Progress Software Corp: Form 10-Q for the period ended Aug 31, 2023

Cautionary Note Regarding Forward-Looking Statements

This Form 10-Q may contain information that are "forward-looking statements" within the meaning of Section 27A of the Securities Act of 1933, as amended; Section 21E of the Securities Exchange Act of 1934, as amended; and the Private Securities Litigation Reform Act of 1995. Whenever we use words such as "believe," "may," "could," "would," "might," "should," "expect," "intend," "plan," "estimate," "target," "anticipate" and negatives and derivatives of these or similar expressions, or when we make statements concerning future financial results, product offerings or other events that have not yet occurred, we are making forward-looking statements. These forward-looking statements are based upon our present intent, beliefs or expectations, but are not guaranteed to occur and may not occur. Actual future results may differ materially from those contained in or implied by our forward-looking statements due to various factors which are more fully described in Part I, Item 1A. Risk Factors in our 2022 Annual Report as well as the risk factors described in Part II, Item 1A of this Report on Form 10-Q. Although we have sought to identify the most significant risks to our business, we cannot predict whether, or to what extent, any of such risks may be realized. We also cannot assure you that we have identified all possible issues that we might face. We undertake no obligation to update any forward-looking statements that we make.

Overview

Progress provides enterprise software products for the development, deployment and management of high-impact business applications.

The key tenets of our strategic plan and operating model are as follows:

Be the Trusted Provider of the Best Products to Develop, Deploy and Manage High Impact Applications. A key element of our strategy is centered on building and maintaining the best products and tools enterprises need to build, deploy, and manage modern, strategic business applications. We offer these products and tools to both new customers and partners, as well as our existing partner and customer ecosystems.

Focus on Customer and Partner Retention to Drive Recurring Revenue and Profitability. Our organizational philosophy and operating principles focus primarily on customer and partner retention and success, and a streamlined operating approach to drive predictable and stable recurring revenue and high levels of profitability.

Follow a Total Growth Strategy through Accretive M&A. We are pursuing a total growth strategy driven by accretive acquisitions of businesses within the infrastructure software space, with products that appeal to both IT organizations and individual developers. These acquisitions must meet strict financial and other criteria, which help further our goal to provide significant stockholder returns by providing scale and increased cash flows. In April 2019, we acquired Ipswitch, Inc.; in October 2020, we acquired Chef Software, Inc.; in November 2021, we acquired Kemp Technologies; and in February 2023, we acquired MarkLogic. These acquisitions met our strict financial criteria.

Employ a Multi-Faceted Capital Allocation Strategy. Our capital allocation policy emphasizes accretive M&A, which allows us to expand our business and drive significant stockholder returns. We also utilize dividends and share repurchases to return capital to stockholders. We intend to continue to repurchase our shares in sufficient quantities to offset dilution from our equity plans and to continue to return a portion of our annual cash flows from operations to stockholders in the form of dividends.

We expect to continue to pursue acquisitions meeting our financial criteria that are designed to expand our business and drive significant stockholder returns. As a result, our expected uses of cash could change, our cash position could be reduced, and we may incur additional debt obligations to the extent we complete additional acquisitions. However, we currently believe that existing cash balances, together with funds generated from operations and amounts available under our Credit Facility, will be sufficient to finance our operations and meet our foreseeable cash requirements, including quarterly cash dividends and stock repurchases to Progress stockholders, as applicable, through at least the next twelve months.

Critical Accounting Policies

Management’s discussion and analysis of financial condition and results of operations are based upon our consolidated financial statements, which have been prepared in accordance with GAAP. We make estimates and assumptions in the preparation of our consolidated financial statements that affect the reported amounts of assets and liabilities, revenue and expenses and related disclosures of contingent assets and liabilities. We base our estimates on historical experience and various other assumptions that are believed to be reasonable under the circumstances. However, actual results may differ from these estimates. The most significant estimates relate to revenue recognition and business combinations. For further information regarding the application of these and other accounting policies, see Note 1 to our Consolidated Financial Statements in Item 8 of our 2022 Annual Report. There have been no significant changes to our critical accounting policies and estimates since our 2022 Annual Report.

Use of Constant Currency

Revenue from our international operations has historically represented a substantial portion of our total revenue. As a result, our revenue results have been impacted, and we expect will continue to be impacted, by fluctuations in foreign currency exchange rates. For example, if the local currencies of our foreign subsidiaries strengthen, our consolidated results stated in U.S. dollars are positively impacted.

As exchange rates are an important factor in understanding period-to-period comparisons, we believe the presentation of revenue growth rates on a constant currency basis enhances the understanding of our revenue results and evaluation of our performance in comparison to prior periods. The constant currency information presented is calculated by translating current period results using prior period weighted average foreign currency exchange rates. These results should be considered in addition to, not as a substitute for, results reported in accordance with GAAP.

Results of Operations

Revenue

(In thousands)

(In thousands)

Total revenue increased as compared to the same periods last year primarily due to our acquisition of MarkLogic in February 2023, as well as increases in our OpenEdge and Kemp product offerings. In the third fiscal quarter, these increases were partially offset by a decrease in our DataDirect and Chef product offerings. In the first nine months of fiscal year 2023, there was also an increase in our DataDirect, Sitefinity, DevTools, and Chef product offerings.

Software License Revenue

(In thousands)

(In thousands)

Software license revenue increased as compared to the same periods last year primarily due to our acquisition of MarkLogic in February 2023, as well as increases in our OpenEdge and Kemp product offerings. In the third fiscal quarter, these increases were partially offset by decreases in our DataDirect and Chef product offerings. In the first nine months of fiscal year 2023, there was also an increase in our DataDirect product offerings.

Maintenance and Services Revenue

(In thousands)

23

(In thousands)

Maintenance revenue increased as compared to the same periods last year primarily due to our acquisition of MarkLogic in February 2023, as well as increases in our OpenEdge and Chef product offerings. Services revenue increased as compared to the same periods last year primarily due to increased services revenue from our acquisition of MarkLogic, partially offset by a decrease in our Chef product offerings. The maintenance increase in the third quarter of fiscal year 2023 was also due to the positive impact of foreign exchange in our EMEA region. The maintenance increase in the first nine months of fiscal year 2023 was partially offset by a decrease in our Kemp product offerings. The services increase in the first nine months of fiscal year 2023 was also due to increases in our Sitefinity and DevTools product offerings.

Revenue by Region

(In thousands)

(In thousands)

Total revenue generated in North America increased $17.1 million and $58.2 million in the third quarter and first nine months of fiscal year 2023, respectively. The increase was primarily due to our acquisition of MarkLogic and increased revenue from our OpenEdge product offering. The increases in revenue over both periods in EMEA was primarily due to our acquisition of MarkLogic and increased revenue from our OpenEdge and Kemp product offerings. The increases in both periods in revenue in Latin America were primarily due to increases in our OpenEdge product offerings. The increases in revenue generated in Asia Pacific in both periods were due to increases in our Chef and Kemp product offerings.

In the first nine months of fiscal year 2023 revenue generated in markets outside North America represented 41% of total revenue on an actual and constant currency basis. In the first nine months of fiscal year 2022 revenue generated in markets outside North America represented 44% of total revenue on an actual and a constant currency basis.

Cost of Software Licenses

(In thousands)

Cost of software licenses consists primarily of costs of inventories, royalties, electronic software distribution, duplication, and packaging. Cost of software licenses as a percentage of software license revenue varies from period to period depending upon the relative product mix.

Cost of Maintenance and Services

(In thousands)

Cost of maintenance and services consists primarily of costs of providing customer support, consulting, and education. The increases in all periods were primarily due to increased headcount, contractor and outside services costs, and hosting costs resulting from our acquisition of MarkLogic.

Amortization of Intangibles

(In thousands)

Amortization of intangibles included in costs of revenue primarily represents the amortization of the value assigned to technology-related intangible assets obtained in business combinations. The increases in all periods are due to the acquisition of MarkLogic.

Gross Profit

(In thousands)

Our gross profit increased in all periods primarily due to the increases in revenue, offset by the increases in costs of software licenses, costs of maintenance and services and the amortization of intangibles, each as described above.

Sales and Marketing

(In thousands)

Sales and marketing expenses increased in all periods primarily due to increased personnel related costs associated with our acquisition of MarkLogic, as well as increases in contractors and outside services costs, partially offset by decreases in marketing and sales events costs.

Product Development

(In thousands)

Product development expenses increased in all periods primarily due to increased personnel related costs associated with our acquisition of MarkLogic, as well as an increase in contractors and outside services costs, partially offset by decreases in other product development costs.

General and Administrative

(In thousands)

General and administrative expenses include the costs of our finance, human resources, legal, information systems and administrative departments. General and administrative expenses increased in all periods primarily due to higher personnel costs associated with our acquisition of MarkLogic, as well as an increase in contractors and outside services costs, partially offset by a decrease in other general and administrative costs.

Amortization of Intangibles

(In thousands)

Amortization of intangibles included in operating expenses primarily represents the amortization of value assigned to intangible assets obtained in business combinations other than assets identified as purchased technology. Amortization of intangibles increased due to the addition of MarkLogic intangible assets, as discussed above.

Cyber Incident and Vulnerability Response Expenses, Net

(In thousands)

*not meaningful

As previously disclosed, following (i) the detection of irregular activity on certain portions of our corporate network that was disclosed on December 19, 2022, and (ii) the discovery of the MOVEit Vulnerability that was disclosed on June 5, 2023, in each instance, we engaged outside cybersecurity experts and other incident response professionals to conduct a forensic investigation and assess the extent and scope of these matters. Cyber incident and MOVEit Vulnerability costs relate to the engagement of external cybersecurity experts and other incident response professionals and are net of received and expected insurance recoveries.

Restructuring Expenses

(In thousands)

*not meaningful

Restructuring expenses recorded in the third fiscal quarter and first nine months of fiscal year 2023 relate to the restructuring activities that occurred in the first and fourth quarters of fiscal years 2023 and 2020, respectively, resulting from the acquisitions of MarkLogic and Chef, respectively. Restructuring expenses recorded in the third quarter of fiscal year 2022 are comprised mostly of costs related to the acquisition of Kemp and the Chef restructuring action of 2020. See the Liquidity and Capital Resources section of this Item 2, Management’s Discussion and Analysis of Financial Condition and Results of Operations.

Acquisition-Related Expenses

(In thousands)

*not meaningful

Acquisition-related costs are expensed as incurred and include those costs incurred as a result of a business combination. These costs consist of professional service fees, including third-party legal and valuation-related fees. Acquisition-related expenses increased due to our acquisition of MarkLogic. Acquisition-related expenses in the same periods of fiscal year 2022 were primarily related to our pursuit of other acquisition opportunities, as well as the acquisition of Kemp.

Gain on Sale of Assets Held for Sale

(In thousands)

*not meaningful

In the second quarter of fiscal year 2022, we sold corporate land and building assets previously reported as assets held for sale on our consolidated balance sheet. As the sale price less cost to sell was greater than the carrying value of these assets we recognized a net gain on the sale of approximately $10.8 million in the second quarter of fiscal year 2022.

Income from Operations

(In thousands)

Income from operations decreased in the third quarter and first nine months of fiscal year 2023 due to an increase in costs of revenue and operating expenses, offset by increased revenue, as shown above.

Other (Expense) Income, Net

(In thousands)

Other expense, net, increased in both periods shown primarily due to increased interest expense on our term loan and our revolving line of credit, which we drew on to fund part of our acquisition of MarkLogic. Interest income and other, net increased due to our acquisition of MarkLogic. Foreign currency loss increased in all periods shown.

Provision for Income Taxes

(In thousands)

Our effective tax rate was 9% and 16% for the three and nine months ended August 31, 2023, respectively and 21% for both the three and nine months ended August 31, 2022. The primary reason for the decrease in the effective rate was due to discrete tax benefits related to stock-based compensation and the impacts of Notice 2023-55, which was issued by the Internal Revenue Service during July 2023 and provides temporary relief for taxpayers in determining whether a foreign tax is eligible for a foreign tax credit under Sections 901 and 903 of the Internal Revenue Code. There were no significant discrete tax items in the three or nine months ended August 31, 2022.

Net Income

(In thousands)

Select Performance Metrics:

Management evaluates our financial performance using a number of financial and operating metrics. These metrics are periodically reviewed and revised to reflect changes in our business.

Annual Recurring Revenue (ARR)

We are providing an ARR performance metric to help investors better understand and assess the performance of our business because our mix of revenue generated from recurring sources has increased in recent years. ARR represents the annualized contract value for all active and contractually binding term-based contracts at the end of a period. ARR includes maintenance, software upgrade rights, both public and dedicated cloud instances and on-premises subscription-based transactions and managed services. ARR mitigates fluctuations due to seasonality, contract term and the sales mix of subscriptions for term-based licenses and SaaS. ARR is not calculated in accordance with GAAP. ARR does not have any standardized meaning and is therefore unlikely to be comparable to similarly titled measures presented by other companies. ARR should be viewed independently of revenue and deferred revenue and is not intended to be combined with or to replace either of those items. ARR is not a forecast and the active contracts at the end of a reporting period used in calculating ARR may or may not be extended or renewed by our customers.

We define ARR as the annual recurring revenue of term-based contracts from all customers at a point in time. We calculate ARR by taking monthly recurring revenue, or MRR, and multiplying it by 12. MRR for each month is calculated by aggregating, for all customers during that month, monthly revenue from committed contractual amounts, additional usage and monthly subscriptions. The calculation is done at constant currency using the current year budgeted exchange rates for all periods presented.

Our ARR was $577.0 million and $488.0 million as of August 31, 2023 and 2022, respectively, which is an increase of 18% year-over-year. The growth in our ARR is primarily driven by the acquisition of MarkLogic.

Net Retention Rate

We calculate net retention rate as of a period end by starting with the ARR from the cohort of all customers as of 12 months prior to such period end ("Prior Period ARR"). We then calculate the ARR from these same customers as of the current period end ("Current Period ARR"). Current Period ARR includes any expansion and is net of contraction or attrition over the last 12 months but excludes ARR from new customers in the current period. We then divide the total Current Period ARR by the total Prior Period ARR to arrive at the net retention rate. Net retention rate is not calculated in accordance with GAAP.

Our net retention rates have generally ranged between 100% and 102% for all periods presented. Our high net retention rates illustrate our predictable and durable top line performance.

Liquidity and Capital Resources

Cash and Cash Equivalents

(In thousands)

The decrease in cash and cash equivalents of $118.3 million from the end of fiscal year 2022 was due to cash outflows of $355.3 million for cash paid for acquisitions, net of cash acquired, repayment of the revolving line of credit of $55.0 million, repurchases of common stock of $30.0 million, dividend payments of $23.7 million, payments of debt obligations of $5.2 million, and purchases of property and equipment of $3.2 million. These cash outflows were offset by proceeds from the issuance of debt of $195.0 million to partially fund the acquisition of MarkLogic, cash inflows from operations of $140.8 million, $12.3 million in cash received from the issuance of common stock, and the effect of exchange rates on cash of $5.5 million. Except as described below, there are no limitations on our ability to access our cash and cash equivalents.

As of August 31, 2023, $84.4 million of our cash and cash equivalents was held by our foreign subsidiaries. Foreign cash includes unremitted foreign earnings, which are invested indefinitely outside of the U.S. As such, the foreign cash is not available to fund our domestic operations. If we were to repatriate these earnings, we may be subject to income tax withholding in certain tax jurisdictions and a portion of the repatriated earnings may be subject to U.S. income tax. However, we do not anticipate that this would have a material adverse impact on our liquidity.

Share Repurchase Program

In January 2023, our Board of Directors increased our share repurchase authorization by $150 million, to an aggregate authorization of $228.0 million. In the nine months ended August 31, 2023 and August 31, 2022, we repurchased and retired 0.5 million shares for $30.0 million and 1.7 million shares for $75.5 million, respectively. The shares were repurchased in both periods as part of our Board of Directors authorized share repurchase program. As of August 31, 2023, there was $198.0 million remaining under the current authorization.

Dividends

On September 20, 2023, our Board of Directors declared a quarterly dividend of $0.175 per share of common stock, which will be paid on December 15, 2023 to stockholders of record as of the close of business on December 1, 2023. Future declarations of dividends and the establishment of future record and payment dates are subject to the final determination of our Board of Directors.

Restructuring Activities

See Note 12 to the condensed consolidated financial statements.

Long-term Debt and Credit Facility

See Note 7 to the condensed consolidated financial statements.

Cash Flows From Operating Activities

(In thousands)

In the first nine months of fiscal year 2023, operating cash flows decreased as a result of higher operating expenses, due to the acquisition of MarkLogic, higher interest expense on debt, and an increase in cash paid for income taxes, as compared to the same period in 2022, partially offset by higher billings and collections. Our gross accounts receivable as of August 31, 2023, decreased by $2.0 million from the end of fiscal year 2022 and our days sales outstanding (DSO) in accounts receivable increased to 49 days from 48 days in the third fiscal quarter of 2022 due to the timing of billings and collections.

Cash Flows (Used in) From Investing Activities

(In thousands)

Net cash outflows and inflows of our net investment activity are generally a result of the timing of our purchases and maturities of securities, which are classified as cash equivalents or short-term securities. In the first nine months of fiscal year 2023, we had payments for acquisitions net of cash acquired of $355.3 million. We also purchased $3.2 million of property and equipment in the first nine months of fiscal year 2023, as compared to $3.1 million in the first nine months of fiscal year 2022. In the second quarter of fiscal year 2022 we received $26.0 million net proceeds from the sale of long-lived assets.

Cash Flows From (Used in) Financing Activities

(In thousands)

During the first nine months of fiscal year 2023, we received $195.0 million in net proceeds from the issuance of debt to partially fund the acquisition of MarkLogic. During the first nine months of fiscal year 2022, we received $7.5 million in net proceeds from the issuance of debt in connection with our amended term loan. We received $20.4 million from the exercise of stock options and the issuance of shares under our employee stock purchase plan as compared to $10.4 million in the first nine months of fiscal year 2022. Further, we repurchased $30.0 million of our common stock under our share repurchase plan compared to $75.5 million in the same period of the prior year. We also made payments on our long-term debt of $60.2 million (including a $55.0 million repayment on the revolving line of credit) in the first nine months of fiscal year 2023 and $5.2 million in the same period in 2022. Finally, we made dividend payments of $23.7 million to our stockholders during the first nine months of fiscal year 2023 and $23.4 million in the first nine months of fiscal year 2022.

Liquidity Outlook

Cash from operations in fiscal year 2023 could be affected by various risks and uncertainties, including, but not limited to, the effects of various risks detailed in Part I, Item 1A. Risk Factors in our 2022 Annual Report which have led to increased disruption and volatility in capital markets and credit markets that could adversely affect our liquidity and capital resources in the future. However, based on our current business plan, we believe that existing cash balances, together with funds generated from operations and amounts available under our Credit Facility, will be sufficient to finance our operations and meet our foreseeable cash requirements through at least the next twelve months. We do not contemplate a need for any foreign repatriation of the earnings which are deemed invested indefinitely outside of the U.S. Our foreseeable cash needs include capital expenditures, acquisitions, debt repayments, quarterly cash dividends, share repurchases, lease commitments, restructuring obligations and other long-term obligations.

Legal and Other Regulatory Matters

See discussion below in Recent Developments: MOVEit Vulnerability for a discussion of the legal proceedings related to the MOVEit Vulnerability.

Recent Accounting Pronouncements

Refer to Note 1 - Nature of Business and Basis of Presentation (Part I, Item 1 of this Form 10-Q) for further discussion.

Recent Developments: MOVEit Vulnerability

Description of Event

As disclosed via a Form 8-K filed on June 5, 2023, on the evening of May 28, 2023 (Eastern Time), our MOVEit technical support team received an initial customer support call indicating unusual activity within their MOVEit Transfer instance. An investigative team was mobilized and, on May 30, 2023, the investigative team discovered a zero-day vulnerability in MOVEit Transfer (including our cloud-hosted version of MOVEit Transfer known as MOVEit Cloud). The investigative team determined the zero-day vulnerability (the “MOVEit Vulnerability”) could provide for unauthorized escalated privileges and access to the customer’s underlying environment in both MOVEit Transfer (the on-premise version) and MOVEit Cloud (a cloud-hosted version of MOVEit Transfer that we deploy in both (i) a public cloud format, as well as, (ii) for a small group of customers, in customer-dedicated cloud instances that are hosted, separate and apart from the public instances of our MOVEit Cloud platform). We promptly took down MOVEit Cloud for further investigation and notified all then-known current and former MOVEit Transfer and MOVEit Cloud customers in order to apprise them of the MOVEit Vulnerability and alert them to immediate remedial actions. In parallel, our team developed a patch for all supported versions of MOVEit Transfer and MOVEit Cloud, which was released on May 31, 2023, and allowed for the restoration of MOVEit Cloud that same day.

MOVEit Transfer is a secure file-transfer software that is installed by customers on-premise and does not have any on-going telemetry after installation that allows us to track, among other things, a customer’s product usage, deployed version, file transfer activity (including any data that is transferred by or stored within the customer’s MOVEit Transfer instance), or whether the customer has applied any security patches or bug fixes to their MOVEit Transfer instance. However, certain MOVEit Transfer customers have reported that malicious threat actors have exploited the MOVEit Vulnerability to obtain access to their environments and portions of their sensitive customer data.

Furthermore, we currently have not seen any evidence that sensitive customer data has been exfiltrated from the public MOVEit Cloud instances. For a small group of customers, we provide dedicated MOVEit Cloud instances that are hosted, for each such customer, separate and apart from the public instances of our MOVEit Cloud platform. Two of our dedicated MOVEit Cloud customers have reported that malicious threat actors have exploited the MOVEit Vulnerability to obtain access to their dedicated MOVEit Cloud environment. As of the date of the filing of this report on Form 10-Q, one such customer has confirmed that no sensitive data was compromised and the other has reported that certain personally identifiable information was exfiltrated.

Since our disclosures regarding the MOVEit Vulnerability, various third-parties have been actively scrutinizing MOVEit Transfer and MOVEit Cloud, leading to the discovery and our prompt patching of additional vulnerabilities. We are currently not aware of any evidence that these additional vulnerabilities were exploited by malicious threat actors prior to creating patches to address them and making those patches available to our MOVEit Transfer customers and applying those patches to the MOVEit Cloud environments – both the public and dedicated cloud instances.

Progress has remained fully operational at all times before and after the discovery of the MOVEit Vulnerability and, as of the time of the filing of this report on Form 10-Q, has not uncovered evidence of unauthorized activity in Progress' corporate environment or impact to products beyond MOVEit Transfer and MOVEit Cloud related to this attack. MOVEit Transfer and MOVEit Cloud represented less than 4% in aggregate of the Company’s revenue for the nine months ended August 31, 2023.

Progress engaged outside cybersecurity experts and other incident response professionals to conduct a forensic investigation and assess the extent and scope of the MOVEit Vulnerability. The Company (i) has and is continuing to implement a series of additional security and related measures aimed at addressing the MOVEit Vulnerability and subsequently discovered vulnerabilities and further strengthening the overall security of our MOVEit applications, (ii) has engaged outside legal counsel to conduct a thorough independent investigation of the MOVEit Vulnerability, and (iii) has engaged with federal law enforcement and other federal agencies with respect to the MOVEit Vulnerability. As our fact-gathering investigation and litigation response continues, we will continue to assess the potential impact of the MOVEit Vulnerability on our business, operations, and financial results.

Expenses Incurred and Amounts Accrued

For the three and nine months ended August 31, 2023, we incurred $1.0 million of costs related to the MOVEit Vulnerability. Costs are provided net of received and expected insurance recoveries of approximately $1.9 million, which was recognized during the third quarter of fiscal year 2023. The timing of recognizing insurance recoveries may differ from the timing of recognizing the associated expenses.

Future Costs

We expect to incur investigation, legal and professional services expenses associated with the MOVEit Vulnerability in future periods. We will recognize these expenses as services are received, net of received and expected insurance recoveries. Our financial liability arising from any of the foregoing will depend on many factors, including limitations contained within our customer contracts, the amount of private litigation, and the number and extent of formal government investigations into the matter, therefore it is not possible at this time to estimate the quantitative impact of any such liability with any reasonable degree of certainty.

Insurance Coverage

During the period when the November 2022 cyber incident and the MOVEit Vulnerability occurred, we maintained $15.0 million of cybersecurity insurance coverage, which is expected to reduce our exposure to expenses and liabilities arising from these events. As of August 31, 2023, we have recorded approximately $4.9 million in insurance recoveries, of which, $3.0 million was related to the November 2022 cyber incident and $1.9 million was related to the MOVEit Vulnerability, providing us with $10.1 million of additional cybersecurity insurance coverage (which is subject to a $0.5 million retention per claim). We will pursue recoveries to the maximum extent available under our insurance policies.

Future Capital Investments

In addition, we may accelerate or make additional investments in our information technology systems, but we are unable to estimate such investments because the nature and scope has not yet been determined. We currently do not expect such amounts to be material to any fiscal period.

Effect on Sales and Customer Loyalty

The MOVEit Vulnerability may adversely affect our future performance and financial results. Customer confidence in Progress may also be impacted by the MOVEit Vulnerability. Through our response speed and transparent communications, we are committed to, and actively engaged in, activities to restore any loss in customer confidence. However, we currently cannot predict the length or extent of any ongoing impact to sales.

Litigation and Governmental Investigations

As of the date of the filing of this report on Form 10-Q, (i) we have received formal letters from 23 customers and others that claim to have been impacted by the MOVEit Vulnerability, some of which have indicated that they intend to seek indemnification from us related to the MOVEit Vulnerability, (ii) we have received a letter from an insurer providing notice of a subrogation claim (where the insurer is seeking recovery for all expenses incurred in connection with the MOVEit Vulnerability), and (iii) we are party to 58 class action lawsuits filed by individuals who claim to have been impacted by exfiltration of data from the environments of our MOVEit Transfer customers (on October 4, 2023, the Judicial Panel on Multidistrict Litigation issued an order consolidating litigation relating to the MOVEit Vulnerability where we are a party in the United States District Court, District of Massachusetts).

We have also been cooperating with several inquiries from domestic and foreign data privacy regulators, inquiries from several state attorneys general, as well as formal investigations from: (i) a U.S. federal law enforcement agency (as of the date of the filing of this report, the law enforcement investigation that we are cooperating with is not an enforcement action or formal governmental investigation of which we have been told that we are a target), and (ii) the SEC (as further described hereafter). On October 2, 2023, Progress received a subpoena from the SEC seeking various documents and information relating to the MOVEit Vulnerability. As described in the cover letter accompanying the subpoena, at this stage, the SEC investigation is a fact-finding inquiry, the investigation does not mean that Progress or anyone else has violated federal securities laws, and the investigation does not mean that the SEC has a negative opinion of any person, entity, or security. Progress intends to cooperate fully with the SEC in its investigation.

Such claims and investigations may have an adverse effect on how we operate our business and our results of operations, and in the future, we may be subject to additional governmental or regulatory investigations, as well as additional litigation or indemnification claims. While a loss from these matters is possible, we cannot reasonably estimate a range of possible losses at this time, particularly while the foregoing matters are pending and our fact-gathering investigation into the matter is ongoing. Furthermore, with respect to the litigation, the proceedings remain in the early stages, alleged damages have not been specified, there is uncertainty as to the likelihood of a class or classes being certified or the ultimate size of any class if certified, and there are significant factual and legal issues to be resolved. Also, each of the governmental inquiries and investigations mentioned above could result in adverse judgements, settlements, fines, penalties, or other resolutions, the amount, scope and timing of which could be material, but which we are currently unable to predict. As such, we have not recorded a loss contingency liability for litigation, claims and governmental investigations in the second quarter. See Note 15 to Consolidated Financial Statements included in Item 1, Financial Statements.

During the first nine months of fiscal year 2023, with the exception of drawing down (and subsequent repayments) on our revolving line of credit as described in Note 7, there were no significant changes to our quantitative and qualitative disclosures about market risk. Please refer to Part II, Item 7A. Quantitative and Qualitative Disclosures about Market Risk included in our 2022 Annual Report, for a more complete discussion of the market risks we encounter.

(a) Evaluation of disclosure controls and procedures

Our management maintains disclosure controls and procedures as defined in Rule 13a-15(e) and 15d-15(e) under the Securities and Exchange Act of 1934, as amended (the "Exchange Act") that are designed to provide reasonable assurance that information required to be disclosed in our reports filed or submitted under the Exchange Act is processed, recorded, summarized and reported within the time periods specified in the SEC's rules and forms, and that such information is accumulated and communicated to management, including our Chief Executive Officer and Chief Financial Officer (our principal executive officer and principal financial officer, respectively), as appropriate, to allow for timely decisions regarding required disclosure.

Our management, including our Chief Executive Officer and Chief Financial Officer, carried out an evaluation of the effectiveness of our disclosure controls and procedures as of the end of the period covered by this report. Based on this evaluation, our Chief Executive Officer and Chief Financial Officer concluded that our disclosure controls and procedures were effective to ensure that the information required to be disclosed in the reports filed or submitted by us under the Exchange Act was recorded, processed, summarized and reported within the requisite time periods and that such information was accumulated and communicated to our management, including our Chief Executive Officer and Chief Financial Officer, as appropriate to allow for timely decisions regarding required disclosure.

The Company acquired MarkLogic on February 7, 2023. Management excluded MarkLogic from its assessment of the effectiveness of the Company’s disclosure controls as of August 31, 2023. MarkLogic represented, in aggregate, approximately 15% of the Company’s total consolidated assets (excluding goodwill and intangibles) and approximately 12% of total consolidated revenues, as of and for the three months ended August 31, 2023.

(b) Changes in internal control over financial reporting

There were no changes in our internal control over financial reporting during the fiscal quarter ended August 31, 2023 that have materially affected, or are reasonably likely to materially affect our internal control over financial reporting.

We operate in a rapidly changing environment that involves certain risks and uncertainties, some of which are beyond our control. In addition to the updated risk factors provided below, please refer to Part I, Item 1A. Risk Factors in our 2022 Annual Report for a more complete discussion regarding certain factors that could materially affect our business, financial condition or future results.

If our products contain software defects or security flaws, it could harm our revenues by causing us to lose customers and could increase our liabilities by exposing us to costly governmental investigations or litigation. For example, the exploitation of the zero-day MOVEit Vulnerability in May 2023 has resulted in government inquiries, two formal government investigations, and private litigation. Our products, despite extensive testing and quality control, may, and at times do, contain defects, vulnerabilities or security flaws. In the ordinary course of business, we may need to issue corrective releases of our software products to fix any defects, vulnerabilities, or security flaws. Depending upon the severity of any such matters, the detection and correction of such matters can be time consuming and costly. If any such issues are exploited by malicious threat actors, we could experience, among other things, material adverse impact to our revenues due to loss of customers and increased liabilities due to costly governmental investigations or litigation. In addition, any such matters could affect the ability of our products to work with hardware or other software products, delay the development or release of new products or new versions of products (due to a reallocation of our internal resources), and/or adversely affect market acceptance of our products, all of which could have a material adverse effect on our operating results and cash flows. For example, we recently released patches for vulnerabilities affecting WS_FTP, one of our file-transfer products that is deployed on-premise in our customers’ environments. Notwithstanding our efforts to promptly patch such vulnerabilities and encourage customers to deploy the patch as quickly as possible, we do not have telemetry into our WS_FTP customers’ environments or control over their patching activity, and there have been reports of exploitation of these vulnerabilities following the release of our security patches. We continue to monitor the situation and assess the potential impact of the WS_FTP vulnerabilities on our business, operations, and financial results. As of August 31, 2023, WS_FTP accounted for less than 1% of our annual gross revenue.

As disclosed via a Form 8-K filed on June 5, 2023, on the evening of May 28, 2023 (Eastern Time), our MOVEit technical support team received an initial customer support call indicating unusual activity within their MOVEit Transfer instance. An investigative team was mobilized and, on May 30, 2023, the investigative team discovered a zero-day vulnerability in MOVEit Transfer (including our cloud-hosted version of MOVEit Transfer known as MOVEit Cloud). The investigative team determined the zero-day vulnerability (the “MOVEit Vulnerability”) could provide for unauthorized escalated privileges and access to the customer’s underlying environment in both MOVEit Transfer (the on-premise version) and MOVEit Cloud (a cloud-hosted version of MOVEit Transfer that we deploy in both (i) a public cloud format, as well as (ii) for a small group of customers, in customer-dedicated cloud instances that are hosted, separate and apart from the public instances of our MOVEit Cloud platform). We promptly took down MOVEit Cloud for further investigation and notified all then-known current and former MOVEit Transfer and MOVEit Cloud customers in order to apprise them of the MOVEit Vulnerability and alert them to immediate remedial actions. In parallel, our team developed a patch for all supported versions of MOVEit Transfer and MOVEit Cloud, which was released on May 31, 2023, and allowed for the restoration of MOVEit Cloud that same day.

MOVEit Transfer is a secure file-transfer software that is installed by customers on-premise and does not have any on-going telemetry after installation that allows us to track, among other things, a customer’s product usage, deployed version, file transfer activity (including any data that is transferred by or stored within the customer’s MOVEit Transfer instance), or whether the customer has applied any security patches or bug fixes to their MOVEit Transfer instance. However, certain MOVEit Transfer customers have reported that malicious threat actors have exploited the MOVEit Vulnerability to obtain access to their environments and portions of their sensitive customer data.

We currently have not seen any evidence that sensitive customer data has been exfiltrated from the public MOVEit Cloud instances. For a small group of customers, we provide dedicated MOVEit Cloud instances that are hosted, for each such customer, separate and apart from the public instances of our MOVEit Cloud platform. Two of our dedicated MOVEit Cloud customers have reported that malicious threat actors have exploited the MOVEit Vulnerability to obtain access to their dedicated MOVEit Cloud environment. As of the date of the filing of this report on Form 10-Q, one such customer has confirmed that no sensitive data was compromised and the other has reported that certain personally identifiable information was exfiltrated.

These events have led to several inquiries from domestic and foreign data privacy regulators; inquiries from several state attorneys general; formal investigations from: (i) a U.S. federal law enforcement agency (as of the date of the filing of this report, the law enforcement investigation that we are cooperating with is not an enforcement action or formal governmental investigation of which we have been told that we are a target), and (ii) the SEC (as further described hereafter); and private litigation; all of which could have adverse impacts on our business and operations and the results thereof. More specifically, as of the date of the filing of this report on Form 10-Q, (i) we have received formal letters from 23 customers and others that claim to have been impacted by the MOVEit Vulnerability, some of which have indicated that they intend to seek indemnification from us related to the MOVEit Vulnerability, (ii) we have received a letter from an insurer providing notice of a subrogation claim (where the insurer is seeking recovery for all expenses incurred in connection with the MOVEit Vulnerability), and (iii) we are party to 58 class action lawsuits filed by individuals who claim to have been impacted by exfiltration of data from the environments of our MOVEit Transfer customers (on October 4, 2023, the Judicial Panel on Multidistrict Litigation issued an order consolidating litigation relating to the MOVEit Vulnerability where we are a party in the United States District Court, District of Massachusetts).

On October 2, 2023, Progress received a subpoena from the SEC seeking various documents and information relating to the MOVEit Vulnerability. As described in the cover letter accompanying the subpoena, at this stage, the SEC investigation is a fact-finding inquiry, the investigation does not mean that Progress or anyone else has violated federal securities laws, and the investigation does not mean that the SEC has a negative opinion of any person, entity, or security. Progress intends to cooperate fully with the SEC in its investigation.

Such claims and investigations may have an adverse effect on how we operate our business and our results of operations, and in the future, we may be subject to additional governmental or regulatory investigations, as well as additional litigation or indemnification claims. Following the discovery of the MOVEit Vulnerability and the various remedial actions described here, we have discovered and patched additional vulnerabilities within the MOVEit Transfer and MOVEit Cloud platforms. While we are currently not aware of any evidence that these additional vulnerabilities were exploited by malicious threat actors, we cannot guarantee that we have or will uncover and/or address all vulnerabilities within the MOVEit platform or any of our other products prior to exploitation by threat actors.

Our financial liability arising from any of the foregoing will depend on many factors, including the extent to which governmental entities investigate the matter and limitations contained within our customer contracts; therefore, we are unable at this time to estimate the quantitative impact of any such liability with any reasonable degree of certainty. As our fact-gathering investigation and litigation response continues, we will continue to assess the potential impact of the MOVEit Vulnerability on our business, operations, and financial results. Also, each of the governmental inquiries and investigations mentioned above could result in adverse judgements, settlements, fines, penalties, or other resolutions, the amount, scope and timing of which could be material, but which we are currently unable to predict.

Our customers and partners may seek refunds, delay implementation timelines, delay payment, fail to pay us in accordance with the terms of their agreements, or terminate use of our products, all of which can have an adverse effect on us. If customers or partners seek refunds, delay implementation of our products, delay payment, fail to pay us under the terms of our agreements, or terminate use of our products, we may be adversely affected both from the inability to collect amounts due and the cost of enforcing the terms of our contracts (including litigation related thereto). For example, as of the date of the filing of this report on Form 10-Q, 23 customers and others that claim to have been impacted by the MOVEit Vulnerability have indicated that they intend to seek indemnification from us related to the MOVEit Vulnerability and it is possible that, in connection therewith, they may delay payment under the terms of their contracts. Other MOVEit Transfer and MOVEit Cloud customers have sought refunds or delayed implementation timelines. As the scope of the impact of the MOVEit Vulnerability becomes more clear, additional customers may attempt to seek refunds, delay product implementation, withhold payments, or cease using the MOVEit product line entirely.

In addition, in the ordinary course of business, some of our customers and partners may seek bankruptcy protection or other similar relief and fail to pay amounts due to us, or pay those amounts more slowly, either of which could adversely affect our operating results, financial position and cash flow.

Our business could be damaged, and we could be subject to liability, in the event of any unauthorized access to our data or our customers’ data, including through privacy and data security breaches, such as or in addition to the MOVEit Vulnerability. The use of certain of our products, including MOVEit Cloud, involves the transmission or storage of third-party data in our environment, some of which may be considered personally identifiable, confidential, or sensitive. In the ordinary course of business, we face security threats from malicious threat actors that could obtain unauthorized access to our systems, infrastructure, products, and networks. We anticipate that these threats will continue to grow in scope and complexity over time.

For example, once we discovered the MOVEit Vulnerability on May 30, 2023, we (i) promptly took down MOVEit Cloud for investigation, and (ii) notified all then-known current and former MOVEit Transfer and MOVEit Cloud customers in order to apprise them of the MOVEit Vulnerability and alert them to immediate remedial actions. In parallel, our team developed a patch for all supported versions of MOVEit Transfer and MOVEit Cloud, which was released on May 31, 2023 and allowed for the restoration of MOVEit Cloud that same day. While we believe that our actions have, and will continue to, reduce the likelihood of similar vulnerabilities occurring in the future in our MOVEit product line, malicious threat actors might use techniques to exploit other zero-day vulnerabilities or use other means that we are unable to defend against, in order to compromise and infiltrate our systems, infrastructure, networks, and products, including, but not limited to, MOVEit or other products. In addition, MOVEit Transfer is a secure file-transfer software that is installed by customers on-premise and does not have any on-going telemetry after installation that allows us to track, among other things, a customer’s product usage, deployed version, file transfer activity (including any data that is transferred by or stored within the customer’s MOVEit Transfer instance), or whether the customer has applied any security patches or bug fixes to their MOVEit Transfer instance.

While we devote a significant amount of resources to cyber security related matters in the operation of our business, we may fail to detect the existence of a breach and be unable to prevent unauthorized access to user and company content across our systems, infrastructure, products, and networks. The techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and are often not recognized until launched against a target. They may originate from less regulated or remote areas around the world, or from state-sponsored actors. If our security measures are breached, we may suffer reputational damage, our products may be perceived as insecure, and we may lose existing customers, or fail to attract and retain new customers.

In addition to internal resources, we frequently rely on third parties when deploying our cybersecurity related infrastructure, and in doing so, may be exposed to security risks outside of our direct control. In connection therewith, we rely on outside vendors and contractors to perform certain services necessary for the operation and testing of certain of our products, and they may fail to adequately secure our platform or discover vulnerabilities in our products.

While we have implemented security procedures and controls aimed at addressing these threats and patching vulnerabilities, our security measures could be compromised and our attempts to implement security measures and patch vulnerabilities could prove to be inadequate or could fail. Any such failure could result in significant legal and financial exposure, increased costs to defend litigation, indemnity and other contractual obligations, government fines and penalties, damage to our reputation and our brand, and a loss of confidence in the security of our products and services that could potentially have an adverse effect on our business and results of operations. In addition, our insurance coverage may not be adequate to cover all costs related to cybersecurity incidents or the exploitation of vulnerabilities as well as the disruptions and liabilities resulting from such events.