Commvault Systems Inc: Form 10-K for the period ended Mar 31, 2025

Company Overview

Commvault Systems, Inc. aims to provide its customers cyber resiliency by protecting and recovering their data and cloud-native applications in a world of increasing cyber threats and attacks, including ransomware. We provide products and services across many types of environments, including on-premises, hybrid and multi-cloud. Our offerings are delivered via self-managed software, software-as-a-service ("SaaS"), integrated appliances, or managed by partners.

With Commvault Cloud, customers have access to business-critical capabilities such as layered defenses to detect and minimize the impact of bad actors; automation to verify clean recovery points; and cloud-native capabilities to dedupe, scale, and as necessary, recover data and cloud applications to remain in a state of continuous business. Our comprehensive solutions address the critical aspects of modern cyber resiliency, from data protection to data recovery, data governance and compliance in a flexible and scalable platform. Commvault was incorporated in Delaware in 1996.

Products

Commvault helps customers protect their data and be cyber resilient in hybrid, multi-cloud, and cloud-native environments. Commvault delivers a portfolio of products and services to effectively protect, quickly capture intelligence, and rapidly recover from cyber incidents. Our solutions create an intuitive cyber resilience experience across customer-managed enterprise software and SaaS-delivered cloud-native solutions that mitigate data sprawl, facilitate cloud adoption, and help customers modernize and transform their enterprise IT environment.

We do this by offering unified visibility and management across the entire hybrid enterprise so our customers can protect and recover data from any location to any location. Our Commvault Cloud offerings are organized in the following packages – Operational Recovery, Autonomous Recovery and Cyber Recovery.

Operational Recovery includes Commvault’s leading backup and recovery capabilities which can be utilized across hybrid enterprise workloads. This solution can be delivered as customer-managed software, as SaaS, or a mix of the two to meet the requirements of hybrid enterprises worldwide. It is designed to meet the needs of any size business protecting workloads across all locations, including hybrid and multi-cloud environments; physical servers; virtual machines (“VMs”); applications and databases; endpoint devices; and cloud applications. Operational Recovery provides backup, verifiable recovery, and cost-optimized cloud workload mobility, helping to ensure data availability and granular recovery, even across multiple clouds.

Autonomous Recovery aims to reduce recovery time, downtime, and costs by bringing automation and validation to Operational Recovery. Designed for automated disaster and cyber recovery use cases, Autonomous Recovery can deliver backup, replication, and disaster recovery for all workloads, on-premises, in the cloud, across multiple clouds, and in hybrid environments. It provides trusted recovery of data and applications, VMs, and containers, along with verifiable recoverability of replicas, cost-optimized cloud data mobility and resilience. Organizations can automatically failover applications to a secondary site in the event of a data incident and continue running without interruption.

Cyber Recovery offers the most comprehensive set of Commvault Cloud capabilities. Building on Operational and Autonomous Recovery Solutions, Cyber Recovery adds data backup and data validation capabilities which help organizations scan for risks, remediate issues, identify compromises in the backup data, and recover clean data at scale. This includes threat scanning to hunt for threats within backup data and cyber deception and threat detection to provide early warning of attacks. This enables organizations to minimize the impact of attacks and aims towards a fast recovery after a cyber incident.

In addition, Commvault provides customers with a variety of unique offerings, including Cleanroom Recovery, HyperScale X, Air Gap Protect, Compliance, Cloud Rewind, and Clumio Backtrack.

Commvault Cloud’s Cleanroom Recovery is a cyber resilience offering. Traditional isolated on-premises cleanrooms can be expensive to build and maintain, and incident response plans often go untested, increasing an organization’s risk and recovery time objectives. Our Cleanroom Recovery solution empowers organizations to be ready to recover by providing a clean, isolated, and on-demand recovery location in the cloud, as well as the ability to regularly and proactively test their incident response plans and recover quickly.

Commvault HyperScale X is an intuitive, easy-to-deploy and scale-out, integrated data protection solution to support enterprises' transformations from legacy scale-up infrastructures to the hybrid cloud, container and virtualized environments. Its flexible architecture allows customers to get up and running quickly and scale while delivering comprehensive data protection for a vast array of workloads, including containers, VMs and databases, from a single, extensible platform. With HyperScale X, customers can leverage the Commvault portfolio, giving them access to the features, functions, and industry-leading integration with applications, databases, public cloud environments, hypervisors, operating systems, NAS systems, and primary storage arrays, wherever the data resides. It is available as a fully integrated appliance or as a reference architecture depending on an organization’s requirements.

Commvault Cloud Air Gap Protect is the “easy button” to adopt secure and scalable cloud storage in minutes, supporting an organization's hybrid cloud strategy without the need for additional cloud expertise. It is an integrated, air-gapped cloud storage target that enables IT organizations to efficiently adopt cloud storage for Operational Recovery, HyperScale X or SaaS to ease digital transformation, reduce risks and scale. This minimizes IT complexities and allows customers to easily store, isolate, and protect data while providing the foundation for predictable costs and reduced overhead.

Commvault's Compliance capabilities, which can be procured as an add-on product, facilitates efficient compliance and protects relevant legal data from alteration. It provides built-in reporting, auditing, and logging so data is not modified or deleted for legal and compliance purposes. It is designed to reduce the time and costs spent between IT and legal departments to expedite discovery and review.

Commvault Cloud Rewind integrates automated cloud-native application recovery and rebuild capabilities to help customers quickly restore an organization’s entire cloud application and data environment. By combining data recovery with cloud-native application and infrastructure rebuild automation, Cloud Rewind can help customers get back to business within minutes after a cloud services outage or ransomware attack.

Commvault’s Clumio Backtrack uses automation to rapidly revert objects and datasets stored in Amazon Simple Storage Service (Amazon S3) to a specific point and time. Being able to revert to a specific point and time can be very useful across a variety of recovery use cases, including bringing back data before it was accidentally deleted; before an application started sending incorrect or corrupt data; or before a cybercriminal encrypted the objects and demanded a ransom.

Professional & Customer Support Services

Commvault offers a wide range of professional and customer support services to complement its product portfolio. We offer multiple levels of service that can be tailored to our customers’ needs.

Our services consist of:

• Global Real-Time Support. We offer global customer support from physical locations around the world, which allows us to provide 24/7 support. Our customers have access to support staff available by phone for first responses and to manage resolutions, and to an online support database for help with troubleshooting and operational questions. Additionally, we leverage Arlie, our artificial intelligence ("AI")-powered assistant within the Commvault Cloud platform, to enhance support with real-time, actionable insights. This advanced AI capability is designed for faster resolutions and an even more responsive support experience. Our cloud-based support system creates a virtual global support center to address customer needs. We have designed our support infrastructure to scale with the increasing globalization of our customers. We have also developed and maintain a knowledge library of storage systems and software products to further enable our support organization to quickly and effectively resolve customer problems.
• Broad Expertise. Our support engineers have extensive knowledge of complex applications, servers and networks. We proactively take ownership of the customer’s problem and provide bug fixes and updates as part of our commitment to enhancing performance and functionality.
• Customer Success Options. We offer various Customer Success options for our software and SaaS customers, including Enterprise Success Program ("ESP") offerings. Our Customer Success offerings provide resources focused on proactively helping our customers achieve their goals and are aligned to their business initiatives. Our ESP offerings provide additional industry technical experts who provide strategic guidance and advice so our enterprise customers achieve their cyber resiliency objectives.

The entire Customer Success program is centered around driving customer adoption, customer satisfaction and quick time to value.

• Technology Consulting Services. Our technical consultants guide customers so their data protection environments are designed for optimal results, configured quickly, and easy to maintain. We offer architecture design; implementation; automation and orchestration; data migration; and health assessment services. In addition, we offer customers staff-augmentation options via resident support engineers to assist with rapid expert deployment and operation of the Commvault portfolio.
• Recovery Services. Commvault Readiness Solutions provide the resources and expertise to quickly accelerate returning to normal business operations through the proper design, implementation, administration, and support of our customers' data protection and cyber resilience environment.
• Education Services. We offer training content for learners at all levels, with basic, intermediate, and expert certifications available. We also provide a selection of self-paced online content for our products in our On-Demand Learning Library.
• Cyber Resilience Managed Services. We provide results-oriented data protection and cyber resilience services to customers worldwide. Commvault experts provide secure, reliable, and cost-effective remote monitoring and management of our customers' data protection environment.

Customers

Our current customer base spans thousands of organizations across a variety of sizes, including large global enterprise companies, and small or mid-sized businesses and government agencies. We support customers in a range of industries, including banking, insurance and financial services, government, healthcare, pharmaceuticals and medical services, technology, legal, manufacturing, utilities and energy.

Strategic Relationships

An important element of Commvault’s strategy is to establish partnerships that support development, marketing, selling and implementation of our solutions. We believe that strategic and technology-based relationships with industry leaders are fundamental to our success. We have forged numerous relationships with software, hardware, cloud and cybersecurity partners to enhance our combined capabilities, help our customers advance business-critical security, resilience, and cloud initiatives, and create the optimal combination of data and information management applications. We believe this approach enhances our ability to expand our product offerings and customer base and to enter new markets. We have established the following types of strategic relationships:

Alliance and Technology Partners. We maintain strategic sales, marketing and technology relationships with industry leaders so that our products are integrated with, supported by and add value to our partners’ portfolios. Collaboration with these market leaders allows us to provide solutions that enable our customers to improve data and information management efficiency. We also maintain relationships with a broad range of industry operating system, application and infrastructure vendors to verify and demonstrate the interoperability of our portfolio with their equipment and technologies. We believe these partnerships enhance our position in the market and serve as an accelerator to sales.

Distributor, Value-Added Reseller, Systems Integrator, Corporate Reseller and Original Equipment Manufacturer Relationships. These partners either bundle our solutions together with their own products or resell our solutions independently.

To broaden our market coverage, we work closely with our global original equipment manufacturer ("OEM") partners, investing significant time and resources to deliver joint solutions incorporating Commvault solutions. These partners team with our technical, engineering, marketing and sales force to enhance integration, tuning, operational management, implementation and vision for solutions that are designed to meet current and future data protection and cyber resilience needs. Our alliance managers work directly with global OEM partners to design, deliver and support field activities that make it easier for customers to locate, learn about, and purchase these differentiated solutions.

Additionally, we have a non-exclusive distribution agreement with Arrow Enterprise Computing Solutions, Inc. ("Arrow"), a subsidiary of Arrow Electronics, Inc. Arrow's primary role is to enable a more efficient and effective distribution channel for our products and services by managing our reseller partners and leveraging their own industry experience. Sales generated through our distribution agreement with Arrow accounted for approximately 35% of our total revenues in fiscal 2025 and 36% in fiscal 2024.

Service Provider Partners. Our solutions are the cyber resilience platform for many service providers, which provide cloud-based solutions to customers worldwide. As companies of all sizes and markets rapidly adopt cloud infrastructures for cost efficiencies, speed and agility, we remain committed to these strategic relationships to address this growing trend. Customers looking to move IT operations to the cloud depend on service providers to migrate, manage and protect their data and cloud infrastructures. We partner with a broad ecosystem of managed service providers and cloud partners to effectively deliver data protection-as-a-service solutions based on Commvault solutions across geographies, vertical markets and offerings.

Cloud Hyperscalers. We sell our solutions via marketplace offerings which enable customers to purchase our solutions through online platforms, such as AWS, Google, Microsoft, or Oracle. The marketplace allows us to publish an offer which an end user can then purchase directly, or with the assistance of a partner.

Cybersecurity and AI Partnerships. Commvault has continued to expand integrations with leading cybersecurity and AI partners. These integrations can play a key role in helping joint customers advance cyber resilience – from identifying potential threats or anomalies, to understanding where sensitive data exists, to accelerating clean recoveries. These bi-directional integrations also empower customers to use their preferred security, data protection, and cyber recovery solutions. Security operations teams can leverage these integrations to help better understand risks and threats, defend against them, and recover with confidence.

Competition

The data protection and cyber resilience market is intensely competitive and highly fragmented. The principal competitive factors in our industry include product functionality, performance, integration, platform coverage, scalability, price, global sales infrastructure, technical support, branding and reputation. The ability of major system vendors to bundle solutions is also a significant competitive factor in our industry.

Our primary competitors in the data protection software applications market, each of which has one or more products that compete with a part of or our entire product suite, include Cohesity, Druva, Rubrik, and Veeam.

Some of our competitors have greater financial resources and may have the ability to offer their products at lower prices than ours. In addition, some have greater name recognition, longer operating histories, substantially larger technical, sales, marketing and other global resources, and larger installed customer base with broader product offerings. As a result, these competitors can devote greater resources to the development, promotion, sale and support of their products than we can. Refer to our "Risk Factors" below.

Sales and Marketing

We sell our cyber resilience solutions to businesses and government agencies of all sizes. We sell through our global direct sales force and partner channels.

We have a variety of marketing programs designed to create brand awareness and market recognition for our product offerings and sales lead generation. Our marketing efforts include sales campaigns, webinars, active participation at trade shows, virtualized cyberattack simulation training sessions, technical conferences and seminars; advertising; content development and distribution; public relations; social media; industry analyst relations; publication of technical and educational articles in industry journals; sales training; and preparation of competitive analyses. In addition, our strategic partners augment our marketing and sales campaigns through seminars, trade shows, joint public relations and advertising campaigns. Our customers and strategic partners provide references and recommendations that we often feature in external marketing activities.

Research and Development

Our research and development organization is responsible for the design, development, testing and certification of our cyber resilience platform and solutions. Our engineering efforts support product development across all major operating systems, databases, applications, hyperscalers and network storage devices. A substantial amount of our development effort goes into certification, integration and support of our solutions to ensure interoperability with our strategic partners’ solutions. We have also made substantial investments in the automation of our product test and quality assurance laboratories.

Technology, Intellectual Property and Proprietary Rights

We believe our solutions are a major differentiator versus our competitors’ portfolios. Our Commvault Cloud platform aims to deliver best-in-class cyber resilience with the fastest recovery across on-premises, hybrid and multi-cloud environments. Our solutions’ unique features drive the performance, scale, TCO benefits and interoperability of our offerings. Such features include encryption, indexing and immutable recovery. Additional options enable content search and auditing features to support data discovery and compliance. Our success and ability to compete depend on our continued development and protection of our solutions. We rely primarily on a combination of trade secrets, patents, and copyrights, as well as contractual provisions, to establish and protect our intellectual property rights.

We patent our technical infrastructure and key usability and design concepts. Our product’s unique capabilities are covered by a robust portfolio of patents worldwide. Areas such as cyber resilience, data protection, transformation, insights, and compliance and governance, including our SaaS and HyperScale X solutions, are core to our competitive advantage. More than 1,500 patents have been issued to Commvault globally as a result of our strategic patenting. We also have established proprietary trademark rights in markets across the globe, and Commvault owns over 200 worldwide trademark registrations and pending registration applications. Refer to our “Risk Factors” below.

Government Regulations

The global legal environment of technology businesses is evolving rapidly and is often unclear. These topics include data privacy and security, pricing, advertising, taxation, economic sanctions, content regulation and intellectual property ownership and infringement.

We are subject to several local, state, federal and foreign laws and regulations regarding data privacy and security. Regulators around the world have adopted or proposed limitations on, or requirements regarding, the collection, distribution, use, security and storage of personal information, payment card information or other confidential information of individuals, and the U.S. Federal Trade Commission and many state attorneys general are applying federal and state consumer protection laws to impose standards on the online collection, use and dissemination of data. In the event of a security breach, these laws may subject us to incident response, notice and remediation costs. Failure to safeguard data adequately or to destroy data securely could subject us to regulatory investigations or enforcement actions under applicable data privacy and security, unfair practices or consumer protection laws. The scope and interpretation of these laws could change, and the associated burdens and our compliance costs could increase in the future.

We are also subject to global laws and regulations that govern or restrict our business and activities in certain countries and with certain persons, including the U.S. Commerce Department’s Export Administration Regulations and economic and trade sanctions regulations maintained by the Office of Foreign Assets Control, as well as anti-bribery and anti-corruption laws and regulations, including the Foreign Corrupt Practices Act and the U.K. Bribery Act. Refer to our “Risk Factors” below.

People

Commvault aims to unlock potential in data, customers and our people. To accomplish that, our people are empowered to drive innovation and help our customers—by inspiring one another and working to make what’s already great, even greater—whether that is product, process or team. As of March 31, 2025, we had approximately 3,300 employees worldwide, of which 37% were in the United States and 63% were located internationally.

We remain committed to providing people with opportunities and resources that enable them to work successfully and creatively, while also investing in their professional and personal development. Throughout fiscal 2025, our employees, partners and customers participated in over 1,400 training programs, totaling more than 260,000 hours.

Community and Belonging

At Commvault, we believe that a culture of community and belonging and a workforce encompassing a broad range of talents and perspectives is a business requirement that helps us compete in the marketplace. The broad range of perspectives in our workforce not only drives our ability to hire the best, most qualified talent and to be a best-in-class cyber resilience organization, but also uphold our value in the marketplace by leading as an employer of choice.

We continue to be committed to securing the best talent with a concerted effort to expound on and build a broad pipeline of candidates. We are committed to providing an environment that fosters career growth, investing in the development, creativity and aspirational needs of all employees.

Employee Health, Safety and Wellness

Commvault values its people and their contribution to our company. In return for their contribution, we are committed to providing a corporate culture that is focused on the health, safety and well-being of our employees. We take a holistic approach to health and wellness to support the dynamic aspects of our employees’ lives, including their physical, social, emotional, family and financial well-being. We operate in accordance with applicable safety laws and procedures to ensure we provide a safe work environment for all.

Information about our Executive Officers

The following table presents information with respect to our executive officers as of May 2, 2025:

Sanjay Mirchandani has served as our President and Chief Executive Officer ("CEO") since February 2019. Prior to joining Commvault, Mr. Mirchandani served from September 2016 to January 2019 as the Chief Executive Officer of Puppet, Inc. (“Puppet”), an Oregon-based IT automation company. Mr. Mirchandani joined Puppet in May 2016 as President and Chief Operating Officer. Mr. Mirchandani brings a wealth of international business experience through his diverse well-rounded career in technology. Before joining Puppet, from October 2013 to April 2016, Mr. Mirchandani served as Corporate Senior Vice President and General Manager of Asia Pacific and Japan at VMware, Inc. and, from June 2006 to October 2013, Mr. Mirchandani held various senior leadership positions at EMC Corporation, including Chief Information Officer and leader of the Global Centers of Excellence. Prior to that, Mr. Mirchandani held various positions at Microsoft Corporation and Arthur Andersen LLP. Mr. Mirchandani has a Master of Business Administration degree from the University of Pittsburgh and a bachelor’s degree in mathematics from Drew University.

Jennifer DiRico has served as our Chief Financial Officer (“CFO”) since August 2024. Prior to joining Commvault, Ms. DiRico served as Senior Vice President & General Manager, International at Toast, Inc. (“Toast”). Ms. DiRico, who was integral to Toast’s initial public offering in 2021, served in a series of leadership positions within Toast since May 2016, including Senior Vice President & Head of Finance, and Chief of Staff. Prior to that, Ms. DiRico served in finance leadership positions with Nuance Communications from 2014 to 2016. She obtained her Masters of Business Administration from Simmons College and Bachelor of Business Administration from the University of Miami.

Gary Merrill has served as our Chief Commercial Officer ("CCO") since August 2024. Prior to his current role, Mr. Merrill served as our CFO from June 2022 to July 2024 and as our Chief of Business Operations from April 2021 until June 2022. He also held the position of Vice President of Operations from April 2019 through March 2021 and from December 2012 to March 2019, served as Chief Accounting Officer. Prior to joining Commvault, Mr. Merrill held accounting management positions with several publicly traded companies. Mr. Merrill began his career with Arthur Anderson LLP in its audit practice. Mr. Merrill obtained his bachelor’s degree in accounting from Elizabethtown College.

Available Information

Our website is located at: www.commvault.com (http://www.commvault.com). On the Investor Relations section of the website, we post filings as soon as reasonably practicable after they are electronically filed with or furnished to the U.S. Securities and Exchange Commission ("SEC"), including: our Annual Reports on Form 10-K, our quarterly reports on Form 10-Q, our current reports on Form 8-K, our definitive proxy statements and any amendments to those reports or statements filed or furnished pursuant to Section 13(a) or 15(d) of the Exchange Act. All such filings are available on the Investor Relations portion of our website free of charge. The contents of our website are not incorporated by reference into this Annual Report on Form 10-K or in any other report, statement or document we file with the SEC.

You should consider each of the following factors as well as the other information in this Annual Report in evaluating our business and our prospects. The risks and uncertainties described below are not the only ones we face. Additional risks and uncertainties not presently known to us or that we currently consider immaterial may also impair our business operations. If any of the following risks actually occur, our business and financial results could be harmed. In that case, the trading price of our common stock could decline. You should also refer to the other information set forth in this Annual Report, including our financial statements and the related notes.

Risks Related to Our Business and Industry

Our industry is intensely competitive, and many of our competitors have greater financial, technical and sales and marketing resources and larger installed customer bases, which could enable them to compete more effectively than we do.

The cyber resiliency market is intensely competitive, highly fragmented and characterized by rapidly changing technology and evolving standards, changing customer requirements and frequent new product introductions. Competitors vary in size and in the scope and breadth of the products and services offered. We must continually innovate to maintain our market position.

The principal competitive factors in our industry include product functionality and integration, platform coverage, ability to invest and scale, price, worldwide sales infrastructure, global technical support, brand recognition and reputation. If we are unable to address these factors, our competitive position could weaken and we could experience a decline in revenues that could adversely affect our business.

It is also costly and time-consuming to change cyber resilience systems. Most of our new customers previously adopted cyber resilience systems, which gives an incumbent competitor an advantage in retaining a customer because the incumbent already understands the network infrastructure, user demands and information technology needs of the customer, and because some customers are reluctant to invest the time and money necessary to change vendors. There are complexities involved in transitioning from traditional on-premises solutions to cloud-based services, including customer adoption rates and the need for scalable infrastructure. Commvault has substantially completed the transition from a perpetual licensing model to a subscription-based model delivered through either term based licenses or SaaS, whereas certain of our competitors are already fully cloud-native.

New competitors entering our markets may have a negative impact on our competitive positioning. As we enter new markets, we expect to encounter new competitors. Many of our existing competitors are broadening their product breadth and scope. We expect increased competition from OEMs, including those we partner with, and from systems and network management companies, especially those that have historically focused on the mainframe computer market and have been making acquisitions and broadening their efforts to include cyber resilience products. We expect that competition will increase as a result of future industry consolidation. Increased competition could harm our business by causing, among other things, price reductions of our products, reduced profitability and loss of market share. Additionally, attracting and retaining skilled professionals is a common challenge in the cyber resilience space, due to the intensely competitive nature of the industry.

We rely on indirect sales channels, such as value-added resellers, systems integrators, corporate resellers, distributors, OEMs, and marketplaces for the distribution of our solutions, and the failure of these channels to effectively sell our solutions could have a material adverse effect on our revenues and results of operations.

We rely significantly on our value-added resellers, systems integrators and corporate resellers, which we collectively refer to as resellers, for the marketing and distribution of our products and services. Resellers are our most significant distribution channel. However, our agreements with resellers are generally not exclusive, are generally renewable annually, typically do not contain minimum sales requirements and in many cases may be terminated by either party without cause. Many of our resellers carry data protection and cyber resilience solutions that compete with ours. These resellers may give a higher priority to other software or SaaS applications, including those of our competitors, or may not continue to carry data protection and cyber resilience solutions. If a number of resellers were to discontinue or reduce the sales of our products, or were to promote our competitors’ products in lieu of our own, it could have a material adverse effect on our future revenues. Events or occurrences of this nature could seriously harm our sales and results of operations. If we fail to manage our resellers successfully, there may be conflicts between resellers or they could fail to perform as we anticipate, including required compliance with the terms and conditions of our agreement, either of which could reduce our sales or impact our reputation in the market. In addition, we expect that a portion of our sales growth will depend upon our ability to identify and attract new resellers. Our competitors also use reseller arrangements and may be more successful in attracting resellers and could enter into exclusive relationships with resellers that make it difficult to expand our reseller network. Any failure on our part to maintain and/or expand our network of resellers could impair our ability to grow revenues in the future.

Further, we have a non-exclusive distribution agreement with Arrow pursuant to which Arrow’s primary role is to enable a more efficient and effective distribution channel for our solutions by managing our resellers and leveraging their own industry experience. Arrow accounted for approximately 35%, 36% and 37% of our total revenues for the years ended March 31, 2025, 2024 and 2023, respectively. If Arrow were to discontinue or reduce the sales of our solutions or if our agreement with Arrow was terminated, and if we were unable to take back the management of our reseller channel or find another distributor to replace Arrow, there could be a material adverse effect on our future business.

Our OEMs sell and integrate our solutions which represents a material portion of our revenues. We have no control over the shipping dates or volumes of systems these OEMs sell and they have no obligation to sell systems incorporating our solutions. They also have no obligation to recommend or offer our solutions exclusively or at all. They have no minimum sales requirements and can terminate our relationship at any time. These OEMs also could choose to develop their own data protection and cyber resilience solutions. Our OEM partners compete with one another. If one of our OEM partners views our arrangement with another OEM as competing, it may decide to stop doing business with us. Any material decrease in the volume of sales generated by OEMs could have a material adverse effect on our revenues and results of operations in the future.

We also sell our solutions via marketplace offerings which enable customers to purchase our solutions through online platforms, typically hosted by a cloud provider. The marketplace allows us to publish an offer which an end user can then purchase directly, or through the assistance of a partner. Similar to our resellers and OEMs, marketplace providers have no obligation to sell or recommend our solutions or offer our solutions exclusively or at all. Failure to effectively compete in the marketplace could have a material adverse effect on our revenues and results of operations in the future.

If the cost for maintenance and support agreements, or our term-based subscription licenses and SaaS arrangements, with our customers is not competitive in the market or if our customers do not renew their agreements, either at all or on terms that are less favorable to us, our business and financial performance might be adversely impacted.

Most of our support and maintenance agreements are for a one-year term and thereafter, we pursue renewal thereof. Historically, such renewals have represented a significant portion of our total revenues. If our customers do not renew their annual maintenance and support agreements, either at all or on terms that are less favorable to us, our business and financial performance might be adversely impacted.

Additionally, a significant amount of our revenues are from term-based software license and SaaS arrangements. Those arrangements are typically one to three years in duration. If at the end of the initial term, customers elect to not renew, or they renew on terms that are less favorable to us, our business and financial performance might be adversely impacted.

Volatility in the global economy could adversely impact our continued growth, results of operations and our ability to forecast future business.

As a global company, we have become increasingly subject to the risks arising from adverse changes in domestic and global economic and political conditions. Uncertainty in the macroeconomic environment and associated global economic conditions have in the past resulted in and may continue to result in volatility in credit, equity, debt and foreign currency markets. The U.S. government has and continues to make significant additional changes in U.S. trade policy and may continue to take future actions that could negatively impact U.S. trade. In addition, the U.S. government and certain foreign governments have recently announced new or increased tariffs on imported goods, and additional tariffs or increases in tariffs could be assessed in the future. The future actions of the U.S. administration and foreign governments with respect to tariffs or other international trade agreements and policies remain unclear. A trade war or other governmental action related to tariffs or international trade agreements or policies has the potential to disrupt our international operations and/or the United States or global economy or certain sectors thereof and, thus, could negatively impact our financial performance or business.

These global economic conditions can result in slower economic activity, decreased consumer confidence, reduced corporate profits and capital spending, inflation, adverse business conditions and liquidity concerns. There has also been increased volatility in foreign exchange markets. These factors make it difficult for our customers, our vendors and us to accurately forecast and plan future business activities. These factors could cause customers to slow or defer spending on our solutions, which would delay and lengthen sales cycles and negatively affect our results of operations. If such conditions deteriorate or if the pace of economic recovery is slower or more uneven, our results of operations could be adversely affected, we may not be able to sustain the growth rates we have experienced recently, and we could fail to meet the expectations of stock analysts and investors, which could cause the price of our common stock to decline.

We continue to invest in our business internationally where there may be significant risks with overseas investments and growth prospects. Increased volatility or declines in the credit, equity, debt and foreign currency markets in these regions could cause delays in or cancellations of orders. Deterioration of economic conditions in the countries in which we do business could also cause slower or impaired collections on accounts receivable.

In periods of volatile economic conditions, our exposure to credit risk and payment delinquencies on our accounts receivable significantly increases.

Our outstanding accounts receivables are generally not secured. Our standard terms and conditions permit payment within a specified number of days following the receipt of our solution. Volatile economic conditions, including those related to the ongoing Russia-Ukraine conflict, the conflicts in the Middle East and the global response to the conflicts, economic downturns, tariffs or the imposition of new tariffs, trade wars, barriers or restrictions, or threats of such actions, supply chain disruptions, or the financial instability of banking institutions could result in our customers and partners facing liquidity concerns leading to them not being able to satisfy their payment obligations to us, which would have a material adverse effect on our financial condition, operating results and cash flows.

In addition, a significant percentage of our revenue is from subscription, or term-based, arrangements. In these arrangements, our customers may pay for solutions over a period of several years. Due to the potential for extended period of collection, we may be exposed to more significant credit risk.

We develop solutions that interoperate with certain products, operating systems and hardware developed by others, and if the developers of those operating systems and hardware do not cooperate with us or we are unable to devote the necessary resources so that our solutions interoperate with those systems, our development efforts may be delayed or foreclosed and our business and results of operations may be adversely affected.

Our solutions operate primarily on the Windows, UNIX, Linux and Novell Netware operating systems; used in conjunction with Microsoft SQL; and on hardware devices of numerous manufacturers. Our reliance on such hardware components exposes us to potential supply chain disruption, which can delay product deliveries and adversely affect customer satisfaction. When new or updated versions of these operating systems, solution applications, and hardware devices are introduced, it is often necessary for us to develop updated versions of our solution applications so that they interoperate properly with these systems and devices. We may not accomplish these development efforts quickly or cost-effectively, and it is not clear what the relative growth rates of these operating systems and hardware will be.

We encounter long sales and implementation cycles, particularly for our larger customers, which could have an adverse effect on the size, timing and predictability of our revenues.

Potential or existing customers, particularly government customers and larger enterprise customers, generally commit significant resources to an evaluation of available solutions and require us to expend substantial time, effort and money educating them as to the value of our solutions. Sales often require an extensive education and marketing effort.

We could expend significant funds and resources during a sales cycle and ultimately fail to win the customer. Our sales cycle for all of our products and services is subject to significant risks and delays over which we have little or no control, including our customers’ budgetary constraints; the timing of our customers’ budget cycles and approval processes; our customers’ willingness to replace their current solutions; our need to educate potential customers about the uses and benefits of our solutions; and the timing of the expiration of our customers’ current agreements for similar solutions.

If our sales cycles lengthen unexpectedly, they could adversely affect the timing of our revenues or increase costs, which may cause fluctuations in our quarterly revenues and results of operations. Finally, if we are unsuccessful in closing sales of our solutions after spending significant funds and management resources, our operating margins and results of operations could be adversely impacted, and the price of our common stock could decline.

We depend on growth in the data protection and cyber resiliency market, and lack of growth or contraction in this market could have a material adverse effect on our sales and financial condition.

Demand for data protection and cyber resilience solutions is linked to growth in the amount of data generated and stored, demand for data retention and management (whether as a result of regulatory requirements or otherwise) demand for and adoption of new backup devices and networking technologies, and ability to respond to and recover from cyber incidents in a secure environment. Because our solutions are concentrated within the data protection and cyber resiliency market, if the demand for backup and data protection solutions devices declines, our sales, profitability and financial condition would be materially adversely affected.

Furthermore, the data protection and cyber resiliency market is dynamic and evolving. Our future financial performance will depend in large part on continued growth in the number of organizations adopting data protection and cyber resilience solutions for their environments. The market for data protection and cyber resilience solutions may not continue to grow at historic rates, or at all. If this market fails to grow or grows more slowly than we currently anticipate, our sales and profitability could be adversely affected.

Our SaaS offerings require costly and continual infrastructure investments and if these investments do not yield the expected return, our business and financial performance might be adversely impacted.

In order to deliver our SaaS offerings via a cloud-based deployment, we have made and will continue to make capital investments and incur substantial costs to implement and maintain this business model. In addition, as we look to deliver new or different cloud-based services, we are making significant technology investments to deliver new capabilities and advance our software to deliver cloud-native customer experiences. Our revenues related to SaaS offerings have increased in recent years. If there is a reduction in demand for these services caused by a lack of customer acceptance, technological challenges, weakening economic or political conditions, including as a result of tariffs or the imposition of new tariffs, trade wars, barriers or restrictions, or threats of such actions, security or privacy concerns, inability to properly manage such services, competing technologies and products, decreases in corporate spending or otherwise, our financial results and competitive position could suffer. If these investments do not yield the expected return, or we are unable to decrease the cost of delivering our cloud services, our gross margins, overall financial results, business model and competitive position could suffer.

We sell a backup appliance which integrates our solution with hardware. If we fail to accurately predict manufacturing requirements and manage our supply chain, we could incur additional costs or experience manufacturing delays that could harm our business.

We generally provide forecasts of our requirements to our supply chain partners on a rolling basis. If our forecast exceeds our actual requirements, a supply chain partner may assess additional charges or we may incur costs for excess inventory they hold, each of which could negatively affect our gross margins. If our forecast is less than our actual requirements, the applicable supply chain partner may have insufficient time or components to produce or fulfill our solutions' requirements, which could delay or interrupt manufacturing of our products or fulfillment of orders for our solutions, and result in delays in shipments, customer dissatisfaction, and deferral or loss of revenue. If we fail to accurately predict our requirements, we may be unable to fulfill those orders or we may be required to record charges for excess inventory. Any of the foregoing could adversely affect our business, financial condition or results of operations.

Our complex solutions may contain undetected errors, which could adversely affect not only their performance but also our reputation and the acceptance of our solutions in the market.

Our complex solutions may contain undetected errors or failures, especially when they are made generally available or new versions are released. Despite extensive testing by us and customers, we have discovered errors in our solutions in the past and will do so in the future. As a result of past discovered errors, we experienced delays and lost revenues while we corrected those solutions. In addition, customers in the past have brought to our attention “bugs” in our software created by the customers’ unique operating environments, which are often characterized by a wide variety of both standard and non-standard configurations that make pre-release testing very difficult and time consuming. Although we have been able to fix these bugs in the past, we may not always be able to do so. Our solutions may also be subject to intentional attacks by viruses that seek to take advantage of these bugs, errors or other weaknesses. Any of these events may result in the loss of, or delay in, market acceptance of our solutions or damage to our reputation, which would seriously harm our sales, results of operations and financial condition.

Incorrect or improper implementation or use of our cyber resilience solutions could result in customer dissatisfaction and harm our business, financial condition, and results of operations.

Our products are deployed by our customers and partners in a wide variety of IT infrastructures, including large-scale, complex technology environments, and we believe our future success will depend, at least in part, on our ability to support such deployments. Implementations of our products may be technically complicated, and it may not be easy to maximize the value of our products without proper implementation, training, and support. Some of our customers have experienced difficulties implementing our products in the past and may experience implementation difficulties in the future. If our customers and partners are unable to implement our products successfully, perceptions of our products may be impaired, our reputation and brand may suffer, or customers may choose not to renew their subscriptions or purchase additional products from us.

Any failure by customers or partners to appropriately implement our products could result in customer dissatisfaction, impact the perceived reliability of our products, result in negative press coverage, negatively affect our reputation, and harm our business, financial condition, and results of operations.

We may not receive significant revenues from our current research and development efforts for several years, if at all.

Developing software and technology is expensive, and the investment in product development may involve a long payback cycle. Our research and development expenses were $146.3 million, or 15%, of our total revenues in fiscal 2025, $132.3 million, or 16%, of our total revenues in fiscal 2024 and $141.8 million, or 18%, of our total revenues in fiscal 2023. We believe that we must continue to dedicate a significant amount of resources to our research and development efforts to maintain our competitive position. However, we may not recognize significant revenues from these investments for several years, if at all.

Our ability to sell our solutions is highly dependent on the quality of our customer support and professional services, and failure to offer high quality customer support and professional services would have a material adverse effect on our sales and results of operations.

Our services include the assessment and design of solutions to meet our customers’ storage management requirements and the efficient installation and deployment of our software applications based on specified business objectives. Further, once our software applications are deployed, our customers depend on us to resolve issues relating to our software applications. A high level of service is critical for the successful marketing and sale of our software. If we or our partners do not effectively install or deploy our applications, or succeed in helping our customers quickly resolve post-deployment issues, it would adversely affect our ability to sell software products to existing customers and could harm our reputation with prospective customers. As a result, our failure to maintain high quality support and professional services would have a material adverse effect on our sales of software applications and results of operations.

We completed a restructuring plan in fiscal 2025, which we cannot guarantee will achieve its intended results.

In fiscal 2024, we initiated a restructuring plan to enhance customer satisfaction, optimize operational efficiency, and align our customer experience functions with our strategic goals. This plan was completed in fiscal 2025. We cannot guarantee the restructuring plan will achieve its intended results. Risks associated with this restructuring plan also include additional unexpected costs, adverse effects on employee morale and the failure to meet operation and growth targets due to the loss of key employees, any of which may impair our ability to achieve anticipated results of operations or otherwise harm our business.

A portion of our revenue is generated by sales to government entities, which are subject to a number of challenges and risks.

Sales to global federal, state, and local governmental agencies account for a portion of our revenue, and we may in the future increase sales to government entities. This customer base experiences budgetary constraints or shifts in spending priorities regularly which may adversely affect sales of our solutions to government entities. Selling to government entities can be highly competitive, expensive and time consuming, often requiring significant upfront time and expense without any assurance that we will successfully sell our solutions. Government entities may require contract terms that differ from our standard terms and conditions including termination rights favorable for the customer, audit rights, and maintenance of certain security clearances for facilities and employees which can entail administrative time and effort resulting in costs and delays. Engagements with government contracts involve stringent compliance requirements and the potential for increased scrutiny, which could adversely impact operational flexibility.

Government demand for our solutions may be more volatile as they are affected by stringent regulations, public sector budgetary cycles, funding authorizations, and the potential for funding reductions or delays, making the time to close such transactions more difficult to predict. The current presidential administration intends to reduce overall government spending and has introduced the Department of Government Efficiency to operationalize this priority; a decline in government spending could negatively impact our revenues and profitability.

Changes in senior management or key personnel could cause disruption in the Company and have a material effect on our business.

We have had, and could have, changes in senior management which could be disruptive to management and operations of the Company and could have a material effect on our business, operating results and financial conditions. Turnover at the senior management level may create instability within the Company, which could impede the Company’s day-to-day operations. Such instability could impede our ability to fully implement our business plan and growth strategy, which would harm our business and prospects.

We rely on our key personnel to execute our existing business operations and identify and pursue new growth opportunities. The loss of key employees could result in significant disruptions to our business, and the integration and training of replacement personnel could be costly, time consuming, cause additional disruptions to our business and be unsuccessful.

We have engaged, and may continue to engage, in strategic acquisitions or transactions, which could have a material adverse effect on our business, results of operations, financial condition and cash flows.

Acquisitions involve a number of risks, including diversion of management’s attention, ability to finance the acquisition on attractive terms, failure to retain key personnel or valuable customers, legal liabilities, the need to amortize acquired intangible assets, and intellectual property ownership and infringement risks, any of which could have a material adverse effect on our business, results of operations, financial condition and cash flows. Any additional future acquisitions may also result in the incurrence of indebtedness or the issuance of additional equity securities.

We could also experience financial or other setbacks if transactions encounter unanticipated problems, including problems related to governmental approval, execution, integration or underperformance relative to prior expectations. Acquisitions may not result in long-term benefits to us or we may not be able to further develop the acquired business in the manner we anticipated.

Following the completion of acquisitions, we may have to rely on the seller to provide administrative and other support, including financial reporting and internal controls, and other transition services to the acquired business for a period of time. There can be no assurance that the seller will do so in a manner that is acceptable to us.

We are preparing to migrate a significant amount of customers from Red Hat environments, and any disruption, delay, or failure in executing this transition effectively could have a material adverse impact on our business operations and customer relationships.

Any delays or issues in the execution of this migration may expose us to financial and operational risks. Additionally, ongoing support and coordination during the transition may result in higher operating costs. If we are unable to successfully complete the migration, our operations and reputation could be materially adversely affected.

Borrowing against our revolving credit facility could adversely affect our operations and financial results.

We have a $100 million revolving credit facility. As of March 31, 2025, there were no borrowings under the credit facility. If we were to borrow substantially against this facility the indebtedness could have adverse consequences, including requiring us to devote a portion of our cash flow from operations to payments of indebtedness, which would reduce the availability of cash flow to fund working capital requirements, capital expenditures and other general purposes; limiting our flexibility in planning for, or reacting to, general adverse economic conditions or changes in our business and the industry in which we operate in; placing us at a competitive disadvantage compared to our competitors that have less debt; and limiting our ability to fund potential acquisitions.

The credit facility also contains financial maintenance covenants, including a leverage ratio and interest coverage ratio, and customary events of defaults. Failure to comply with these covenants could result in an event of default, which, if not cured or waived, could accelerate our repayment obligations. For further discussion on our revolving credit facility, see Note 17 of the notes to the consolidated financial statements.

Risks Related to our International Operations

If we are unable to effectively manage certain risks and challenges related to our India operations, our business could be harmed.

Our India operations are a key factor to our success. We believe that our significant presence in India provides certain important advantages for our business, such as direct access to a large pool of skilled professionals and assistance in growing our business internationally. However, it also creates certain risks that we must effectively manage. As of March 31, 2025, approximately 39% of our employees were located in India. Wage costs differentiate depending on regions throughout the world. Wages in India are increasing at a faster rate than in the many other countries, including the United States. These increases could result in us incurring increased costs for technical professionals and reduced margins. There is intense competition in India for skilled technical professionals, and we expect such competition to increase. As a result, we may be unable to cost-effectively retain our current employee base in India or hire additional new talent. In addition, India has experienced significant inflation, low growth in gross domestic product and shortages of foreign exchange. India also has experienced civil unrest and has been involved in conflicts with neighboring countries. The occurrence of any of these circumstances could result in disruptions to our India operations, which, if continued for an extended period of time, could have a material adverse effect on our business.

In recent years, India’s government has adopted policies that are designed to promote foreign investment, including significant tax incentives, relaxation of regulatory restrictions, liberalized import and export duties and preferential rules on foreign investment and repatriations. These policies may not continue. If we are unable to effectively manage any of the foregoing risks related to our India operations, our development efforts could be impaired, our growth could be slowed and our results of operations could be negatively impacted.

We may experience fluctuations in foreign currency exchange rates that could adversely impact our results of operations.

We derive almost half of our revenues from international markets. Our international sales are generally denominated in foreign currencies, and this revenue and related cash flow could be materially affected by currency fluctuations. Our primary exposure is to fluctuations in exchange rates for the U.S. dollar versus the Euro and, to a lesser extent, the Australian dollar, British pound sterling, Canadian dollar, Chinese yuan, Indian rupee, Korean won and Singapore dollar. Changes in currency exchange rates could adversely affect our reported revenues and could require us to reduce our prices to remain competitive in foreign markets, which could also have a material adverse effect on our results of operations. An unfavorable change in the exchange rate of foreign currencies against the

U.S. dollar would result in lower revenues when translated into U.S. dollars, although operating expenditures would be lower as well.

In recent fiscal years, we have selectively hedged our exposure to changes in foreign currency exchange rates on the balance sheet. In the future, we may enter into additional foreign currency-based hedging contracts to reduce our exposure to significant fluctuations in currency exchange rates on the balance sheet, although there can be no assurances that we will do so. However, as our international operations grow, or if dramatic fluctuations in foreign currency exchange rates continue or increase or if our hedging strategies become ineffective, the effect of changes in the foreign currency exchange rates could become material to revenue, operating expenses, and income.

Our international sales and operations are subject to factors that could have an adverse effect on our results of operations.

We have significant sales and services operations outside the United States and derive a substantial portion of our revenues from these operations. We generated approximately 46% and 48% of our revenues from outside the United States in fiscal 2025 and fiscal 2024, respectively. International revenue increased 15% in fiscal 2025 compared to fiscal 2024. Expansion of our international operations has and is expected to require a significant amount of attention from our management and substantial financial resources and might require us to add qualified management in these markets.

In addition to facing risks similar to the risks faced by our domestic operations, our international operations are also subject to risks related to the differing legal, political, social and regulatory requirements and economic conditions of many countries, including:

• adverse effects in economic conditions in the countries in which we operate, particularly related to the ongoing Russia-Ukraine conflict and the regional conflict in the Middle East;
• difficulties in staffing and managing our international operations;
• foreign countries may impose additional withholding taxes or otherwise tax our foreign income, impose tariffs or adopt other restrictions on foreign trade or investment, including currency exchange controls;
• difficulties in coordinating the activities of our geographically dispersed and culturally diverse operations;
• general economic conditions in the countries in which we operate, including seasonal reductions in business activity in the summer months in Europe and in other periods in other countries;
• imposition of, or unexpected adverse changes in, foreign laws or regulatory requirements, including those pertaining to sanctions, export restrictions, privacy and data protection, trade and employment restrictions and intellectual property protections;
• longer payment cycles for sales in foreign countries and difficulties in collecting accounts receivable;
• competition from local suppliers;
• greater risk of a failure of our employees and partners to comply with both U.S. and foreign laws, including antitrust regulations, the U.S. Foreign Corrupt Practices Act, the U.K. Bribery Act of 2010, and any trade regulations ensuring fair trade practices;
• costs and delays associated with developing solutions in multiple languages; and
• political unrest, war or acts of terrorism.

Our business in emerging markets requires us to respond to rapid changes in market conditions in those markets. Our overall success in international markets depends, in part, upon our ability to succeed in differing legal, regulatory, economic, social and political conditions. We may not continue to succeed in developing and implementing policies and strategies that will be effective in each location where we do business. The occurrence of any of the foregoing factors may have a material adverse effect on our business and results of operations.

Risks Related to Technology and Security

We may be subject to IT system failures, network disruptions, cybersecurity incidents and breaches in data security.

IT system failures, network disruptions, cybersecurity incidents and breaches of data security could disrupt our operations by causing delays or cancellation of customer orders, impeding the delivery of our solutions, negatively affecting customer support or professional services, preventing the processing of transactions and reporting of financial results, and disturbing our enterprise resource planning system. IT system failures, network disruptions, cybersecurity incidents and breaches of data security could also result in the unintentional disclosure of customer or our information as well as damage our reputation. There can be no assurance that a system failure, network disruption, cybersecurity incident or data security breach will not have a material adverse effect on our financial condition and operating results. Cybersecurity breaches or incidents and other exploited security vulnerabilities could subject us to significant costs and third-party liabilities, result in improper disclosure of data and violations of applicable privacy and other laws, require us to change our business practices, cause us to incur significant remediation costs, lead to loss of customer confidence in, or decreased use of our products and services, damage our reputation, divert the attention of management from the operation of our business, result in significant compensation or contractual penalties from us to our customers and their business partners as a result of losses to or claims by them, or expose us to litigation, regulatory investigations, and significant fines and penalties.

Bad actors regularly attempt to gain unauthorized access to our IT systems, and many such attempts are increasingly sophisticated and difficult to detect. These attempts, which might be related to industrial, corporate or other espionage, criminal hackers or nation-state and nation-state supported actors, include trying to covertly introduce malware or ransomware to our environments, impersonating authorized users, as well as other intrusions from nation-state actors and nation-state supported actors. In particular, cyber attacks, including those from organized criminal threat actors, nation-states and nation-state supported actors, are prevalent and severe and could lead to significant interruptions, delays, or outages in our operations, disruptions in our services, loss of data, loss of income, significant extra expense to restore data or systems, reputational loss and the diversion of funds. Cybercriminals are leveraging artificial intelligence (“AI”) to develop more sophisticated and targeted attacks, making detection and prevention increasingly challenging, resulting in heightened risks of security breaches and incidents. As cyberattacks, including AI-driven threats, become increasingly sophisticated, there is an omnipresent need to enhance security measures to protect our systems and data.

Third-party service providers that we may rely on to back up and process our confidential information may also be subject to similar threats. Such threats could result in the misappropriation, theft, misuse, disclosure, loss or destruction of the technology, intellectual property, or the proprietary, confidential or personal information, of us or our employees, customers, licensees, suppliers or partners, as well as damage to or disruptions in our IT systems. These threats are constantly evolving, increasing the difficulty of successfully defending against them or implementing adequate preventative measures. We seek to detect and investigate all cybersecurity breaches or incidents and to prevent their recurrence, but attempts to gain unauthorized access to our IT systems or other attacks may be successful, and in some cases, we might be unaware of an incident or its magnitude and effects.

Additionally, due to political uncertainty, our third-party service providers are vulnerable to heightened risks of cybersecurity incidents and security and privacy breaches and incidents caused or initiated by nation-state or affiliated actors, including attacks that could materially disrupt our systems, operations and services, or impact our customers systems, operations, and services. For example, in February and April 2025, Microsoft notified the Company about unauthorized activity within our Azure environment by a suspected nation-state threat actor. As part of the ongoing investigation regarding this activity, the Company immediately activated its incident response plan, issued security advisories, and implemented several advanced security measures, including enhanced rotation of credentials and strengthened security monitoring, among other proactive measures. Similarly, supply chain attacks have increased in frequency and severity, and there have been high-profile incidents of third-party service providers causing widespread disruptions to their customers’ infrastructure due to errors in their SaaS offerings. We cannot guarantee that third parties and infrastructure in our supply chain have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our Commvault Cloud platform, systems and network or the systems and networks of third parties that support us and our business. Moreover, we may have limited remedies against third-party providers in the event of a service disruption.

In addition, any failure to successfully implement new information systems and technologies, or improvements or upgrades to existing information systems and technologies in a timely manner could adversely impact our business, internal controls, results of operations, reputation, and financial condition.

We may not be successful in our initiatives that utilize AI, which could adversely affect our business, reputation, or financial results.

There are significant risks involved in utilizing AI and no assurance can be provided that such usage will enhance our business or assist our business in being more efficient or profitable. Known risks currently include accuracy, bias, toxicity, intellectual property infringement or misappropriation, data privacy, and cybersecurity and data provenance. In addition, AI may have errors or inadequacies that are not easily detectable. For example, certain AI may utilize historical data in its analytics. To the extent that such historical data is not indicative of the current or future conditions, or models fail to filter biases in the underlying data or collection methods, such AI usage may lead us to make determinations on behalf of our business, recommendations to our clients, or developments to our products and services, in each case, that may have an adverse effect on our business and financial results. If AI models are incorrectly designed or the data used to train them is overbroad, incomplete, inadequate or biased in some way, our use may inadvertently reduce our efficiency or cause unintentional or unexpected outputs that are incorrect, do not match our business goals, do not comply with our policies or interfere with the performance of our products and services, business and reputation.

AI is a complex and rapidly evolving regulatory landscape. The use of AI may increase intellectual property, cybersecurity and data protection, operational and technological risks, and our related efforts may result in new or enhanced governmental or regulatory scrutiny, litigation, ethical concerns, or other complications that could adversely affect our business, reputation, or financial results or subject us to legal liability. In particular, technologies underlying AI and their use cases are subject to a variety of laws, including intellectual property, cybersecurity and data protection, consumer protection and equal opportunity laws. If we do not have sufficient rights to use the data on which these models rely, we may incur liability through the violation of such laws, third-party privacy or other rights or contracts to which we are a party. Changes in laws, rules, directives and regulations may adversely affect the ability of our business to develop and use AI.

We market our own products as containing AI features. Some of our customers, especially those in highly regulated industries, may be reluctant or unwilling to adopt such AI features which could reduce or delay customer adoption.

Any of these factors could adversely affect our business, reputation, or financial results or subject us to legal liability.

Our success depends on our technology partners. We rely on Microsoft’s products and services, including Azure, and other third parties to support certain of our products, services, customers, and business operations. Any errors, disruptions, performance problems, cybersecurity incidents, or failures in such third parties’ operational infrastructure could adversely affect our business, brand, financial conditions and results of operations.

We rely on the technology, infrastructure, and software applications, including software-as-a-service offerings, of certain third parties, such as Microsoft Azure, in order to host or operate certain of our products, services and operational infrastructure. We do not have control over such third parties’ operations. Therefore, we depend on these third parties to protect their infrastructure and operations against damage or interruption from cybersecurity incidents, natural disasters, power or telecommunications failures, criminal acts, and similar events.

If any of these third-parties’ experience errors, disruptions, cybersecurity incidents, or other performance deficiencies, if their products and services are updated such that our products and services become incompatible, if their products and services fail or become unavailable due to extended outages, interruptions, defects, or otherwise, or if they are no longer available on commercially reasonable terms or prices (or at all), such events may cause errors or failures in our products and services, damages to our reputation or brand, or decline to our revenue and margins. As a result, we could be exposed to legal or contractual liability, our expenses could increase, our ability to manage our operations could be interrupted, and our operational processes could be impaired until equivalent services or technology, if available, are identified, procured, and implemented, all of which may take significant time and resources, increase our costs, and could adversely affect our business.

Many of these third-party providers impose limitations on their liability for such errors, disruptions, defects, performance deficiencies, or failures. Any renegotiation or renewal of our agreements with these third parties, or a new agreement with another provider, may be on terms that are significantly less favorable to us than our current agreements. Microsoft and other cloud platform providers may furthermore introduce functionality that competes with our products and services, as a result of an acquisition, or their own development.

If we fail to adapt and respond effectively to rapidly changing technology, evolving industry standards, changing regulations, or to changing customer needs, requirements, or preferences, our products may become less competitive.

Our ability to attract new users and customers and increase revenue from existing customers depends in large part on our ability to enhance, improve, and differentiate our products, increase adoption and usage of our products, and introduce new products and capabilities. The market in which we compete is subject to rapid technological change, evolving industry standards, and changing regulations, as well as changing customer needs, requirements, and preferences. The success of our business will depend, in part, on our ability to adapt and respond effectively to these changes on a timely basis. If we are unable to enhance our products and keep pace with rapid technological change, or if new technologies emerge that are able to deliver competitive products at lower prices, more efficiently, more conveniently, or more securely than our products, our business, financial condition, and results of operations could be adversely affected.

Risks Related to Financial, Accounting, Regulatory, Tax, and Other Legal Matters

We have been, and may in the future become, involved in litigation that may have a material adverse effect on our business.

From time to time, we may become involved in various legal proceedings relating to matters incidental to the ordinary course of our business, including intellectual property, commercial, product liability, employment, class action, whistleblower and other litigation and claims, and governmental and other regulatory investigations and proceedings. Such matters can be time-consuming, divert management’s attention and resources and cause us to incur significant expenses. Furthermore, because litigation is inherently uncertain, there can be no assurance that the results of any of these actions will not have a material adverse effect on our business, results of operations or financial condition.

We are subject to several local, state, federal and foreign laws and regulations regarding privacy and data protection, and any actual or perceived failure by us to comply with such laws and regulations could adversely affect our business.

We are currently subject, and may become further subject, to local, state, federal and foreign laws and regulations regarding the privacy and protection of personal data or other potentially sensitive information. In the United States, federal, state, and local governments have enacted numerous data privacy security laws, including data breach notification laws, data privacy laws, consumer protection laws, and other similar laws. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the "CCPA"), imposes obligations on certain businesses to provide specific disclosures in privacy notices and grants California residents certain rights related to their personal data. The CCPA imposes statutory fines for noncompliance (up to $7,500 per violation). Other states have enacted or proposed similar laws. These developments may increase legal risk and compliance costs for us and our customers.

Governments worldwide are implementing more stringent data protection regulations, requiring companies to invest heavily in compliance mechanisms to avoid substantial fines and reputational damage. Outside the United States, an increasing number of laws, regulations, and industry standards govern data privacy and security. For example, the European Union’s ("E.U.") General Data Protection Regulation ("E.U. GDPR") and the Digital Operational Resilience Act (“DORA”), and the United Kingdom’s ("U.K.") GDPR ("U.K. GDPR"), impose strict requirements for processing the personal data of individuals. Violations of these obligations carry significant potential consequences. For example, under the E.U. GDPR, government regulators may impose temporary or definitive bans on processing, as well as fines of up to €20 million or 4% of the annual global revenue, whichever is greater. Additionally, new and emerging data privacy regimes may be applicable in Asia, including India's Digital Personal Data Protection Act, China's Personal Information Protection Law, Japan's Act on the Protection of Personal Information, and Singapore's Personal Data Protection Act. Countries are enacting stricter data localization requirements, compelling companies to store data within specific jurisdictions, which complicates global operations and increases compliance costs.

In addition, as a technology provider, our customers expect us to demonstrate compliance with current data privacy laws and further make contractual commitments and implement processes to enable the customer to comply with their own obligations under data privacy laws, and our actual or perceived inability to do so may adversely impact sales of our products and services, particularly to customers in highly regulated industries.

Our actual or perceived failure to comply with laws, regulations, contractual commitments, or other actual or asserted obligations, including certain industry standards, regarding personal information, or other confidential information of individuals could lead to costly legal action, brand and reputational damage, significant liability, inability to process data, and decreased demand for our services, which could adversely affect our business. In addition, any security breach that results in the release of, or unauthorized access to, personal information, or other confidential information of individuals could subject us to incident response, notice and remediation costs. Failure to safeguard data adequately or to destroy data securely could subject us to regulatory investigations or enforcement actions under applicable data security, unfair practices or consumer protection laws which could have an adverse effect on our business, financial condition or operating results. The scope and interpretation of these laws could change and the associated burdens and our compliance costs could increase in the future.

Changes in tax laws or tax rulings could materially affect our financial position, results of operations, and cash flows.

The tax regimes in which we are subject or under which we operate are constantly facing changes in tax laws, regulations, or rulings, or changes in interpretations of existing laws and regulations, and could materially affect our financial position and results of operations. In addition, our tax obligations and effective tax rate in the jurisdictions in which we conduct business could increase in the future, including as a result of the Base Erosion and Profit Shifting ("BEPS") Project that is being led by the Organization for Economic Co-operation and Development ("OECD"), commonly referred to as “BEPS 2.0”. Due to our international business activities, these types of changes to the taxation of our activities could increase our worldwide effective tax rate, the amount of taxes imposed on our business, and our compliance costs, and harm our financial position. We continue to monitor the impact of new global and U.S. legislation on our effective tax rate.

Our effective tax rate is difficult to project, and changes in such tax rate or adverse results of tax examinations could adversely affect our operating results.

We are a U.S.-based multinational company subject to tax in multiple U.S. and foreign tax jurisdictions. Our results of operations would be adversely affected to the extent that our geographical mix of income becomes more weighted toward jurisdictions with higher tax rates and would be favorably affected to the extent the relative geographic mix shifts to lower tax jurisdictions. Any change in our mix of earnings is dependent upon many factors and is therefore difficult to predict.

The process of determining our anticipated tax liabilities involves many calculations and estimates that are inherently complex and make the ultimate tax obligation determination uncertain. As part of the process of preparing our consolidated financial statements, we are required to estimate our income taxes in each of the jurisdictions in which we operate prior to the completion and filing of tax returns for such periods. These estimates involve complex issues, require extended periods of time to resolve, and require us to make judgments, such as anticipating the outcomes of audits with tax authorities and the positions that we will take on tax returns prior to our actually preparing the returns. In the normal course of business, we are subject to examination by taxing authorities throughout the world. The final determination of tax audits and any related litigation could be materially different from our historical tax provisions and accruals. For further discussion on income taxes, see Note 12 of the notes to the consolidated financial statements.

Furthermore, our overall effective income tax rate and tax expenses may be affected by various factors in our business, including changes in our entity structure, geographic mix of income and expenses, tax laws, and variations in the estimated and actual level of annual profits before income tax.

Our reported financial results may be adversely affected by changes in accounting principles generally accepted in the United States.

Generally accepted accounting principles in the United States are subject to interpretation by the Financial Accounting Standards Board, the SEC, and various bodies formed to promulgate and interpret appropriate accounting principles. A change in these principles or interpretations could have a significant effect on our reported financial results, and may even affect the reporting of transactions completed before the announcement or effectiveness of a change.

Goodwill represents a portion of our assets and any impairment of these assets could negatively impact our results of operations.

At March 31, 2025, our goodwill had a carrying value of approximately $185.3 million, which represented approximately 17% of our total assets. We test goodwill for impairment at least annually at the reporting unit level, or more often if an event occurs or circumstances change that would more likely than not reduce the fair value of its carrying amount. This qualitative assessment requires us to assess and make judgments regarding a variety of factors which impact the fair value of the reporting unit or asset being tested, including business plans, anticipated future cash flows, economic projections and other market data. Because there are inherent uncertainties involved in these factors, significant differences between these estimates and actual results could result in future impairment charges and could materially impact our future financial results. For additional information on our goodwill impairment testing, see Note 2 of the notes to the consolidated financial statements. Any future impairment of this asset could have a material adverse effect on our results of operations, which may adversely affect the market price of our common stock.

Impairment charges of long-lived assets, including assets held for sale, could adversely affect our financial condition and results of operations.

We review our long-lived assets for impairment whenever events or changes in circumstances indicate that the carrying amount of the assets may not be fully recoverable. In January 2023, we reclassified our owned corporate headquarters as assets held for sale. As a result, we evaluated the carrying value of our long-lived assets related to the property and determined that the carrying value of those assets may not be fully recoverable, and as such, recorded an impairment charge of $53.5 million in the fourth quarter of fiscal 2023. We recorded an additional $2.9 million impairment in fiscal 2025 related to changes in the estimated fair value less costs to sell. As of March 31, 2025, the sale has not yet been finalized.

While classified as held for sale, we may need to reassess the fair value of the building at each of our reporting periods and determine whether the carrying value is recoverable. If the carrying value is not deemed to be recoverable based on current market conditions, we may be required to record additional impairment charges in the future. In addition, if certain events or changes in circumstances arise, such as being unable to sell the building within a reasonable timeframe or if selling the building would result in a negative economic future state, we may need to reclassify the building from “assets held for sale” to “assets held and used,” and record a cumulative catch-up on the depreciable assets, which may have a material impact on our operating results and could impact the market price of our common stock. See Note 6 of the notes to the consolidated financial statements for additional information on our assets held for sale.

We may experience a decline in revenues or volatility in our quarterly operating results, which may adversely affect the market price of our common stock.

We cannot predict our future quarterly revenues or operating results with certainty because of many factors outside of our control. A significant revenue or profit decline, lowered forecasts or volatility in our operating results could cause the market price of our common stock to decline substantially. Factors that could affect our revenues and operating results include the following:

• the unpredictability of the timing and magnitude of orders for our solutions, particularly transactions greater than $100,000, as a majority of our quarterly revenues have been earned and recorded near the end of each quarter;
• failure to develop substantial sales pipeline for our products;
• failure to attract new customers and expand sales to our existing customers, including by effectively marketing and pricing our products;
• the possibility that our customers may cancel, defer or limit purchases as a result of reduced information technology budgets;
• the possibility that our customers may defer purchases of our solutions in anticipation of new solutions or updates from us or our competitors;
• the ability of our OEMs and resellers to meet their sales objectives;
• market acceptance of our new solutions and enhancements;
• our ability to control expenses;
• changes in our pricing, packaging and distribution terms or those of our competitors; and
• the demands on our management, sales force and customer services infrastructure as a result of the introduction of new solutions or updates.

Our expense levels are relatively fixed and are based, in part, on our expectations of future revenues. If revenue levels fall below our expectations and we are profitable at the time, our net income would decrease because only a small portion of our expenses varies with our revenues. Therefore, any significant decline in revenues for any period could have an immediate adverse impact on our results of operations for that period. We believe that period-to-period comparisons of our results of operations should not be relied upon as an indication of future performance. Our results of operations could be below expectations of public market analysts and investors in future periods which would likely cause the market price of our common stock to decline.

The price of our common stock may be highly volatile and may decline regardless of our operating performance.

The market price of our common stock could be subject to significant fluctuations in response to:

• variations in our quarterly or annual operating results;
• changes in financial estimates, treatment of our tax assets or liabilities or investment recommendations by securities analysts following our business or our competitors;
• the public’s response to our press releases, rumors, our other public announcements and our filings with the SEC;
• changes in accounting standards, policies, guidance or interpretations or principles;
• sales of common stock by our directors, officers and significant stockholders;
• announcements of technological innovations or enhanced or new products by us or our competitors;
• our failure to achieve operating results consistent with securities analysts’ projections;
• the operating and stock price performance of other companies that investors may deem comparable to us;
• broad market and industry factors, including economic downturns and financial instability of banking institutions; and
• other events or factors, including those resulting from war, incidents of terrorism or responses to such events.

The market prices of companies in the data protection and cyber resiliency market have been extremely volatile. Stock prices of many of those companies have often fluctuated in a manner unrelated or disproportionate to their operating performance. In the past, following periods of market volatility, stockholders have often instituted securities class action litigation. Securities litigation could have a substantial cost and divert resources and the attention of management from our business.

Although we believe we currently have adequate internal control over financial reporting, we are required to assess our internal control over financial reporting on an annual basis, and any future adverse results from such assessment could result in a loss of investor confidence in our financial reports and have an adverse effect on our stock price.

Management has assessed that our internal control over financial reporting is effective and lacks any material weaknesses. Such assessment is made through subjective judgment of our management that may be open to interpretation. The effectiveness of our internal control in the future is subject to the risk that such internal controls may become inadequate. In the future, if we fail to timely complete this assessment, or if our independent auditors are unable to express an opinion on the effectiveness of our internal controls, there may be a loss of public confidence in our financial reporting, the market price of our stock could decline and we could be subject to regulatory sanctions or investigations by the Nasdaq Stock Market, the SEC or other regulatory authorities, which would require additional financial and management resources. Any failure to implement required new or improved controls, or difficulties encountered in their implementation, could harm our operating results or cause us to fail to timely meet our regulatory reporting obligations.

Certain provisions of our certificate of formation and our amended and restated bylaws or Delaware law could prevent or delay a potential acquisition of control of our Company, which could decrease the trading price of our common stock.

Our certificate of formation, amended and restated bylaws and the laws in the State of Delaware contain provisions that are intended to deter coercive takeover practices and inadequate takeover bids by making such practices or bids unacceptably expensive to the prospective acquirer and to encourage prospective acquirers to negotiate with our Board of Directors rather than to attempt a hostile takeover. Delaware law also imposes restrictions on mergers and other business combinations between us and any holder of 15% or more of our outstanding common stock.

We believe that these provisions protect our shareholders from coercive or otherwise unfair takeover tactics by effectively requiring those who seek to obtain control of the Company to negotiate with our Board of Directors and by providing our Board of Directors with more time to assess any acquisition of control. However, these provisions could apply even if an acquisition of control of the Company may be considered beneficial by some shareholders and could delay or prevent an acquisition of control that our Board of Directors determines is not in the best interests of our Company and our shareholders.

General Risks

Our business could be materially and adversely affected as a result of natural disasters, terrorism or other catastrophic events.

Any economic failure or other material disruption caused by war, climate change or natural disasters, including fires, floods, hurricanes, earthquakes, and tornadoes; power loss or shortages; environmental disasters; telecommunications or business information systems failures or similar events could also adversely affect our ability to conduct business. If such disruptions result in cancellations of customer orders or contribute to a general decrease in economic activity or corporate spending on IT, or impair our ability to meet our customer demands, our operating results and financial condition could be materially adversely affected.

There is also an increasing concern over the risks of climate change and related environmental sustainability matters. In addition to physical risks, climate change risk includes longer-term shifts in climate patterns, such as extreme heat, sea level rise, and more frequent and prolonged drought. Such events could disrupt our operations or those of our customers or third parties on which we rely, including through direct damage to assets and indirect impacts from supply chain disruption and market volatility.

Our business may be adversely affected by the ongoing Russia-Ukraine conflict, the regional conflict in the Middle East or a public health crisis. These events may cause us or our customers to temporarily suspend operations and could adversely affect the economies and financial markets of many countries, resulting in an economic downturn that could affect demand for our solutions, our ability to collect against existing trade receivables and our operating results.

Risk Management and Strategy

Commvault has established a cybersecurity program for the benefit of the company, our customers, partners and stakeholders. The cybersecurity program includes policies, processes and practices that are designed to assess, identify and manage material risks from cybersecurity threats and is integrated into our enterprise risk management program. Led by the Chief Security Officer (“CSO”), Commvault’s cybersecurity program leverages the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, with the primary objective of securing systems and data from cyber threats. We partner with industry-leading cybersecurity experts for continuous monitoring, alerting, mitigation and responsiveness related to our cybersecurity program. We adopt industry best practices and security technologies and have established a Security Incident Response Plan ("SIRP") which outlines our processes for incident preparation, detection, analysis, containment, eradication, and post-incident analysis. In addition to the SIRP, we maintain a Crisis Management Plan to organize roles and responsibilities in the event of a crisis, a Disaster Recovery Plan to provide guidance in the recovery of systems following an outage, and a Business Continuity Plan to identify alternative means of conducting business in the event of business disruption. We partner with third party service providers to enhance our monitoring and response capabilities, facilitate readiness activities including tabletop exercises, and perform various methods of cybersecurity penetration testing. All employees are required to undergo annual security awareness training on current and potential cybersecurity threats and report suspicious activity. We also assess third-party service provider cybersecurity controls and include security and privacy terms in contracts as appropriate.

Commvault maintains a variety of third-party certifications and undergoes annual assessments for SOC 2 Type 2, ISO 27001, HIPAA, CJIS, and PCI DSS. In support of these certifications and assessments, our products also undergo security testing. Annually, internal auditors complete a risk assessment of specific business operations, such as privacy and sanctions compliance and travel and expense policy compliance, identify areas of heightened risk, and conduct dedicated audit engagements. The findings, observations, and recommendations from these engagements are shared with Management, including the CEO, CFO, Chief Trust Officer, CSO, Chief Information Officer ("CIO"), and Senior Vice President of Engineering and the Audit Committee, as appropriate.

Given the increasingly complex and sophisticated cyber threat landscape, we try to be vigilant to predict and prevent attacks. Commvault has prioritized cyber resilience measures and leverages governance processes and procedures to mitigate potential business impacts if and when an adverse event occurs. To date, Commvault is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect Commvault, including its business strategy, results of operations or financial condition. Although no material impacts have been recorded to date, IT system failures, network disruptions, cybersecurity incidents, and data breaches could adversely impact our business, internal controls, results of operations, and financial condition. For example, in February and April 2025, Microsoft notified the Company about unauthorized activity within our Azure environment by a suspected nation-state threat actor. As part of the ongoing investigation regarding this activity, the Company immediately activated its incident response plan, issued security advisories, and implemented several advanced security measures, including enhanced rotation of credentials and strengthened security monitoring, among other proactive measures.

For additional description of cybersecurity risks and potential related impacts on Commvault, refer to the risk factor captioned “Risks Related to Technology and Security – We may be subject to IT system failures, network disruptions, cybersecurity incidents and breaches in data security” in Part 1, Item 1A. “Risk Factors.”

Governance

Commvault’s Board of Directors (the "Board") provides oversight of Commvault’s enterprise risk management strategy, which includes risks from cybersecurity threats. The Audit Committee of the Board receives quarterly briefings on the cybersecurity program from the CSO and briefings on the Enterprise Risk Management Committee (“ERMC”) from the Chief Trust Officer. The Board is kept apprised of cybersecurity updates through quarterly reporting from the Audit Committee Chair and annual, or as needed, reporting directly to the Board from the CSO.

Commvault’s Management, including the CEO, CFO, Chief Trust Officer, CSO, CIO, and Senior Vice President of Engineering, is responsible for our cybersecurity risk management strategy, operational decision- making, and incident preparedness and response. The current CSO holds a Bachelor of Science and Master of Business Administration from the University of Maryland, industry certifications such as CISSP, PMP, CIPP/E, CIPP/US and CISA, is affiliated with various industry working groups focused on threat intelligence and privacy, and has over twenty years of experience in cybersecurity leading technical, operational, and strategic programs to protect critical data and infrastructure. Management ensures cybersecurity risks are communicated through the establishment of the ERMC and regular, or as needed, reporting to the Audit Committee and the Board. The ERMC is responsible for the implementation, maintenance, and execution of our enterprise risk management program. The ERMC meets quarterly, or as needed, to assess, consider, and manage material risks, including cybersecurity threats across the business. An Executive Security Council is responsible for the significant operational decisions in the event of an active cybersecurity incident. The Executive Security Council meets monthly, or as needed, with the Audit Committee Chair as an optional attendee, to provide counsel and foster productive communication between Management and the Board.

Our principal administrative, sales, marketing, customer support and research and development facility is located at our owned corporate headquarters in Tinton Falls, New Jersey. In October 2024, we signed a purchase and sale agreement to sell the property. We believe the sale will be completed in the first quarter of fiscal 2026. Upon closing of the transaction, we will enter into a lease for a portion of the premises.

In addition, we have offices in the United States in California and Florida; and outside the United States in Australia, Austria, Belgium, Brazil, Canada, China, Denmark, Egypt, France, Germany, India, Israel, Italy, Japan, Malaysia, Netherlands, Saudi Arabia, Singapore, South Africa, South Korea, Spain, Sweden, Switzerland, Taiwan, United Arab Emirates, and United Kingdom.

From time to time, we are subject to claims in legal proceedings arising in the normal course of business. We do not believe that we are currently party to any pending legal action that could reasonably be expected to have a material adverse effect on our business or operating results.

You should read the following discussion and analysis along with our consolidated financial statements and the related notes included elsewhere in this Annual Report on Form 10-K. The statements in this discussion regarding our expectations of our future performance, liquidity and capital resources, and other non-historical statements are forward-looking statements. These forward-looking statements are subject to numerous risks and uncertainties, including, but not limited to, the risks and uncertainties described under “Risk Factors” and elsewhere in this Annual Report on Form 10-K. Our actual results may differ materially from those contained in or implied by any forward-looking statements. For discussion comparing the period ended March 31, 2024 to March 31, 2023, please refer to our Annual Report on Form 10-K, filed with the SEC on May 13, 2024.

Overview

Commvault Systems, Inc. aims to provide its customers cyber resiliency by protecting and recovering their data and cloud-native applications in a world of increasing cyber threats and attacks, including ransomware. We provide products and services across many types of environments, including on-premises, hybrid and multi-cloud. Our offerings are delivered via self-managed software, software-as-a-service ("SaaS"), integrated appliances, or managed by partners.

Industry

Our industry continues to go through accelerating changes as the result of compounding data growth, increasing security threats, and the introduction of new technologies. These changes are shifting the demands on the importance of resilience for the modern enterprise. Companies now require a comprehensive cyber resilience platform that simplifies and manages these forces holistically. Commvault Cloud is designed to secure and accelerate the recovery so that data can be restored from anywhere to anywhere, rapidly, reliably, and at scale.

Sources of Revenues

We generate revenues through subscription arrangements, perpetual software licenses, customer support contracts and other services. A significant portion of our total revenues comes from subscription arrangements, which include both sales of term-based licenses and SaaS offerings. We are focused on these types of recurring revenue arrangements.

We expect our subscription arrangements will continue to generate revenues from the renewals of term-based licenses and SaaS offerings sold in prior years. Any of our pricing models (capacity, instance based, etc.) can be sold via a subscription arrangement, either through term-based licensing or hosted services. In term-based license arrangements, the customer has the right to use the software over a designated period of time. The capacity of the license is fixed and the customer has made an unconditional commitment to pay. Software revenue in these arrangements is generally recognized when the software is delivered. In SaaS offerings, customers use hosted software over the contract period without taking possession of the software. Revenue related to SaaS is recognized ratably over the contract period.

We sell to end-user customers both directly through our sales force and indirectly through our global network of value-added reseller partners, systems integrators, corporate resellers, OEMs and marketplaces. Subscription revenue generated through indirect distribution channels accounted for approximately 90% of total subscription revenue in recent fiscal years. Subscription revenue generated through direct distribution channels accounted for approximately 10% of total subscription revenue in recent fiscal years. Deals initiated by our direct sales force are sometimes transacted through indirect channels based on end-user customer requirements, which are not always in our control and can cause this overall percentage split to vary from period-to-period. As such, there may be fluctuations in the dollars and percentage of subscription revenue generated through our direct distribution channels from time-to-time. We believe that the growth of our subscription revenue, derived from both our indirect channel partners and direct sales force, are key attributes to our long-term growth strategy. We intend to continue to invest in both our channel relationships and direct sales force in the future, but we continue to expect more revenue to be generated through indirect distribution channels over the long term. The failure of our indirect distribution channels or our direct sales force to effectively sell our products and services could have a material adverse effect on our revenues and results of operations.

We have a non-exclusive distribution agreement with Arrow pursuant to which Arrow's primary role is to enable a more efficient and effective distribution channel for our solutions by managing our resellers and leveraging their own industry experience. We generated approximately 35%, 36% and 37% of our total revenues through Arrow in fiscal 2025, fiscal 2024 and fiscal 2023, respectively. If Arrow were to discontinue or reduce the sales of our solutions or if our agreement with Arrow was terminated, and if we were unable to take back the management of our reseller channel or find another distributor to replace Arrow, there could be a material adverse effect on our future business.

Our customer support revenue includes support contracts tied to our software products. Customer support includes software updates on a when-and-if-available basis, telephone support, integrated web-based support, and other premium support offerings, for both term-based software license and perpetual software license arrangements. We sell our customer support contracts as a percentage of net software. Customer support revenue is recognized ratably over the term of the customer support agreement, which is typically one year on our perpetual licenses. The term of our subscription arrangements is typically one to three years but can range between one and five years.

Our other services revenue consists primarily of professional service offerings, including consultation, assessment and design, installation services, and customer education. Revenues from other services can vary period over period based on the timing services are delivered and are typically recognized as the services are performed.

Description of Costs and Expenses

Our cost of revenues is as follows:

• Cost of Subscription Revenue, consists primarily of the cost of third-party royalties and other costs such as media, manuals, translation and distribution costs, and third-party hosting fees related to our SaaS offerings;
• Cost of Perpetual License Revenue, consists primarily of the cost of third-party royalties;
• Cost of Customer Support Revenue, consists of salary and employee benefit costs in providing customer support services; and
• Cost of Other Services Revenue, consists of salary and employee benefit costs in providing professional services.

Our operating expenses are as follows:

• Sales and Marketing, consists primarily of salaries, commissions, employee benefits, stock-based compensation and other direct and indirect business expenses, including travel and related expenses, sales promotion expenses, public relations expenses and costs for marketing materials and other marketing events (such as trade shows and advertising);
• Research and Development, consists primarily of salaries, stock-based compensation, benefits and related expenses for research and development personnel associated with the development of new, or the modification of existing, offerings and applications; further, costs related to certain contract labor and consulting fees and expenses associated with the design, certification and testing of our offerings are included; as well as legal costs associated with the patent registration of such offerings and applications;
• General and Administrative, consists primarily of salaries, stock-based compensation and benefits for our executive, accounting, human resources, legal, information technology and other administrative personnel. Also included in this category are other general corporate expenses, such as outside legal and accounting services, compliance costs and insurance; and
• Depreciation and Amortization, consists of depreciation expense for fixed assets, computer equipment we use for information services and in our development and test labs, and amortization of intangible assets. In fiscal year 2023, depreciation for our owned corporate headquarters was also included.

Foreign Currency Exchange Rates’ Impact on Results of Operations

Sales outside the United States were 46% of our total revenues for fiscal 2025, 48% for fiscal 2024 and 47% for fiscal 2023. The income statements of our non-U.S. operations are translated into U.S. dollars at the average exchange rates for each applicable month in a period. To the extent the U.S. dollar weakens against foreign currencies, the translation of these foreign currency denominated transactions generally results in increased revenue, operating expenses and income from operations for our non-U.S. operations. Similarly, our revenue, operating expenses and net income will generally decrease for our non-U.S. operations if the U.S. dollar strengthens against foreign currencies.

Using the average foreign currency exchange rates from fiscal 2024, our fiscal 2025 total revenues would have been higher by $4.2 million and our cost of revenues would have been higher by $1.0 million, respectively. Our operating expenses would not have been materially impacted for fiscal 2025.

In addition, we are exposed to risks of foreign currency fluctuation primarily from cash balances, accounts receivables and intercompany accounts denominated in foreign currencies and are subject to the resulting transaction gains and losses, which are recorded as a component of general and administrative expenses. We recognized net foreign currency transaction losses of $1.5 million, $2.4 million and $1.2 million in fiscal 2025, fiscal 2024 and fiscal 2023, respectively.

Critical Accounting Policies

In presenting our consolidated financial statements in conformity with U.S. generally accepted accounting principles ("GAAP"), we are required to make estimates and judgments that affect the amounts reported therein. Some of the estimates and assumptions we are required to make relate to matters that are inherently uncertain as they pertain to future events. We base these estimates on historical experience and on various other assumptions that we believe to be reasonable and appropriate. Actual results may differ significantly from these estimates. To the extent that there are material differences between these estimates and actual results, our future financial statement presentation, financial condition, results of operations and cash flows may be affected.

In many cases, the accounting treatment of a particular transaction is specifically dictated by GAAP and does not require management’s judgment in its application, while in other cases, significant judgment is required in selecting among available alternative accounting standards that allow different accounting treatment for similar transactions. We consider these policies requiring significant management judgment to be critical accounting policies. The following is a description of these critical accounting policies.

Revenue Recognition

We account for revenue in accordance with Accounting Standards Codification ("ASC") 606, Revenue from Contracts with Customers. Our revenue recognition policies require us to make significant judgments and estimates. In applying our revenue recognition policy, we must determine which portions of our revenue are recognized currently (generally software-related revenue) and which portions must be deferred and recognized in future periods (generally SaaS, customer support, and other services revenue). We analyze various factors including, but not limited to, the selling price of undelivered services when sold on a stand-alone basis, our pricing policies, the creditworthiness of our customers, and contractual terms and conditions in helping us to make such judgments about revenue recognition. As most of our transactions go through indirect distribution channels, we are also required to make judgments around principal versus agent considerations and judgments around which party is our customer in multi-party arrangements. Changes in judgment on any of these factors could materially impact the timing and amount of revenue recognized in a given period. We recognize revenue net of sales tax.

We generate revenues through subscription arrangements, perpetual software licenses, customer support contracts and other services. A significant portion of our total revenues comes from subscription arrangements, which include both sales of term-based licenses and SaaS offerings. We are focused on these types of recurring revenue arrangements.

We expect our subscription arrangements will continue to generate revenues from the renewals of term-based licenses and SaaS offerings sold in prior years. We offer of our pricing models (capacity, instance based, etc.) to be sold via a subscription arrangement, either through term-based licensing or hosted services. In term-based license arrangements, the customer has the right to use the software over a designated period of time. The capacity of the license is fixed and the customer has made an unconditional commitment to pay. Software revenue in these arrangements is generally recognized when the software is delivered. In SaaS offerings, customers use hosted software over the contract period without taking possession of the software. Revenue related to SaaS is recognized ratably over the contract period.

We sell both perpetual and term-based licenses of our software. We refer to our term-based software licenses as subscription arrangements. We do not customize our software and installation services are not required. The software is delivered before related services are provided and is functional without professional services, updates and technical support. We have concluded that our software licenses (both perpetual and subscription) are functional intellectual property that is distinct, as the user can benefit from the software on its own. Revenues for both perpetual and term-based licenses is typically recognized when the software is delivered and/or made available for download as this is the point the user of the software can direct the use of, and obtain substantially all of the remaining benefits from, the functional intellectual property. We do not recognize software revenue related to the renewal of subscription software licenses earlier than the beginning of the new subscription period.

We also offer software that integrates with appliances and address a wide range of business needs and use cases, ranging from support for remote or branch offices with limited IT staff up to large corporate data centers. These appliances are almost exclusively sold via a software only model in which we sell software to a third party, which assembles an integrated appliance that is sold to end user customers. As a result, the revenues and costs associated with hardware are usually not in our financial statements.

Our customer support revenue includes support contracts tied to our software products. Customer support includes software updates on a when-and-if-available basis, telephone support, integrated web-based support, and other premium support offerings, for both term-based software license and perpetual software license arrangements. We sell our customer support contracts as a percentage of net software. Customer support revenue is recognized ratably over the term of the customer support agreement, which is typically one year on our perpetual licenses. The term of our subscription arrangements is typically one to three years, but can range between one and five years.

Our other services revenue consists primarily of professional service offerings, including consultation, assessment and design, installation services, and customer education. Revenues from other services can vary period over period based on the timing services are delivered and are typically recognized as the services are performed.

Most of our contracts with customers contain multiple performance obligations. For these contracts, we evaluate and account for individual performance obligations separately if they are determined to be distinct. The transaction price is allocated to the separate performance obligations on a relative standalone selling price basis. Standalone selling prices of software licenses (both perpetual and term-based) are typically estimated using the residual approach. Standalone selling prices for SaaS, customer support contracts, and other services are typically estimated based on observable transactions when these services are sold on a standalone basis.

Our typical performance obligations include the following:

Accounting for Income Taxes

Under ASC 740, deferred income taxes arise from temporary differences between the tax basis of assets and liabilities and their reported amounts. Valuation allowances are established when, in our judgment, it is more likely than not that deferred tax assets will not be realized. In assessing the need for a valuation allowance, we consider all available objective and verifiable evidence both positive and negative, including historical levels of pre-tax income or loss, both on a consolidated basis and tax reporting entity basis, legislative developments, expectations and risks associated with estimates of future pre-tax income, and prudent and feasible tax planning strategies. At March 31, 2025 and 2024, we recorded a valuation allowance, which reflects uncertainties around our ability to generate sufficient income in certain jurisdictions to utilize our net deferred tax assets. At March 31, 2023, we had recorded a full valuation allowance as the realizability of the Company's gross deferred tax assets was not more likely than not. We believe, in the current period, it is more likely than not that we will have sufficient taxable income to realize our remaining deferred tax assets.

Goodwill and Purchased Intangible Assets

Goodwill represents the residual purchase price paid in a business combination after the fair value of all identified assets and liabilities have been recorded. We test goodwill for impairment at least annually, on January 1, or more frequently if events or changes in circumstances indicate that the carrying value of goodwill may not be recoverable. We have one reporting unit. Goodwill is tested at this reporting unit level. We have elected to first assess the qualitative factors to determine whether it is more likely than not that the fair value of our single reporting unit is less than its carrying amount as a basis for determining whether it is necessary to perform the quantitative goodwill impairment test. This may involve making judgments about a variety of factors that impact fair value, including business plans, anticipated future cash flows, economic projections, and other market data. If the qualitative assessment indicates that it is more likely than not that the fair value is less than the carrying amount, a quantitative goodwill impairment test is performed. If the fair value exceeds the carrying amount, no further analysis is required; otherwise, an impairment loss is recognized for the amount by which the carrying value of goodwill exceeds its fair value. Because there are inherent uncertainties involved in these factors, significant differences between these estimates and actual results could result in future impairment charges and could materially impact our future financial results. No impairment of goodwill has been identified during the years presented.

We apply judgment in estimating the fair value of purchased intangible assets, which involves the use of significant judgment. The assumptions used in valuing intangible assets include, but are not limited to, future expected cash flows of the asset, discount rates to determine the present value of the future cash flows, attrition rates of customers, and expected technology life cycles. We also estimate the useful lives of the intangible assets based on the expected period over which we anticipate generating economic benefit from the asset. Additionally, we assess purchased intangible assets for impairment when events or changes in circumstances indicate the carrying amount is not recoverable and exceeds its fair value. Determining the fair value of intangible assets requires management to make estimates based on all available information and, in some cases, assumptions regarding the timing and amount of future revenues and expenses associated with the asset. Because there are inherent uncertainties involved in these factors, significant differences between these estimates and actual results could result in future impairment charges and could materially impact our future financial results. No impairment of purchased intangible assets has been identified during the years presented.

Results of Operations

Amounts reported in millions are rounded based on the amounts in thousands. As a result, the sum of the components reported in millions may not equal the total amount reported in millions due to rounding.

Fiscal year ended March 31, 2025 compared to fiscal year ended March 31, 2024

Revenues ($ in millions)

• Total revenues increased $156.4 million, or 19% year over year, driven primarily by an increase in subscription revenue, partially offset by decreases in perpetual license and other services revenues. We remain focused on selling subscription arrangements through both term-based software licenses and SaaS offerings.
• Subscription revenue increased $160.5 million, or 37% year over year, driven primarily by a 74% increase in our SaaS revenue. Term-based license revenue increased 22%, primarily due to an increase in the number of larger term-based license transactions (deals greater than $0.1 million) period over period and an increase in the average selling price of these transactions. Subscription revenue accounted for 59% of total revenues in fiscal 2025 compared to 51% in fiscal 2024.
• Perpetual license revenue decreased $2.0 million, or 3% year over year. Our preferred route to market is led by the sale of term-based licenses. Perpetual licenses are generally only sold in certain verticals and geographies. Perpetual license revenue accounted for 6% of total revenues in fiscal 2025 compared to 7% in fiscal 2024.
• Customer support revenue was flat compared to the same period of the prior year, driven by a $25.7 million decrease in customer support revenue attached to perpetual license support renewals, offset by a $25.5 million increase in customer support related to term-based license arrangements.
• Other services revenue decreased $2.0 million, or 4% year over year. Changes in other services revenue can vary period over period primarily due to the timing professional services are delivered.

We track total revenues on a geographic basis. Our Americas region includes the United States, Canada, and Latin America. Our International region primarily includes Europe, Middle East, Africa, Australia, India, Southeast Asia and China. Americas and International represented 61% and 39% of total revenues, respectively, for the fiscal year ended March 31, 2025. Total revenues increased 22% and 14% year over year in the Americas and International, respectively.

• The increase in the Americas total revenues was primarily due to increases of 40% and 12% in subscription and perpetual license revenues, respectively. Customer support and other services revenues declined 2% and 3%, respectively.
• The increase in International total revenues was primarily due to a 33% increase in subscription revenue, partially offset by a 10% decrease in perpetual license revenue, driven by the shift from selling perpetual licenses to subscription arrangements. Customer support revenue increased 2% year over year. Other services revenue declined 6% year over year due to a decrease in the delivery of professional services as compared to the same period of the prior year.

Our total revenues in International is subject to changes in foreign exchange rates as further discussed above in the “Foreign Currency Exchange Rates’ Impact on Results of Operations” section.

Cost of Revenues and Gross Margin ($ in millions)

• Total cost of revenues increased $27.4 million and represented 18% of our total revenues in fiscal 2025 and fiscal 2024.
• Cost of subscription revenue increased $30.5 million, representing 15% of our total subscription revenue in fiscal 2025 compared to 14% in fiscal 2024. The year over year increase is primarily the result of incremental hosting costs associated with the Clumio, Inc. ("Clumio") acquisition and an increase in the cost of infrastructure related to growth in our SaaS offerings.
• Cost of perpetual license revenue decreased $0.7 million and represented 3% of our total perpetual revenue in fiscal 2025 compared to 4% in fiscal 2024.
• Cost of customer support revenue decreased $3.1 million and represented 19% of our total customer support revenue in fiscal 2025 compared to 20% in fiscal 2024.
• Cost of other services revenue increased $0.7 million, representing 72% of our total other services revenue in fiscal 2025 compared to 68% in fiscal 2024.

Operating Expenses ($ in millions)

• Sales and marketing expenses increased $79.1 million, or 22%, due to increases in sales commissions and bonus associated with increased revenues relative to the prior year; increases in employee compensation tied to strategic go to market investments; and, an increase of $11.0 million in stock-based compensation. In addition, in fiscal 2025, there were increases year over year in certain marketing and go to market activities, which included a live sales kickoff event and participation in certain strategic conferences, including the RSA conference, which did not occur in fiscal 2024.
• Research and development expenses increased $14.0 million, or 11%, driven by increases in employee compensation and related expenses resulting from additional headcount related to the Appranix, Inc. ("Appranix") and Clumio acquisitions completed in April 2024 and October 2024, respectively. Expenses related to stock-based compensation increased $2.4 million compared to the prior year. Investing in research and development remains a priority for Commvault and we anticipate continued responsible spending related to the development of our software applications and hosted services.
• General and administrative expenses increased $24.4 million, or 21%, driven by increases in accounting and legal expenses related to the acquisitions of Appranix and Clumio, and increases in employee compensation and related expenses, including a $3.2 million increase in stock-based compensation year over year.
• Restructuring: Our restructuring plan, initiated in the fourth quarter of fiscal 2024 and completed in fiscal 2025, was intended to enhance customer satisfaction through the reorganization and redesign of our customer success functions. The realignment of the customer success structure aimed to optimize operational efficiency and improve continuity for our customers through the pre-sales and post-sales experience. Restructuring expenses were $10.0 million and $4.5 million for the years ended March 31, 2025 and 2024, respectively. These charges related primarily to severance and related costs associated with headcount reductions as well as costs related to office termination and exit charges. These expenses included $4.6 million in fiscal 2025 and $1.5 million in fiscal 2024 of stock-based compensation related to modifications of existing awards granted to certain employees impacted by the plan.

Risks associated with our restructuring plan include additional unexpected costs, adverse effects on employee morale and the failure to meet operational and growth targets due to the loss of key employees, any of which may impair our ability to achieve anticipated results of operations or otherwise harm our business.

• Depreciation and amortization expense increased $2.7 million, or 41%, driven by the acquisition of certain intangible assets in fiscal 2025.
• Change in contingent consideration: During the year ended March 31, 2025, we recorded an expense of $2.1 million related to changes in the estimated fair value of our contingent consideration arrangement. The arrangement is contingent upon meeting certain financial metrics by June 30, 2025 and can range up to $4.0 million.
• Impairment charges: During the year ended March 31, 2025, we recorded an impairment charge of $2.9 million related to our assets held for sale, which includes changes in the estimated fair value and estimated costs to sell.

Income Tax Expense (Benefit)

Income tax expense was $4.9 million in fiscal 2025 compared to a benefit of $85.3 million in fiscal 2024. Income tax expenses for the year ended March 31, 2025 relate primarily to current federal taxes. The income tax benefit for the fiscal year ended March 31, 2024 relates primarily to the release of the previously recorded valuation allowance against certain deferred tax assets in the U.S. and foreign jurisdictions.

Liquidity and Capital Resources

In recent fiscal years, our principal source of liquidity has been cash provided by operations. As of March 31, 2025, our cash and cash equivalents balance was $302.1 million, of which approximately $265.4 million was held outside of the United States by our foreign legal entities. These balances are dispersed across approximately 35 international locations around the world. We believe that such dispersion meets the current and anticipated future liquidity needs of our foreign legal entities. In the event we need to repatriate funds from outside of the United States, such repatriation would likely be subject to restrictions by local laws and/or tax consequences, including foreign withholding taxes.

On December 13, 2021, we entered into a five-year $100 million senior secured revolving credit facility (the “Credit Facility”) with JPMorgan Chase Bank, N.A. The Credit Facility is available for share repurchases, general corporate purposes, and letters of credit. The Credit Facility contains financial maintenance covenants including a leverage ratio and interest coverage ratio. The Credit Facility also contains certain customary events of default which would permit the lender to, among other things, declare all loans then outstanding to be immediately due and payable if such default is not cured within applicable grace periods. The Credit Facility also limits our ability to incur certain additional indebtedness, create or permit liens on assets, make acquisitions, make investments, loans or advances, sell or transfer assets, pay dividends or distributions, and engage in certain transactions with foreign affiliates. Outstanding borrowings under the Credit Facility accrue interest at an annual rate equal to the Secured Overnight Financing Rate plus 1.25% subject to increases based on our actual leverage. The unused balance on the Credit Facility is also subject to a 0.25% annual interest charge subject to increases based on our actual leverage. As of March 31, 2025, there were no borrowings under the Credit Facility and we were in compliance with all covenants.

On April 15, 2025, we successfully refinanced our existing $100 million senior secured revolving credit facility, replacing it with a new five-year senior secured revolving credit facility. This refinancing has increased the Company's total borrowing capacity to $300 million. Under the terms of the new Credit Facility, borrowings will accrue interest at a per annum rate determined by the Company’s election of either the Secured Overnight Financing Rate (SOFR) plus a margin ranging from 1.50% to 2.00%, or a base rate, which is generally the greater of the prime rate plus a margin ranging from 0.50% to 1.00%. The applicable margin in each case is contingent upon the Company’s leverage ratio. Additionally, the unused balance on the Credit Facility is also subject to an annual interest charge of 0.25% subject to increases based on the Company's leverage ratio.

During the fiscal year ended March 31, 2025, we repurchased $165.0 million of common stock, or approximately 1.2 million shares. On April 17, 2025, the Board of Directors approved an increase in our share repurchase program so that $250.0 million was available. The Board's authorization has no expiration date.

A summary of the cash used for the stock repurchase program consists of the following:

Our summarized cash flow information is as follows (in millions):

- Net cash provided by operating activities was impacted by:

• Fiscal 2025: net income adjusted for the impact of non-cash charges and an increase in deferred revenue, partially offset by an increase in accounts receivable.
• Fiscal 2024: net income adjusted for the impact of non-cash charges and an increase in deferred revenue, partially offset by an increase in accounts receivable.

- Net cash used in investing activities was impacted by:

• Fiscal 2025: $65.3 million for the acquisitions of Appranix and Clumio, $3.8 million of capital expenditures and $1.3 million for the purchase of equity securities.
• Fiscal 2024: $4.1 million of capital expenditures and $1.4 million for the purchase of equity securities.

- Net cash used in financing activities was impacted by:

• Fiscal 2025: $165.0 million used to repurchase shares of our common stock under our repurchase program, partially offset by $17.5 million of proceeds from the exercise of stock options and the Employee Stock Purchase Plan.
• Fiscal 2024: $184.0 million used to repurchase shares of our common stock under our repurchase program, partially offset by $13.4 million of proceeds from the exercise of stock options and the Employee Stock Purchase Plan.

Working capital decreased $30.2 million from $110.2 million as of March 31, 2024 to $80.0 million as of March 31, 2025. The decrease in working capital is primarily the result of a decrease in cash and cash equivalents driven by the acquisitions of Appranix and Clumio in fiscal 2025 and an increase in the current portion of deferred revenue, partially offset by an increase in accounts receivable.

We believe that our existing cash, cash equivalents and our cash from operations will be sufficient to meet our anticipated cash needs for working capital, income taxes, capital expenditures and potential stock repurchases for at least the next twelve months. We may seek additional funding through public or private financings or other arrangements during this period. Adequate funds may not be available when needed or may not be available on terms favorable to us, or at all. If additional funds are raised by issuing equity securities, dilution to existing stockholders will result. If we raise additional funds by obtaining loans from third parties, the terms of those financing arrangements may include negative covenants or other restrictions on our business that could impair our operational flexibility and would also require us to fund additional interest expense. If funding is insufficient at any time in the future, we may be unable to develop or enhance our products or services, take advantage of business opportunities or respond to competitive pressures, any of which could have a material adverse effect on our business, financial condition and results of operations.

Summary Disclosures about Contractual Obligations and Commercial Commitments

We have various contractual obligations and commitments, such as contingent consideration obligations, purchase commitments, royalty expenses, warranties, and leases that are disclosed in the notes to the consolidated financial statements. See Note 4 "Business Combinations", Note 9 "Commitments and Contingencies" and Note 16 "Leases" of the notes to the consolidated financial statements for further information regarding these commitments.

Indemnifications

Certain of our software licensing agreements contain certain provisions that indemnify our customers from any claim, suit or proceeding arising from alleged or actual intellectual property infringement. These provisions continue in perpetuity along with our software licensing and SaaS agreements. We have never incurred a liability relating to one of these indemnification provisions in the past and we believe that the likelihood of any future payout relating to these provisions is remote. Therefore, we have not recorded a liability during any period related to these indemnification provisions.

Impact of Recently Issued Accounting Standards

See Note 2 of the notes to the consolidated financial statements for a discussion of the impact of recently issued accounting standards.

Interest Rate Risk

None.

Foreign Currency Risk

Economic Exposure

As a global company, we face exposure to adverse movements in foreign currency exchange rates. Our international sales are generally denominated in foreign currencies and this revenue could be materially affected by currency fluctuations. Approximately 46% of our sales were outside the United States in fiscal 2025 and 48% in fiscal 2024. Our primary exposures are to fluctuations in exchange rates for the U.S. dollar versus the Euro, and to a lesser extent, the Australian dollar, British pound sterling, Canadian dollar, Chinese yuan, Indian rupee, Korean won and Singapore dollar. Changes in currency exchange rates could adversely affect our reported revenues and require us to reduce our prices to remain competitive in foreign markets, which could also have a material adverse effect on our results of operations. Historically, we have periodically reviewed and revised the pricing of our products available to our customers in foreign countries and we have not maintained excess cash balances in foreign accounts.

We estimate that a hypothetical 10% change in all foreign exchange rates would impact our reported operating profit by approximately $15.5 million annually. This sensitivity analysis disregards the possibilities that rates can move in opposite directions and that losses from one geographic area may be offset by gains from another geographic area.

Transaction Exposure

Our exposure to foreign currency transaction gains and losses is primarily the result of certain net receivables due from our foreign subsidiaries and customers being denominated in currencies other than the functional currency of the subsidiary. Our foreign subsidiaries conduct their businesses in local currency and we generally do not maintain excess U.S. dollar cash balances in foreign accounts.

Foreign currency transaction gains and losses are recorded in general and administrative expenses in the consolidated statements of operations. We recognized net foreign currency transaction losses of $1.5 million, $2.4 million and $1.2 million in the years ended March 31, 2025, 2024 and 2023, respectively.

Evaluation of Disclosure Controls and Procedures

Our management, with the participation of the Chief Executive Officer and Chief Financial Officer, has evaluated the effectiveness of our disclosure controls and procedures, as defined in Rules 13a-15(e) and 15d-15(e) of the Securities Exchange Act of 1934, as of March 31, 2025. Based on that evaluation, the Chief Executive Officer and Chief Financial Officer concluded that our disclosure controls and procedures were effective as of March 31, 2025.

Management’s Report on Internal Control over Financial Reporting

Our management is responsible for establishing and maintaining adequate internal control over our financial reporting as defined in Rules 13a-15(f) of the Exchange Act. There are inherent limitations in the effectiveness of any internal control, including the possibility of human error and the circumvention or overriding of controls. Accordingly, even an effective internal control can provide only reasonable assurance with respect to financial statement preparation. Further, because of changes in conditions, the effectiveness of any internal control may vary over time.

Our management, with the participation of our principal executive officer and principal financial officer, has evaluated the effectiveness of our internal control over financial reporting as of March 31, 2025. In making this assessment, management used the framework set forth by the Committee of Sponsoring Organizations of the Treadway Commission ("COSO") in the 2013 Internal Control—Integrated Framework.

Based on our assessment, using those criteria, our management concluded that, as of March 31, 2025, our internal control over financial reporting was effective. The effectiveness of our internal control over financial reporting as of March 31, 2025 has been audited by Ernst & Young LLP, our independent registered public accounting firm, as stated in their report, which is included below in this Annual Report on Form 10-K.

Changes in Internal Control over Financial Reporting

There was no change in our internal control over financial reporting that occurred during the fourth quarter of fiscal 2025 that has materially affected, or is reasonably likely to materially affect, our internal control over financial reporting.

Report of Independent Registered Public Accounting Firm

To the Stockholders and the Board of Directors of Commvault Systems, Inc.

Opinion on Internal Control Over Financial Reporting

We have audited Commvault Systems, Inc.’s internal control over financial reporting as of March 31, 2025, based on criteria established in Internal Control—Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (2013 framework) (the COSO criteria). In our opinion, Commvault Systems, Inc. (the Company) maintained, in all material respects, effective internal control over financial reporting as of March 31, 2025, based on the COSO criteria.

We also have audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) (PCAOB), the consolidated balance sheets of the Company as of March 31, 2025 and 2024, the related consolidated statements of operations, comprehensive income (loss), stockholders’ equity and cash flows for each of the three years in the period ended March 31, 2025, and the related notes and our report dated May 5, 2025 expressed an unqualified opinion thereon.

Basis for Opinion

The Company’s management is responsible for maintaining effective internal control over financial reporting and for its assessment of the effectiveness of internal control over financial reporting included in the accompanying Management’s Report on Internal Control over Financial Reporting. Our responsibility is to express an opinion on the Company’s internal control over financial reporting based on our audit. We are a public accounting firm registered with the PCAOB and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB.

We conducted our audit in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects.

Our audit included obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, testing and evaluating the design and operating effectiveness of internal control based on the assessed risk, and performing such other procedures as we considered necessary in the circumstances. We believe that our audit provides a reasonable basis for our opinion.

Definition and Limitations of Internal Control Over Financial Reporting

A company’s internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company’s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

/s/ Ernst & Young LLP

Iselin, New Jersey

May 5, 2025