What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-01-29 compared with 2025-01-30 · 156 added, 129 removed, 365 unchanged (44% of the section changed)

7 unchanged sentences

• Laws, regulations and customer expectations regarding the use, storage and movement of data may restrict our ability to continue to optimize our platform.

• A failure to innovate in response to rapidly evolving technological changes and in the midst of an intensely competitive market may harm our competitive position and business prospects.

• A failure to innovate and adapt how we offer our products in response to rapidly evolving technological changes and in the midst of an intensely competitive market may harm our competitive position and business prospects.

• We may not successfully increase our penetration of international markets or manage risks associated with foreign markets.

3 unchanged sentences

• If we fail to comply with applicable anti-corruption and anti-bribery laws, export control laws, economic and trade sanctions laws, or other global trade laws, we could be subject to penalties and civil and/or criminal sanctions and our business could be materially adversely affected.

• Our customer deals are becoming more complex, which tend to involve longer and more expensive sales cycles, increased pricing pressure and implementation and configuration challenges.

• Our customer deals are becoming more complex, which tend to involve longer, more expensive sales cycles, increased pricing pressure, and implementation and configuration challenges.

• As we acquire or invest in companies and technologies, we may not realize the expected business or financial benefits and the acquisitions and investments may divert our management’s attention and result in additional shareholder dilution or costs.

4 unchanged sentences

• Disruptions or defects in our services could damage our customers’ businesses, subject us to substantial liability and harm our business.

• Delays in improving our information systems and processes could interfere with our ability to support our existing and growing customer and employee base as we scale.

• We may not be able to protect or enforce our intellectual property rights.

• Delays in improving our information systems and processes could interfere with our ability to support our existing and growing base of customers and employees as we scale.

• We may not be able to protect or enforce our IP rights.

• Our use of open-source software could harm our ability to sell our products and services and subject us to possible litigation.

• Various factors, including our customers’ business, integration, migration, compliance and security requirements or errors by us, our partners or our customers, may cause implementations of our products to be delayed, inefficient or otherwise unsuccessful.

• Our failure or perceived failure to achieve our ESG goals or maintain ESG practices that meet evolving stakeholder expectations could adversely affect us.

• Our failure or perceived failure to achieve our corporate sustainability goals or maintain corporate sustainability practices that meet evolving stakeholder expectations could adversely affect us.

• We may face natural disasters, including climate change, and other events beyond our control.

Risks Related to the Financial Performance or Financial Position of Our Business

• Because we generally recognize revenues from our subscription service over the subscription term, a decrease in new subscriptions or renewals may not be immediately reflected in our operating results.

• Because we generally recognize revenues from our subscription services over the subscription term, a decrease in new subscriptions or renewals may not be immediately reflected in our operating results.

• As our business grows, we expect our revenue growth rate to decline over the long term.

9 unchanged sentences

Laws, regulations and customer expectations regarding the use, storage and movement of data may restrict our ability to continue to optimize our platform.

Governments have adopted, and likely will continue to adopt, laws and regulations affecting the use, storage and movement of data, including laws related to data privacy and security, the use of machine learning and artificial intelligence (“AI”), and data sovereignty or residency requirements.

Governments have adopted, and likely will continue to adopt, laws and regulations affecting the use, storage and movement of data, including laws related to data privacy and security, the use of machine learning and AI, and data sovereignty or residency requirements.

Changing laws, regulations and standards applying to the collection, storage, use, sharing, portability, transfer or other control or processing of data, including personal data, could affect our ability to efficiently and cost-effectively offer our services and to develop our products and services for maximum utility, as well as our customers’ ability to use data or share data.

Such changes may restrict our ability to use, store or otherwise process customer data in connection with providing services and could alter or increase our compliance requirements.

Such changes may restrict our ability

2025 Annual Report 23

to use, store or otherwise process customer data in connection with providing services and could alter or increase our compliance requirements.

In some cases, this could impact our ability to offer our services in certain locations or our customers’ ability to deploy our services globally.

For example, the EU Data Act has significant requirements regarding data portability, interoperability and accessibility and unclear data transfer restrictions, any of which could impact our operations.

In addition, the relatively new Trans-Atlantic Data Privacy Framework, which facilitates the transfer of data between the United States (“U.S.”) and European Union (“EU”), may be subject to legal challenges and regulatory interpretations that could create uncertainties and impact our operations and compliance obligations.

We offer region-specific services, by which customer data is hosted locally and customers may elect to receive support from locally-based ServiceNow teams.

For example, the EU Data Act has data portability, interoperability and accessibility requirements, as well as unclear data transfer restrictions that could impact our operations.

In addition, the Trans-Atlantic Data Privacy Framework, which facilitates the transfer of data between the United States (“U.S.”) and European Union (“EU”), may be subject to legal challenges and regulatory interpretations that could create uncertainties and impact our operations and compliance obligations.

We offer some region-specific services where customer data is hosted locally and customers may elect to receive support from locally-based ServiceNow teams.

Setting up and maintaining these region-specific services require significant investment, including to comply with applicable laws and regulations.

Actual or perceived non-compliance with those laws and regulations could result in proceedings or investigations against us by regulatory authorities or others, lead to significant fines, damages, orders, litigation or reputational harm and may otherwise adversely impact our business.

Actual or perceived non-compliance with those laws, regulations, or the terms of our region-specific service offerings may result in investigations or proceedings against us by regulatory authorities or others, significant fines or damages, orders, litigation, reputational harm and other adverse impacts on our business.

We will also need to continually adapt to customer privacy and security requirements as they change over time.

For example, as customers increasingly adopt a hybrid (on-premises and off-premises/hyperscale cloud) approach for their IT workloads, our cloud services may fail to address evolving customer requirements, including data localization.

Further, due to heightened concerns relating to privacy and security regulatory matters, our customers may request certain certifications and failure to obtain, or consistently maintain, those certifications may adversely impact our reputation and business.

A failure to innovate in response to rapidly evolving technological changes and in the midst of an intensely competitive market may harm our competitive position and business prospects.

Further, due to heightened concerns relating to privacy and security regulatory matters, our customers from time to time request certain certifications, and a failure to obtain or consistently maintain those certifications may adversely impact our reputation and business.

A failure to innovate and adapt how we offer our products in response to rapidly evolving technological changes and in the midst of an intensely competitive market may harm our competitive position and business prospects.

We compete in markets that evolve rapidly.

The pace of innovation will continue to accelerate as customers recognize the advantages of acquiring leading digital technologies and adopting modern cloud-based infrastructure.

The pace of innovation will continue to accelerate as customers recognize the advantages of acquiring leading digital technologies and adopting AI native solutions and modern cloud-based infrastructure.

Cutting-edge capabilities such as AI, machine learning, hyper automation, low-code/no-code application development, system observability and predictive insights become increasingly relevant to the customer’s evolving needs.

2 unchanged sentences

They may introduce new technology, solve similar problems in different ways or more effectively utilize existing technology that reduces demand for our services.

They may utilize acquisitions, integrations or consolidations to offer integrated or bundled products, enhanced

functionality or other advantages.

They may utilize acquisitions, integrations or consolidations to offer integrated or bundled products, enhanced functionality or other advantages.

Some of our existing competitors and potential competitors are larger and have greater name recognition, the ability to more efficiently scale their business, more established operations and customer relationships and greater financial and technical resources than we do.

1 unchanged sentence

They may create pricing pressures by reducing the price of competing products, services or subscriptions or bundling their offerings, causing our offerings to appear relatively more expensive.

Competition from cloud-based vendors may increase as they build business applications or AI powered automation solutions that compete with our products and services.

Companies whose products are integrated with our Platform could also seek to compete with us by blocking, limiting or imposing fees on particular integrations or data access.

Cloud-based and AI native vendors may build more business applications or AI powered automation solutions that compete with our products and services.

We may also encounter customer reluctance or unwillingness to migrate away from their current solutions.

4 unchanged sentences

• accurately predict and meet our customers’ changing digital transformation needs, priorities and adoption practices, including their technology infrastructures and buying and budgetary practices;

• invest in and continually optimize our own technology platform so that we continue to meet the very high-performance expectations of our customers;

• successfully deliver and promote new, scalable technologies and products to meet customer needs and priorities;

• invest in and continually optimize our own technology platform so that we continue to meet the high-performance expectations of our customers;

• successfully deliver and promote new, scalable technologies and products, such as AI, to meet customer needs and priorities;

• efficiently integrate with technologies within our customers’ digital environments;

7 unchanged sentences

• effectively deliver, directly or through our partner ecosystem, the digital transformation process planning, IT systems architecture planning, and product implementation services that our customers require to be successful.

Further, in response to evolving customer needs, we may make significant investments in changing how we offer our products or services, such as bundling offerings or shifting to consumption-based pricing for support services or how our services are delivered or priced.

However, customers may not be satisfied with these changes and, therefore, may not grow or maintain their business with us.

Further, to remain competitive, we may make significant investments in changing how we offer our products or services.

These changes could include, among others, bundling certain products and services, modifying service delivery methods, or altering pricing models, such as incorporating more consumption-based pricing components into our offerings.

However, customers may not be satisfied with these changes, and, as a result, we may not recover the cost or realize the anticipated benefits of our investments.

With respect to service delivery methods, we entered into agreements with public cloud service providers to achieve greater operational and financial efficiencies.

Our strategy of migrating an increasing portion of Company hosted instances to these providers depends on our ability to adequately prepare our operations to facilitate the migration, our customers’ willingness to use public cloud services to host their instances, and customer demand not materially falling short of our commitments with the public cloud service providers.

We may not successfully increase our penetration of international markets or manage risks associated with foreign markets.

Sales outside of North America represented 37% and 36% of our total revenues for the years ended December 31, 2024 and 2023, respectively.

Sales outside of North America represented 37% of our total revenues for each of the years ended December 31, 2025 and 2024.

The growth of our business depends on our ability to increase our sales outside of the U.S.

4 unchanged sentences

Our rate of acquisition of new large enterprise customers, a factor affecting our growth, has been generally lower in territories where we are less established and where there may be heightened or evolving regulations and operational and IP risks.

We have experienced, and may continue to experience, difficulties in new geographic markets, including hiring qualified sales management personnel, penetrating the target market, and managing local operations.

We have experienced and may continue to experience difficulties in new geographic markets, including hiring qualified sales management personnel, penetrating the target market and

2025 Annual Report 25

managing local operations.

Risks associated with making our products and services available in international markets include, for example:

• compliance with multiple, conflicting and changing governmental laws and regulations;

• compliance with multiple, conflicting and changing governmental laws and regulations, including antitrust and competition regulations;

• requirements to have local partner(s), local entity ownership limitations or technology transfer or sharing requirements, or to comply with data residency and transfer laws and regulations, privacy and data protection laws and regulations, which may increase operational costs and restrictions;

2 unchanged sentences

• different pricing and distribution environments;

• potential changes in international trade policies, tariffs, agreements and practices, including the adoption and expansion of formal or informal trade restrictions or regulatory frameworks that may favor local competitors;

• governmental direction, business practices and/or cultural norms that may favor local competitors;

• more prevalent cybersecurity, intellectual property and AI risks;

• governmental direction, business practices and/or cultural norms that may favor local companies;

• more prevalent cybersecurity, IP and AI risks;

• localization of our services, including translation into foreign languages and associated expenses.

1 unchanged sentence

Incorporating AI technology into our offerings may result in operational, legal, regulatory, ethical and other challenges.

We are increasingly innovating and expanding offerings on our platform by integrating AI technology.

We expect AI to be an increasingly important driver of future growth, although, like many innovations, it presents risks and uncertainties that may impact our ability to realize its desired or anticipated benefits for our business.

AI technology is rapidly evolving and to remain competitive, we will need to make significant investments to continue to successfully develop and incorporate the technology into our products.

Our ability to incorporate AI technology into our products depends on the availability and pricing of third-party hardware and software equipment and technical infrastructure.

We are increasingly innovating and expanding offerings on our platform by integrating AI technology into our customer-facing products and internal operations.

We consider AI to be an important driver of future growth, although, like many innovations, it presents risks and uncertainties that may impact our ability to realize its desired or anticipated benefits for our business.

AI technology is evolving quickly.

To remain competitive, we must make significant investments to continue to successfully develop and incorporate this technology into our products.

Our ability to incorporate AI technology into our products depends on the availability, performance and pricing of third-party hardware and software equipment and technical infrastructure.

Our competitors or other third parties may develop or incorporate AI into their products more quickly or successfully than us.

Other companies may also have or in the future may obtain intellectual proprietary rights that would prevent, limit, or interfere with our ability to make, use, or sell our AI products.

They may also have or in the future obtain IP rights that would prevent, limit or interfere with our ability to make, use or sell our AI products.

For these reasons, among others, we may not be able to compete effectively in the evolving AI market.

Our business model may be affected by global trends and laws that govern the use of AI and machine learning.

For example, the EU AI Act places new requirements on providers of AI technologies that will need to be addressed in alignment with various deadlines in the coming years.

These and other laws or regulations may cause us to modify our data handling and compliance practices, which could be costly or disruptive to our operations, and may also impact our ability to use certain data to support our products or our product development efforts or hinder our customers’ ability to adopt or continue to use our products.

We may face new or heightened legal, ethical and other challenges arising out of the perceived or actual impact of AI on human rights, intellectual property, privacy and employment, among other areas.

For example, our use of AI could lead to copyright infringement or other intellectual property claims, potentially requiring us to pay compensation or licensing fees to third parties.

Our business model may be affected by global trends and laws that govern the use of AI.

For example, the EU AI Act places new requirements on providers of AI technologies that will need to be addressed in alignment with various deadlines.

These and other laws or regulations or enforcement practices may cause us to modify our data handling and compliance practices, which could be costly or disruptive to our operations, and may also impact our ability to use certain data to support our products or our product development efforts or hinder our customers’ ability to adopt or continue to use our products.

We may face new or heightened legal, ethical and other challenges arising out of the perceived or actual impact of AI on human rights, IP, privacy, security, employment and the environment, among other areas.

For example, our use of AI, both internally and in our customer-facing products, could lead to copyright infringement claims or other IP claims, potentially requiring us to pay compensation or licensing fees to third parties.

Additionally, social and ethical concerns surrounding the use of AI in our offerings could harm our brand and may cause us to incur additional costs.

AI systems may not perform as intended or may produce outcomes, such as unreliable or biased results, that could negatively affect customer trust, result in limited adoption of our AI enabled products, expose us to reputational harm or create potential liability.

Failure by us or others in our industry to adequately address these concerns could erode public confidence in AI and slow adoption of AI in our products.

3 unchanged sentences

While we provide our partners with training and programs, including accreditations and certifications, these programs may not be effective or utilized consistently by partners.

In addition, new partners may require extensive training and/or significant time and resources to become productive.

Additionally, our relationships with partners may require us, along with our partners, to comply with complex regulations, contractual requirements and government procurement rules.

New partners may also require extensive training and/or significant time and resources to become productive.

Separately, our relationships with partners may require us, along with our partners, to comply with complex regulations, contractual requirements and government procurement rules.

Failure to adhere to these requirements could result in the loss of business opportunities, potential liabilities or penalties.

For example, our partners could misrepresent to our customers the functionality of our platform or products, fail to perform services to our customers’ expectations, or violate laws or our corporate policies.

For example, our partners could misrepresent to our customers the functionality of our platform or products, fail to perform services that meet our customers’ expectations, or violate laws or our corporate policies.

Further, changes to our direct go-to-market models may cause friction with our partners.

23 unchanged sentences

In addition, compliance with complex regulations and contracting provisions in a variety of jurisdictions can be expensive and consume significant management resources.

In certain jurisdictions, our ability to win business may be constrained by political and other factors unrelated to our competitive position in the market.

Our public sector customers may have contractual, statutory or regulatory rights to terminate current contracts with us or our third-party distributors or resellers for convenience or due to a default, though such risk may be assumed by such third-party distributor or reseller.

In certain jurisdictions, our ability to win business may be constrained by political and other factors unrelated to our market offerings.

2025 Annual Report 27

assumed by such third-party distributor or reseller.

If a contract is terminated for convenience, we may only be able to collect fees for products or services delivered prior to termination and settlement expenses.

If a contract is terminated due to a default, we may be liable for excess costs incurred by the customer for procuring alternative products or services or be precluded from doing further business with governmental entities.

If a contract is terminated due to a default, we may be liable for excess costs incurred by the customer for procuring alternative products or services.

In addition, we could be precluded from doing further business with governmental entities.

Further, we are required to comply with a variety of complex laws, regulations and contractual provisions relating to the formation, administration or performance of government contracts that give public sector customers substantial rights and remedies, many of which are not typically found in commercial contracts.

These may also include rights with respect to price protection, refund and setoff, performance of services in languages other than English, the accuracy of information provided to the government, contractor compliance with supplier diversity policies, constraints on sales practices and other obligations that are particular to government contracts.

These laws, regulations and contractual provisions may encompass rights with respect to price protection, refund and setoff, the provision of services in languages other than English, the accuracy of information provided to the government, contractor compliance with supplier diversity policies, constraints on certain business and sales practices, and other obligations that are particular to government contracts.

These obligations may apply to us and/or our third-party resellers or distributors whose practices we may not control.

1 unchanged sentence

We and governments routinely investigate and audit compliance with contractual and regulatory requirements.

For example, as disclosed in Note 17 in the notes to our consolidated financial statements, the Company informed certain U.S.

For example, as disclosed in Note 18 “Commitments and Contingencies” in the notes to our consolidated financial statements, the Company informed certain U.S.

government agencies of an internal investigation and preliminary findings and is cooperating with, among others, the Department of Justice, which commenced its own investigation into the matters.

9 unchanged sentences

As we continue to expand our business internationally, we will inevitably do more business with large private enterprises and the public sector in countries outside of the U.S.

Increased business in countries with heightened levels of corruption subjects us and our officers and directors to increased scrutiny and potential liability from our business operations.

Increased business in countries with heightened trade controls and levels of corruption subjects us and our officers and directors to increased scrutiny and potential liability.

We have an established compliance program, but there is a risk that our employees, partners, vendors, customers and agents, as well as those companies to which we outsource certain of our business operations, could violate our policies and applicable law, exposing us to additional scrutiny and potential liability.

We have experienced this in the past and may experience it again in the future.

In addition, we are subject to customs laws that may impose tariffs on us, directly or indirectly.

In addition, we are subject to customs laws that may impose tariffs on us, either directly or indirectly.

This includes tariffs imposed by the U.S.

government and other countries on imports, which we are responsible to pay in certain circumstances.

Higher tariffs on imports related to our operations could increase our operating costs.

1 unchanged sentence

As a result of the Russia-Ukraine conflict, for example, the U.S.

and other jurisdictions have imposed economic and trade sanctions and export control restrictions against Russia and Belarus, as well as certain persons, assets and interests associated with those countries.

If this conflict continues or if serious conflict arises elsewhere, the U.S.

and other jurisdictions have imposed economic and trade sanctions and export control restrictions against Russia and Belarus, as well as certain persons, assets and interests associated with

those countries.

For so long as this conflict continues or if serious conflict arises elsewhere, the U.S.

and other jurisdictions could impose wider economic and trade sanctions as well as export restrictions, which could impact our business opportunities and operations.

1 unchanged sentence

Foreign Corrupt Practices Act of 1977, as amended, the UK Bribery Act, other applicable anti-corruption and anti-bribery laws, or applicable export control or economic and trade sanctions laws by our employees or third-party intermediaries could subject us to significant risks such as adverse media coverage and/or severe criminal or civil sanctions, which could materially adversely affect our reputation and business.

Our customer deals are becoming more complex, which tend to involve longer and more expensive sales cycles, increased pricing pressure and implementation and configuration challenges.

Our customer deals are becoming more complex, which tend to involve longer, more expensive sales cycles, increased pricing pressure, and implementation and configuration challenges.

The customer deals we pursue are becoming more complex as we engage with increasingly larger enterprise customers with multiple workflow products that span the enterprise.

16 unchanged sentences

• disruption to our business and diversion of management attention and other resources;

• potential financial, credit or regulatory risks associated with acquired customers, suppliers and partners of the acquired business;

• potential financial, credit or regulatory risks associated with acquiring a business or a part thereof, including risks of delayed, conditioned or denied regulatory clearances and risks relating to customers, suppliers and partners of the acquired business;

• dependence on acquired technologies or licenses for which alternatives may not be available to us or which may involve significant cost or complexity;

• in the case of foreign acquisitions, the challenges associated with integrating operations across different cultures, languages, and legal regimes and any currency and regulatory risks associated with specific countries;

• in the case of foreign acquisitions, the challenges associated with integrating operations across different cultures, languages, legal regimes and any currency, tax and regulatory risks associated with specific countries;

• data security or privacy risks, compliance requirements or integration costs from the acquired technology or company;

2025 Annual Report 29

• impairment of our investments or the possibility our investees will be unable to obtain future funding on favorable terms or at all;

7 unchanged sentences

Our growing business operations increase our exposure to cyberattacks by a range of actors, who have used and will continue to use assorted tactics, techniques, and procedures, including malicious code, ransomware, social engineering, business email compromises, supply chain attacks, denial of service attacks and similar internet-enabled, fraudulent activity, and the frequency of those attacks have become more common.

Additionally, as AI technologies continue to advance, threat actors can leverage these technologies to develop more sophisticated attack methods that are increasingly automated, targeted, coordinated and more difficult to defend against.

The proliferation of these technologies could enable less skilled threat actors to initiate attacks and increase the frequency, scale and impact of security incidents.

Further, during times of war and other major conflicts, we and our third-party providers may be vulnerable to a heightened risk of geopolitically motivated attacks, including cyberattacks, that could materially disrupt our systems and operations, supply chain and ability to provide our services.

7 unchanged sentences

We have identified vulnerabilities in our products and services in the past and expect to continue to do so in the future.

We cannot be certain that we will be able to identify all vulnerabilities or address the vulnerabilities of which we become aware.

There have been delays and may continue to be delays in developing patches that can be effectively deployed to address vulnerabilities.

Further, security researchers and other individuals have in the past actively searched for, published and/or exploited actual and potential vulnerabilities in our products or services and will likely continue to do so in the future.

Consistent with our vulnerability management program, we prioritize security risks and consider their severity and potential impact in determining whether and when to remediate or mitigate them.

In addition, we cannot be certain that we will be able to prevent, detect or remediate all vulnerabilities, and there have been delays and may continue to be delays in developing patches that can be effectively deployed to address vulnerabilities.

Further, security researchers and other entities and individuals have actively searched for, published and/or exploited actual and potential vulnerabilities in our products or services and will likely continue to do so in the future.

Also, certain persons, including researchers, have in the past not abided by, and may in the future not abide by, our responsible disclosure program, which has resulted in, and could in the future result in the compromise of our systems or our or our customers’ data.

Moreover, the incorporation of third-party or open-source software code into our or our customers’ systems increases the risk of exploitation of vulnerabilities.

Moreover, the incorporation of third-party, AI-generated or open-source software code into our or our customers’ systems increases the risk of exploitation of

vulnerabilities.

We also have inherited and may in the future inherit additional security risks from acquiring or partnering with other companies.

In most instances, our customers are responsible for administering access to the data held in their particular instance for their employees and service providers.

While our software is delivered with certain preset configurations, we

understand that our customers require flexibility to configure the Now Platform to their specific business needs.

In most instances, our customers are responsible for configuring and determining access levels to the data held in their particular instance for their employees and service providers.

While our software is delivered with certain preset configurations, we understand that our customers require flexibility to configure the ServiceNow AI Platform to their specific business needs.

We work closely with our customers to help them evaluate their security configurations, including providing guidance to align configuration settings with their business needs.

3 unchanged sentences

In certain cases, customers may misconfigure their systems and claim that they were not properly informed of the risks to their configuration.

Our data security system and data governance framework, designed to protect our and our customers’ information and prevent data loss, may not be effective at preventing material breaches caused by intentional or unintentional actions or inactions by employees, contractors or third parties.

Techniques used to sabotage or to obtain unauthorized access to systems are constantly evolving and may go undetected until a successful attack occurs.

Our data security system and data governance framework, designed to protect our and our customers’ information and prevent data loss, may not be effective at preventing, detecting, responding to or remediating material breaches caused by intentional or unintentional actions or inactions by employees, contractors or third parties.

Techniques used to sabotage or to obtain unauthorized access to systems are constantly evolving and may go undetected until we become aware of a successful attack.

Moreover, we have experienced security incidents, which may reoccur in the future, that resulted in unauthorized access to, loss or inadvertent disclosure of confidential, proprietary and sensitive information.

17 unchanged sentences

These consequences can result regardless of whether the incident is suffered by us, affects our third-party service providers or stems from customers’ action or inaction.

Moreover, even if a breach is unrelated to our security programs or practices, it could still cause us reputational harm and require us to undertake significant efforts to assess and respond to the breach, including further protecting our customers from their own vulnerabilities.

There can be no assurance that any limitations of liability provisions in our subscription agreements, terms of use or other agreements would be enforceable or adequate or would otherwise protect us from any such liabilities or damages with respect to any particular claim.

2 unchanged sentences

There is increasingly intense competition for talent in the technology industry.

Our success depends substantially upon the continued services of our management team, particularly our chief executive officer, chief operating officer and the other members of our executive staff.

From time to time in the ordinary course of business, there have been and may continue to be changes in our management team.

Our success depends substantially upon the continued services of our management team, particularly our chief executive officer and the other members of our executive staff.

From time to time in the ordinary course of business, there have been and may

2025 Annual Report 31

continue to be changes in our management team.

While we seek to manage these transitions carefully, such changes may result in a loss of institutional knowledge and negatively affect our business.

6 unchanged sentences

We are continually evaluating and, as appropriate, enhancing the attractiveness of our compensation packages and benefit programs.

As a result, we have experienced and may continue to

experience increased costs that may not be offset by either improved productivity or higher sales, potentially resulting in a reduction in our profitability.

In addition, we grant equity awards to our employees and sustained declines in our stock price or lower stock price performance relative to our competitors reduces the retention value of such awards, which can impact the competitiveness of our compensation.

As a result, we have experienced and may continue to experience increased costs that may not be offset by either improved productivity or higher sales, potentially resulting in a reduction in our profitability.

Many of our employees, including all of our executive officers, are employed “at-will” and may terminate their employment with us at any time.

1 unchanged sentence

Delays in the release of, or actual or perceived defects in, our products may slow the adoption of our latest technologies, reduce our ability to efficiently provide services, decrease customer satisfaction and adversely impact future product sales.

We must successfully continue to release new products and updates to existing products.

We must successfully continue to release new products and updates and features to existing products.

The success of any release depends on a number of factors, including our ability to manage the risks associated with actual or perceived quality or other defects or deficiencies, delays in the timing of releases or the adoption of releases by customers, and other complications that may arise during the early stages of introducing our products.

2 unchanged sentences

Our business depends on our platform to be available without disruption.

From time to time, we have experienced and expect to continue to experience defects, disruptions, outages and other performance and quality problems with our platform.

New defects may be detected in the future and may arise from our increasing use of the public cloud.

From time to time, we have experienced and expect to continue to experience defects, disruptions, data loss, outages and other performance and quality problems with our platform.

New defects may be detected in the future and may arise from our increasing use of public cloud service providers.

For example, we provide regular updates to our services, which can contain undetected defects.

Defects may also be introduced by our use of third-party software, including open-source software.

Disruptions may result from errors we make in developing, delivering, configuring or hosting our services, or designing, installing, expanding or maintaining our cloud infrastructure.

Disruptions in service can also result from incidents outside of our control, including third-party incidents or denial of service or ransomware attacks, among others.

We currently serve our customers primarily using equipment managed by us and co-located in third-party data centers operated by several different providers located around the world, and we serve certain of our customers using data center facilities operated by public cloud service providers.

These data centers are vulnerable to damage or interruption from earthquakes, hurricanes, floods, fires, power failures and similar events.

Disruptions, data loss and service degradation may result from errors we make in developing, delivering, configuring or hosting our services, or designing, installing, expanding or maintaining our cloud infrastructure.

They may also arise from incidents outside of our control, including third-party incidents, denial of service or ransomware attacks, as well as from our efforts to address vulnerabilities and security incidents.

Although we currently serve our customers primarily using equipment managed by us and co-located in third-party data centers operated by several different providers worldwide, we expect to increasingly serve our customers using data center facilities operated by public cloud service providers.

As our reliance on public cloud service providers increases, we face heightened risks of outages or performance degradation beyond our direct control.

Similarly, supply chain issues or other incidents involving critical service providers could disrupt our operations or

reduce our productivity.

These data centers, whether managed by us or third parties, are vulnerable to damage or interruption from earthquakes, hurricanes, floods, fires, power failures and similar events.

They may also be subject to break-ins, sabotage, intentional acts of vandalism and similar misconduct, equipment failure and adverse events caused by operator error or negligence.

In addition, an increased use of the public cloud increases our vulnerability to cyberattacks.

In addition, an increased use of public cloud service providers increases our vulnerability to cyberattacks.

Despite precautions taken at these centers, problems at these centers have occurred, resulting in interruptions in our services.

Such problems could occur again and result in similar or lengthier service interruptions and the loss of customer data.

In addition, our customers may use our services in ways that cause disruptions in service for other customers.

In addition to data center providers, we also have a large ecosystem of vendors and service providers that we use for our products.

If there is a compromise to data, supply chain issue or other incident with our critical service providers, it may impact our ability to provide our services and reduce our productivity.

Furthermore, our customers may use our services in ways that cause disruptions in service for other customers.

We also have a large ecosystem of vendors and service providers that we use for our products, and a data compromise, supply chain issue or other incident involving a critical service provider could impact our ability to provide our services and reduce our productivity.

Our customers use our services to manage important aspects of their businesses, and our reputation and business will be adversely affected if our customers and potential customers believe our services are unreliable.

Disruptions or defects in our services may reduce our revenues, cause us to issue credits or pay penalties, subject us to claims and litigation, cause our customers to delay payment or terminate or fail to renew their subscriptions, and adversely affect our ability to attract new customers.

Disruptions or defects in our services may reduce our revenues, cause us to issue credits or pay penalties, subject us to claims and litigation, cause our customers to delay payment or terminate or decline to renew their subscriptions, and adversely affect our ability to attract new customers.

Similarly, customers may have unique requirements for system resiliency and performance depending on their business models and customers in highly regulated markets may have more demanding requirements that we may not be able to, or may not choose to, meet.

The occurrence of payment delays, service credit, warranty or termination for material breach or other claims against us could result in an increase in our bad debt expense, an increase in collection cycles, an increase to our service level credit accruals, other increased expenses or risks of litigation.

The occurrence of payment delays, service credit, warranty or termination for material breach or other claims against us could result in an increase in our bad debt expense, longer aggregate collection cycles, service level credit accruals and other expenses and a heightened risk of litigation.

We may not have insurance sufficient to compensate us for potentially significant losses that may result from claims arising from disruptions to our services.

Delays in improving our information systems and processes could interfere with our ability to support our existing and growing customer and employee base as we scale.

Delays in improving our information systems and processes could interfere with our ability to support our existing and growing base of customers and employees as we scale.

We rely on our information systems and those of third parties to operate and scale our business.

As the information we rely on for our business evolves, including as a result of implementing AI technologies, our information systems, including their infrastructure needs, network capacity and computing power, may need to expand.

We have made and continue to make investments to improve our information systems to support the needs of our growing customer and employee base, increase productivity, develop and enhance our services, expand into new geographic areas, and scale with

our overall growth.

Such improvements are often complex, costly, and time consuming.

We have made and continue to make investments to improve our information systems to support the needs of our growing base of customers and employees, increase productivity, develop and enhance our services, expand into new geographic areas, and scale with our overall growth.

Such improvements are often complex, costly, time consuming, and may lead to impairments or write downs of existing technologies and other assets.

If implementation of these improvements is delayed, or if we encounter unforeseen problems when migrating away from our existing systems and processes, our operations and our ability to manage our business could be negatively impacted.

This might lead to disruptions to our operations, loss of customers, loss of revenue, or damage to our reputation, all of which could harm our business plan to successfully scale our operations and enhance productivity.

We may not be able to protect or enforce our intellectual property rights.

We may not be able to protect or enforce our IP rights.

Our success depends significantly on our ability to protect our proprietary technology and our brand under patent, copyright, trademark, trade secret and other IP protections in the U.S.

5 unchanged sentences

Unauthorized parties may attempt to copy or obtain and use, or may have copied or obtained and used, our technology to develop products and services that provide features and functionality similar to ours.

Our competitors could also independently develop services equivalent to ours, and our IP rights may not be broad enough for us to prevent competitors from utilizing their developments to compete with us.

Our competitors could also independently develop services equivalent to ours, and our IP rights may not be broad enough for us to prevent them from utilizing their developments to compete with us.

Reverse engineering, unauthorized copying or other misappropriation of our proprietary technology could enable third parties to benefit from our technology without paying us for it.

We may initiate claims or litigation against third parties for infringement or misappropriation of our proprietary rights or to establish the validity of our proprietary rights.

We may initiate claims or litigation against third parties for infringement or misappropriation of our

2025 Annual Report 33

proprietary rights or to establish the validity of our proprietary rights.

However, we may be adversely affected if we are unable to prevent third parties from infringing upon or misappropriating our IP rights or are required to incur substantial costs defending our IP rights.

6 unchanged sentences

Further, upon expiration of any agreements that allow us to use third-party IP, we may be unable to renew such agreements on favorable terms, if at all, in which case we may face IP litigation or may need to cease offering or to modify our products and services to remove such components.

In addition, our subscription agreements generally require us to defend our customers against claims that our technology infringes the intellectual property rights of third parties.

In addition, our subscription agreements generally require us to defend our customers against claims that our technology infringes the IP rights of third parties.

Any claim or litigation, whether or not resolved in our favor, could result in significant expense to us, divert the efforts of our personnel and may result in counterclaims against us.

8 unchanged sentences

Additionally, the IP ownership and license rights of new technologies and the use of outputs therefrom, such as AI, which we are increasingly building into our product offerings, have not been fully addressed by U.S.

courts interpreting current and new laws or regulations, and the use or adoption of such technologies in our products and services may expose us to potential intellectual property claims;

and foreign courts interpreting current and new laws or regulations, and the use or adoption of such technologies in our products and services may expose us to potential IP claims;

breach of a data license, software license, or website terms of service allegations;

4 unchanged sentences

Our products incorporate software licensed to us by third-party authors under open-source licenses, and we expect to continue to incorporate open-source software into our products and services in the future.

We monitor our use of open-source software to avoid subjecting our products and services to adverse licensing conditions.

Additionally, certain of our products may use or be developed with data sets subject to open-source licenses, which may contain restrictions on data set use.

We monitor our use of open-source software and data sets to avoid subjecting our products and services to adverse licensing conditions.

However, there can be no assurance that our efforts have been or will be successful.

9 unchanged sentences

Some customer implementations may take longer than planned, delay our ability to sell additional products or fail to meet our customers’ expectations, resulting in customers canceling or failing to renew their subscriptions before our products have been fully implemented.

Some customers may lack the internal resources to manage a digital transformation such as our offering and, as a consequence, may be unable to see the benefits of our products.

Unsuccessful, lengthy, or costly implementations and integrations could result in claims from customers, reputational harm, and opportunities for competitors to displace our products.

Our failure or perceived failure to achieve our ESG goals or maintain ESG practices that meet evolving stakeholder expectations could adversely affect us.

Our ability to achieve published environmental, social, and governance (“ESG”) initiatives, goals and commitments is subject to numerous factors both within and outside of our control.

Our failure or perceived failure to achieve our ESG goals or maintain ESG practices that meet evolving stakeholder expectations or regulatory requirements could harm our reputation, adversely impact our ability to attract and retain employees or customers and expose us to increased scrutiny from the investment community, regulatory authorities and others or subject us to liability.

Our reputation also may be harmed by the perceptions that our customers, employees and other stakeholders have about our action or inaction on ESG issues.

Damage to our reputation and loss of brand equity may reduce demand for our products and services.

Some customers may lack the resources to effectively manage a digital transformation using our products and, as a consequence, may be unable to see the benefits of our products.

Unsuccessful, lengthy or costly implementations and integrations could result in claims from customers, reputational harm and opportunities for other market participants to displace our products.

Our failure or perceived failure to achieve our corporate sustainability goals or maintain corporate sustainability practices that meet evolving stakeholder expectations could adversely affect us.

Our ability to achieve published corporate sustainability goals and commitments is subject to numerous factors both within and outside of our control.

Our failure or perceived failure to achieve our corporate sustainability goals or maintain corporate sustainability practices that meet stakeholder expectations or regulatory requirements could harm our reputation, adversely impact our ability to attract and retain employees or customers and expose us to increased scrutiny from the investment community, regulatory authorities and others or subject us to liability.

Our reputation also may be harmed by the perceptions that our customers, employees and other stakeholders have about our action or inaction on corporate sustainability issues.

In addition, the increasing prevalence of corporate sustainability laws and regulations across the jurisdictions in which we operate may increase compliance risks and costs and, together with differing views on the appropriate role of sustainability practices and disclosures, may subject us to greater stakeholder scrutiny.

Any potential damage to our reputation or loss of brand equity may reduce demand for our products and services.

We may face natural disasters, including climate change, and other events beyond our control.

Natural disasters or other catastrophic events may damage or disrupt our operations, international commerce and the global economy, and thus could have a negative effect on our business.

Our business operations are subject to interruption by natural disasters, flooding, fire, extreme heat, power shortages, pandemics, terrorism, political unrest, telecommunications failure, vandalism, cyberattacks, geopolitical instability, war, the effects of climate change and other events beyond our control.

While we maintain crisis management and disaster response plans, such planning may not account for all possible events and the occurrence of such events could make it difficult or impossible for us to deliver our services to our customers, could decrease demand for our services, and could cause us to incur substantial expense.

Our business operations are subject to interruption by natural disasters, flooding, fire, extreme heat, power shortages, pandemics, terrorism, political

2025 Annual Report 35

unrest, telecommunications failure, vandalism, cyberattacks, geopolitical instability, war, the effects of climate change and other events beyond our control.

While we maintain crisis management, business continuity and disaster response plans, such planning may not account for all possible events and the occurrence of such events could make it difficult or impossible for us to deliver our services to our customers, could decrease demand for our services, and could cause us to incur substantial expense.

Our insurance may not be sufficient to cover losses or additional expenses we may sustain.

In the event of major natural disasters or catastrophic events, our backup systems could fail, customer data could be lost, and resumption of operations could require significant time.

We may be subject to increased costs, regulations, reporting requirements, standards or expectations regarding climate change-driven impacts on our business.

While we seek to mitigate our business risks associated with climate change by establishing robust environmental programs as part of our ESG strategy, certain of those risks are inherent wherever business is conducted.

Any of our primary locations may be vulnerable to the adverse effects of climate change.

For example, our California headquarters have experienced, and may continue to experience, climate-related events at an

increasing frequency and severity, including drought, water scarcity, heat waves, wildfires and air quality impacts and power shutoffs associated with wildfires.

In the event of major natural disasters or catastrophic events, our backup systems could fail, critical teams could be impacted, customer data could be lost and resumption of operations could require significant time.

We may be subject to increased costs, regulations, reporting requirements, standards or expectations regarding climate-related impacts on our business.

While we seek to mitigate our business risks associated with climate-related risks by establishing environmental sustainability and enterprise risk programs, certain of those risks are inherent wherever business is conducted.

Any of our primary locations may be vulnerable to the adverse effects of climate-related risks.

For example, our California headquarters have experienced and may continue to experience climate-related events at an increasing frequency and severity, including drought, water scarcity, heat waves, wildfires and air quality impacts and power shutoffs associated with wildfires.

Changing market dynamics, global policy developments and increasing frequency and impact of extreme weather events on critical infrastructure in the U.S.

1 unchanged sentence

Risks Related to the Financial Performance or Financial Position of Our Business

Because we generally recognize revenues from our subscription service over the subscription term, a decrease in new subscriptions or renewals may not be immediately reflected in our operating results.

Because we generally recognize revenues from our subscription services over the subscription term, a decrease in new subscriptions or renewals may not be immediately reflected in our operating results.

We generally recognize revenues from customers ratably over the terms of their subscriptions.

15 unchanged sentences

Additionally, our future effective tax rate could be impacted by changes in accounting principles or changes in federal, state or international tax laws or tax rulings and these changes may have a retroactive effect.

For example, the One Big Beautiful Bill Act (“OBBBA”) was enacted on July 4, 2025, introducing a broad range of tax reform provisions that will affect our financial results.

Department of Treasury has broad authority to issue regulations and interpretative guidance that may significantly impact how we will comply with the law, which could affect our results of operations in the period issued.

Many countries are actively considering or have proposed or enacted changes to their tax laws based on the model rules adopted by the Organisation for Economic Co-operation and Development (“OECD”) defining a 15% global minimum tax (commonly referred to as Pillar 2).

Pillar 2 rules are at varying stages of adoption across jurisdictions where we operate.

The timeline to implement these rules and the specific rules vary by jurisdiction.

The adoption of Pillar 2 rules may affect our effective tax rate and current tax obligations and liabilities.

While we do not currently anticipate Pillar 2 rules to have a material impact on our consolidated financial statements, we are monitoring developments from the OECD, governmental bodies, such as the EU, and intergovernmental economic organizations, to evaluate the impact of changing global tax laws.

Global tax developments applicable to multinational businesses and increased scrutiny under tax examinations, as well as changes in federal, state or international tax laws or rulings that may increase our worldwide effective tax rate, could have a material impact on our business.

In addition, we may be subject to income tax audits by tax jurisdictions throughout the world, many of which have not established clear guidance on the tax treatment of cloud computing companies.

During 2025, multiple jurisdictions where the Company operates enacted legislation to implement the Organisation for Economic Co-operation and Development (“OECD”) Pillar 2 global minimum tax rules (generally imposing a 15% minimum effective tax rate on relevant groups).

In January 2026, the OECD issued additional guidance, including a safe harbor framework for certain U.S.-parented groups such as ours.

Even with this safe harbor, we could still be subject to local minimum tax regimes in countries that have adopted these rules.

Based on legislation enacted to date and currently available guidance, we have not recorded a material tax liability related to Pillar 2.

However, these global minimum tax rules are new and technically complex, and governments continue to issue updates on how they should be interpreted and applied.

Differences in how jurisdictions implement the rules, as well as future guidance from the OECD or taxing authorities, could change our tax obligations in future periods.

These developments, along with changes in U.S.

or foreign tax laws or the interaction of Pillar 2 with other tax regimes, may increase our effective tax rate and could have a material impact on our financial results.

In addition, we are subject to ongoing tax audits globally.

Many jurisdictions have not established clear guidance on the tax treatment of cloud computing and digital services.

Although we believe our income tax liabilities are reasonably estimated and accounted for in accordance with applicable laws and principles, an adverse resolution of one or more uncertain tax positions in any period could have a material impact on our results of operations for that period.

1 unchanged sentence

and are subject to inter-company agreements regarding the development and distribution of those assets to other jurisdictions with potential challenge under permanent establishment or transfer pricing principles.

While we believe that our position is appropriate

and well founded, if our position were successfully challenged by taxing authorities in other jurisdictions, we may become subject to significant tax liabilities.

While we believe that our position is appropriate and well founded, if our position were successfully challenged by taxing authorities in other jurisdictions, we may become subject to significant tax liabilities.

We may be adversely affected by our debt service obligations.

10 unchanged sentences

If we breach any of the covenants and do not obtain a waiver from the note holders or lenders, then, subject to applicable cure periods, any outstanding indebtedness may be declared immediately due and payable.

In addition, changes by any rating agency to our credit rating may negatively impact the value and liquidity of our securities.

In addition, a rating agency’s change to our credit rating may negatively impact the value and liquidity of our securities.

Downgrades in our credit ratings could restrict our ability to obtain additional financing in the future and could affect the terms of any such financing.

2025 Annual Report 37

Risks Related to General Economic and Political Conditions

3 unchanged sentences

capital markets experienced and continue to experience extreme volatility and disruption.

Furthermore, inflation rates in the U.S.

and other key markets have recently increased to levels not seen in decades resulting in federal action to increase interest rates, affecting capital markets.

Such economic volatility could adversely affect our business, financial condition, results of operations and cash flows, and future market disruptions could negatively impact us.

Such volatility could adversely affect our business, financial condition, results of operations and cash flows and future market disruptions could negatively impact us.

These unfavorable economic conditions could increase our operating costs and, because our typical contracts with customers lock in our price for a few years, our profitability could be negatively affected.

Geopolitical destabilization and warfare have impacted and may continue to impact global currency exchange rates, commodity prices, energy markets, trade and movement of resources, which may adversely affect the buying power of our customers, our access to and cost of resources from our suppliers, and ability to operate or grow our business.

Geopolitical destabilization and warfare have impacted and may continue to impact global currency exchange rates, commodity prices, energy markets, trade and movement of resources, which may adversely affect the buying power of our customers and our access to and cost of resources from our suppliers and ability to operate or grow our business.

In addition, from time to time, the U.S.

and other key international economies have been impacted and may continue to be impacted by geopolitical and economic instability, high levels of credit defaults, international trade disputes, changes in demand for various goods and services, high levels of persistent unemployment, wage and income stagnation, restricted credit, poor liquidity, reduced corporate profitability, volatility in credit, equity and foreign exchange markets, inflation, bankruptcies, international trade agreements, export controls, economic and trade sanctions, health crises and overall economic uncertainty.

and other key international economies have been impacted and may continue to be impacted by geopolitical and economic instability.

These conditions include, among others, high levels of credit defaults, international trade disputes, changes in demand for various goods and services, high levels of persistent unemployment, wage and income stagnation, restricted credit, poor liquidity, reduced corporate profitability, volatility in credit, equity and foreign exchange markets, inflation, bankruptcies, tariffs, international trade agreements, export controls, economic and trade sanctions, health crises and overall economic uncertainty.

These conditions can arise suddenly and affect the rate of digital transformation spending and could adversely affect our customers’ or prospective customers’ ability or willingness to purchase our services, delay purchasing decisions, reduce the value or duration of their subscriptions, or affect renewal rates.

6 unchanged sentences

It is particularly difficult to forecast any impact from exchange rate movements.

Unanticipated currency

fluctuations have adversely affected and could continue to adversely affect our financial results or cause our results to differ from investor expectations or our own guidance in any future periods.

Volatility in foreign currency exchange rates and global financial markets is expected to continue due to political and economic uncertainty globally.

We use derivative instruments, such as foreign currency forward contracts, to hedge exposures that certain of our balance sheet and income statement items have to changes in foreign currency exchange rates.

Unanticipated currency fluctuations have adversely affected and could continue to adversely affect our financial results or cause our results to differ from investor expectations or our own guidance in any future periods.

Volatility in foreign currency exchange rates and global financial markets is expected to continue due to global political and economic uncertainty.

We use derivative instruments, such as foreign currency forward contracts, to hedge certain balance sheet and income statement exposures to foreign currency exchange rates.

These hedging contracts have reduced and may continue to reduce, but they have not and cannot entirely eliminate, the impact of adverse foreign currency exchange rate movements.

5 unchanged sentences

In addition, technology companies in general have highly volatile stock prices, and the volatility in stock price and trading volume of securities is often unrelated or disproportionate to the financial performance of the companies issuing the securities.

Factors affecting our stock price, some of which are beyond our control, include, among other factors:

Factors affecting our stock price, some of which are beyond our control, include, among others:

• changes in the estimates of our operating results, revenue growth or changes in recommendations by securities analysts;

19 unchanged sentences

Securities litigation could result in substantial costs and divert management’s attention and resources from our business.

2025 Annual Report 39

Provisions in our governing documents or Delaware law might discourage, delay or prevent a change of control or changes in our management and, therefore, depress our stock price.

Our certificate of incorporation and bylaws contain provisions that could depress our stock price by acting to discourage, delay or prevent a change in control or changes in our management that our shareholders may deem advantageous.

Our certificate of incorporation and bylaws contain provisions that could depress our stock price by discouraging, delaying or preventing a change in control or changes in our management that our shareholders may deem advantageous.

These provisions, among other things:

• permit our board to establish the number of directors;

• require super-majority voting to amend certain provisions in our certificate of incorporation and bylaws;

• authorize issuance of “blank check” preferred stock that our board could use to implement a shareholder rights plan;

5 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors