Progress Software Corp: Form 10-Q for the period ended May 31, 2023

Cautionary Note Regarding Forward-Looking Statements

This Form 10-Q may contain information that are "forward-looking statements" within the meaning of Section 27A of the Securities Act of 1933, as amended; Section 21E of the Securities Exchange Act of 1934, as amended; and the Private Securities Litigation Reform Act of 1995. Whenever we use words such as "believe," "may," "could," "would," "might," "should," "expect," "intend," "plan," "estimate," "target," "anticipate" and negatives and derivatives of these or similar expressions, or when we make statements concerning future financial results, product offerings or other events that have not yet occurred, we are making forward-looking statements. These forward-looking statements are based upon our present intent, beliefs or expectations, but are not guaranteed to occur and may not occur. Actual future results may differ materially from those contained in or implied by our forward-looking statements due to various factors which are more fully described in Part I, Item 1A. Risk Factors in our 2022 Annual Report as well as the risk factors described in Part II, Item 1A of this Report on Form 10-Q. Although we have sought to identify the most significant risks to our business, we cannot predict whether, or to what extent, any of such risks may be realized. We also cannot assure you that we have identified all possible issues that we might face. We undertake no obligation to update any forward-looking statements that we make.

Overview

Progress is the trusted provider of the best products to develop, deploy and manage high-impact applications. We enable our customers to develop the applications and experiences they need, deploy where and how they want, and manage it all safely and securely. Progress helps customers drive faster cycles of innovation, fuel momentum and accelerate their path to success.

The key tenets of our strategic plan and operating model are as follows:

Be the Trusted Provider of the Best Products to Develop, Deploy and Manage High Impact Applications. A key element of our strategy is centered on building and maintaining the best products and tools enterprises need to build, deploy, and manage modern, strategic business applications. We offer these products and tools to both new customers and partners, as well as our existing partner and customer ecosystems.

Focus on Customer and Partner Retention to Drive Recurring Revenue and Profitability. Our organizational philosophy and operating principles focus primarily on customer and partner retention and success, and a streamlined operating approach to drive predictable and stable recurring revenue and high levels of profitability.

Follow a Total Growth Strategy through Accretive M&A. We are pursuing a total growth strategy driven by accretive acquisitions of businesses within the infrastructure software space, with products that appeal to both IT organizations and individual developers. These acquisitions must meet strict financial and other criteria, which help further our goal to provide significant stockholder returns by providing scale and increased cash flows. In April 2019, we acquired Ipswitch, Inc.; in October 2020, we acquired Chef Software, Inc.; in November 2021, we acquired Kemp Technologies; and in February 2023, we acquired MarkLogic. These acquisitions met our strict financial criteria.

In recent years, our total growth strategy, described above, has resulted in the rapid expansion of our product portfolio. As our portfolio evolves, we continuously evaluate our organization for additional synergies and efficiencies. In connection therewith, we are working to realign our go-to-market, product, and operational teams and to increase centralization of shared services and functions across our company. We believe that these changes will improve collaboration among the teams that develop, sell, and support our products; enhance our ability to integrate acquired businesses; and lead to greater system uniformity and increased operating efficiency.

Employ a Multi-Faceted Capital Allocation Strategy. Our capital allocation policy emphasizes accretive M&A, which allows us to expand our business and drive significant stockholder returns. We also utilize dividends and share repurchases to return capital to stockholders. We intend to continue to repurchase our shares in sufficient quantities to offset dilution from our equity plans and to continue to return a portion of our annual cash flows from operations to stockholders in the form of dividends.

We expect to continue to pursue acquisitions meeting our financial criteria that are designed to expand our business and drive significant stockholder returns. As a result, our expected uses of cash could change, our cash position could be reduced, and we may incur additional debt obligations to the extent we complete additional acquisitions. However, we currently believe that existing cash balances, together with funds generated from operations and amounts available under our Credit Facility, will be sufficient to finance our operations and meet our foreseeable cash requirements, including quarterly cash dividends and stock repurchases to Progress stockholders, as applicable, through at least the next twelve months.

Critical Accounting Policies

Management’s discussion and analysis of financial condition and results of operations are based upon our consolidated financial statements, which have been prepared in accordance with GAAP. We make estimates and assumptions in the preparation of our consolidated financial statements that affect the reported amounts of assets and liabilities, revenue and expenses and related disclosures of contingent assets and liabilities. We base our estimates on historical experience and various other assumptions that are believed to be reasonable under the circumstances. However, actual results may differ from these estimates. The most significant estimates relate to revenue recognition and business combinations. For further information regarding the application of these and other accounting policies, see Note 1 to our Consolidated Financial Statements in Item 8 of our 2022 Annual Report. There have been no significant changes to our critical accounting policies and estimates since our 2022 Annual Report.

Use of Constant Currency

Revenue from our international operations has historically represented a substantial portion of our total revenue. As a result, our revenue results have been impacted, and we expect will continue to be impacted, by fluctuations in foreign currency exchange rates. For example, if the local currencies of our foreign subsidiaries strengthen, our consolidated results stated in U.S. dollars are positively impacted.

As exchange rates are an important factor in understanding period-to-period comparisons, we believe the presentation of revenue growth rates on a constant currency basis enhances the understanding of our revenue results and evaluation of our performance in comparison to prior periods. The constant currency information presented is calculated by translating current period results using prior period weighted average foreign currency exchange rates. These results should be considered in addition to, not as a substitute for, results reported in accordance with GAAP.

Results of Operations

Revenue

(In thousands)

(In thousands)

Total revenue increased as compared to the same periods last year primarily due to our acquisition of MarkLogic in February 2023, as well as increases in our OpenEdge, Chef, and Kemp product offerings. In the second fiscal quarter, these increases were partially offset by a decrease in our DataDirect product offering. In the first six months of fiscal year 2023, there was also an increase in our DataDirect product offering, offset by the negative impact of foreign exchange on license and maintenance revenue in our EMEA region.

Software License Revenue

(In thousands)

(In thousands)

Software license revenue increased as compared to the same period last year primarily due to our acquisition of MarkLogic in February 2023, as well as increases in our OpenEdge, Chef, and Kemp product offerings. In the second fiscal quarter, these increases were partially offset by decreases in our DataDirect product offering. In the first six months of fiscal year 2023, there was also an increase in our DataDirect product offering.

Maintenance and Services Revenue

(In thousands)

23

(In thousands)

Maintenance revenue increased as compared to the same periods last year primarily due to our acquisition of MarkLogic in February 2023, as well as increases in our DevTools and Chef product offerings. Services revenue increased as compared to the same period last year primarily due to increased services revenue from our acquisition of MarkLogic, as well as increases in our Sitefinity product offerings. The maintenance increase in the first six months of fiscal year 2023 was partially offset by the negative impact of foreign exchange in our EMEA region.

Revenue by Region

(In thousands)

(In thousands)

Total revenue generated in North America increased $20.3 million and $41.1 million in the second quarter and first six months of fiscal year 2023, respectively. The increase was primarily due to our acquisition of MarkLogic. The increases in revenue over both periods generated in EMEA was primarily due to our acquisition of MarkLogic and increased revenue from our Chef product offerings. The increase in the first six months of fiscal year 2023 was partially offset by the negative impact of foreign exchange in our EMEA region. The increases in both periods in revenue in Latin America was primarily due to increases in our OpenEdge product offerings. The increases in revenue generated in Asia Pacific in both periods was due to increases in our Chef product offerings.

In the first six months of fiscal year 2023 revenue generated in markets outside North America represented 40% of total revenue compared to 41% of total revenue on a constant currency basis. In the first six months of fiscal year 2022 revenue generated in markets outside North America represented 44% of total revenue compared to 45% of total revenue on a constant currency basis.

Cost of Software Licenses

(In thousands)

Cost of software licenses consists primarily of costs of inventories, royalties, electronic software distribution, duplication, and packaging. Cost of software licenses as a percentage of software license revenue varies from period to period depending upon the relative product mix.

Cost of Maintenance and Services

(In thousands)

Cost of maintenance and services consists primarily of costs of providing customer support, consulting, and education. The increases in all periods were primarily due to increased headcount, contractor and outside services costs, and hosting costs resulting from our acquisition of MarkLogic.

Amortization of Intangibles

(In thousands)

Amortization of intangibles included in costs of revenue primarily represents the amortization of the value assigned to technology-related intangible assets obtained in business combinations. The increases in all periods are due to the acquisition of MarkLogic.

Gross Profit

(In thousands)

Our gross profit increased in all periods primarily due to the increases in revenue, offset by the increases in costs of software licenses, costs of maintenance and services and the amortization of intangibles, each as described above.

Sales and Marketing

(In thousands)

Sales and marketing expenses increased in all periods primarily due to increased personnel related costs associated with our acquisition of MarkLogic, as well as increases in contractors and outside services costs. These increases were partially offset by decreases in marketing and sales events costs in the first six months of fiscal year 2023.

Product Development

(In thousands)

Product development expenses increased in all periods primarily due to increased personnel related costs associated with our acquisition of MarkLogic, as well as an increase in contractors and outside services costs.

General and Administrative

(In thousands)

General and administrative expenses include the costs of our finance, human resources, legal, information systems and administrative departments. General and administrative expenses increased in all periods primarily due to higher personnel costs associated with our acquisition of MarkLogic, as well as an increase in contractors and outside services costs, partially offset by a decrease in other general and administrative costs.

Amortization of Intangibles

(In thousands)

Amortization of intangibles included in operating expenses primarily represents the amortization of value assigned to intangible assets obtained in business combinations other than assets identified as purchased technology. Amortization of intangibles increased due to the addition of MarkLogic intangible assets, as discussed above.

Cyber Incident and Vulnerability Response Expenses, Net

(In thousands)

*not meaningful

As previously disclosed on December 19, 2022, following the detection of irregular activity on certain portions of our corporate network, we engaged outside cybersecurity experts and other incident response professionals to conduct a forensic investigation and assess the extent and scope of the cyber incident. Cyber incident costs relate to the engagement of external cybersecurity experts and other incident response professionals and are net of received and expected insurance recoveries.

Restructuring Expenses

(In thousands)

*not meaningful

Restructuring expenses recorded in the second fiscal quarter and six month period of fiscal year 2023 relate to the restructuring activities that occurred in the first and fourth quarters of fiscal years 2023 and 2020, respectively, resulting from the acquisitions of MarkLogic and Chef, respectively. Restructuring expenses recorded in the second quarter of fiscal year 2022 are comprised mostly of costs related to the acquisition of Kemp and the Chef restructuring action of 2020. See the Liquidity and Capital Resources section of this Item 2, Management’s Discussion and Analysis of Financial Condition and Results of Operations.

Acquisition-Related Expenses

(In thousands)

Acquisition-related costs are expensed as incurred and include those costs incurred as a result of a business combination. These costs consist of professional service fees, including third-party legal and valuation-related fees. Acquisition-related expenses increased due to our acquisition of MarkLogic, as well as our pursuit of other acquisition opportunities. Acquisition-related expenses in the same periods of fiscal year 2022 were primarily related to our pursuit of other acquisition opportunities, as well as the acquisition of Kemp.

Gain on Sale of Assets Held for Sale

(In thousands)

In the second quarter of fiscal year 2022, we sold corporate land and building assets previously reported as assets held for sale on our consolidated balance sheet. As the sale price less cost to sell was greater than the carrying value of these assets we recognized a net gain on the sale of approximately $10.8 million in the second quarter of fiscal year 2022.

Income from Operations

(In thousands)

Income from operations decreased in the second quarter of and first six months of fiscal year 2023 due to an increase in costs of revenue and operating expenses, offset by increased revenue, as shown above.

Other (Expense) Income, Net

(In thousands)

Other expense, net, increased in both periods shown primarily due to increased interest expense on our term loan and our revolving line of credit, which we drew on to fund part of our acquisition of MarkLogic. Interest income and other, net increased due to the our acquisition of MarkLogic. Foreign currency loss increased in all periods shown.

Provision for Income Taxes

(In thousands)

Our effective tax rate was 17% and 21% for the three months ended May 31, 2023 and 2022 respectively. The primary reason for the decrease in the effective rate was due to discrete tax benefits related to stock-based compensation and an audit settlement in the second fiscal quarter of 2023. There were no significant discrete tax items in the second fiscal quarter of 2022.

Our effective tax rate was 20% and 21% for the six months ended May 31, 2023 and 2022 respectively. The primary reason for the decrease in the effective rate was due to discrete tax benefits related to stock-based compensation and an audit settlement in the second fiscal quarter of 2023. There were no significant discrete tax items in the six months ended May 31, 2022.

Net Income

(In thousands)

Select Performance Metrics:

Management evaluates our financial performance using a number of financial and operating metrics. These metrics are periodically reviewed and revised to reflect changes in our business.

Annual Recurring Revenue (ARR)

We are providing an ARR performance metric to help investors better understand and assess the performance of our business because our mix of revenue generated from recurring sources has increased in recent years. ARR represents the annualized contract value for all active and contractually binding term-based contracts at the end of a period. ARR includes maintenance, software upgrade rights, both public and dedicated cloud instances and on-premises subscription-based transactions and managed services. ARR mitigates fluctuations due to seasonality, contract term and the sales mix of subscriptions for term-based licenses and SaaS. ARR is not calculated in accordance with GAAP. ARR does not have any standardized meaning and is therefore unlikely to be comparable to similarly titled measures presented by other companies. ARR should be viewed independently of revenue and deferred revenue and is not intended to be combined with or to replace either of those items. ARR is not a forecast and the active contracts at the end of a reporting period used in calculating ARR may or may not be extended or renewed by our customers.

We define ARR as the annual recurring revenue of term-based contracts from all customers at a point in time. We calculate ARR by taking monthly recurring revenue, or MRR, and multiplying it by 12. MRR for each month is calculated by aggregating, for all customers during that month, monthly revenue from committed contractual amounts, additional usage and monthly subscriptions. The calculation is done at constant currency using the current year budgeted exchange rates for all periods presented.

Our ARR was $569.0 million and $479.0 million as of May 31, 2023 and 2022, respectively, which is an increase of 19% year-over-year. The growth in our ARR is primarily driven by the acquisition of MarkLogic.

Net Retention Rate

We calculate net retention rate as of a period end by starting with the ARR from the cohort of all customers as of 12 months prior to such period end ("Prior Period ARR"). We then calculate the ARR from these same customers as of the current period end ("Current Period ARR"). Current Period ARR includes any expansion and is net of contraction or attrition over the last 12 months but excludes ARR from new customers in the current period. We then divide the total Current Period ARR by the total Prior Period ARR to arrive at the net retention rate. Net retention rate is not calculated in accordance with GAAP.

Our net retention rates have generally ranged between 101% and 102% for all periods presented. Our high net retention rates illustrate our predictable and durable top line performance.

Liquidity and Capital Resources

Cash and Cash Equivalents

(In thousands)

The decrease in cash and cash equivalents of $130.7 million from the end of fiscal year 2022 was due to cash outflows of $356.1 million for cash paid for acquisitions, net of cash acquired, repurchases of common stock of $30.0 million, repayment of the revolving line of credit of $25.0 million, dividend payments of $15.9 million, payments of debt obligations of $3.4 million, and purchases of property and equipment of $2.0 million. These cash outflows were offset by proceeds from the issuance of debt of $195.0 million, cash inflows from operations of $94.7 million, $8.3 million in cash received from the issuance of common stock, and the effect of exchange rates on cash of $3.2 million. Except as described below, there are no limitations on our ability to access our cash and cash equivalents.

As of May 31, 2023, $77.1 million of our cash and cash equivalents was held by our foreign subsidiaries. Foreign cash includes unremitted foreign earnings, which are invested indefinitely outside of the U.S. As such, it is not available to fund our domestic operations. If we were to repatriate these earnings, we may be subject to income tax withholding in certain tax jurisdictions and a portion of the repatriated earnings may be subject to U.S. income tax. However, we do not anticipate that this would have a material adverse impact on our liquidity.

Share Repurchase Program

In January 2023, our Board of Directors increased our share repurchase authorization by $150 million, to an aggregate authorization of $228.0 million. In the six months ended May 31, 2023 and May 31, 2022, we repurchased and retired 0.5 million shares for $30.0 million and 1.1 million shares for $51.5 million, respectively. The shares were repurchased in both periods as part of our Board of Directors authorized share repurchase program. As of May 31, 2023, there was $198.0 million remaining under the current authorization.

Dividends

On June 21, 2023, our Board of Directors declared a quarterly dividend of $0.175 per share of common stock, which will be paid on September 15, 2023 to stockholders of record as of the close of business on September 1, 2023. Future declarations of dividends and the establishment of future record and payment dates are subject to the final determination of our Board of Directors.

Restructuring Activities

See Note 12 to the condensed consolidated financial statements.

Long-term Debt and Credit Facility

See Note 7 to the condensed consolidated financial statements.

Cash Flows From Operating Activities

(In thousands)

In the first six months of fiscal year 2023, operating cash flows decreased as a result of higher operating expenses, due to the acquisition of MarkLogic, as compared to the same period in 2022, partially offset by higher billings and collections. Our gross accounts receivable as of May 31, 2023, decreased by $10.8 million from the end of fiscal year 2022 and our days sales outstanding (DSO) in accounts receivable increased to 44 days from 39 days in the second fiscal quarter of 2022 due to the timing of billings and collections.

Cash Flows (Used in) From Investing Activities

(In thousands)

Net cash outflows and inflows of our net investment activity are generally a result of the timing of our purchases and maturities of securities, which are classified as cash equivalents or short-term securities. In the second quarter of fiscal year 2023 had payments for acquisitions net of cash acquired of $356.1 million. We also purchased $2.0 million of property and equipment in the first six months of fiscal year 2023, as compared to $2.0 million in the first six months of fiscal year 2022. In the second quarter of fiscal year 2022 we received $26.0 million net proceeds from the sale of long-lived assets.

Cash Flows From (Used in) Financing Activities

(In thousands)

During the first six months of fiscal year 2023, we received $195.0 million in net proceeds from the issuance of debt. During the first six months of fiscal year 2022, we received $7.5 million in net proceeds from the issuance of debt in connection with our amended term loan. We received $16.4 million from the exercise of stock options and the issuance of shares under our employee stock purchase plan as compared to $7.8 million in the first six months of fiscal year 2022. Further, we repurchased $30.0 million of our common stock under our share repurchase plan compared to $51.5 million in the same period of the prior year. We also made payments on our long-term debt of $28.4 million (including a $25.0 million repayment on the revolving line of credit) in the first six months of fiscal year 2023 and $3.4 million in the same period in 2022. Finally, we made dividend payments of $15.9 million to our stockholders during the first six months of fiscal year 2023 and $15.6 million in the first six months of fiscal year 2022.

Liquidity Outlook

Cash from operations in fiscal year 2023 could be affected by various risks and uncertainties, including, but not limited to, the effects of various risks detailed in Part I, Item 1A. Risk Factors in our 2022 Annual Report which have led to increased disruption and volatility in capital markets and credit markets that could adversely affect our liquidity and capital resources in the future. However, based on our current business plan, we believe that existing cash balances, together with funds generated from operations and amounts available under our Credit Facility, will be sufficient to finance our operations and meet our foreseeable cash requirements through at least the next twelve months. We do not contemplate a need for any foreign repatriation of the earnings which are deemed invested indefinitely outside of the U.S. Our foreseeable cash needs include capital expenditures, acquisitions, debt repayments, quarterly cash dividends, share repurchases, lease commitments, restructuring obligations and other long-term obligations.

Legal and Other Regulatory Matters

See discussion below in Part I, Item 2, regarding Recent Developments: MOVEit Vulnerability, as well as legal and other regulatory matters in Part II, Item 1. Legal Proceedings.

Recent Accounting Pronouncements

Refer to Note 1 - Nature of Business and Basis of Presentation (Part I, Item 1 of this Form 10-Q) for further discussion.

Recent Developments: MOVEit Vulnerability

Description of Event

As disclosed via a Form 8-K filed on June 5, 2023, on the evening of May 28, 2023 (Eastern Time), our MOVEit technical support team received an initial customer support call indicating unusual activity within their MOVEit Transfer instance. An investigative team was mobilized and, on May 30, 2023, the investigative team discovered a zero-day vulnerability in MOVEit Transfer (including our cloud-hosted version of MOVEit Transfer known as MOVEit Cloud). The investigative team determined the zero-day vulnerability (the “MOVEit Vulnerability”) could provide for unauthorized escalated privileges and access to the customer’s underlying environment in both MOVEit Transfer (the on-premise version) and MOVEit Cloud (the cloud-hosted version of MOVEit Transfer that we deploy in both (i) a public cloud format, as well as, (ii) for a small group of customers, in a customer-dedicated cloud instance that is managed separately from the public-cloud). We promptly took down

MOVEit Cloud for further investigation and notified all then-known MOVEit Transfer and MOVEit Cloud customers in order to apprise them of the MOVEit Vulnerability and alert them to immediate remedial actions. In parallel, our team developed a patch for all supported versions of MOVEit Transfer and MOVEit Cloud, which was released on May 31, 2023, and allowed for the restoration of MOVEit Cloud that same day.

MOVEit Transfer is a secure file-transfer software that is installed by customers on-premise and does not have any on-going telemetry after installation that allows us to track, among other things, a customer’s product usage, deployed version, file transfer activity (including any data that is transferred by or stored within the customer’s MOVEit Transfer instance), or whether the customer has applied any security patches or bug fixes to their MOVEit Transfer instance. However, certain MOVEit Transfer customers have reported that malicious threat actors have exploited the MOVEit Vulnerability to obtain access to their environments and portions of their sensitive customer data.

Furthermore, while we continue to investigate this vulnerability in MOVEit Cloud, we currently have not seen any evidence that sensitive customer data has been exfiltrated from the public MOVEit Cloud instances. For a small group of customers, we provide a dedicated MOVEit Cloud instance which is hosted, for each such customer, separate and apart from the public instances of our MOVEit Cloud platform. Two of our dedicated MOVEit Cloud customers have reported that malicious threat actors have exploited the MOVEit Vulnerability to obtain access to its environment. As of the date of the filing of this report on Form 10-Q, one such customer has confirmed that no sensitive data was compromised and another has not revealed the nature of the data that may have been accessed.

Since our disclosures regarding the MOVEit Vulnerability, various third-parties have been actively scrutinizing MOVEit Transfer and MOVEit Cloud, leading to the discovery and our prompt patching of additional vulnerabilities. We are not aware of any evidence that these additional vulnerabilities were exploited by malicious threat actors prior to creating patches to address them and making those patches available to our MOVEit Transfer customers and applying those patches to the MOVEit Cloud environments – both the public and dedicated cloud instances.

Progress has remained fully operational at all times before and after the discovery of the MOVEit Vulnerability and, as of the time of the filing of this report on Form 10-Q, has not uncovered evidence of unauthorized activity or impact to products beyond MOVEit Transfer and MOVEit Cloud. MOVEit Transfer and MOVEit Cloud represented approximately 4% in aggregate of the Company’s revenue for the six months ended May 31, 2023.

Progress has engaged outside cybersecurity experts and other incident response professionals to conduct a forensic investigation and assess the extent and scope of the MOVEit Vulnerability. While Progress’ investigation remains ongoing, the Company (i) has and is continuing to implement a series of additional security and related measures aimed at addressing the MOVEit Vulnerability and subsequently discovered vulnerabilities and further strengthening the overall security of our MOVEit applications, (ii) has engaged outside legal counsel to conduct a thorough independent investigation of the MOVEit Vulnerability, and (iii) has engaged with federal law enforcement and other federal agencies with respect to the MOVEit Vulnerability. As the investigation remains ongoing, Progress will continue to assess the potential impact on its business, operations and financial results.

Expenses Incurred and Amounts Accrued

Given that the MOVEit Vulnerability was only discovered on May 30, 2023, and our second quarter ended on May 31, 2023, we incurred minimal costs and expenses with respect to the MOVEit Vulnerability during the second quarter.

Future Costs

We expect to incur investigation, legal and professional services expenses associated with the MOVEit Vulnerability in future periods. We will recognize these expenses as services are received, net of received and expected insurance recoveries. Our financial liability arising from any of the foregoing will depend on many factors, including limitations contained within our customer contracts, the amount of private litigation, and whether governmental entities launch formal investigations into the matter, and it is not possible at this time to estimate the quantitative impact of any such liability with any reasonable degree of certainty.

Insurance Coverage

We maintain cybersecurity insurance and other types of insurance coverage for up to $15.0 million in losses, which are expected to reduce our exposure to liabilities arising from the MOVEit Vulnerability. We will pursue recoveries to the maximum extent available under the policies. As of May 31, 2023, we have recorded approximately $3.0 million in insurance recoveries, all of which was related to the November 2022 cyber incident, providing us with $12.0 million of additional coverage (which is subject to a $0.5 million per claim deductible).

Future Capital Investments

In addition, we may accelerate or make additional investments in our information technology systems, but we are unable to estimate such investments because the nature and scope has not yet been determined. We currently do not expect such amounts to be material to any fiscal period.

Effect on Sales and Customer Loyalty

The MOVEit Vulnerability may adversely affect our future performance and financial results. Customer confidence in Progress may also be impacted by the MOVEit Vulnerability. Through our response speed and transparent communications, we are committed to, and actively engaged in, activities to restore any loss in customer confidence. We currently cannot predict the length or extent of any ongoing impact to sales.

Litigation and Governmental Investigations

As of the date of the filing of this report on Form 10-Q, (i) four customers that claim to have been impacted by the MOVEit Vulnerability have indicated that they intend to seek indemnification from us related to the MOVEit Vulnerability, and (ii) there have been eleven class action lawsuits filed by individuals who claim to have been impacted by exfiltration of data from the environments of our MOVEit Transfer customers. We have also been cooperating with several inquiries and one formal investigation from domestic and foreign law enforcement agencies and data privacy regulators. As of the date of the filing of this report, the law enforcement investigation that we are cooperating with is not an enforcement action or formal governmental investigation of which we have been told that we are a target.

Such claims and investigations may have an adverse effect on how we operate our business and our results of operations, and in the future, we may be subject to additional governmental or regulatory investigations, as well as additional litigation or indemnification claims. While a loss from these matters is possible, we cannot reasonably estimate a range of possible losses at this time and our investigation into the matter is ongoing. Furthermore, with respect to the litigation, the proceedings remain in the early stages, alleged damages have not been specified, there is uncertainty as to the likelihood of a class or classes being certified or the ultimate size of any class if certified, and there are significant factual and legal issues to be resolved. As such, we have not recorded a loss contingency liability for litigation, claims and governmental investigations in the second quarter. See Note 15 to Consolidated Financial Statements included in Item 1, Financial Statements.

During the first six months of fiscal year 2023, with the exception of drawing down on our revolving line of credit as described in Note 7, there were no significant changes to our quantitative and qualitative disclosures about market risk. Please refer to Part II, Item 7A. Quantitative and Qualitative Disclosures about Market Risk included in our 2022 Annual Report, for a more complete discussion of the market risks we encounter.

(a) Evaluation of disclosure controls and procedures

Our management maintains disclosure controls and procedures as defined in Rule 13a-15(e) and 15d-15(e) under the Securities and Exchange Act of 1934, as amended (the "Exchange Act") that are designed to provide reasonable assurance that information required to be disclosed in our reports filed or submitted under the Exchange Act is processed, recorded, summarized and reported within the time periods specified in the SEC's rules and forms, and that such information is accumulated and communicated to management, including our Chief Executive Officer and Chief Financial Officer (our principal executive officer and principal financial officer, respectively), as appropriate, to allow for timely decisions regarding required disclosure.

Our management, including our Chief Executive Officer and Chief Financial Officer, carried out an evaluation of the effectiveness of our disclosure controls and procedures as of the end of the period covered by this report. Based on this evaluation, our Chief Executive Officer and Chief Financial Officer concluded that our disclosure controls and procedures were effective to ensure that the information required to be disclosed in the reports filed or submitted by us under the Exchange Act was recorded, processed, summarized and reported within the requisite time periods and that such information was accumulated and communicated to our management, including our Chief Executive Officer and Chief Financial Officer, as appropriate to allow for timely decisions regarding required disclosure.

The Company acquired MarkLogic on February 7, 2023. Management excluded MarkLogic from its assessment of the effectiveness of the Company’s disclosure controls as of May 31, 2023. MarkLogic represented, in aggregate, approximately

15% of the Company’s total consolidated assets (excluding goodwill and intangibles) and approximately 14% of total consolidated revenues, as of and for the three months ended May 31, 2023.

(b) Changes in internal control over financial reporting

There were no changes in our internal control over financial reporting during the fiscal quarter ended May 31, 2023 that have materially affected, or are reasonably likely to materially affect our internal control over financial reporting.

We operate in a rapidly changing environment that involves certain risks and uncertainties, some of which are beyond our control. In addition to the updated risk factors provided below, please refer to Part I, Item 1A. Risk Factors in our 2022 Annual Report for a more complete discussion regarding certain factors that could materially affect our business, financial condition or future results.

If our products contain software defects or security flaws, it could harm our revenues by causing us to lose customers and could increase our liabilities by exposing us to costly governmental investigations or litigation. For example, the exploitation of the zero-day MOVEit Vulnerability in May 2023 has resulted in government inquiries, a formal law enforcement investigation, and private litigation. Our products, despite extensive testing and quality control, may contain defects, vulnerabilities or security flaws. In the ordinary course of business, we may need to issue corrective releases of our software products to fix any defects, vulnerabilities, or security flaws. Depending upon the severity of any such matters, the detection and correction of such matters can be time consuming and costly. If any such issues are exploited by malicious threat actors, we could experience, among other things, material adverse impact to our revenues due to loss of customers and increased liabilities due to costly governmental investigations or litigation. In addition, any such matters could affect the ability of our products to work with hardware or other software products, delay the development or release of new products or new versions of products (due to a reallocation of our internal resources), and/or adversely affect market acceptance of our products, all of which could have a material adverse effect on our overall performance.

On the evening of May 28, 2023 (Eastern Time), our MOVEit technical support team received an initial customer support call indicating unusual activity within their MOVEit Transfer instance. An investigative team was mobilized and, on May 30, 2023, the investigative team discovered a zero-day vulnerability in MOVEit Transfer (including our cloud-hosted versions of MOVEit Transfer, known as MOVEit Cloud). The investigative team determined that the zero-day vulnerability (the “MOVEit Vulnerability”) could provide for unauthorized escalated privileges and access to the customer’s underlying environment in both MOVEit Transfer (the on-premise version) and MOVEit Cloud (a cloud-hosted version of MOVEit Transfer that we deploy in both (i) a public cloud format, as well as (ii) for a small group of customers, in a customer-dedicated cloud instance which is managed separately from the public-cloud). We promptly took down MOVEit Cloud for further investigation and notified all then-known MOVEit Transfer and MOVEit Cloud customers in order to apprise them of the MOVEit Vulnerability and alert them to immediate remedial actions. In parallel, our team developed a patch for all supported versions of MOVEit Transfer and MOVEit Cloud, which was released on May 31, 2023 and allowed for the restoration of MOVEit Cloud the same day.

MOVEit Transfer is a secure file-transfer software that is installed by customers on-premise and does not have any on-going telemetry after installation that allows us to track, among other things, a customer’s product usage, deployed version, file transfer activity (including any data that is transferred by or stored within the customer’s MOVEit Transfer instance), or whether the customer has applied any security patches or bug fixes to their MOVEit Transfer instance. However, certain MOVEit Transfer customers have reported that malicious threat actors have exploited the MOVEit Vulnerability to obtain access to their environments and portions of their sensitive customer data.

Furthermore, while we continue to investigate this vulnerability in MOVEit Cloud, we currently have not seen any evidence that sensitive customer data has been exfiltrated from the public MOVEit Cloud instances. For a small group of customers, we provide a dedicated MOVEit Cloud instance which is hosted, for each such customer, separate and apart from the public instances of our MOVEit Cloud platform. Two of our dedicated MOVEit Cloud customers have reported that malicious threat actors have exploited the MOVEit Vulnerability to obtain access to its environment. As of the date of the filing of this report on Form 10-Q, one such customer has confirmed that no sensitive data was compromised and another has not revealed the nature of the data that may have been accessed.

As of the date of the filing of this report on Form 10-Q, these events have led to several domestic and foreign government inquiries, one formal investigation from a law enforcement agency, and private litigation, all of which could have adverse impacts on our business and operations and the results thereof. More specifically, as of the date of the filing of this report on Form 10-Q, (i) four customers that claim to have been impacted by the MOVEit Vulnerability have indicated that they intend to seek indemnification from us related to the MOVEit Vulnerability, and (ii) there have been eleven class action lawsuits filed by individuals who claim to have been impacted by exfiltration of data from the environments of our MOVEit Transfer customers. We have also been cooperating with inquiries from several domestic and foreign law enforcement agencies and data privacy regulators, as well as one formal investigation from a law enforcement agency. Such claims and investigations may have an adverse effect on how we operate our business and our results of operations, and in the future, we may be subject to additional governmental or regulatory investigations, as well as additional litigation or indemnification claims. Following the discovery of the MOVEit Vulnerability and the various remedial actions described here, we have discovered and patched additional vulnerabilities within the MOVEit Transfer and MOVEit Cloud platforms. While we are not aware of any evidence that these additional vulnerabilities were exploited by malicious threat actors prior to creating patches to address them and making those patches available to our MOVEit Transfer customers and applying those patches to the MOVEit Cloud environments (both the public and dedicated cloud instances) we cannot guarantee that we have or will uncover and/or address all vulnerabilities within the MOVEit platform or any of our other products prior to exploitation.

Our financial liability arising from any of the foregoing will depend on many factors, including the extent to which governmental entities investigate the matter and limitations contained within our customer contracts; therefore, we are unable at this time to estimate the quantitative impact of any such liability with any reasonable degree of certainty. As the investigation remains ongoing, we will continue to assess the potential impact of the MOVEit Vulnerability on our business, operations, and financial results.

Our customers and partners may seek refunds, delay implementation timelines, delay payment, fail to pay us in accordance with the terms of their agreements, or terminate use of our products, all of which can have an adverse affect on us. If customers or partners seek refunds, delay implementation of our products, delay payment, fail to pay us under the terms of our agreements, or terminate use of our products, we may be adversely affected both from the inability to collect amounts due and the cost of enforcing the terms of our contracts (including litigation related thereto). For example, as of the date of the filing of this report on Form 10-Q, four customers that claim to have been impacted by the MOVEit Vulnerability have indicated that they intend to seek indemnification from us related to the MOVEit Vulnerability and it is possible that, in connection therewith, they may delay payment under the terms of their contracts. Other MOVEit Transfer and MOVEit Cloud customers have sought refunds or delayed implementation timelines. As the scope of the impact of the MOVEit Vulnerability becomes more clear, additional customers may attempt to seek refunds, delay product implementation, withhold payments, or cease using the MOVEit product line entirely.

In addition, in the ordinary course of business, some of our customers and partners may seek bankruptcy protection or other similar relief and fail to pay amounts due to us, or pay those amounts more slowly, either of which could adversely affect our operating results, financial position and cash flow.

Our business could be damaged, and we could be subject to liability, in the event of any unauthorized access to our data or our customers’ data, including through privacy and data security breaches, such as or in addition to the MOVEit Vulnerability. The use of certain of our products, including MOVEit Cloud, involves the transmission or storage of third-party data in our environment, some of which may be considered personally identifiable, confidential, or sensitive. In the ordinary course of business, we face security threats from malicious threat actors that could obtain unauthorized access to our systems, infrastructure, products, and networks. We anticipate that these threats will continue to grow in scope and complexity over time.

For example, once we discovered the MOVEit Vulnerability on May 30, 2023, we (i) promptly took down MOVEit Cloud for investigation, and (ii) notified all then-known MOVEit Transfer and MOVEit Cloud customers in order to apprise them of the MOVEit Vulnerability and alert them to immediate remedial actions. In parallel, the MOVEit engineering team worked to develop a patch for all supported versions of MOVEit Transfer (and MOVEit Cloud), which was released on May 31, 2023 and allowed for the restoration of MOVEit Cloud that same day. While we believe that our actions have, and will continue to, reduce the likelihood of similar vulnerabilities occurring in the future in our MOVEit product line, malicious threat actors might use techniques to exploit other zero-day vulnerabilities or use other means that we are unable to defend against, in order to compromise and infiltrate our systems, infrastructure, networks, and products, including, but not limited to, MOVEit or other products. In addition, MOVEit Transfer is a secure file-transfer software that is installed by customers on-premise and does not have any on-going telemetry after installation that allows us to track, among other things, whether the customer has applied any security patches or bug fixes to their MOVEit Transfer instance.

While we devote a significant amount of resources to cyber security related matters in the operation of our business, we may fail to detect the existence of a breach and be unable to prevent unauthorized access to user and company content across our systems, infrastructure, products, and networks. The techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and are often not recognized until launched against a target. They may originate from less regulated or remote areas around the world, or from state-sponsored actors. If our security measures are breached, we may suffer reputational damage, our products may be perceived as insecure, and we may lose existing customers, or fail to attract and retain new customers.

In addition to internal resources, we frequently rely on third parties when deploying our cybersecurity related infrastructure, and in doing so, may be exposed to security risks outside of our direct control. In connection therewith, we rely on outside vendors and contractors to perform certain services necessary for the operation and testing of certain of our products, and they may fail to adequately secure our platform or discover vulnerabilities in our products.

While we have implemented security procedures and controls aimed at addressing these threats and patching vulnerabilities, our security measures could be compromised and our attempts to implement security measures and patch vulnerabilities could prove to be inadequate or could fail. Any such failure could result in significant legal and financial exposure, increased costs to defend litigation, indemnity and other contractual obligations, government fines and penalties, damage to our reputation and our brand, and a loss of confidence in the security of our products and services that could potentially have an adverse effect on our business and results of operations. In addition, our insurance coverage may not be adequate to cover all costs related to cybersecurity incidents or the exploitation of vulnerabilities as well as the disruptions resulting from such events.