VeriSign (VRSN) 10-K2022 FY Annual report

The aggregate market value of the voting and non-voting common equity stock held by non-affiliates of the Registrant as of June 30, 2022, was $12.4 billion based upon the last sale price reported for such date on the Nasdaq Global Select Market. For purposes of this disclosure, shares of Common Stock held by persons known to the Registrant (based on information provided by such persons and/or the most recent Schedule 13Gs filed by such persons) to beneficially own more than 5% of the Registrant’s Common Stock and shares held by officers and directors of the Registrant have been excluded because such persons may be deemed to be affiliates. This determination is not necessarily a conclusive determination for other purposes.

Number of shares of Common Stock, $0.001 par value, outstanding as of the close of business on February 10, 2023: 104,879,307 shares.

The contents of these websites are not intended to be incorporated by reference into this Form 10-K or in any other report or document we file.

We also perform the Root Zone Maintainer function under an agreement with ICANN for the core of the internet’s DNS and operate two of the 13 root zone servers that contain authoritative data for the top of the DNS hierarchy.

We believe that timely development of new and enhanced services, including monitoring and visualization, registry provisioning platforms, navigation and resolution services, data services, value added services, and new and enhanced ways to ensure the security, stability, and resiliency of our services, is necessary to remain competitive in the marketplace.

Our future success will depend, in large part, on our ability to continue to maintain and enhance our current technologies and services and to develop new ones. We actively investigate and incubate new concepts and evaluate new business ideas through our innovation pipeline. We expect that most of the future enhancements to our existing services and our new services will be the result of internal development efforts in collaboration with suppliers, other vendors, customers, and the technology community. Under certain circumstances, we may also acquire or license technology from third parties.

To the extent end-users navigate using search engines or social media, as opposed to direct navigation via domain names, or transact on e-commerce platforms, we face competition from search engines such as Google, Bing, Yahoo!, and Baidu, social media networks such as Facebook and WeChat, e-commerce platforms such as Amazon, eBay and Taobao, and microblogging tools such as Twitter. In addition, we face competition from these social media and e-commerce platforms if they are used by businesses and individuals to establish an online presence rather than through the use of a domain name. Furthermore, we face competition from providers of web and mobile applications that allow end-users to locate and access content.

The DNS is governed under a multi-stakeholder model comprising civil society, the private sector, including for-profit and not-for-profit organizations such as ICANN, governments, including the U.S. government, academia, non-governmental organizations, and international organizations. ICANN plays a central coordination role in this bottom-up multi-stakeholder system. ICANN is mandated through its bylaws to uphold a private sector-led multi-stakeholder approach to internet governance for the public benefit. ICANN’s multi-stakeholder policy development processes have created, and will continue to create, policies, programs, and standards that directly or indirectly impact our business. Certain policies can be adopted as Consensus or Temporary Policies, which we are obligated to follow under our agreements with ICANN. For example, in response to the General Data Protection Regulation, ICANN issued a Temporary Policy modifying public access to information from Whois services.

We operate two of the world’s thirteen root servers. Along with the ICANN community, we are involved in discussions to establish criteria for operations of the root server system including the root servers that we operate. We also publish the root zone file, as the Root Zone Maintainer, under the Root Zone Maintainer Service Agreement (“RZMA”) with ICANN. The RZMA will expire on October 19, 2024, with an automatic renewal, unless earlier terminated.

Our employees are mission driven and values focused. Their dedication to these principles forms the backbone that enables Verisign to provide secure, stable, and resilient global connectivity. We recognize the importance of talent and culture in driving an environment that fosters high performance, inclusion, and integrity in all aspects of our work.

We rely on a combination of copyrighted software, trademarks, service marks, patents, trade secrets, know-how, restrictions on disclosure, and other methods to protect our proprietary assets. We also enter into confidentiality and/or intellectual property assignment agreements with our employees, consultants and current and potential affiliates, customers and business partners. We also control access to and distribution of proprietary documentation and other confidential information.

We have been issued numerous patents in the U.S. and abroad, covering a wide range of our technologies. Additionally, we continue to file patent applications with respect to certain of our technologies in the U.S. Patent and Trademark Office and internationally. Patents may not be awarded with respect to these applications and even if such patents are awarded, such patents may not provide sufficient protection of our technologies. We continue to consider opportunities for strategic growth and use of our patent portfolio.

We have obtained trademark registrations for the VERISIGN mark and VERISIGN logo in the U.S. and certain countries, and have pending trademark applications for the VERISIGN logo in a number of other countries. We have common law rights in other proprietary names. We take steps to enforce and police Verisign’s trademarks. We rely on the strength of our Verisign brand to help differentiate ourselves in the marketing of our products and services.

Our principal intellectual property consists of, and our success is dependent upon, proprietary software used in our business and certain methodologies (many of which are patented or for which patent applications are pending) and technical expertise and proprietary know-how we use in both the design and implementation of our current and future registry services. We own our proprietary Shared Registration System through which registrars submit second-level domain name registrations for each of the registries we operate, as well as the ATLAS distributed lookup system which processes hundreds of billions of queries per day. Some of the software and protocols used in our business are in the public domain or are otherwise available to our competitors, and some are based on open standards set by organizations such as the Internet Engineering Task Force. To the extent any of our patents are considered “standard essential patents,” we may be required to license such patents to our competitors on reasonable and non-discriminatory terms or otherwise be limited in our ability to assert such patents.

As an operator of critical internet infrastructure, we experience a high rate of cyber-attacks and attempted security breaches targeting our systems and services, including the most sophisticated forms of attacks, such as advanced persistent threat attacks, exploitation of zero-day vulnerabilities, ransomware attacks, and social engineering attacks. The forms of these attacks are constantly evolving and may involve methods, tools, and strategies that may not have been previously identified and may not have been observed until the moment of launch, or until sometime after, making these attacks virtually impossible to anticipate and difficult to defend against. In addition to external threats, our systems and services are subject to insider threat risks, including physical or electronic break-ins, sabotage, and risks from suppliers, such as consultants and advisors, SaaS providers, hardware, software, and network systems manufacturers, regional internet registries, and other vendors, or from current or former contractors or employees. These threats and any resulting security breaches can arise from intentional or unintentional actions. Our continued exposure to these threats and the potential that they could lead to material liability claims against us requires us to expend significant financial and other resources. We have developed policies, standards, and procedures to identify, protect, detect, respond, and recover from threats posed by cybersecurity risks, and failure to comply with these policies, standards, and procedures by our employees or suppliers could limit our ability to effectively manage threats from these cybersecurity risks. In addition, we must ensure that our employees stay focused on cybersecurity threats especially in our hybrid work environment, or our ability to effectively manage cybersecurity risks could be impacted. Our failure to effectively manage these security risks, including insider threats, could result in material harm to our business, including loss of or delay in revenues, failure to meet service level agreements, material liability claims, failure to maintain market acceptance, injury to our reputation, and increased costs, and could call into question our ability to preserve the security and stability of the internet.

Security vulnerabilities in our systems and our vendors’ systems, including vulnerabilities in third party software and hardware, pose a material risk to our operations. We use externally-developed technology, systems, and services, including both hardware and software, for a variety of purposes, including compute, storage, encryption and authentication, back-office support, and other functions. We have developed policies, standards, and procedures to reduce the impact of security vulnerabilities in system components, as well as at any vendors where our data is stored or processed. However, such measures cannot provide absolute security. While we strive to remediate known vulnerabilities on a timely basis, such vulnerabilities could be exploited before our remediation is effective and if so, could cause systems and service interruptions, data loss and other damages. Our failure to identify, remediate and mitigate security vulnerabilities, including any potential failure to timely replace and upgrade hardware, software, or other technology assets, could result in material harm to our business, including loss of or delay in revenues, failure to meet service level agreements, material liability claims, failure to maintain market acceptance, injury to our reputation, increased costs, and call into question our ability to preserve the security and stability of the internet.

In addition, our networks have been, and likely will continue to be, subject to DDoS attacks. Recent industry experience has demonstrated that DDoS attacks continue to grow in size and sophistication and have the ability to widely disrupt internet services. While we have adopted mitigation techniques, procedures, and strategies to defend against DDoS attacks, and have successfully mitigated DDoS attacks to date, there can be no assurance that we will be able to defend against every attack, especially as the attacks increase in size and sophistication. Any attack, even if only partially successful, could disrupt our networks, increase response time, negatively impact our ability to meet our service level agreements, and generally impede our ability to provide reliable service to our customers and the broader internet community. We have historically incurred, and will continue to incur, significant costs to enable our infrastructure to process levels of attack traffic that can be substantially larger than our normal transaction volume. We are employing new technologies and new and different services and capabilities to help mitigate DDoS attacks. If these new technologies, services and capabilities are not effective, our infrastructure could be

In addition, we are subject to social engineering attacks including phishing, spear phishing, whaling, vishing, smishing, and domain spoofing, which are designed to entice people to divulge sensitive information or take actions that, if successful, could pose a material risk to our operations. The number of such attacks is increasing. Social engineering attacks have occurred in concert with ransomware attacks. While we deploy advanced tools and conduct continuous security awareness training to address social engineering attacks, such measures cannot provide absolute security. Similarly, although we implement redundant architecture and multiple recovery solutions, and conduct periodic exercises to mitigate the threat of ransomware, we still may be subject to successful ransomware attacks. Our failure to prevent such attacks, including any successful social engineering attack, could result in our inability to meet our service legal agreements and could otherwise materially harm our business, including from legal claims, governmental investigations and scrutiny, injury to our reputation, and increased costs.

We do not maintain specific reserves for security breaches, cyber-attacks and DDoS attacks against our systems and the amount of insurance coverage we maintain may be inadequate to cover claims or liabilities relating to such attacks.

Despite testing, services as complex as those we offer or develop could contain undetected defects or errors, which could result in service outages or disruptions, compromised customer data, including DNS data, diversion of development resources, injury to our reputation, legal claims, increased insurance costs or increased service costs. Performance of our services, whether or not defective, could have unforeseen or unknown adverse effects on the networks over which they are delivered, on internet users and consumers, and on third-party applications and services that use our services, any of which could result in legal claims against us. While we strive to prevent, detect and remediate defects or errors, they can and do occur and they could result in our inability to meet customer expectations in a timely manner, failure to meet our service level agreements, injury to our reputation, and increased costs.

Routing on the internet depends on the Border Gateway Protocol (“BGP”), which is a protocol that relies on networks within the internet infrastructure acting in a trustworthy manner when sharing information about destinations for connectivity and the routing of internet traffic. As a trust-based protocol, BGP has a number of vulnerabilities that may lead to outages or disrupt our services, including as a result of “route hijacks” that involve accidental or malicious rerouting of internet traffic, or “route leaks” that involve the malicious or unintentional propagation of routing information beyond the intended scope of the originator, receiver, and/or one of the networks along the route’s path. Both route hijacks and route leaks can result in partial or full rerouting of internet traffic for the impacted destinations. These types of events, which are generally beyond our control, could enable an array of attack conditions or service disruptions, and could result in adverse publicity and adversely affect the public’s perception of the security of e-commerce and communications over the internet, as well as of the security or reliability of our services.

To address internet routing system vulnerabilities, many internet service providers have adopted and apply internet reachability policies based on a system known as the Resource Public Key Infrastructure (“RPKI”) operated by the regional internet registries (“RIRs”). The RIRs allocate internet number resources, such as internet protocol addresses, to enterprises and network operators. We have limited visibility into the maturity of and investment in the RIRs’ operational and security controls, which are outside of our control. When the availability, integrity, or confidentiality of any of the information in the RPKI system, or systems used to maintain and administer RPKI data and systems, are impacted or otherwise compromised in any of the RIRs, or any network operator that is a relying party of the RPKI system, or the operations or ingestion of data from the RPKI system are otherwise impacted by a known or unknown vulnerability, our services may be negatively impacted. Such impacts may include degraded or full loss of reachability of service addresses in the global internet routing system, resulting in degradation or complete loss of availability of our registration and resolution services. A compromise of the RPKI system and related services, or unintentional or unauthorized manipulation of data therein, may also result in other denial of service attack conditions for our infrastructure and services. The systemic dependencies introduced by RPKI and the relying parties of the RPKI system, including network service providers, are outside of our control, and systems that depend upon the RPKI may be only as secure as the weakest elements of the RPKI system. Contracting with RIRs for the provision of and access to RPKI services carries material operational risks, as described above, as well as material contractual risks, which may expose us to service disruptions and material liability.

We depend on the uninterrupted operation of our various systems, secure data centers, and other computer and communication networks. Our systems and operations are vulnerable to damage or interruption from power loss, transmission cable cuts and other telecommunications failures, damage or interruption caused by fire, earthquake, and other natural disasters, intentional acts of vandalism, terrorist attacks, unintentional mistakes, or errors. Our systems and operations also face risks inherent in, or arising from, the terms and conditions of our agreements with service providers to operate our networks and data centers. We are also subject to the risk of state suppression of internet operations. Any of these problems or outages could create potential liability and exposure, including from a failure to meet our service level agreements, and could decrease customer satisfaction, harming our business, or resulting in adverse publicity and damage to our reputation or call into question our ability to preserve the security and stability of the internet.

Most of the computing infrastructure for our Shared Registration System is located at, and most of our customer information is stored in, data centers we own or lease and operate. In 2019, we expanded some of our data center services to a leased data center facility. These data centers are vulnerable to damage or interruption, including from natural disasters, such as fires, earthquakes, hurricanes, and floods, power loss, hardware or system failures, physical or electronic break-ins, human error or interference. We are also updating our network architecture in several of our new and existing data centers. If our data center facilities or the updated network architecture do not operate as expected, including the ability to quickly switch over between sites, we could experience service interruptions or outages. A failure in the operation of our Shared Registration System could result in the inability of one or more registrars to register or manage domain names for a period of time. If such a registrar has not implemented robust services in a manner that preserves transactions until processed by the registry, then the failure in the operation of our Shared Registration System could result in permanent loss of transactions at the registrar during that period. A failure in the operation of our Shared Registration System could also impact our ability to provide up-to-date information in our resolution systems, which could result in breaches of our service level agreements pertaining to our resolution services and impact the resolution of domain names on the internet. Although we carry insurance, we do not carry insurance or designated financial reserves for such interruptions.

In addition, our services depend on the secure and efficient operation of the internet connections to and from customers to our Shared Registration System residing in our secure data centers. These connections depend upon the secure and efficient operation of internet service providers, internet exchange point operators, and internet backbone service providers. Such providers have encountered periodic operational problems or experienced outages in the past beyond our scope of control and may continue to encounter problems and outages or may choose to discontinue their service. If the providers that our connections depend upon do not protect, maintain, improve, and reinvest in their networks or present inconsistent, incorrect, or invalid data regarding DNS responses through their networks, our business could be harmed.

We retain certain customer and employee information in our data centers and various domain name registration systems. Any physical or electronic break-in or other security breach or compromise of the information stored at our data centers or domain name registration systems may jeopardize the security of information we retain or that is retained in the computer systems and networks of our customers. In such an event, we could face material liability and exposure from litigation and investigations, fail to meet service level agreements, or be at risk for loss of various security and standards-based compliance certifications needed for operation of our businesses, and customers could be reluctant to use our services, any of which could also adversely affect our reputation and harm our business or cause financial losses that are either not insured against or not fully covered through any insurance.

We are also subject to changing laws and regulations that impact whether, how, and under what circumstances we may transfer, process and/or receive certain data that is critical to our operations, including data shared between countries or regions in which we operate and data shared among our products and services. For example, following the invalidation of the U.S.-EU Safe Harbor by the European Court of Justice (“EUCJ”) in 2015, the European Union and United States agreed to an alternative framework for data transferred from the European Union to the United States, called Privacy Shield. In 2018, Privacy Shield was also invalidated by the EUCJ. In 2022, the United States and European Union announced a new, but undefined data transfer framework, which once finalized, also could be subject to further legal challenges.

A significant portion of our revenues is derived from customers outside the U.S. Our business operations in international locations have required, and will continue to require, significant management attention and resources. We may also need to tailor some of our services for a particular location and to enter into international distribution and operating relationships. We may fail to maintain our ability to conduct business, including potentially material business operations in some international locations, or we may not succeed in expanding our services into new international locations or expand our presence in existing locations. Failure to do so could materially harm our business. Moreover, local laws and customs in many countries differ significantly from those in the U.S. In many foreign countries, particularly in those with developing economies, it is common for others to engage in business practices that are prohibited by our internal policies and procedures or U.S. law or regulations applicable to us. There can be no assurance that our employees, contractors and agents will not take actions in violation of such policies, procedures, laws and/or regulations. Violations of laws, regulations or internal policies and procedures by our employees, contractors or agents could result in financial reporting problems, investigations, fines, penalties, or prohibition on

Escalating political tensions between the United States and China in particular may pose additional risks to our business in China. In 2020 and 2021, the U.S. government announced restrictions on trading with certain Chinese companies. The Chinese government subsequently announced actions that, if implemented, could impose additional restrictions on the Chinese operations of non-Chinese companies. These and future government actions impacting our ability to operate in China may cause our management’s attention to be diverted, our reputation to be damaged, or our business in China to be adversely affected.

We are subject to income taxes in both the U.S. and numerous international jurisdictions. Significant judgment is required in determining our worldwide provision for income taxes. In the ordinary course of our business, there are many transactions and calculations where the ultimate tax determination is uncertain. Our effective tax rates may fluctuate significantly on a quarterly basis because of a variety of factors, including changes in the mix of earnings and losses in countries with differing statutory tax rates, changes in our business or structure, changes in tax laws that could adversely impact our income or non-income taxes or the expiration of or disputes about certain tax agreements in a particular country. We are subject to audit by various tax authorities. In accordance with U.S. GAAP, we recognize income tax benefits, net of required valuation allowances and accrual for uncertain tax positions. Although we believe our tax estimates are reasonable, the final determination of tax audits and any related litigation could be materially different than that which is reflected in historical income tax provisions and accruals. Should additional taxes be assessed as a result of an audit or litigation, an adverse effect on our results of operations, financial condition and cash flows in the period or periods for which that determination is made could result.

The Organization for Economic Cooperation and Development (“OECD”) continues to issue guidance that will provide a long-term, multilateral proposal on the taxation of the digital economy. Similarly, some international tax jurisdictions, independent of the OECD, have enacted or may enact new tax regimes aimed at income resulting from digital services. Although we cannot predict the nature or outcome of such changes or the likelihood of such legislative proposals being adopted in the U.S. or throughout the world, any or all of these changes in tax laws could increase our taxes and adversely impact our financial condition and cash flow.

Our Registry Agreements with ICANN require us to implement and comply with various technical standards and specifications published by the Internet Engineering Task Force (“IETF”). ICANN could impose requirements on us through changes to these IETF standards, or new standards, that are inconsistent with our current or future plans, that impose substantial

The internet is governed under a multi-stakeholder model comprising civil society, the private sector, including for-profit and not-for-profit organizations such as ICANN, governments, including the U.S. government, academia, non-governmental organizations and international organizations. If ICANN fails to uphold, or if the multi-stakeholder model is significantly redefined, it could harm our business. For example, certain governments, governmental organizations, and private actors continue to express dissatisfaction with the multi-stakeholder form of internet governance and have proposed alternatives including oversight by the United Nations or by international treaties. Furthermore, national legislation has been proposed on topics such as information security and access to personal information that effectively supplants the multi-stakeholder process for policy development in the DNS. Substantially weakening or replacing the multi-stakeholder form of internet governance could materially harm our business.

In addition, in 2016 the U.S. government transferred key internet functions to ICANN, who adopted new and enhanced accountability mechanisms in its bylaws such as the creation of the Empowered Community. There can be no assurance that the removal of the U.S. government oversight of these key functions, or the changes to ICANN’s bylaws, will not negatively impact our business.

We are, and may in the future become, involved in claims, lawsuits, audits, and investigations, including intellectual property litigation and infringement claims. Litigation is inherently unpredictable, and unexpected judgments or excessive verdicts do occur. In addition, proceedings that we initially view as immaterial could prove to be material. Adverse outcomes in lawsuits, audits and investigations, could result in significant monetary damages, including indemnification payments, or injunctive relief that could adversely affect our ability to conduct our business, and may have a material adverse effect on our financial condition, results of operations and cash flows. For example, we are engaged in activities to help mitigate security threats and other forms of DNS abuse in the gTLDs and ccTLDs we operate and we are involved in community efforts that could increase and expand such activities including potential new contractual obligations. Such activities include, for example, receiving reports of suspected threats and abuse from appropriate “trusted notifiers” (typically involving national and international law enforcement) and notifying registrars or others of domain names associated with suspected malicious or illegal activity. Our activities may also include disabling one or more domain names in the gTLDs or ccTLDs we operate including in response to governmental directives and orders in those jurisdictions in which we operate. Activities such as these have resulted in, and could in the future result in, significant litigation and could harm our reputation. Given the inherent uncertainties in litigation, even when we are able to reasonably estimate the amount of possible loss or range of loss and therefore record an aggregate litigation accrual for probable and reasonably estimable loss contingencies, the accrual may change in the future due to new developments or changes in approach. In addition, such claims, lawsuits, audits and investigations could involve significant expense and diversion of management’s attention and resources from other matters.

We have been designated as the registry operator for certain new gTLDs, including certain IDN gTLDs. Our new gTLDs may not be as or more successful than the new gTLDs obtained by our competitors. In addition, our new gTLDs may face additional universal acceptance and usability challenges and it is possible that resolution of domain names within some of these new gTLDs may be blocked within certain state or organizational environments, challenging universal resolvability of these strings and their general acceptance and usability.

See the “Competition” section in Part I, Item 1 of this Form 10-K for further information.

Technologies relating to online presence, including social media, mobile devices, apps, and search engines, have evolved and continue to evolve, changing the internet practices and behaviors of consumers and businesses. These ongoing changes can negatively impact the demand for our domain names. In addition, registrants purchase domain names for a variety of reasons, including personal, commercial, and investment reasons. Changes in the motivation of domain name registrants can negatively impact our business.

Some registrars and registrants purchase and resell domain names at an increased price in a secondary market. Adverse changes in the resale value of domain names, changes in the business models for such domain name registrars and registrants, or other factors, including regulations limiting the resale of domain names, could result in a decrease in the demand and/or renewal rates for domain names in the gTLDs we operate.

Some registrars and registrants seek to generate revenues by registering domain names specifically for website advertising. Changes in the way these registrars and registrants are compensated (including changes in methodologies and metrics) by advertisers and advertisement placement networks, such as Google, Baidu and Bing, have adversely affected, and may continue to adversely affect the market for domain names used for this purpose, which has resulted in, and may continue to result in, a decrease in demand and/or the renewal rate for such domain names. In addition, if spending on online advertising and marketing is reduced, this may result in a further decline in the demand for domain names used for this purpose.

We seek to serve new, developing, and emerging economies in international locations to grow our business. These economies are rapidly evolving and may not grow or even if they do grow, our services may not be widely used or accepted there. Accordingly, the demand for our services in these locations is uncertain. Factors that may affect acceptance or adoption of our services in these locations include:

All of the domain name registrations and renewals for the registries we operate occur through registrars. Registrars and their resellers engage in substantial marketing efforts to increase the demand and/or renewal rates for domain names as well as their own associated offerings. Consolidation in the registrar or reseller industry or changes in ownership, management, or strategy among individual registrars or resellers, including vertical integration by registrar or reseller industry participants, could result in significant changes to their businesses, operating models, and cost structures. These changes could include reduced marketing efforts for the gTLDs we operate or other operational changes that could adversely impact the demand and/or the renewal rates for the domain names for which we are the registry operator.

With the introduction of new gTLDs, many of our registrars and resellers have chosen to, and may continue to choose to, focus their short- or long-term marketing efforts on these new offerings and/or reduce the prominence or visibility of our products and services on their e-commerce platforms. Our registrars and resellers sell domain name registrations of other competing registries, including new gTLDs, and some also sell and support their own services for websites such as email, website hosting, and other services. Our registrars and resellers may be more motivated to sell to registrants to whom they can also market their own services. To the extent that registrars and resellers focus more on selling and supporting their services and less on the registration and renewal of domain names in the gTLDs we operate, our revenues could be adversely impacted. Our ability to successfully market our services to, and build and maintain strong relationships with, new and existing registrars or resellers is a factor upon which successful operation of our business is dependent. If we are unable to keep a significant portion of their marketing efforts focused on selling registrations of domain names in the gTLDs we operate, as opposed to other competing gTLDs, including the new gTLDs, or their own services, our business could be harmed.

Our business is highly technical and requires individuals skilled and knowledgeable in unique technologies, configurations, operating systems, and software development tools. We depend on the knowledge, experience, and performance of these employees and leaders to effectively manage and provide innovative solutions for our business. For example, we require employees with expertise in DNS operations and with certain cybersecurity specialties. Because such employees are in high demand by our competitors and other companies, we must be able to attract, integrate, retain and motivate such highly skilled employees and leaders. Failure to attract and retain such employees and to effectively implement succession plans for these employees could harm our business.

Our success depends in part on our internally developed technologies and related intellectual property. Despite our precautions, it may be possible for an external party to copy or otherwise obtain and use our intellectual property without authorization. Furthermore, the laws of other countries may not protect our proprietary rights in those countries to the same extent U.S. law protects these rights in the U.S. In addition, it is possible that others may independently develop substantially equivalent intellectual property. If we do not effectively protect our intellectual property, our business could suffer. Additionally, we have filed patent applications with respect to some of our technology in the U.S. Patent and Trademark Office and patent offices outside the U.S. Patents may not be awarded with respect to these applications and even if such patents are awarded, third parties may seek to oppose or otherwise challenge our patents, and such patents’ scope may differ significantly from what was requested in the patent applications and may not provide us with sufficient protection of our intellectual property. In the future, we may have to resort to litigation to enforce and protect our intellectual property rights, to protect our trade secrets or to determine the validity and scope of the proprietary rights of others. This type of litigation is inherently unpredictable and, regardless of its outcome, could result in substantial costs and diversion of management attention and technical resources. Some of the software and protocols used in our business are based on standards set by standards setting organizations such as the IETF. To the extent any of our patents are considered “standards essential patents,” in some cases we

We also license externally developed technology that is used in some of our products and services to perform key functions. These externally developed technology licenses may not continue to be available to us on commercially reasonable terms or at all. The loss of, or our inability to obtain or maintain, any of these technology licenses could hinder or increase the cost of our services, launching new products and services, entering into new markets and/or otherwise harm our business. Some of the software and protocols used in our business are in the public domain or may otherwise become publicly available, which means that such software and protocols are or may become equally available to our competitors.

We rely on the strength of our Verisign brand to help differentiate Verisign in the marketing of our products. Dilution of the strength of our brand could harm our business. We are at risk that we will be unable to fully register, build equity in, or enforce the Verisign logo in all markets where Verisign products and services are sold.

None.

Our common stock is traded on the Nasdaq Global Select Market under the symbol VRSN. On February 10, 2023, there were 323 holders of record of our common stock. We cannot estimate the number of beneficial owners since many brokers and other institutions hold our stock on behalf of stockholders.

This Form 10-K contains forward-looking statements within the meaning of Section 27A of the Securities Act and Section 21E of the Exchange Act. These forward-looking statements are based on current expectations and assumptions and involve risks and uncertainties, including, statements regarding our expectations about the sufficiency of our existing cash, cash equivalents and marketable securities, and funds generated from operations, together with our borrowing capacity under the unsecured revolving credit facility. Forward-looking statements include, among others, those statements including the words “expects,” “anticipates,” “intends,” “believes” and similar language. Our actual results may differ significantly from those projected in the forward-looking statements. Factors that might cause or contribute to such differences include, but are not limited to, those discussed in the section titled “Risk Factors” in Part I, Item 1A of this Form 10-K. You should also carefully review the risks described in other documents we file from time to time with the SEC, including the Quarterly Reports on Form 10-Q or Current Reports on Form 8-K that we file in 2023. You are cautioned not to place undue reliance on the forward-looking statements, which speak only as of the date of this Form 10-K. We undertake no obligation to update publicly or revise such statements, whether as a result of new information, future events, or otherwise, except as required by law.

We operate in multiple tax jurisdictions in the United States and internationally. Tax laws and regulations in these jurisdictions are complex, interrelated, and periodically changing. Significant judgment or interpretation of these laws and regulations is often required in determining our worldwide provision for income taxes, including, for example, the calculations of taxable income in each jurisdiction, deferred taxes, and the availability and amount of deductions and tax credits. We have recognized $234.6 million of deferred tax assets, net as of December 31, 2022. Our income tax expense was $206.4 million for the year ended December 31, 2022.

The final taxes payable are also dependent upon many factors, including negotiations with taxing authorities in various jurisdictions and resolution of disputes arising from various tax examinations. We only recognize or continue to recognize tax positions and tax benefit amounts that are more likely than not to be sustained upon examination. We adjust these amounts in light of changing facts and circumstances; however, due to the complexity of some of these uncertainties, the ultimate resolution may result in an outcome that is materially different from our current estimate of unrecognized tax benefits. See Note 10, “Income Taxes” of our Notes to Consolidated Financial Statements in Item 8 of this Form 10-K for further discussion of the $165.5 million deferred tax asset and corresponding income tax benefit recognized in the fourth quarter of 2021.

A comparison of selling, general and administrative expenses is presented below:

During 2021, we completed a transfer of intellectual property between certain non-U.S. subsidiaries. This intellectual property did not have any book value, however the transfer created an amortizable tax basis that resulted in the recognition of a $165.5 million deferred tax asset and a corresponding income tax benefit.

The following table presents our principal sources of liquidity:

In 2022, we repurchased 5.5 million shares of our common stock at an average stock price of $187.07 for an aggregate cost of $1.03 billion under our share repurchase program. In 2021, we repurchased 3.3 million shares of our common stock at an average stock price of $215.16 for an aggregate cost of $700.0 million. Effective October 27, 2022, our Board of Directors authorized the repurchase of our common stock in the amount of $803.0 million, in addition to the $197.0 million that remained available for repurchases under the share repurchase program, for a total repurchase authorization of up to $1.00 billion under the program. As of December 31, 2022, there was approximately $858.8 million remaining available for future share repurchases under the share repurchase program which has no expiration date.

As of December 31, 2022, we had $750.0 million principal amount outstanding of the 2.70% senior unsecured notes due 2031, $550.0 million principal amount outstanding of the 4.75% senior unsecured notes due 2027, $500.0 million principal amount outstanding of the 5.25% senior unsecured notes due 2025. As of December 31, 2022, there were no borrowings outstanding under our $200.0 million unsecured revolving credit facility that will expire in 2024.

Certain reclassifications have been made to prior period amounts to conform to current period presentation. Such reclassifications have no effect on net income as previously reported.

Software included in property and equipment includes amounts paid for purchased software and development costs for internally developed software. The Company capitalized $10.6 million and $12.1 million of costs related to internally developed software during 2022 and 2021, respectively.

Verisign maintains a foreign currency risk management program designed to mitigate foreign exchange risks associated with the monetary assets and liabilities that are denominated in currencies other than the U.S. dollar. The primary objective of this program is to minimize the gains and losses resulting from fluctuations in exchange rates. The Company does not enter into foreign currency transactions for trading or speculative purposes, nor does it hedge foreign currency exposures in a manner that entirely offsets the effects of changes in exchange rates. The program may entail the use of forward or option contracts, which are usually placed and adjusted monthly. These foreign currency forward contracts are derivatives and are recorded at fair market value. The Company records gains and losses on foreign currency forward contracts in Non-operating income (loss), net. Gains and losses related to foreign currency forward contracts were not significant in each of the last three years.

The Company recognizes the U.S. income tax effect of future global intangible low-taxed income inclusions in the period in which they arise.

Verisign is involved in various investigations, claims and lawsuits arising in the normal conduct of its business, none of which, in its opinion, will have a material adverse effect on its financial condition, results of operations, or cash flows. The Company can provide no assurance that it will prevail in any litigation. Regardless of the outcome, any litigation may require the Company to incur significant litigation expense and may result in significant diversion of management attention.

The following table summarizes the Company’s cash, cash equivalents, and marketable securities and the fair value categorization of the financial instruments measured at fair value on a recurring basis:

As of December 31, 2022, the Company’s other financial instruments include cash, accounts receivable, restricted cash, and accounts payable whose carrying values approximated their fair values. The aggregate fair value of the Company’s senior notes is $1.65 billion and $1.88 billion as of December 31, 2022 and December 31, 2021, respectively. The fair values of these debt instruments are based on available market information from public data sources and are classified as Level 2.

The following table presents the detail of property and equipment, net:

The following table presents the detail of goodwill:

On December 12, 2019, the Company entered into a credit agreement for a $200.0 million committed unsecured revolving credit facility (the “2019 Credit Facility”). The 2019 Credit Facility includes a financial covenant requiring that the Company’s leverage ratio not exceed 4.0 to 1.0. As of December 31, 2022, there were no borrowings outstanding under the 2019 Credit Facility and the Company was in compliance with the financial covenants. The 2019 Credit Facility was amended in December 2021 to address the LIBOR transition. The 2019 Credit Facility expires on December 12, 2024 at which time any outstanding borrowings are due. Verisign may from time to time request lenders to agree on a discretionary basis to increase the commitment amount by up to an aggregate of $150.0 million.

Treasury stock is accounted for under the cost method. Treasury stock includes shares repurchased under stock repurchase programs and shares withheld in lieu of the tax withholding due upon vesting of RSUs.

Effective February 10, 2022, the Company’s Board of Directors (“Board”) authorized the repurchase of its common stock in the amount of approximately $705.4 million, in addition to the $294.6 million that remained available for repurchases under the share repurchase program. Effective October 27, 2022, our Board of Directors authorized the repurchase of our common stock in the amount of $803.0 million, in addition to the $197.0 million that remained available for repurchases under the share repurchase program, for a total repurchase authorization of up to $1.00 billion under the program. The program has no expiration date. Purchases made under the program could be effected through open market transactions, block purchases, accelerated share repurchase agreements or other negotiated transactions. As of December 31, 2022 there was approximately $858.8 million remaining available for repurchases under the program.

The income tax benefit that was included within Income tax (expense) benefit related to these stock-based compensation expenses for 2022, 2021, and 2020 was $13.8 million, $12.4 million, and $11.0 million, respectively.

The following table summarizes unvested RSUs activity for the year ended December 31, 2022:

Income before income taxes is categorized geographically as follows:

The provision for income taxes consisted of the following: