, we rely on our channel partners to sell our Platform. A substantial amount of sales of our Platform flows through our channel partners and we expect this to continue for the foreseeable future. ZeroFox derived approximately 16% of its revenue for the Successor Period from subscriptions through channel partners. The loss of a substantial number of our channel partners or the failure to recruit additional channel partners, could adversely affect our operating results. Our ability to increase revenue will depend in part on our success in maintaining successful relationships with our channel partners and in training our channel partners to independently sell and deploy our Platform. If we fail to effectively manage our existing sales channels, or if our channel partners are unsuccessful in fulfilling the orders for our solutions, or if we are unable to enter into arrangements with, and retain a sufficient number of, high quality channel partners in each of the regions in which we sell products and solutions and keep them motivated to sell our products and solutions, our ability to sell our products and solutions and results of operations will be harmed.

30

We target enterprise customers and government organizations, and sales to these customers involve risks that may not be present or that are present to a lesser extent with sales to smaller entities.

We have a sales team that targets enterprise customers and government organizations. These sales involve risks that may not be present or that are present to a lesser extent with sales to smaller entities, such as longer sales cycles, more complex customer requirements, substantial upfront sales costs, and less predictability in completing sales. For example, enterprise customers may require considerable time to evaluate and test our products and solutions and those of our competitors prior to making a purchase decision and placing an order. A number of factors influence the length and variability of our sales cycle, including the need to educate potential customers about the uses and benefits of our products and solutions, the discretionary nature of purchasing and budget cycles, and the competitive nature of evaluation and purchasing approval and/or competitive bidding processes. As a result, the length of our sales cycle, from identification of the opportunity to deal closure, may vary significantly from customer to customer, with sales to enterprise customers and government organizations typically taking longer to complete. Moreover, enterprise customers often begin to deploy our products and solutions on a limited basis, but nevertheless demand configuration, integration services and pricing negotiations, which increase our upfront investment in the sales effort with no guarantee that these customers will deploy our products and solutions widely enough across their organization to justify our substantial upfront investment. Further, a significant percentage of our enterprise sales are to customers in the financial services sector. An economic slowdown in that sector could adversely impact our sales.

Our success and ability to grow our business depend on retaining and expanding our customer base. If we fail to add new customers or retain existing customers, our business, financial condition, and results of operations could be harmed.

We may enter into subscription agreements for our Platform and solutions where customers have discretion to renew or terminate services at the end of the term, or stand-alone agreements for the provision of specified software or services. For us to improve our operating results, it is important that we add new customers and that our existing customers renew their subscriptions and upgrade and expand their subscribed services. Our customers have no obligation to renew their subscriptions, to upgrade or expand their subscribed services, or to continue their relationship with us once a stand-alone engagement ends. Our customers’ renewal, upgrade and expansion rates may decline or fluctuate as a result of a number of factors, including their satisfaction or dissatisfaction with our offerings, our pricing, the effects of general economic conditions, competitive offerings, or alterations or reductions in our customers’ spending levels. If we are unable to add new customers or if our existing customers do not renew their subscriptions when the term expires or do not upgrade and expand the subscribed services or if customers renew on terms less favorable to us, or do not otherwise continue to use our Platform and solutions for subsequent engagements, our revenue may decline and our business, financial condition, and results of operations could be harmed.

31

Our customers may merge with other entities who purchase solutions and services from our competitors, and, during weak economic times, there is an increased risk that one or more of our customers will file for bankruptcy protection, either of which may harm our business, financial condition, and results of operations. We also face risks from international customers that file for bankruptcy protection in foreign jurisdictions, particularly given that the application of foreign bankruptcy laws may be more difficult to predict. In addition, we may determine that the cost of pursuing any claim may outweigh the recovery potential of such claim. As a result, broadening or protracted extension of an economic downturn could harm our business, financial condition, and results of operations.

We provide service level commitments under some of our customer contracts. If we fail to meet these contractual commitments, we could be obligated to provide credits for future service and our business could suffer.

Certain of our customer agreements contain service level commitments, which contain specifications regarding the availability and performance of our Platform. Any failure of or disruption to our infrastructure could impact the performance of our Platform and the availability of products and services to customers. If we are unable to meet our stated service level commitments or if we suffer extended periods of poor performance or unavailability of our Platform, we may be contractually obligated to provide affected customers with service credits for future subscriptions, refunds, and in certain cases, the right to cancel their subscription. Our revenue, other results of operations and financial condition could be harmed if we suffer performance issues or downtime that exceeds the service level commitments under our agreements with our customers.

The COVID-19 pandemic could adversely affect our business, operating results, and financial condition.

We could be negatively impacted by the COVID-19 pandemic, the widespread outbreak of another illness or communicable disease, a natural disaster, or any other public health crisis. At its height, the COVID-19 pandemic had a significant negative effect on the global economy, supply chains and labor force participation, and created significant volatility in financial markets. Although the effects of the pandemic during fiscal year 2023 were not as significant as prior years, new variants continued to cause waves of COVID-19 cases around the globe, disrupting operations and contributing to the lengthening of the sales cycle for some prospective customers and delays in the delivery of professional services and trainings to our customers. The extent of the future impact of the COVID-19 pandemic or other outbreaks of communicable diseases on our business, operating results, cash flows, and financial condition, including our ability to execute our business strategies and initiatives in the expected time frame, will depend on future developments, including the duration, spread and severity of the pandemic, the evolution of the virus and the effects of mutations in its genetic code, country and state restrictions regarding virus containment, the availability and effectiveness of vaccines and treatment options, accessibility to our delivery and operations locations, our continued utilization of remote work environments in response to future health and safety restrictions, our clients’ acceptance of remote work environments, and the effect on our clients’ businesses and the demand for their products and services, all of which are highly uncertain and cannot be accurately predicted.

32

We do not yet know the full extent of potential impacts on our business, operations or on the global economy, particularly if the COVID-19 pandemic continues and persists for an extended period. The impacts and potential impacts of the COVID-19 pandemic on our business operations include:

Any of the foregoing could adversely affect our business, financial condition, and operating results.

The extent to which the COVID-19 pandemic may continue to affect our business will depend on continued developments, which are uncertain and cannot be predicted. Even after the COVID-19 pandemic has subsided, we may continue to suffer an adverse effect to our business due to its global economic effect, including any economic recessions. In addition, a recurrence of COVID-19 cases or an emergence of additional variants or strains could cause other widespread or more severe impacts depending on where infection rates are highest.

33

Our business will be subject to the risks of natural catastrophic events and to interruption by man-made problems such as power disruptions or terrorism.

A significant natural disaster, such as an earthquake, a fire, a flood, or significant power outage could have a material adverse impact on our business, results of operations and financial condition. Natural disasters could affect our personnel, supply chain, or logistics providers’ ability to provide materials and perform services. In addition, climate change could result in an increase in the frequency or severity of natural disasters. In the event that our infrastructure, or the information technology systems, supply chain or logistics of our service providers, is hindered by any of the events discussed above, the results could be missed financial targets, such as revenue, for a particular quarter. Likewise, we could be subject to other man-made problems, including but not limited to power disruptions and terrorist acts.

We rely heavily on the services of our senior management team, and if we are not successful in attracting or retaining senior management personnel, we may not be able to successfully implement our business strategy.

Our future success is substantially dependent on our ability to attract, retain, and motivate our key employees and the members of our management team. In particular, we are highly dependent on the services of James C. Foster, our chief executive officer, who is critical to our future vision and strategic direction. We also rely on our leadership team in the areas of operations, security, analytics, engineering, product management, research and development, marketing, sales, partnerships, mergers and acquisitions, support, and general and administrative functions. Although we entered into employment agreements with our key personnel, our senior management is employed on an “at-will” basis, which means they may terminate their employment with us at any time. If one or more of our key employees resigns or otherwise ceases to provide us with their service, our business could be harmed.

We rely on the performance of highly skilled personnel, including senior engineering, professional services, sales and technology professionals, and our ability to increase our customer base depends to a significant extent on our ability to expand our sales and marketing operations.

We believe our success has depended, and continues to depend, on the efforts and talents of our highly skilled team members, including our sales personnel, professional services personnel, and software engineers. We do not maintain key person insurance on any of our employees. Our key employees are employed on an “at-will” basis, which means that they could terminate their employment with us at any time. The loss of any of our key employees could adversely affect our ability to execute our business plan, and we may not be able to find adequate replacements. We cannot ensure that we will be able to retain the services of our key employees.

34

If we do not effectively expand and train our sales force, we may be unable to add new customers or increase sales to our existing customers, and our business will be adversely affected.