Netskope

Prospectus Summary

The following summary highlights information contained elsewhere in this prospectus. It does not contain all the information you should consider before investing in our Class A common stock. You should read this entire prospectus carefully, including the sections titled "Risk Factors" and "Management's Discussion and Analysis of Financial Condition and Results of Operations," and our consolidated financial statements and related notes included elsewhere in this prospectus, before making an investment decision. In this prospectus, unless the context requires otherwise, all references to "we," "our," "us," "Netskope," and the "Company" refer to Netskope, Inc. and its consolidated subsidiaries. Our fiscal year end is January 31, and our fiscal quarters end on April 30, July 31, October 31, and January 31. Our fiscal year ended January 31, 2024, fiscal year ended January 31, 2025, and fiscal year ending January 31, 2026 are referred to herein as "fiscal 2024", "fiscal 2025", and "fiscal 2026", respectively.

Overview

We are redefining security and networking for the era of cloud and AI.

The cloud and AI have completely revolutionized work. We are more dispersed, more productive, and more automated than ever before, and the rate of change is only accelerating. Not since the internet has there been such a transformative tectonic shift. But, with it has come collateral damage—traditional security and networking are now broken.

We founded Netskope to address this revolution. We built Netskope One, our unified, cloud-native platform from the ground up to solve the challenge of securing and accelerating the digital interactions of enterprises in this new era. Organizations rely on our Netskope One platform to provide profound contextual intelligence into their data and digital interactions, securing them with precision, without sacrificing the digital experience. We leverage our patented technologies to enable dynamic, granular context-aware policies that allow us to protect sensitive data, stop threats, support regulatory compliance, and elevate the digital experience.

By converging advanced security and modern networking capabilities with deep analytics, based on our analysis of IDC data, we believe our unified solution addresses a large total addressable market that is projected to reach $138.9 billion by 2028, growing at a 16.8% compound annual growth rate ("CAGR") from 2024 to 2028, providing us with a sustained and durable opportunity. We believe we are in the early days of addressing the nascent market opportunity for AI security that we project will grow to $30.8 billion by 2028, contributing an incremental $9.9 billion to our estimated total addressable market by 2028.1 Organizations today operate in a digital landscape that is heterogeneous and highly connected. It is comprised of globally dispersed users and non-human entities such as devices, applications, automated systems, and AI agents that interact with each other and a plethora of managed and unmanaged Software-as-a-Service ("SaaS") applications, websites, AI, private applications, and other ecosystem applications across data centers and private and public clouds. With this new digital landscape, enterprises need a security and networking platform that can handle these far more complex, distributed, and dynamic sets of connections—all with more advanced security measures—to keep the organization, its people, and its data safe.

The substrate for this digital landscape is the modern internet. No longer just a collection of static web pages of the 2000-2010 era, it is dynamic, interactive, and data-rich, and powered by the cloud and AI. In addition, continuously evolving technologies, such as AI, are voraciously consuming organizational data but also generating it at unprecedented scale. This data is increasingly spread across the cloud and shadow IT systems and accessed by human and non-human entities worldwide, beyond locked down on-premises corporate IT environments. Data is the lifeblood of modern organizations, but protecting it and the broader organization has never been more difficult.

1 See the section titled "Business—Our Market Opportunity" for a more detailed discussion of the assumptions underlying our estimate of the total addressable market for our unified solution and AI security.

Meanwhile, cyber adversaries are leveraging cloud and AI technologies to launch widespread and sophisticated attacks. Ransomware-as-a-Service groups have emerged, deploying an onslaught of rapidly morphing attack campaigns. Nefarious actors trick victims into executing commands that infect their machine with malware, such as the LummaStealer campaign that transpired in early 2025. AI advances have armed attackers with new tools, such as deepfakes, to steal data for financial gain, espionage, or digital warfare. Organizations also face significant compliance risk from constantly growing security and data privacy regulations.

Legacy appliance-based and first-generation cloud security solutions were designed for a legacy internet and data footprint, where simple rules-based threat detection and block-or-allow policies were sufficient. Moreover, traditional corporate networks were not designed to support the scale, flexibility, performance, and advanced security that is essential in the cloud and AI era. This frustrates users and creates an untenable situation for organizations, forcing them to trade performance for security, or vice versa. In many cases, users may be allowed to directly access an application without security to avoid a bad user experience. The fragmented nature of these legacy solutions, and the way they were architected, fundamentally limits their ability to address the complex and continuously evolving security and networking challenges that are the new reality for organizations. These tradeoffs hurt security, limit resilience and performance, create greater regulatory risk, and increase operational costs.

Architecture is critical when addressing these challenges. Our Netskope One platform uses a unique architecture built from the ground up as a unified platform with a converged security, network, and analytics technology stack that runs on our NewEdge global private cloud network ("NewEdge network") to deliver highly secure and performant digital interactions.

Our Netskope One platform deeply understands the dynamic "language" of the modern internet. This means enabling real-time contextual visibility into, and control over, an organization's traffic. For example, our Netskope One platform sees if a user is entering sensitive corporate data into a prompt of a personal instance of an application such as Google Gemini or ChatGPT and then coaches or re-directs them towards the corporate instance—in real-time. This sophisticated contextual awareness is critical for safely enabling the widespread adoption of cloud and AI tools that drive business innovation and productivity today.

Our Netskope One platform leverages our proprietary AI models to detect, classify, track, and control sensitive data no matter where it is or how it is being used, stop threats no matter where they originate, and improve the digital experience globally whether a human or non-human entity is involved. We solve organizations' security versus performance tradeoff challenges with our NewEdge network, which is comprised of more than 120 full-compute edge data centers in more than 75 regions, with all of our capabilities available for every customer in every data center. Architected to deliver advanced security capabilities as close to the end user as possible, our NewEdge network greatly reduces the need to re-route traffic back and forth between data centers and provides a seamless, resilient user experience across locations and devices. This enables blazing fast traffic on-ramps and processing and optimized access to critical business applications and content.

Our customers rely on us to protect their sensitive data, stop threats, accelerate their digital interactions, and deliver significantly higher operational simplicity. They include some of the largest and most complex organizations around the world and across industries. As of July 31, 2025, we had 4,317 customers,2 a 21% year-over-year increase from 3,571 customers as of July 31, 2024. As of July 31, 2025, more than 30% of the Fortune 100 and approximately 18% of the Forbes Global 2000 were our customers.

2 Customers refers to end customers. For more information, see Note 2 "Basis of Presentation and Summary of Significant Accounting Policies" in the notes to our consolidated financial statements included elsewhere in this prospectus.

As the digital and threat landscape continues to evolve, we have grown rapidly since our inception. Our Annual Recurring Revenue ("ARR")3 increased 33% year-over-year to $707 million as of July 31, 2025, compared to $531 million as of July 31, 2024. Our revenue increased 31% year-over-year to $328 million for the six months ended July 31, 2025, compared to $251 million for the six months ended July 31, 2024. Net loss improved to $170 million for the six months ended July 31, 2025, compared to $207 million for six months ended July 31, 2024.

We have achieved strong retention metrics, as evidenced by our dollar-based net retention rate ("NRR")4, which increased to 118% as of July 31, 2025, compared to 113% as of July 31, 2024. In addition, our dollar-based gross retention rate ("GRR")5 increased to 96% as of July 31, 2025, compared to 95% as of July 31, 2024.

In recent periods, we have invested in research and development to drive rapid innovation, leveraging our core platform to serve our customers' needs and further strengthen our technology leadership. We have also invested in expanding our salesforce and channel partners to pursue attractive growth opportunities both domestically and internationally. Netskope is built to scale. As a result, our loss from operations improved to $91 million for the six months ended July 31, 2025 from $161 million for the six months ended July 31, 2024, while our non-GAAP loss from operations improved to $63 million for the six months ended July 31, 2025 from $123 million for the six months ended July 31, 2024. For the five most recent fiscal quarters ended July 31, 2024, October 31, 2024, January 31, 2025, April 30, 2025 and July 31, 2025, our incremental operating margin was 12%, 83%, 85%, 108%, and 74%, while our incremental non-GAAP operating margin was 10%, 72%, 72%, 100%, and 58%, respectively.

Our operating cash flow margin improved to 3% for the six months ended July 31, 2025 from (42%) for the six months ended July 31, 2024. See the section titled "Management's Discussion and Analysis of Financial Condition and Results of Operations—Non-GAAP Financial Measures" for information regarding our use of non-GAAP loss from operations and incremental non-GAAP operating margin and a reconciliation of non-GAAP loss from operations to loss from operations.

Industry Background

Cloud and AI are Transforming the Internet

The internet is no longer just a collection of static web pages. The modern digital landscape is dynamic, data-rich, and interactive, spanning the web, data centers, managed and unmanaged SaaS applications, private and public clouds, and ecosystem applications. Today's internet and software applications use modern languages and methods of exchanging information, rich context, and data, notably via Application Programming Interfaces ("APIs") and new protocols, such as Model Context Protocol ("MCP") and the Agent2Agent ("A2A") protocol typically encoded using JavaScript Object Notation ("JSON"). Applications now connect directly to AI models via APIs and various protocols— sending requests, initiating third-party services, and receiving responses in real-time—all of which increase the complexity of these interactions and some of which require little or no human interaction. The challenge is security—organizations must have very granular visibility and context of the modern digital landscape so they can enable its use but must also do so securely and with a great end user experience. This requires a real-time, deep understanding of the contextual parameters of each digital interaction to enable more granular levels of dynamic and comprehensive control—a necessity for organizations modernizing their security while prioritizing business adoption of new technologies.

3 See the section titled "Management's Discussion and Analysis of Financial Condition and Results of Operations—Overview" for a description of how we calculate ARR.

4 See the section titled "Management's Discussion and Analysis of Financial Condition and Results of Operations—Overview" for a description of how we calculate NRR.

5 See the section titled "Management's Discussion and Analysis of Financial Condition and Results of Operations—Overview" for a description of how we calculate GRR.

Protecting Data—the Lifeblood of Modern Business—Has Never Been More Difficult or More Important

The vast amount of data an organization has and creates is often one of its greatest assets and competitive differentiators. It is mission critical for organizations to classify and protect this data. The challenge is that this growing amount of sensitive data is no longer maintained in secure, centralized corporate systems. Data now resides across digital environments, including corporate managed and unmanaged decentralized cloud services, the web, AI, SaaS applications, Infrastructure-as-a-Service, Platform-as-a-Service, private applications, endpoints, on-premises networks, databases, data lakes, data warehouses, email, and other IT systems. The nature of how it moves within and outside of an organization's control is dramatically different than it was a decade ago. For example:

New data sharing behaviors, such as image, audio, and video sharing, undermine the effectiveness of conventional, static text-based data identification methods that traditional data loss prevention ("DLP") solutions mainly rely upon.

Generative AI applications can create synthetic data ranging from realistic text and images to code, audio, and video content, which often mimics real-world data. This synthetic data serves to train other AI systems, enhance simulations, or generate personalized content, but it also raises concerns about the origin and authenticity of the data, which can be exploited to forge documents or create deepfake communications that look and sound authentic and can evade legacy data inspection techniques.

Agentic AI, characterized by its autonomous decision-making capabilities, creates operational data that includes logs of actions, decisions, and interactions with other systems. This data travels between interconnected enterprise systems, APIs, and cloud infrastructures—from creation, through various stages of processing, to its eventual use in business analytics or automated responses. This introduces new vectors for data leakage and unauthorized access that legacy data inspection tools were not designed to look for.

Modern Business Needs Fast, Secure, and Resilient Performance that Far Exceeds the Capability of Existing Network Architectures Traditional networks were built for a world where users typically worked from fixed locations, such as offices or campuses, and their applications and data resided in a corporate data center. The world we now live in is vastly different.

Extended enterprises need to provide ubiquitous access to their globally distributed business partners, suppliers, contractors, and acquired businesses. Furthermore, many digital interactions are now automatically initiated by internet of things/operational technology devices, factory floors, applications, robots, and AI agents, which we collectively refer to as "non-human entities." As a result, it is now an organizational imperative to deliver a fast and seamless experience for all digital interactions.

Cyber Risk Is One of the Greatest Challenges Organizations Face

Adversaries continue to find new and innovative ways to trick organizations and their employees into downloading and opening high-risk file types such as executables, archives, documents, and scripts while evading inspection. Adversaries are increasingly targeting cloud and SaaS applications directly, stealing tokens and credentials, and tricking victims into authorizing the attacker to directly access their data, bypassing the endpoint completely. Examples of these include:

Ransomware-as-a-Service groups have emerged, deploying an onslaught of campaigns, including double-extortion schemes where data is stolen, encrypted, and leaked if the ransom is not paid.

Nefarious actors have deployed fake CAPTCHA pages to trick victims into executing a command that infects their machine with malware, such as the LummaStealer campaign that transpired in early 2025.

Recent AI advances have armed attackers with new tools to create increasingly convincing and targeted baits, including deepfakes, making social engineering more difficult to detect.

Limitations of Legacy Systems

Legacy systems suffer from a number of fundamental architectural shortcomings, including:

Inability to Provide Real-time Granular Inspection and Control of Digital Activity, Forcing Organizations to Block Essential Applications or Allow Them to be Used and Accept the Risks Many legacy security systems are not capable of understanding the dynamic, data-rich, and interactive language of the modern internet. As a result, they lack real-time granular visibility and context of each interaction and cannot go beyond rigid and rudimentary controls such as blocking or allowing based on basic application access rules, device posture, or common activity types. Moreover, these legacy security systems were built for a world of human-generated traffic and struggle to manage the velocity and risks of machine-to-machine communication between non-human entities, creating critical blind spots.

Lacking a Unified, Comprehensive Approach to Data Security

Many organizations today rely on a myriad of disparate point solutions for data security, each intended for a specific digital environment. This fragmented approach with disjointed controls and policies leaves IT teams struggling to gain full visibility into where their data resides, what type of data it is, who is accessing it, and how it is being used holistically. This has two important consequences:

Increased exposure to data breaches. Without unified, comprehensive data security in place, data is more vulnerable to breaches, theft, and misuse, which can have significant adverse consequences.

Stifled productivity and agility. Teams may be reluctant to share or experiment with data, fearing security breaches or non-compliance with regulations. As a result, organizations that do not modernize their data security find themselves locked out of their own data, unable to leverage it effectively for new business models, solutions, or customer experiences.

Cannot Apply Advanced Security and Networking Controls at Scale Without Degrading Performance

Legacy security and networking systems suffer from one or more of the following architectural limitations.

They lack advanced security controls. Their technology and architecture were built for securing legacy internet traffic, not for the era of the modern cloud and AI. As a consequence, they cannot understand the context needed to determine what should, or should not, require inspection. In addition, they have rudimentary data security capabilities and lack the sophisticated methods of inspection and advanced algorithms, including the use of AI, needed to identify sensitive data across all formats of data and stop threats. They also lack the ability to conduct data and advanced threat inspection in real-time at scale for cloud and AI applications.

They lack advanced security capabilities at the edge and therefore must re-route traffic back to central corporate data centers or limited cloud enforcement points to enforce the required security controls, which leads to a poor user experience. This is because:

Legacy systems are built on a centralized compute model, not taking user experience into account. Over time, ever increasing throughput of traffic has resulted in an unacceptably slow experience for human and non-human entities.

Their networks leverage the public cloud providers' infrastructure, much of which is not intended to handle compute-intensive products from edge locations. This limits the number of locations where their security services can operate and hinders the control they can exert over traffic routing. In addition, public cloud providers control how they prioritize traffic.

They are unable to process encrypted traffic, which makes up 80-95% of internet traffic according to the Electronic Frontier Organization, at the scale and speed required by modern organizations.

Siloed, Cumbersome, and Closed Security and Networking Infrastructure

Organizations are burdened with a plethora of disparate security and networking appliances and cloud tools, each requiring separate management consoles, policies, and configurations. Even when all of these are sourced from a single vendor, they are often fragmented and inefficient. Instead of receiving the seamless single console, policy framework, and network experience they hope for, organizations get only a "platform" that is unintegrated, complex, costly to deploy, difficult to operate, and many times designed to be closed in order to lock-in customers.

Our Revolutionary Approach

Our Netskope One platform is architected from the ground up to address the limitations of existing solutions and help customers modernize security and networking for the cloud and AI era. Our platform simplifies administration, integrates with and enhances existing investments, protects people, non-human entities, and data from pervasive threats, enables tool and capabilities consolidation without requiring complete system overhauls, and balances the historically conflicting needs of networking and security.

With the widespread adoption of SaaS and cloud, and the beginnings of an era expected to be dominated by AI, the way that essential security and networking services are delivered must fundamentally change in order to satisfy modern business needs. We deliver a modern solution; our team has not only built a converged platform, but has also fully reimagined the architecture of security, networking, and analytics for the cloud and AI era.

Architecture is critical, and platform architecture itself is as important as the individual security, network, and analytics services that it delivers. The traditional methods of delivering these services are inadequate for the demands of today and tomorrow. A modern architecture is necessary for greater visibility and control over data, threats, and access, ensuring all enterprise traffic remains fast and secure when everything, everywhere, is online and interconnected, while addressing the increasing velocity and volume of security threats.