7 unchanged sentences
violation of privacy or security laws and other litigation and legal risk;
+Added: financial risks;
and reputational risks.
16 unchanged sentences
When appropriate, we use external service providers and consultants to assess or monitor the environment or otherwise assist with aspects of our cybersecurity controls and risk assessment process.
−Removed: Our risk management approach is supplemented by external and internal enterprise risk management audits, which are designed to test the effectiveness of our security controls.
+Added: Our risk management approach is supplemented by external and internal audits, which are designed to test the effectiveness of our security controls.
We conduct penetration testing on a periodic basis and have established an external bug bounty program to allow security researchers to help identify vulnerabilities in our systems before they mature into real-world cybersecurity threats.
4 unchanged sentences
At least once a year, the Board of Directors discusses our programs and policies related to cybersecurity and risk initiatives and considers them closely both from a risk management perspective and as part of Workday’s business strategy.
−Removed: Additionally, the Board has delegated to its Audit Committee oversight of cybersecurity risks and processes to manage them.
+Added: Additionally, the Board of Directors has delegated to its Audit Committee oversight of cybersecurity risks and processes to manage them.
Our Audit Committee is comprised entirely of independent directors who regularly evaluate cybersecurity risks.
−Removed: The materials presented to our Board and Audit Committee include updates on our data security posture, results from third-party assessments , progress towards predetermined risk-mitigation-related goals, our incident response plan, and certain cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks.
−Removed: The Board and Audit Committee generally receive materials, including a cybersecurity scorecard and other materials indicating current and emerging cybersecurity threat risks and describing our ability to mitigate those risks, and discuss such matters with our Chief Information Security Officer (“CISO”) .
−Removed: Material cybersecurity threat risks are also considered during separate Board and committee meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, and other relevant matters .
+Added: The materials presented to our Board of Directors and Audit Committee include updates on our data security posture, results from third-party assessments , progress towards predetermined risk-mitigation-related goals, our incident response plan, and certain cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks.
+Added: The Board of Directors and Audit Committee generally receive materials, including a cybersecurity scorecard and other materials indicating current and emerging cybersecurity threat risks and describing our ability to mitigate those risks, and discuss such matters with our Chief Information Security Officer (“CISO”) .
+Added: Material cybersecurity threat risks are also considered during separate Board of Directors and committee meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, and other relevant matters .
Our CISO leads all aspects of our global cybersecurity program.
−Removed: Our CISO joined Workday in 2010 and has served as our CISO since April 2018.
−Removed: Our CISO has more than 20 years of experience in cybersecurity and information technology risk management, including at a large public company and a recognized consulting firm.
−Removed: He also has a degree in information systems management.
+Added: Our CISO joined Workday in September 2025.
+Added: Our CISO has more than 25 years of experience in cybersecurity defense, engineering, and governance, including leading security teams at several public companies.
+Added: He also has a degree in computer information systems and a master's degree in telecommunications.
Our cybersecurity program is also supported by a cross-functional leadership team that contributes to our information security and privacy programs and practices, as well as identifies and mitigates security and privacy risks.
−Removed: This team includes our CIO and our Chief Legal Counsel.
+Added: This team includes our CIO and our Chief Legal Officer.
This team contributes to the development of our cybersecurity strategy and is periodically updated regarding evolving cybersecurity risks and the in-place responsive actions.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.