RADWARE LTD [RDWR] Filings

 

 

 

☐	SHELL COMPANY REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

---

---

 

---

•

“Articles of Association” is to our Amended and Restated Articles of Association;

•

“Companies Law” or the “Israeli Companies Law” are to the Israeli Companies Law, 5759-1999, as amended;

•

“dollars,” “$,” or “US$” are to U.S. dollars;

•

“EUR” are to euros;

•

“Nasdaq” is to the Nasdaq Stock Market LLC;

•

“NIS” or “shekels” are to New Israeli Shekels;

•

“ordinary shares” are to our ordinary shares, par value NIS 0.05 per share;

•

the “SEC” is to the U.S. Securities and Exchange Commission;

•

the “U.S.” is to the United States; and

•

“U.S. GAAP” are to generally accepted accounting principles in the United States.

•	Changing or severe global economic conditions could have a material adverse effect on our results of operations.

•	We depend upon independent distributors to sell our solutions to customers.  If our distributors do not succeed in selling our products and services, we may not be able to operate profitably.

•	We must manage our anticipated growth effectively in order to be profitable.

•	A shortage of components or manufacturing capacity could cause a delay in our ability to fulfill orders or increase our manufacturing costs, and any disruption in our supply chain could have a material adverse effect on our results of operations.

•	We rely on a few vendors to provide our hardware platforms and components for the manufacture of our products.

•	Our success depends on our ability to attract, train and retain highly qualified personnel.

•	Competition in the market for cyber security and application delivery solutions and in our industry, in general, is intense. If we are unable to compete effectively, we may lose market share, and we may be unable to maintain profitability.

•	We must develop new solutions and enhance existing solutions to remain competitive.

•	Our reputation and business could be harmed based on real or perceived shortcomings, defects or vulnerabilities in our solutions or if our end-users experience security breaches, which could have a material adverse effect on our business, reputation and operating results.

•

As a security provider, if our information technology systems and data, or those of our service providers and other contractors, are compromised by cyber-attackers or other malicious actors, or by a critical system failure, our reputation, financial condition and operating results could be materially adversely affected.

•	Outages, interruptions, or delays in hosting services could impair the delivery of our cloud-based security services and harm our business.

•	Our global operations may expose us to additional risks.

•	We have incurred net losses in the past two years and may incur losses in the future.

•	A slowdown in the growth of the cyber security and application delivery solutions market would reduce our addressable market and solutions sales.

•	If the market for our cloud-based solutions does not continue to develop and grow, we may incur capital and operating losses.

•	Our solutions may have long sales cycles, which may reduce the predictability of our financial performance.

•	We may pursue acquisitions or other investments that could disrupt our business and harm our financial condition.

•	Our business in countries with a history of corruption and transactions with foreign governments increases the risks associated with our international activities.

•	Currency exchange rates and fluctuations of exchange rates could have a material adverse effect on our results of operations.

•	Undetected defects and errors may increase our costs and impair the market acceptance of our products.

•	Our business and operating results could suffer if third parties infringe upon our proprietary technology.

•	Our products may infringe on the intellectual property rights of others.

•	Laws, regulations and industry standards affecting our business are evolving, and unfavorable changes could harm our business.

•	Some of our solutions contain “open source” and third-party software, and any failure to comply with the terms of one or more of these open source and third-party software licenses could negatively affect our business.

•	The amount of intangible assets and goodwill on our books may in the future lead to significant impairment charges.

•	Additional tax liabilities, including due to tax positions we have taken, could materially adversely affect our results of operations and financial condition.

•	The enactment of legislation changing the United States’ taxation of international business activities could materially impact our financial position and results of operations.

•	If we are unable to realize our investment objectives, our financial condition and results of operations may be adversely affected.

•

We rely on information technology systems to conduct our businesses, and failure to protect these systems against security breaches and otherwise to implement, integrate, upgrade and maintain such systems in working order could have a material adverse effect on our results of operations, cash flows or financial condition.

•	Major disruptions or deficiencies of our information technology systems could disrupt our operations and cause unanticipated increases in our costs.

•

Our business may be affected by sanctions, export controls and similar measures targeting Russia and other countries and territories as well as other responses to Russia’s military conflict in Ukraine, including indefinite suspension of operations in Russia and dealings with Russian entities by many multi-national businesses across a variety of industries.

•	Climate change may have an adverse impact on our business.

•	Our disclosures and initiatives related to environmental, social and governance (“ESG”) matters expose us to numerous risks, including risks to our reputation, business, financial performance and growth.

•	The late Yehuda Zisapel (and following his death, his estate), Nava Zisapel, and Roy Zisapel, our President, Chief Executive Officer and a director, may exert significant influence in the election of our directors and over the outcome of other matters requiring shareholder approval.

•	Provisions of our Articles of Association and Israeli law as well as the terms of our equity incentive plan could delay, prevent or make a change of control of us more difficult or costly, which could depress the price of our ordinary shares.

•	Our share price has been volatile in the past and may be subject to volatility in the future.

•	If we are characterized as a passive foreign investment company, our U.S. shareholders may suffer adverse tax consequences.

•	If a U.S. person is treated as owning at least 10% of our ordinary shares, such holder may be subject to adverse U.S. federal income tax consequences.

•	Political, economic and military instability in the Middle East or Israel, including the state of war declared in Israel in October 2023, may harm our business.

•	The tax benefits we may receive in connection with our preferred enterprise program require us to satisfy prescribed conditions and may be terminated or reduced in the future. This would increase taxes and decrease our net profit.

•	We have obtained benefits from the Israeli Innovation Authority that subject us to ongoing restrictions.

•	It may be difficult to enforce a U.S. judgment against us or our officers and directors and to assert U.S. securities laws claims in Israel.

•	Your rights and responsibilities as a shareholder will be governed by Israeli law, which may differ in some respects from the rights and responsibilities of shareholders of U.S. companies.

•

increasing throughput, capacity, performance algorithmic coverage and efficiency of our core products, to cope with growing velocity and complexity of attacks;

•

adapting to fundamental changes in our customers’ data centers’ infrastructure and changes in the locations of applications and data by offering relevant solutions for multi-clouds and hybrid cloud environments;

•

offering new solutions to adapt to the changes in applications’ deployment frameworks, workflows and architectures, massive usage of Application Programming Interface (API) stacks, third-party attacks that require browser security presence, supply chain attacks and new edge delivery technologies in response to the rise of modern applications buildup and delivery requirements;

•

adapting to changes in the cyber threat landscape, by extending our security coverage to include client-side attacks, edge attacks, API-level attacks,  cloud-native attacks (cloud access management and workloads), complex application-level attacks, such as Business Logic Attacks (BLA), encrypted attacks, usage of open source third-party attack libraries, and/or AI, natural language processing (NLP) and automated attacks;

•

addressing new regulations and compliance standards, including those related to publicly exposed services that require the validation of safety of sensitive data provided or consumed by the service consumers;

•

developing and enhancing our cloud, physical and virtual appliances and container offerings and expanding our managed security services capabilities to address the industry trend of providing services for the cloud and through the cloud – organically and inorganically; and

•

increasing our support offerings to address the industry trend of increased customer reliance on third-party provided or managed information technology services.

•

adversely affect the market’s perception of our security solutions,

•

cause current or potential customers to look to our competitors for alternatives,

•

require us to expend significant financial resources to analyze, correct or eliminate any vulnerabilities, and

•

lead to investigations, litigation, fines and penalties, any of which could have a material adverse effect on our operations, financial condition and reputation.

•

post-merger integration problems resulting from the combination of any acquired operations with our own operations or from the combination of two or more operations into a new unified entity;

•

diversion of management’s attention from our core business;

•

substantial expenditures, which could divert funds from other corporate uses;

•

entering markets in which we have little or no experience;

•

loss of key employees of the acquired operations; and

•

known or unknown contingent liabilities, including, but not limited to, tax and litigation costs.

•

A large portion of our expenses in Israel, principally salaries and related personnel expenses, are paid in NIS, whereas most of our revenues are generated in U.S. dollars. When the U.S. dollar is weak, our foreign currency-denominated expenses will be higher, whereas if the U.S. dollar is strong, our foreign currency-denominated expenses will be lower. If the NIS strengthens against the U.S. dollar, the dollar value of our Israeli expenses will increase and may have a material adverse effect on our business, operating results, and financial condition;

•

A portion of our international sales are denominated in currencies other than U.S. dollars, such as euros, thereby exposing us to currency fluctuations in such international sales transactions;

•

We incur expenses in several other currencies in connection with our operations in Europe and Asia. Devaluation of the U.S. dollar relative to such local currencies causes our operational expenses to increase; and

•

The majority of our international sales are denominated in U.S. dollars. Accordingly, devaluation in the local currencies of our customers relative to the U.S. dollar could cause our customers to decrease orders or default on payment.

•

blocking sanctions on some of the largest state-owned and private Russian financial institutions (and their subsequent removal from SWIFT);

•

blocking sanctions against Russian and Belarusian individuals, including the Russian President, other politicians and those with government connections or involved in Russian military activities;

•

blocking sanctions against certain Russian businessmen and their businesses, some of which have significant financial and trade ties to the European Union;

•

blocking of Russia’s foreign currency reserves and prohibition on secondary trading in Russian sovereign debt and certain transactions with the Russian Central Bank, National Wealth Fund and the Ministry of Finance of the Russian Federation;

•

expansion of sectoral sanctions in various sectors of the Russian and Belarusian economies and the defense sector;

•

United Kingdom sanctions introducing restrictions on providing loans to, and dealing in securities issued by, persons connected with Russia;

•

restrictions on access to the financial and capital markets in the European Union, as well as prohibitions on aircraft leasing operations;

•

sanctions prohibiting most commercial activities of U.S., U.K., and E.U. persons in the so-called People’s Republic of Donetsk and the so-called People’s Republic of Luhansk (and, with respect to the E.U., the areas of Kherson and Zaporizhzhia not controlled by the Ukrainian government), with all of these new restrictions largely tracking prior prohibitions relating to Crimea and Sevastopol;

•

enhanced import and export controls and trade sanctions targeting Russia’s imports of technological goods, including E.U. and U.K. prohibitions on exporting a wide range of “industrial” goods to Russia (and on importing a large number of “revenue-generating” goods from Russia).  The restrictions also include bans on the export of large numbers of “luxury” items to Russia (and in some cases also to Belarus), tighter controls on exports and reexports of dual-use items, stricter licensing policy with respect to issuing export licenses, and/or increased use of “end-use” controls to block or impose licensing requirements on exports, as well as higher import tariffs;

•

closure of airspace to Russian aircraft;

•

ban on imports of Russian oil, liquefied natural gas and coal to the United States;

•

ban on imports of Russian fish, seafood, and preparations thereof, alcoholic beverages, non-industrial diamonds, and gold to the United States;

•

a ban on “new investment” in the Russian Federation by a U.S. person, which may be interpreted broadly (with a similar prohibition also enacted by the United Kingdom);

•

bans on the provision of certain professional services, including accounting, trust and corporate formation, auditing, and management consulting services, among others; and

•

bans on the provision of services related to the worldwide maritime transportation of seaborne Russian oil, if purchased above a specific price cap.

•

operating results that do not meet forecasts by securities analysts;

•

announcements concerning us or our competitors;

•

the introduction of new products and new industry standards;

•

general market conditions and changes in market conditions in our industry;

•

the general state of securities markets (particularly the technology sector);

•

political, economic and other developments in the State of Israel, the U.S. and worldwide, including, for example, the Ukraine-Russia and Israel-Hamas military conflicts; and

•

any of the events underlying any of the other risks or uncertainties set forth elsewhere in this annual report actually occurs.

•

subject to limited exceptions, the judgment is final and non-appealable;

•

the judgment was given by a court competent under the laws of the state of the court and is otherwise enforceable in such state;

•

the judgment was rendered by a court competent under the rules of private international law applicable in Israel;

•

the laws of the state in which the judgment was given provide for the enforcement of judgments of Israeli courts;

•

adequate service of process has been effected and the defendant has had a reasonable opportunity to present his arguments and evidence;

•

the judgment is enforceable under the laws of State of Israel and its enforcement is not contrary to the law, public policy, security, or sovereignty of the State of Israel;

•

the judgment was not obtained by fraud and does not conflict with any other valid judgment in the same matter between the same parties; and

•

an action between the same parties in the same matter was not pending in any Israeli court at the time the lawsuit was instituted in the U.S. court.

•

Products – We offer a range of cloud-based subscriptions, on-premises products, software products and product subscriptions (or a combination of these) to our customers.

•

Services – We offer managed services, professional services, technical support and training and certification to our customers and partners.

•

Radware’s Core Business - this segment consists of our core business operations, including our cloud security as-a-service products, application and data centers security products and our application availability products; and

•

The Hawks’ Business – this segment consists of the operations of our two subsidiaries: SkyHawk Security, a spinoff of our former cloud native protector business which now provides an agentless Cloud-native threat Detection and Response (CDR), combined with Cloud Infrastructure Entitlement Manage (CIEM), Cloud Security Posture Management CSPM and Autonomous Purple Team for AWS Google Cloud and Azure, and EdgeHawk, which is engaged in transforming routers and network nodes into security platforms.

o

Cloud DDoS Protection Service. Our Cloud DDoS Protection Service provides a full range of enterprise-grade DDoS protection services in the cloud. Based on our DDoS protection technology, it aims to offer organizations wide security coverage, accurate detection and short time to protect from today’s dynamic and evolving DDoS attacks. We offer a multi-vector DDoS attack detection and mitigation service, handling network-layer attacks, server-based attacks and application-layer DDoS attacks.

◾

Always-On Cloud DDoS Protection Service. This service provides always-on protection where traffic is always routed through Radware’s cloud security scrubbing centers with no on-premise device required for detection and mitigation. This service is recommended for organizations that have applications hosted in the cloud or those that are not able to deploy an on-premise attack mitigation device in their data center.

◾

Always-On Hybrid Cloud DDoS Protection Service. This service integrates with our on-premise DDoS Protection device. The traffic is mitigated in the on-premise device and diverted through Radware’s cloud security scrubbing centers upon a large volumetric DDoS attack that aims to saturate the internet pipe. This service is recommended for organizations that place a high premium on the user experience and wish to avoid even the slightest possible downtime as a result of DDoS attacks.

◾

On-Demand Cloud DDoS Protection Service. This service protects against internet pipe saturation and is activated when the attack threatens to saturate the organization’s internet pipe. This service is recommended for organizations that are looking for the lowest cost solution and are less sensitive to real-time detection of DDoS attacks.

◾

On-Demand Cloud Hybrid DDoS Protection Service. The on-premise DefensePro device detects and mitigates all types of DDoS attacks in real-time, while volumetric DDoS attacks are diverted and mitigated in the cloud. This service is recommended for organizations that can deploy an on-premise device in their data centers.

o

Cloud Web DDoS Protection. We offer our Cloud DDoS Protection users an additional protection layer dedicated to detecting and mitigating sophisticated application-layer DDoS attacks. Our Cloud Web DDoS Protection uses advanced L7 behavioral-based detection and mitigation techniques to block sophisticated Web DDoS Tsunami attacks, offering protection against advanced HTTP/S floods that use randomization techniques to bypass traditional protections.

o

Enterprise Package: Includes a comprehensive web security coverage, including OWASP Top-10, advanced attacks and zero-day attack protection, that is fully managed and monitored 24x7 and designed to guarantee service availability at any given time with protection against today’s emerging web application and DDoS attacks.

o

Enterprise Premium Package: Includes all web security and managed services offered in the Enterprise package, in addition to a dedicated technical account manager and an Emergency Response Team (“ERT”) expert as well as pre and post attack alerts and reports and ongoing updates from Radware’s security experts.

o

Bot Manager. Our Bot Manager provides comprehensive protection of web applications, mobile apps and APIs from automated threats like bots. Bot Manager provides precise bot management across all channels by combining behavioral modeling for granular intent analysis, collective bot intelligence and fingerprinting of browsers, devices and machines. It is designed to protect against all forms of account takeover (credential stuffing, brute force, etc.), denial of inventory, DDoS, ad and payment fraud and web scraping to help organizations safeguard and grow their online operations.

o

Cloud-Native Protector (“CNP”) Service. The CNP service provides an agentless cloud-native security solution for applications, workloads and infrastructure hosted on AWS and Microsoft Azure. The CNP service offers multi-layered protection to reduce risk by continuously verifying compliance against multiple security standards, identifying publicly exposed assets, keeping track of asset inventory with prioritized cross-cloud visibility, fortifying the cloud threat surface with context-aware smart hardening, and providing advanced attack detection and remediation capabilities to stop data theft attempts.

o

Cloud Application Protection Services. Our Cloud Application Protection Services secure business applications through a single platform, including WAF, bot management, API protection and application DDoS protection. Our Cloud Application Protection Services offer the following application security capabilities:

◾

Protect Digital Assets and Data. Our Cloud Application Protection Services protect digital assets and customer data in multiple environments, such as on-premise, virtual clouds, private clouds, public clouds, hybrid environments, or Kubernetes.

◾

Protect Against OWASP Vulnerabilities. Our solution helps protect against various known attack vectors, including the OWASP Top 10 Web Application Security Risks, Top 10 API Security Vulnerabilities, and Top 21 Automated Threats to Web Applications.

◾

Protect Against Zero-Day Attacks. Our positive security model assists in stopping unknown threats in their tracks. Our machine-learning analysis engine continuously studies application traffic and end-user behavior to build and enhance security policies that reduce exposure to zero-day attacks.

◾

Detect, Manage, and Mitigate Bots. Our solution detects and distinguishes between “good” bots and “bad” bots to protect websites, mobile apps, and APIs against a wide range of application attacks, such as account takeover credential, denial of inventory, ad and payment fraud, web scraping and more.

◾

Protect APIs. API attacks are a rapidly growing threat to business applications and customer data. Our solution combines behavioral analysis and policy automation to protect evolving API matrix from increasingly sophisticated API assaults.

◾

Client-Side Protection From Supply Chain Attacks. As server-side security improves, more hackers target the less protected and rarely monitored client side. Radware helps protect end users’ data when interacting with any third-party services in the application supply chain, including form jacking, skimming and DOM XSS.

◾

Mitigate Application-Level DDoS Assaults. Our Web DDoS Protection solution helps detect and mitigate HTTP-based DDoS assaults. Utilizing multi-patented, behavioral-based algorithms, it automatically generates precise signatures in real time to stop disruptive web DDoS attacks without blocking legitimate user traffic.

o

DefensePro Attack Mitigation Device. DefensePro® provides automated DDoS protection from fast-moving, high-volume, encrypted, or very-short-duration threats and is part of Radware’s attack mitigation solution. It defends against Internet of Things (IoT)-based, Burst, DNS and TLS/SSL attacks to secure organizations against emerging network multi-vector attacks, ransom DDoS campaigns, IoT botnets, phantom floods, and other types of cyberattacks.

o

Radware Kubernetes WAF. Radware Kubernetes WAF is a Web Application Firewall solution for CI/CD environments orchestrated by Kubernetes. Our Kubernetes WAF integrates with common software provisioning, testing and visibility tools in the CI/CD pipeline offering both IT security and DevOps personnel detailed insight down to the pod and container levels, and enables organizations to implement application and data security in on-premise and cloud-based implementations.

o

Alteon® Application Delivery Controller (ADC). Alteon is our application delivery and security solution that manages application traffic across cloud and data center locations, optimizing availability and performance. It provides advanced, end-to-end local and global load balancing capabilities for web, cloud and mobile-based applications. Alteon integrates multiple application protection services to provide protection against an array of cyber threats. Alteon’s analytics also provides insightful visibility so that IT managers can manage and guarantee application service level agreement (SLA) and stay ahead of cyberattacks.

•

Alteon Deliver Package. For applications that require high performance ADCs with advanced layer 4-7 ADC functionality.

•

Alteon Perform Package. For deployments requiring performance optimization, advanced application performance monitoring, global server load balancing, link load balancing, and automated/optimized ADC service operation.

•

Alteon Secure Package. For applications that require our most advanced protections, including an embedded WAF module, authentication gateway, bot management, threat intelligence feeds (ERT Security Updates Service, ERT Active Attackers Feed, and ERT Location-based Mitigation), and SSL processing from perimeter security devices (with its embedded SSL inspection module).

o

LinkProof NG. LinkProof® NG is a multi-homing and enterprise gateway solution that allows service level availability and continuous connectivity of enterprise and cloud-based applications. It is an application-aware multi-homing and link load balancing module that delivers 24/7 continuous connectivity and service level assurance, improved performance, and cost-effective scalability of bandwidth for corporate and cloud-based applications.

o

Cyber Controller. Our Cyber Controller is a unified solution for management, configuration and attack lifecycle. The Cyber Controller provides enhanced security, increased visibility and an improved user experience via multiple security operation dashboards for a unified view into attack lifecycle and mitigation analysis for both inline and out-of-path DDoS deployments. Cyber Controller provides network analytics with comprehensive visibility of traffic statistics during peacetime and attack, and simplified management and configuration with unified visibility and control.

o

Cyber Controller Standard: Provides the network management tool and network monitoring tool for the Radware family of cyber security and application delivery solutions. It provides our customers immediate visibility to health, real-time status, performance and security of our products from one central, unified console. An analytics module provides an intuitive, customizable Graphical User Interface with granular forensic insights into application performance, denial-of-service and web application attacks.

o

Cyber Controller X: In addition to the “Standard” license features, provides the ability to manage the DefensePro X product line using the new Cyber Controller X stream.

o

Cyber Controller Plus: An add-on on top of either the “Standard” or “X” licenses, enabling orchestration, automation and out-of-path capabilities for attack life-cycle management.

o

MSSP Portal. The Managed Security Service Provider (MSSP) Portal is a turnkey, multi-tenant DDoS detection and mitigation service portal. The Portal collects and aggregates security attack measurement and events (including traffic utilization, attack distribution and alerts) and displays them in real-time and historical reports. Our MSSP Portal enables service providers to resell cyber security mitigation services to their customers as a managed service.

o

ERT Security Updates Subscription (SUS). Our Security Update Subscription is a security-advisory and managed monitoring and detection system dedicated to protecting network elements, hosts, and applications against the latest security vulnerabilities and threats. The Security Update Subscription delivers periodic, emergency, and custom attack signature updates to subscribers to protect against known attack patterns. The service is available for DefensePro and Alteon Integrated WAF.

o

ERT Active Attackers Feed. Our ERT Active Attackers Feed (EAAF) is a threat intelligence feed designed to protect against emerging DDoS threats, including those involving IoT botnets and new DNS attack vectors. The EAAF subscription enhances our attack mitigation solution by identifying and blocking IP addresses involved in major attacks in real time to offer preemptive protection from known attackers. This subscription is available for DefensePro, Alteon ADC and Cloud Application Protection Services.

o

ERT Protection Packages. Our ERT Protection packages bundle our ERT services into two packages: ERT Silver Protection Package and ERT Gold Protection Package. ERT Silver Protection Package consolidates ERT Security Update Subscription, ERT Active Attackers Feed, and Location-based Mitigation. ERT Gold Protection Package includes ERT under Attack Service on top of the ERT Silver Package.

o

Alteon Global Elastic License (GEL). Alteon GEL is a purchasing and deployment subscription that enables a high level of flexibility for ADC services across datacenters, private and public clouds. GEL enables dynamic ADC capacity allocation and the ability to move that capacity across environments, without having to invest separately in a dedicated ADC infrastructure for each and every location where organization’s applications are deployed (e.g. on-premise, public cloud, etc.). This application delivery licensing model helps to eliminate planning risks in the purchase and deployment of ADC services, enabling continuous investment protection of the ADC infrastructure throughout its lifecycle duration.

o

Location-based Mitigation. Our location-based mitigation solution is a subscription offering that enables network traffic filtering by countries and regions based on the geolocation mapping of IP subnets. The subscription also supports per-policy block and allow lists, making it a beneficial solution for carriers and service providers that wish to protect multitenant networks. The subscription helps organizations comply with global and industry regulation requirements such as the Office of Foreign Assets Control and others. This subscription is available for DefensePro and Alteon ADC.

o	Certainty Support Program. We offer technical support for all our products through our Certainty Support Program. Certainty support levels include:

o

Basic. This level provides business day access, including weekends from 9 a.m. to 5 p.m. (local time) to technical support center services, and technical documentation, either via the Web, e-mail or direct phone support during working days. New software releases are available for units covered under the certainty support program.

o

Standard. This level increases access to the technical support center 24/7/365 and adds next business day replacement of failed hardware and waives customer shipping costs.

o

Advanced. This level increases the certainty support level standard to four hours’ replacement of failed hardware advanced replacement.

o

Professional Services. Our professional services group is staffed by a global team of experts possessing extensive knowledge and experience in security and application delivery both in data centers and the cloud. The group offers a full range of services to design, implement, automate, and optimize our customer solutions. We offer the following key professional services:

o

Design and Planning. This service plans and designs applications for future growth with Radware engineers. The service starts with a review of business goals, network optimization assessment and an overview of application architecture and security requirements to help create a comprehensive deployment plan that is tailored to organizational IT requirements.

o

Application and Security Optimization Services. This service analyzes and reviews the current implementation and design and provides recommendations to help optimize the system and achieve business goals.

o

Resident Engineer. Our Resident Engineer service is a proactive on-site engineer who performs operations, design and automation activities. From initial deployment to ongoing management and day-to-day operation, our Resident Engineer service decreases the time demands on our customers’ staff, allowing them to focus on their core business.

o

Technical Account Manager. Our technical account manager is a proactive consultant that implements best practices, provides guidance and optimizes networking and application resources.

o	ERT Service.  Our ERT is a group of security experts available 24x7 for proactive security support services for customers facing an array of application- and network-layer attacks. These services include:

o

ERT Managed Security Service. Our ERT offers a fully managed application- and network-security service. The service covers a broad range of attack types from different forms of DDoS to a variety of application attacks against our customers’ servers or data centers. It includes immediate response, onboarding, consulting, remote management, and reporting.

o

ERT Under-Attack Service. The ERT under-attack service offers 24x7 access to a security expert within 10 minutes. The ERT engineer will take the lead, fight off attacks and provide postmortem analysis of security events. The ERT under-attack service lets organizations know there is someone to rely on, guaranteeing support throughout the attack life cycle from the moment it begins. The ERT experts are available 24x7 and assist large enterprises worldwide with complex multi-vector attacks against their networks, data centers and application services.

•

We have announced the opening of additional Cloud Security centers in Melbourne (Australia), Toronto (Canada), Auckland (New Zealand), and Tel Aviv (Israel). The facilities are designed to reduce traffic latency, as well as increase service redundancy and mitigation capacity to help customers defend against denial-of-service attacks, web application attacks, malicious bot traffic, and attacks on APIs.

•

We have introduced a new Cloud Web DDoS Protection solution. The new solution is designed to minimize the growing gap between standard DDoS mitigation and an emerging generation of more aggressive, layer 7, HTTP, and HTTPS Flood attacks—also known as Web DDoS Tsunami attacks. Our solution mitigates these encrypted, high-volume, multi-vector threats that evade standard web application firewalls (WAF) and network-based DDoS tools, essentially rendering them ineffective.

•

We have added to our Cloud WAF service a new advanced service called Client-Side Protection. As server-side security improves, more hackers target the less protected and rarely monitored client side. Our Cloud WAF Client-Side Protection service ensures the protection of end users’ data when interacting with any third-party services in the application supply chain, including form jacking, skimming and DOM XSS.

•

We have announced enhancements to our Bot Manager solution to help organizations prevent nefarious bots from bypassing their defenses to gain unlawful access to native Android and iOS (Google and Apple) mobile applications.

•

We have added to our Bot Manager Blockchain-based protection option. The Blockchain mitigation relies on Crypto Challenge mitigation, which is based on the cryptographic proof-of-work concept used in various blockchains, and designed to deliver continuous, invisible browser-based challenges to suspected bots that automatically and exponentially become more difficult if solved. The Blockchain-based protection mitigates CAPTCHA solving bots and avoider bots.

•

We have improved our customer experience by launching a new unified portal for our cloud WAF, API Protection, Bot Manager, and Cloud DDoS. The new portal allows centralized security management through a single dashboard for a customer’s applications across all platforms and all security modules.

•

We have introduced a new line of DefensePro X attack mitigation platforms. The next-generation solution combines high performance and DDoS mitigation capacity protection with enriched usability and visibility to defend against increasingly sophisticated cyber threats. To answer the cybersecurity needs of medium-sized businesses as well as enterprises, Tier-1 service providers, and carriers, the DefensePro X lineup offers five new hardware platforms and one virtual platform with a wide range of DDoS protections.

•

We have announced new platforms for our Alteon ADC product line:

•

Alteon 7 series. This is a high-end performance application delivery appliance with high performance SSL with support for latest encryption standards (i.e. ECC). The new platform, with models 7700 and 7100, offers on-demand 100 & 200 Gbps throughput scalability and designed for carriers, mobile operators and large enterprises.

•

Alteon 6300. This is a modular platform with selectable I/O and SSL acceleration modules, high performance SSL with support for latest encryption standards (i.e. ECC). The platform is designed for carriers, mobile operators and very large enterprises with On-demand 60 and 90Gbps throughput scalability.

•

In January 2023, we introduced a new global Radware Cybersecurity Partner Program. The global program offers our existing and prospective ecosystem partners a more lucrative and systematic approach to creating, managing, and growing sales opportunities based on our cloud security services and solutions. Equipped with new participation tiers, training, certifications, financial incentives, and support materials, it is designed to empower our ecosystem partners to accelerate their growth and improve operating margins. This includes resellers, managed security service providers, carriers, and cloud service providers.

•

In September 2023, we launched an enhanced program for MSSPs, which is designed to make it easier for MSSPs to expand their value-added service portfolio and manage the hosted security services needed to address the surge in cyberattacks and shortage in skilled cybersecurity talent. To accelerate revenue growth, partners are granted access to new licensing models, expanded technical training, and more marketing and sales enablement tools.

•

Innovation, Proprietary Technologies, and Thought Leadership. We are offering innovative solutions in our domain. We were one of the first companies to offer hybrid attack mitigation solutions; behavioral DDoS attacks detection with automated real-time signature creation for attack mitigation; device fingerprinting technology implementation for Bot-based attacks detection; auto-policy generation for our WAF solution; protection against encrypted attacks without opening the sessions for DDoS protection; and AI to detect attacks targeting workloads in public clouds. We believe this has given us significant expertise, know-how, and leadership in the market for cyber-attack mitigation solutions, and we take part in many technology communities, standard organizations, and open source projects. At the same time, we continue to invest in research and development of cyber security and application delivery technologies in order to introduce new and innovative solutions, which are supported and protected by multiple patents and proprietary rights.

•

Automation. We are offering automated attack detection and mitigation solutions that reduce the total cost of ownership of cyber security solutions, including behavioral analysis technology to detect zero-day DDoS attacks; automated real-time signature creation for DDoS attacks mitigation; intent-based behavioral analysis and machine learning (or “ML”) models to detect automated Bot attacks; and machine learning (positive security model) to detect zero-day web application attacks.

•

Wide attacks coverage. Our solutions offer a wide coverage against attacks, including mitigation of all four generations of Bot attacks; negative and positive security models to defend against known (OWASP top-10) and zero-day web application attacks (standard solutions typically cover OWASP top-10 attacks only); and advanced DDoS attacks protection such as DNS flood attacks, burst floods, SSL flood attacks, IoT botnets and Web DDoS attacks.

•

Industry Awards. We gained multiple industry awards during 2023, including the following:

o

Quadrant Knowledge Solutions – 2023 DDoS Mitigation SPARK Matrix™, July 2023 – Leader

o

Quadrant Knowledge Solutions – 2023 WAF SPARK Matrix™, December 2023 – Leader

o

Quadrant Knowledge Solutions – 2023 Bot Management SPARK Matrix™, July 2023 – Leader

o

GigaOm Research – GigaOm Radar for DDoS Protection 2023 – Leader and Fast Mover

o

GigaOm Research – GigaOm Radar for Application and API Protection: March 2023, Leader and Fast Mover

•

Focus on cloud and application security. We aim to offer superior and innovative cyber security solutions and cloud-based solutions and expand our portfolio in these two dimensions. We also invest in go-to-market efforts related to cloud security services and public cloud solutions.

•

Invest in data center solutions. We continue to develop and sell holistic cyber security and application delivery solutions for physical, cloud, and hybrid data centers and cloud applications.

•

Increase our market footprint. We believe that a significant market opportunity exists to sell our solutions with the complementary products and services provided by other organizations with whom we wish to collaborate. To that end, we have already established strategic relationships with various third parties, including leading global-class partners, such as Cisco, Check Point, and Nokia, which provide critical access to certain large customers allowing us to sell our solutions. We intend to further increase our market footprint through collaboration with leading partners.

•

Expand our footprint in the medium sized enterprise market. The needs of the mid-market enterprises regarding the management of cyber security risks are substantially similar to the needs of the large enterprise market, but their capacity and access to skilled talent are more limited. We believe that our fully managed cloud security services can be a great fit for this market, and we intend to further expand our market footprint in this segment.

•

Pursue acquisitions and investments. In order to achieve our business objectives, we may evaluate and pursue the acquisition of, or significant investments in, other complementary companies, technologies, products, and/or businesses that enable us to enhance and increase our technological capabilities and expand our product and service offerings.

•

DDoS Mitigation: Akamai Technologies, Inc., or Akamai, Imperva Inc., or Imperva, Netscout Systems, Inc., and Cloudflare, Inc.

•

Web Application Firewalls and Bot Management: Akamai, Imperva, Cloudflare, Inc., F5 Networks, Inc., or F5, and AWS

•

Application Delivery: F5, A10 Networks, Inc., and Citrix Systems, Inc.

•

CDR: Gem Security, Inc.

•

We have implemented key performance indicators (KPIs), which set quantitative reduction goals for the use of water, power and paper;

•

We work with our suppliers to maintain compliance with various environmental laws and guidelines, such as RoHS and WEEE in the EU, and adopted our Conflict Minerals Policy available at www.radware.com/corporategovernance/conflictminerals (information contained on our website, including in our Conflict Minerals Policy, is not incorporated herein by reference and shall not constitute part of this annual report), which outlines our practices and procedures with respect to responsible sourcing of minerals from conflict-affected and high-risk areas; and

•

Our corporate headquarters in Tel Aviv, Israel, as well as our training rooms in Tel Aviv are designed in the “TED” style to serve as multifunctional work spaces while the operations room utilizes NVX video technology in order to minimize the amount of copper wiring required to function and travel. At our headquarters, we offer EV charging stations to our employees and visitors, and where applicable according to local requirements, we offer recycling and properly dispose of e-waste.

•

We are an equal-opportunity employer and make employment decisions based on a person’s qualifications and our business needs. This is demonstrated by our Human Rights and Labor Standards Policy;

•

Our corporate policy maintains zero tolerance for harassment, sexual harassment, and discrimination, and it imposes significant consequences for behavior deemed to create a hostile work environment. This is demonstrated by our Code of Conduct and Ethics as well as our Human Rights and Labor Standards Policy;

•

We offer what we believe is an attractive mix of compensation and benefit plans to support our employees’ and their families’ physical, mental, and financial well-being. This includes allowing the majority of our employees to have a direct ownership interest in Radware by participating in our equity-based incentive plans; and

•

We are focused on maintaining a healthy, safe, and secure work environment that protects our employees and the public from harm. This is demonstrated by the measures we implemented in order to overcome the challenges presented by the COVID-19 pandemic. We implemented a hybrid work model, which enables our employees to work partly remote and partly in the office. We believe that this flexibility drives increased job satisfaction while addressing the major challenges of remote work, such as isolation and lack of community.

•

Corporate Governance and Board Practices: Our corporate governance policies and practices are designed to foster effective board oversight in service of the long-term interests of our shareholders. Our Board of Directors consists of 8 members, of whom seven qualify as “independent directors” under the Nasdaq rules and one is female. The Audit and Compensation Committees of our Board of Directors, which are charged with significant functions in our risk oversight and compensation philosophy, respectively, both currently consist of three members, all of whom qualify as “independent directors” under the Nasdaq rules. For further details on our corporate governance, as well as our Board of Directors and its committees’ roles and practices, see Items 6.C “Board Practices” and 16.G “Corporate Governance.”

•

Ethical Business Conduct: All our directors, officers, consultants, service providers and employees are expected to conduct themselves in accordance with our Code of Conduct and Ethics available at http://www.radware.com/corporategovernance/ (information contained on our website, including in our Code of Conduct and Ethics, is not incorporated herein by reference and shall not constitute part of this annual report). Our Code of Conduct and Ethics is intended to promote various elements of ethical business conduct, such as compliance with laws; avoiding conflict of interests and personal exploitation of corporate opportunities; fair dealing; confidentiality of information; and other policies and guidelines in connection with insider trading and anti-corruption laws and policies.

Name of Subsidiary	Place of Incorporation
Radware Inc.	New Jersey, United States
Radware UK Limited	United Kingdom
Radware France	France
Radware Srl	Italy
Radware GmbH	Germany
Nihon Radware KK	Japan
Radware Australia Pty. Ltd.	Australia
Radware Singapore Pte. Ltd.	Singapore
Radware Korea Ltd.	Korea
Radware Canada Inc.	Canada
Radware India Pvt. Ltd.	India
Kaalbi Technologies Limited Ltd.	India
Radware (India) Cyber Security Solutions Private Limited	India
Radware China Ltd. 睿伟网络科技（上海）有限公司	China
Radware (Hong Kong) Limited	Hong Kong
Radyoos Media Ltd.*	Israel
Radware Canada Holdings Inc.	Canada
Radware Iberia, S.L.U.	Spain
Edgehawk Security Ltd.	Israel
SkyHawk (CNP) Security Ltd.**	Israel
SkyHawk Security, Inc.***	Delaware, United States
CSR Cloud Security Ltd.	Israel
Radware (Colombia) S.A.S.	Colombia

AB-NET Communications Ltd. Binat Business Ltd. BYNET Data Communications Ltd.* Bynet Data Centers Ltd. CloudRide Ltd.* BYNET Electronics Ltd.* BYNET SEMECH (outsourcing) Ltd.* Bynet Software Systems Ltd. Bynet System Applications Ltd.*

Ceragon Networks Ltd. Internet Binat Ltd.* Packetlight Networks Ltd. RAD-Bynet Properties and Services (1981) Ltd.* Radbit Computers, Inc. RADCOM Ltd. RAD Data Communications Ltd.* Radiflow Ltd.

RADWIN Ltd. DC Protection Ltd. (previously known as SecurityDAM Ltd.)

•

We recognize physical and software product revenues when control of the product is transferred to the customer (i.e., when our performance obligation is satisfied), which typically occurs at shipment, and we recognize revenues from product and cloud subscriptions, as part of the product revenues, ratably over the subscription period.

•

Revenues from post-contract customer support (PCS), which mainly represents help-desk support and unit repairs or replacements, professional services, and ERT services, are recognized ratably over the contract or subscription period, which is typically between one year and three years.

		2023				2022				2021
		(US $ in thousands)
Revenues:
Products		$	145,541			$	172,161			$	170,438
Services			115,751				121,265				116,058
			261,292				293,426				286,496
Cost of revenues:
Products			41,450				43,014				42,191
Services			10,260				10,870				10,255
			51,710				53,884				52,446
Gross profit			209,582				239,542				234,050
Operating expenses, net:
Research and development, net			82,617				86,562				74,098
Sales and marketing			126,237				126,533				119,842
General and administrative			32,408				29,786				21,885
Total operating expenses, net			241,262				242,881				215,825
Operating income (loss)			(31,680	)			(3,339	)			18,225
Financial income, net			13,927				8,052				4,407
Income (loss) before taxes on income			(17,753	)			4,713				22,632
Taxes on income			3,837				4,879				14,821
Net income (loss)			(21,590	)			(166	)			7,811

		2023				2022				2021
Revenues:
Products			56	%			59	%			59	%
Services			44				41				41
			100				100				100
Cost of Revenues:
Products			16				15				15
Services			4				4				3
			20				19				18
Gross profit			80				81				82
Operating expenses, net:
Research and development, net			32				30				26
Sales and marketing			48				43				42
General and administrative			12				10				7
Total operating expenses, net			92				83				75
Operating income (loss)			(12	)			(1	)			6
Financial income, net			5				3				2
Income (loss) before taxes on income			(7	)			2				8
Taxes on income			(1	)			(2	)			(5	)
Net income (loss)			(8	)%			0	%			3	%

(US$ in thousands, except percentages)		2023								2022								2021								% Change 2023 vs. 2022				% Change 2022 vs. 2021
Products			145,541				56	%			172,161				59	%			170,438				59	%			(15	)%			1	%
Services			115,751				44	%			121,265				41	%			116,058				41	%			(5	)%			4	%
Total			261,292				100	%			293,426				100	%			286,496				100	%			(11	)%			2	%

(US$ in thousands, except percentages)		2023								2022								2021								% Change 2023 vs. 2022				% Change 2022 vs. 2021
North, Central and South America (principally the United States)(*)			103,435				40	%			123,947				42	%			128,770				45	%			(17	)%			(4	)%
EMEA (Europe, the Middle East and Africa)			96,488				37	%			104,219				36	%			98,388				34	%			(7	)%			6	%
Asia-Pacific			61,369				23	%			65,260				22	%			59,338				21	%			(6	)%			10	%
Total			261,292				100	%			293,426				100	%			286,496				100	%			(11	)%			2	%

(US$ in thousands, except percentages)		2023								2022								2021
Cost of Products			41,450				28.5	%			43,014				25.0	%			42,191				24.8	%
Cost of Services			10,260				8.9	%			10,870				9.0	%			10,255				8.8	%
Total			51,710				19.8	%			53,884				18.4	%			52,446				18.3	%

(US$ in thousands, except percentages)		2023				2022				2021				% Change 2023 vs. 2022				% Change 2022 vs. 2021
Research and development, net		$	82,617			$	86,562			$	74,098				(5	)%			17	%
Sales and marketing			126,237				126,533				119,842				0	%			6	%
General and administrative			32,408				29,786				21,885				9	%			36	%
Total		$	241,262			$	242,881			$	215,825				(1	)%			13	%

		2023				2022				2021
Grants			331,899				250,284				248,233
Weighted-average grant-date fair value			5.48				6.77				6.87

		2023				2022				2021
Grants			1,390,718				1,947,499				1,143,097
Weighted-average grant-date fair value			15.82				21.31				32.57

•

Radware’s Core Business - this segment consists of our core business operations, including our cloud security as-a-service products, application and data centers security products and our application availability products; and

•

The Hawks’ Business – this segment consists of the operations of our two subsidiaries: SkyHawk Security, a spinoff of our former cloud native protector business which now provides an agentless Cloud-native threat Detection and Response (CDR), combined with Cloud Infrastructure Entitlement Manage (CIEM), Cloud Security Posture Management CSPM and Autonomous Purple Team for AWS Google Cloud and Azure, and EdgeHawk, which is engaged in transforming routers and network nodes into security platforms.

		Year ended December 31, 2023
		Radware Core				Hawks				Total
Revenues		$	260,322			$	970			$	261,292
Operating loss		$	(16,802	)		$	(14,878	)		$	(31,680	)

		Year ended December 31, 2022
		Radware Core				Hawks				Total
Revenues		$	290,408			$	3,018			$	293,426
Operating income (loss)		$	8,416			$	(11,755	)		$	(3,339	)

		Year ended December 31, 2021
		Radware Core				Hawks				Total
Revenues		$	283,913			$	2,583			$	286,496
Operating income (loss)		$	24,114			$	(5,889	)		$	18,225

		2023				2022				2021
Net cash provided by (used in) operating activities		$	(3,500	)		$	32,148			$	71,774
Net cash provided by (used in) investing activities			92,779				(56,018	)			7,849
Net cash used in financing activities			(64,926	)			(22,458	)			(41,881	)

	Payments Due by Period (US $ in thousands)
Contractual obligations	Total	Less than 1 year*	1-3 years	3-5 years	More than 5 years
Operating leases (1)	22,265	4,937	7,673	5,834	3,821
Total contractual cash obligations (2)	22,265	4,937	7,673	5,834	3,821

•

Applications are migrating to the public cloud.  The migration to public cloud exposes organizations to new threats that require consistent security across all cloud environments. Organizations also prefer to purchase security services as a subscription, to match the subscription-based consumption of hosting services.

•

Datacenter architecture is changing. Datacenter architecture is changing to include various models such as a physical datacenter, a virtual datacenter, a software defined datacenter, and private or public cloud. New emerging edge clouds, coupled with the emerging 5G breakouts and SD-WAN, will enable enterprises to effectively leverage cloud-native services and edge computing services. Many organizations use a mixed infrastructure that includes a combination of one or more of the above and therefore require broader overarching protection that encompasses both the datacenter and multi-cloud-based applications. In addition, this mixed environment often involves multiple vendors and creates challenges in IT staffing and operational costs, which increase the needs for hybrid cloud services, managed “single pane of glass” style security services and modern automated data center technologies.

•

Application modernization requires new security tools. Application infrastructure is changing, from monolithic applications to modern applications and websites in which deployment workflows, front-end built-tools and API-centric architectures are used. The rise of cloud-native ecosystems, increasingly adapting cloud-direct and micro-services architecture packaged as containers, is providing a built-in “on-demand” elasticity and availability application infrastructure. This enables introducing and running the new generation of cloud-native applications, in a fast, adaptive and more efficient way by interacting with DevOps CICD tools and methods. As such, the AppSec blast radius is expanded and requires injection of security controls within the application lifecycle at early stages, to avoid slowdown in development, to sanitize, for example, usage of opensource software used by developers and might leak in malicious code (recent Log4J library). Various “shift-right” and “shift-left” methods are used and specifically adapted for various target deployment environments.

•

The above-mentioned cloud-native application delivery opens the door for leakage through the open cloud interface. A new family of attack surfaces manifested by the fact that the cloud APIs are publicly published, and DevOps processes are done from the outside of the cloud “perimeter” (the insider becomes the outsider). “Cloud-native” infiltrations are enabled by the usage of cloud-IAM (identify and access) misconfigurations or account take over techniques and by various vulnerabilities of publicly exposed web and API interfaces. This creates a need for a new protection posture for compliance, permissions hardening, vulnerabilities detection as well as cloud-native detection (infiltrations and exfiltration) and response tools under new industry categories: CIEM (Cloud Infrastructure Entitlement Management), CSPM (Cloud Security Posture Management), CWPP (Cloud Workload Protector Platform), and CTDR (Cloud Threat Detection and Response).

•

Organizations’ attack surfaces are increasing due to a changing economy. This was caused by a combination of two forces. First, working from home, primarily due to the restraints associated with COVID-19, required organizations to enable remote access to applications and services that were previously not exposed. This eliminated the traditional network perimeter, and now, even after The World Health Organization determined that COVID-19 no longer fit the definition of a public health emergency, every home computer or mobile device has become the new perimeter. Second, an increase in the online consumption of goods has accelerated organizations’ digital transformation and migration to the cloud. The result is more opportunities for attackers to leverage the increased attack surface.

•

Increasing complexity and intensity of security threats, including in view of AI-weaponized attacks. The increasing complexity and intensity of the security threats landscape requires expertise in identifying the attacks and state-of-the-art security to mitigate the attacks and safeguard the assets. Attack delivery is aided by the growing presence of connected devices (IoT), which increases the threat surface against any kind of infrastructure, as well as traffic encryption (dark data) assisting in hiding attacks. Furthermore, attack tools are increasingly available to all through the dark net and becoming more sophisticated as hackers use automation and weaponize AI. Increasing focus is currently centered around the new opportunities of weaponizing AI enabled by OpenAI. This leads to ever morphing and scalable attack vectors at all levels, from volumetric botnets through web and API-centric attacks, as well as new attack surfaces that utilize Kubernetes-platforms (container orchestration platform of choice). The mass amount of uncontrolled IoT devices and cloud hosting opens the door for a new generation of botnets and automated bots that are hard to classify and block. Most organizations are not able to keep up with these developments with their internal cyber security resources and seek managed security services.

•

Increasing expectations for applications availability and frictionless performance, due to the increasing dependence on applications in today’s business world. Businesses are sensitive to the resilience and availability of their applications, given their customers’ expectations of flawless experience and optimal performance. As such, exposed web and API based applications are the target for attackers that utilize both the server side as well as the client/browser side platforms for spreading their malicious code. New security controls utilize the power of AI and machine learning to control the delivery of AppSec services (control false positives) as well as detection of zero-days.

•

Israel-Hamas and Ukraine-Russia Military Conflicts. The state of war declared in Israel in October 2023 (see the risk factor titled “Political, economic and military instability in the Middle East or Israel, including the state of war declared in Israel in October 2023, may harm our business”) and the Russia-Ukraine war (see the risk factor titled “Our business may be affected by sanctions, export controls and similar measures targeting Russia and other countries and territories as well as other responses to Russia’s military conflict in Ukraine, including indefinite suspension of operations in Russia and dealings with Russian entities by many multi-national businesses across a variety of industries”).

•

We have developed a broad portfolio of solutions to address the challenges and meet the requirements arising from these trends.

•

We continuously focus on innovation and believe that our solutions have, in many instances, a technological advantage over competing solutions.

•

We offer our solutions in a wide array of deployment models (on-premise solutions, managed services, cloud-based solutions, etc.), in order to support various customers’ business models. We believe this flexibility addresses the complexity and diversity of the current application and infrastructure ecosystem.

•

We operate in a highly competitive environment, and some of our competitors have larger internal resources, and a larger installed base.

•

While we believe that the shift towards a subscription-based business model is a strategic transition towards higher growth and profitability in the long term, we may not be successful in its execution, including an inability to maintain a high subscription renewal rate.

•

In addition, our customers’ purchasing decisions are related to the conditions in our industry and in the various regions and geographical markets in which we operate and are tied to the overall IT spending climate. Uncertainty about current global economic conditions continues to pose a risk as customers may postpone or reduce spending in response to such uncertainties. In particular, the Israel-Hamas and Ukraine-Russia military conflicts may negatively affect economic conditions regionally, as well as globally, disrupt operations, affect supply chains, or otherwise negatively impact our business.

•

The other risks and uncertainties we face, as described under Item 3.D “Risk Factors.”

•

Revenue recognition;

•

Investment in marketable securities;

•

Business combinations;

•

Goodwill and impairment of long-lived assets;

•

Share-based compensation; and

•

Income taxes.

Name	Age	Position
Yuval Cohen (1)(2)	61	Chairman of the Board of Directors
Yair Tauman (1)(2)(3)(4)	75	Director
Stanley B. Stern (2)(4)(6)(7)	66	Director, Chairman of the Nomination and Corporate Governance Committee
Naama Zeldis (2)(3)(4)(5)	60	Director, Chairperson of the Audit Committee
Meir Moshe (2)(3)(5)(7)	69	Director, Chairman of the Compensation Committee
Israel Mazin (2)(6)(7)	64	Director
Alex Pinchev (1)(2)	73	Director
Roy Zisapel (5)	53	President, Chief Executive Officer and Director
Guy Avidan	61	Chief Financial Officer
Yoav Gazelle	54	Chief Business Officer
David Aviv	68	Chief Technology Officer
Gabi Malka	48	Chief Operating Officer
Sharon Trachtman	55	Chief Marketing Officer
Riki Goldriech	47	Chief People Officer

		Salaries, fees, commissions and bonuses				Pension, retirement and other similar benefits
2022 - All directors and officers as a group, consisting of 14 persons*		$	3,307,407			$	527,559
2023 - All directors and officers as a group, consisting of 15 persons**		$	2,419,283			$	475,235

Name and Principal Position (1)	Year	Salary	Bonus (including Sales Commissions) (2)	Equity-Based Compensation (3)	All Other Compensation (4)	Total
(US$ In Thousands)
Roy Zisapel, President, Chief Executive Officer and Director	2023	450 (5)	(6)	2,451	139*	3,040
Guy Avidan, Chief Financial Officer	2023	308		261	67	636
Yoav Gazelle, Chief Business Officer	2023	240	198	214	40	692
Gabi Malka, Chief Operating Officer	2023	319		139	73	531
David Aviv, Chief Technology Officer	2023	300		139	72	511

(1)

Unless otherwise indicated herein, all Covered Executives are (i) employed on a full-time (100%) basis; and (ii) subject to customary confidentiality, intellectual property assignment and non-solicitation provisions as well as an undertaking not to compete with us or in our field of business for at least 12 months following termination of employment.

(2)

Amounts reported in this column represent annual bonuses, including sales commissions. Consistent with our Compensation Policy, such bonuses are based upon (i) for non-sales executive officers - achievement of milestones and targets and the measurable results of the Company, as compared to our budget and/or work plan for the relevant year. The bonus (of up to 10% of the annual bonus) is based on the achievement and performance of pre-determined key performance indicators (KPIs), and, in any event, not to exceed the amount of 200% of the base salary; and (ii) for sales executive officers - achievement of targets of revenues generated by the individual and/or his/her team or division and/or the Company and in any event, not to exceed the amount of four annual base salaries of such executive.

(3)

Amounts reported in this column represent the grant date fair value in accordance with accounting guidance for share-based compensation. For a discussion of the assumptions used in reaching this valuation, see Note 2(s) to our consolidated financial statements included elsewhere in this annual report.

(4)

Amounts reported in this column include benefits and perquisites, including those mandated by applicable law. Such benefits and perquisites may include, to the extent applicable to the Covered Executive, payments, contributions and/or allocations for savings funds (e.g., Managers Life Insurance Policy), education funds (“keren hishtalmut”), pension, severance, vacation, car or car allowance, medical insurances and benefits, risk insurances (e.g., life or work disability insurance), phone, convalescence or recreation pay, relocation, payments for social security, tax gross-up payments and other benefits and perquisites consistent with Radware’s guidelines. Unless otherwise indicated herein, all Covered Executives (i) are entitled to a notice period of at least one month prior to termination (other than termination for cause), during which they are generally entitled to all compensation and rights under their employment agreements; and (ii) are not entitled to any special bonuses or benefits upon a change of control of our Company, other than a potential acceleration of the vesting of their share options pursuant to our equity incentive plan, as more fully described in Item 6.E “Share Ownership.”

(5)

As approved by our shareholders on July 28, 2022, as of such date, Roy Zisapel’s gross base salary increased from $400,000 to $450,000 and his annual bonus increased from $400,000 to $600,000 (however, the actual payout, based on performance, could reach $900,000 for overperformance).

(6)

Consistent with our Compensation Policy, and as approved by our shareholders on July 28, 2022, Roy Zisapel is entitled to an annual bonus of up to $600,000 (however, the actual payout, based on performance, could reach $900,000 for overperformance).

Class		Term expiring at the annual meeting for the year		Directors
Class I		2024		Yair Tauman and Yuval Cohen
Class II		2025		Roy Zisapel, Naama Zeldis and Meir Moshe
Class III		2026		Stanley Stern, Israel Mazin and Alex Pinchev*