What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2023-10-26 compared with 2023-07-27 · 45 added, 26 removed, 3 unchanged (96% of the section changed)

Investing in our securities involves risks.

You should carefully consider the risks and uncertainties described under the section “Risk Factors” in Part I, Item 1A of our Annual Report on Form 10-K filed with the SEC on January 31, 2023 and below all of the other information in this Quarterly Report on Form 10-Q, including our condensed consolidated financial statements and related notes, before making an investment decision.

The section “Risk Factors” in our Annual Report on Form 10-K filed with the SEC on January 31, 2023 identifies the risks and uncertainties, though they are not the only ones we face, that could materially and adversely affect our business, financial condition or results of operations.

In addition to the risk factor below and information set forth in this Form 10-Q, you should carefully consider the risks and uncertainties described under the section “Risk Factors” in Part I, Item 1A of our Annual Report on Form 10-K filed with the SEC on January 31, 2023 and Part II, Item 1A of our Quarterly Report on Form 10-Q filed with the SEC on July 27, 2023, which could materially and adversely affect our business, financial condition or results of operations.

Our business could be harmed by any of these risks or additional risks and uncertainties not presently known to us or that we currently believe to be immaterial.

Our stock price could decline due to any of these risks.

Risks Related to Our Ability to Grow Our Business

Laws, regulations and customer expectations regarding the use, storage and movement of data may restrict our ability to continue to optimize our platform and adversely affect our business.

Governments have adopted, and may likely continue to adopt, laws and regulations affecting the use, storage and movement of data, including laws related to data privacy, the use of machine learning and artificial intelligence (“AI”), and data sovereignty or residency requirements.

As a cloud-based service provider, we optimize performance of our products and services by utilizing data centers located in, and support provided from, different jurisdictions.

As we continue to innovate and improve the offerings on our platform, we leverage machine learning and AI to create more efficient and effective workflows for our customers.

Changing laws, regulations and standards applying to the collection, storage, use, sharing, transfer or other control or processing of data, including personal data such as employee or marketing data, could affect our ability to efficiently and cost-effectively offer our services, to develop our products and services to maximize their utility, as well as our customers’ ability to use data or share data with service providers.

Such changes may restrict our ability to use, store or otherwise process data of our customers in connection with providing and supporting our services.

In some cases, this could impact our ability to offer our services in certain locations or our customers’ ability to deploy our services globally.

In addition, we may become subject to new or heightened legal, ethical or other challenges arising out of the perceived or actual impact of AI on human rights, intellectual property, privacy and employment, among other issues, and we may experience brand or reputational harm, legal liability or increased costs associated with those issues.

Existing and upcoming laws and regulations globally, including European and state specific privacy laws in the United States (“U.S.”), global trends to regulate the use of AI and machine learning, the ruling of the European Court of Justice in Schrems v.

Facebook Ireland and interpretations of that ruling by regulators and customers, recommendations issued by the European Data Protection Board, Standard Contractual Clauses issued by the European Commission, and other global privacy, data residency, sovereignty and transfer laws, regulations and standards (including self-regulatory standards) may cause us to incur substantial operational costs or require us to modify our data handling practices and/or policies, may limit the development, use and adoption of our services, and could reduce overall demand for our services.

While a new Privacy Shield has been proposed to permit the transfer of data between the U.S.

and the European Union, the timing and precise requirements of the Privacy Shield are uncertain, as is the possibility that any agreement would be challenged in court.

Laws or regulations related to the use of AI and machine learning technology may impact our ability to use certain data for developing our products and may also become an impediment to the adoption of our products for customers regulated by such laws and regulations.

In 2022, we began offering an EU-centric services delivery model, by which customers may elect to receive support from EU‑based ServiceNow teams, with an EU, cloud‑hosted digital workflow solution.

This offering required a significant investment in financial and human resources, and we may see similar requests for local solutions in other territories.

In addition, actual or perceived non-compliance with those laws and regulations could result in proceedings or investigations against us by regulatory authorities or others, lead to significant fines, damages, orders or reputational harm and may otherwise adversely impact our business, financial condition and operating results.

Changes in our developed or acquired products and how such products utilize data could also alter or increase our compliance requirements.

As a result, our innovation and business drivers in developing or acquiring new and emerging technologies and the demand for our products could be impacted.

UNREGISTERED SALES OF EQUITY SECURITIES AND USE OF PROCEEDS

DEFAULTS UPON SENIOR SECURITIES

Not applicable.

MINE SAFETY DISCLOSURES

Not applicable.

Risks Related to the Operation of Our Business

If we or our third-party service providers experience an actual or perceived cybersecurity event, our platform may be perceived as not being secure, and we may lose customers or incur significant liabilities, which would harm our business and operating results.

Our operations involve the storage, transmission and processing of our customers’ confidential, proprietary and sensitive data, which may include personally identifiable information, protected health information, financial information and, in some cases, government information.

While we have security measures and a data governance framework in place designed to protect customer information and prevent data loss, these protective mechanisms we have implemented may not be effective at preventing material breaches caused by intentional or unintentional action or inaction by employees or third parties, which may result in the unauthorized access or release of our instances and ultimately our or our customers’ data, IP and other confidential business information.

Third parties have attempted to fraudulently induce employees, contractors, or users to disclose information or to gain access to our or our customers’ data, and we have been the target of increasingly sophisticated email and text message scams that attempt to acquire personal information or company assets.

Further, we have experienced an increase in the number and sophistication of cyberattacks and security challenges as the growing number of employees, vendors and other third parties that remotely access our systems increase our exposure to attack.

Computer malware, ransomware, viruses, hacking, phishing and denial of service attacks by third parties have become more prevalent in our industry, and similar malicious attacks have been made against our and our third-party service providers’ systems in the past and may occur again in the future.

Our employees have fallen victim to phishing attacks in the past and may again in the future.

The frequency and sophistication of these attacks have increased, and it appears that cyber crimes and cyber criminal networks, some of which may be state-supported, have substantial resources and may target U.S.

enterprises or our customers and their use of our products.

In addition, we have established extensive development and testing environments for our engineers developing new products and features.

Security protocols in those environments have necessarily been less rigorous than in environments housing customer data, but a vulnerability or security defect arising out of our development and testing environment could become incorporated in code imported to our environments housing customer data.

Similarly, in the unique circumstances where customer data may be utilized in developer environments for testing or learning, that data may be at greater risk.

Because techniques used to sabotage, obtain unauthorized access to systems or prohibit authorized access to systems change frequently and generally may not be detected until successfully launched against a target, we have been and may continue to be unable to anticipate these techniques or to implement adequate preventative measures.

This has included and may continue to include underlying infiltration of pre-existing systems, including those of our third-party service providers or customers, perpetrated by more sophisticated or state-supported attackers, including foreign cybersecurity attacks on U.S.

technology companies and retaliatory cybersecurity attacks stemming from the Russian invasion of Ukraine or other geopolitical tensions.

It may also include exploitation of vulnerabilities in third party or open source software code that may be incorporated into our own or our customers’ systems, such as the vulnerability in the Java logging library known as “log4j” identified in late 2021 that affected our industry.

The occurrence of these and other more sophisticated or state-supported attack campaigns may increase as geopolitical tensions and intermittent warfare continue or escalate outside of the U.S.

For example, due to the Russia-Ukraine conflict, conflict in the Middle East, rising tensions between the U.S.

and North Korea and rising tensions with China, we and our customers, third-party vendors and service providers are subject to a heightened risk of cybersecurity attacks, phishing

attacks, viruses, malware, ransomware, hacking or similar breaches from state-supported actors, including attacks that could materially disrupt our systems and operations, supply chain, and ability to make available or sell our products and services.

We devote significant financial and personnel resources to implement and maintain security measures while meeting customer expectations as to the performance of our systems;

however, as cybersecurity threats develop and grow more complex and sophisticated over time, such as in connection with geopolitical warfare, we will continue to make significant further investments to protect data and infrastructure, but a residual risk may remain despite our preventative efforts.

A security breach suffered by us or our third-party service providers, an attack against our service availability or unauthorized access or loss of data could result in a disruption to our service, litigation, service level agreement claims, indemnification and other contractual obligations, regulatory investigations, government fines and penalties, reputational damage, loss of sales and customers, mitigation and remediation expenses and other significant costs and liabilities.

In addition, we may incur significant economic and operational consequences in order to appropriately assess and respond to security incidents and to implement appropriate safeguards to protect against future incidents.

We also cannot be certain that insurance coverage will continue to be available on acceptable terms or in sufficient amounts to cover the potentially significant losses that may result from a security incident or an insurer will not deny coverage as to any future claim.

Additionally, as we increase reliance on third-party and public cloud infrastructure, we depend in part on third-party security measures to protect against unauthorized access, cyberattacks and the mishandling of data.

However, our ability to monitor our third-party service providers’ data security is limited.

Employee error or malfeasance in configuring, maintaining, and using services offered by third-party providers may affect our ability to monitor and secure such services.

While our software is delivered with certain preset configurations, we empower our customers to configure the Now Platform in the manner that best suits their business needs.

Further, in most instances, our customers are responsible for administering access to the data held in their particular instance for their employees and service providers.

In configuring our platform, ServiceNow employees and customers have made errors in the past and may do so again in the future.

We are aware that, on occasion, our customers and ServiceNow have configured certain settings on our platform, or retained preset configurations, in a manner not aligned with their preferred security levels, which can result in, and has resulted in, information being made more widely accessible than intended.

Such misconfigurations can be, and have been, identified publicly, increasing the risk of data being exposed unintentionally.

We have worked and will continue to work closely with our customers to help them evaluate their security configurations, including providing guidance and taking action designed to help customers align configuration settings with their business needs.

In addition, as needed, we have evaluated and modified our own internal configurations, as well as the configurations of the services provided to us by third parties, and will continue to do so.

While we offer tools and support, customers are not required to utilize them and may experience a data exposure or suffer a cybersecurity attack on their own systems, unrelated to our own, and allow a malicious actor access to the customer’s information held on our platform.

Even if such a breach is unrelated to our security programs or practices, such breach could cause us reputational harm and require us to incur significant economic and operational consequences in order to adequately assess and respond to the breach, including further protecting our customers from their own vulnerabilities, and to implement appropriate safeguards to protect against future breaches.

In addition, any misconfiguration or misuse of our software that results in unauthorized access to, or the misuse, loss or destruction of, our and our customers’ data or in a violation of our terms or applicable law may result in reputational harm or liability.

Similar risks apply to a breach that results from misconfiguration or misuse of our providers’ services.

Digital supply chain attacks have increased in frequency and severity.

We cannot guarantee that third parties and our supply chain infrastructure have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our platform, systems and network or the systems and networks of third parties that support us and our business.

Third parties may also exploit vulnerabilities in, or obtain unauthorized access to, platforms, systems, networks, or physical facilities utilized by us or our third-party vendors or service providers.

Furthermore, supply chain disruptions due to the Russian invasion of Ukraine (and resulting legal or regulatory developments) and any indirect effects may further complicate any existing supply chain constraints.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors