Added10-Q 2026-10-30 vs 10-K 2026-02-24
• our ability to comply with evolving telecommunications-related regulations and industry standards;
TWLOTwilio
We envision a world in which every digital interaction is amazing. 10-K, Item 1
- Employees
- 5,587
- Headquarters
- San Francisco, CA
- CEO
- Khozema Shipchandler
- Next results
- around Feb 11, 2027
31 paragraphs in Risk Factors of the 10-K filed Feb 24, 2026 with nothing like them in the 10-K filed Feb 26, 2025. Quoted exactly. Paragraphs that were only edited are under 10-K change.
Compared with the Risk Factors in the latest 10-K of the other 74 Technology companies: a paragraph with at least half its words the same at another company is called similar, and the companies are listed under it. A paragraph most of them have is marked boilerplate. No line means no other company has one like it. This counts text; it does not say how serious a risk is.
•our reliance on network service providers and internet service providers for network service and connectivity;
Read in the 10-K ↗
Macroeconomic and political conditions and uncertainties have in the past adversely affected, and may in the future adversely affect, our business, results of operations and financial condition, and could exacerbate many of the other risks described in this “Risk Factors” section.
Read in the 10-K ↗
•seasonal trends, including due to increased consumer activity in the fourth quarter;
Read in the 10-K ↗
Reliance on these providers poses risks to the quality of our services, primarily by limiting our control, operating flexibility, and ability to timely identify and respond to necessary service changes, and by subjecting us to service interruptions or outages. Reliance on such providers in the past has caused, and may in the future cause, errors, service outages, security incidents, or poor-quality communications on our products, and we could encounter difficulty identifying the source of the problem. This has in the past, and may in the future, cause harm to our brand, result in lost revenue, and cause us to lose existing and prospective customers.
Read in the 10-K ↗
We also face risks related to losing access to these services. Many of these providers do not have long-term committed contracts with us and may interrupt services or terminate their agreements with us without notice. We may not be able to replace these services on a cost-effective basis, or at all, and even if we can, replacing providers may be time-consuming, costly and result in delays.
Read in the 10-K ↗
We depend upon our IT systems to conduct virtually all of our business operations, ranging from our internal operations and research and development activities to our marketing and sales efforts and communications with our customers, vendors and other business partners. Moreover, our platform stores, transmits, and otherwise processes our, our customers’ and our partners’ proprietary, confidential, and sensitive data. We also rely on various third-party service providers – including network service providers, internet service providers, telecommunications carriers, and providers of cloud infrastructure and cloud communications – for business operations, to operate our platform and to deliver our products, as well as third-party technology and intellectual property.
We have been targeted by threat actors seeking unauthorized access to our systems or data, or that of our customers or third-party service providers, or to disrupt our operations or ability to provide our services. Our third-party service providers have also been targeted. Our platform and our underlying infrastructure, the information we store and process, and those of our third-party service providers, are subject to evolving threats and have in the past and may in the future be subject to breaches, compromises, disruptions, or other incidents, including as a result of the following:
•fraud, social-engineering attacks (such as phishing) and other third-party attempts to induce our employees, customers or partners to disclose sensitive information to gain access to our customers’ data or systems, or our data or our systems;
Similar paragraph at 1 of 74 other Technology companies: CRM•efforts by hackers or sophisticated groups, such as criminal organizations, state-sponsored organizations or nation-states, to launch coordinated cyberattacks on internally built infrastructure or on third-party cloud-computing platform providers, including malicious code, ransomware, destructive malware, supply chain attacks and distributed denial-of-service attacks;
Similar paragraph at 1 of 74 other Technology companies: CRM•third-party attempts to abuse our marketing, advertising, messaging or products and functionalities to impersonate persons or organizations and disseminate information that is false, misleading or malicious;
Similar paragraph at 1 of 74 other Technology companies: CRM•attacks on, malfunctions or unavailability of, or other vulnerabilities in, the underlying networks and services that power the internet or that our products otherwise depend on, many of which are not under our control or the control of our customers or partners;
Similar paragraph at 1 of 74 other Technology companies: CRM•employee fraud, misconduct or error, including resulting from efforts to bribe, extort, infiltrate or otherwise compromise our or our service providers’ workforce.
Read in the 10-K ↗
We make, and expect to continue to make, significant investments in processes and controls designed to mitigate risks associated with breaches and other incidents, including to evaluate and respond to known and potential risks. These investments are, and could increasingly be, costly, and may not be effective or prevent a material incident. Our ability to effectively mitigate these risks may be impacted by, among other factors:
•the rapidly evolving nature of techniques to breach, compromise, or disrupt IT systems and infrastructure, including increasing use of AI technologies, such that we may not be able to recognize such techniques until launched against a target, or anticipate, prevent, or timely respond to them, increasing the likelihood and magnitude of damage of a breach or other incident;
•the increasing complexity of our internal IT systems, including as we adopt new technologies, including AI solutions, and incorporate and secure IT environments from acquired companies;
Similar paragraph at 1 of 74 other Technology companies: CRM•our limited control over customers and third-party providers (including those authorized by customers to access their data) and the processing of data by third-party providers, which may prevent us from maintaining the integrity or security of such data.
Similar paragraph at 1 of 74 other Technology companies: CRMIn the normal course of business, we experience, and have experienced, cyberattacks and other security incidents, which have in the past and may in the future cause harm to our business. For example, in 2022, one such incident resulted in threat actors obtaining employee credentials and accessing customer data, and required us to notify affected customers and regulators and take steps to remediate the incident. While to date the security events we have experienced have not had a material financial impact, we may experience significant and material future incidents. Any security incident can result in loss, corruption, unavailability, or other unauthorized processing of confidential information or sensitive personal information. Any such event, or the perception that it has occurred, may also result in damage to our reputation, erosion of customer trust, loss of customers, litigation, regulatory investigation, fines, penalties, and other consequences and liabilities that could adversely affect our business, results of operation and financial condition. Laws and regulations require us to maintain security measures, and we may have contractual or other legal obligations to notify customers, government agencies, impacted individuals or other relevant stakeholders of security breaches or other incidents, which disclosures are costly and may cause widespread negative publicity and resulting harm, among other adverse consequences. Further, the detection, prevention, and remediation of known and potential security incidents, including determining whether an incident is notifiable or reportable, may not be straightforward and result in additional direct or indirect costs to respond or alleviate the consequences of the actual or perceived incident, such as additional infrastructure capacity spending to mitigate system degradation or reallocation of resources from development activities. We maintain errors, omissions and cyber liability insurance policies covering certain security and privacy damages, but such insurance may not be sufficient to cover the potentially significant losses resulting from a security breach or other incident, may be denied with respect to a particular claim, or may not remain available in the future on acceptable terms or at all.
Read in the 10-K ↗
We are subject to increasing legal, regulatory, and contractual obligations relating to privacy, data protection and cybersecurity that affect how we process personal data in the jurisdictions where we and our customers operate. Our obligations change frequently due to new or modified laws and regulations, as well as court rulings interpreting or invalidating them. These evolving obligations involve significant compliance costs and operational challenges, and increasingly expose us to enforcement actions and other proceedings or actions, sanctions, and litigation, as well as regulatory and public scrutiny of our practices relating to personal information. We expect the increasing breadth and depth, and changing nature of, these obligations to continue to require significant resources, including to review our technology, systems and processes against changing requirements. They may also limit our ability to use personal data for new products, including those relying on AI-related technologies.
In the United States, for example, the California Consumer Privacy Act (as amended by the California Privacy Rights Act of 2020, the “CCPA”) provides our customers, employees, and other individuals certain rights related to their personal information. The federal government has also proposed, and numerous other states are considering or have proposed and/or enacted, laws and regulations addressing privacy and cybersecurity. Internationally, the regulatory landscape is increasingly complex and fragmented and compliance increasingly financially burdensome. For example, in the European Union (“EU”), the General Data Protection Regulation (“GDPR”) imposes significant requirements regarding the processing of personal information, including related to transparency, individuals’ privacy rights, compliance contracting, data minimization, data breach notification, data retention, security, and international data transfers. Other international privacy and data protection laws also impose strict requirements, such as related to marketing communications and deployment of cookies. Together, this patchwork of global requirements presents significant compliance challenges, and subjects us to possible fines, sanctions, litigation, and other adverse consequences. For example, under the GDPR, regulators may impose temporary or definitive bans on data transfers or other processing, require deletion, and impose significant fines, potentially ranging up to 4% of our worldwide revenue.
We must also comply with increasing laws and regulations relating to data residency, data localization, and the transfer of data across territorial boundaries, arising from the fact that our primary data processing facilities are in the United States. For
Read in the 10-K ↗
7 more
Additionally, as a provider of interconnected VoIP service, we must also comply with certain U.S. federal privacy laws and regulations, including Section 222 of the Communications Act of 1934, as amended, and the FCC’s customer proprietary network information rules. We are also subject to state rules and obligations that have been proposed or adopted, or may be in the future. We are also subject to other rapidly changing technology- and industry-specific laws, regulations and obligations. For example, we expect increased global regulation in the use of AI and ML such as the recent AI Act in Europe, which imposes onerous obligations related to the development, placement on the market and use of AI systems. Various countries and a growing number of U.S. states are also enacting legislation regulating aspects of AI or AI generally. We may need to change our business practices to comply with obligations under these or other new and evolving regimes, and face significant compliance challenges, liability, or other risks.
Read in the 10-K ↗
We have deployed, and continue to develop and incorporate, AI solutions and features in our platform and our business, and these solutions and features may become more important to our operations, future growth or competitiveness over time. We expect to rely on AI solutions and features to help drive future growth and efficiency in our business, but there can be no assurance that we will realize the desired or anticipated benefits from AI in a timely or cost-effective manner. For example, we
Read in the 10-K ↗
As a provider of communications products and a licensed telecommunications provider, we are required to comply with many changing federal, state and international regulations, including relating to privacy, security, telecommunications, consumer protection, fraud and scam prevention, Know Your Customer and Know Your Traffic and other requirements and obligations, which often vary across the numerous jurisdictions in which we operate. Compliance with these requirements involves significant management attention and compliance costs, and can present operational challenges, onboarding delays and friction for our customers, require us to raise prices, restructure or discontinue our products, or limit our ability to expand into certain jurisdictions. If we do not comply with such requirements, we could face enforcement actions, significant fines, remedial directions to implement audits or new processes, loss of licenses, restrictions or prohibitions on our ability to operate or offer certain of our products, eroded customer trust, and damage to our brand and reputation, and other consequences. Any of the foregoing could adversely affect our business, results of operations and financial condition.
In the United States, at the federal level, we and/or our customers are required to comply with laws and regulations limiting telemarketing and certain technologies that enable automatic calling and/or messaging and establishing quiet hours for solicitations, such as the Telephone Consumer Protection Act of 1991 (“TCPA”), laws requiring assistance to law enforcement in electronic surveillance, requirements to pay regulatory fees and contributions to various federally administered funds, requirements to safeguard the privacy of certain customer information, and requirements aimed at mitigating illegal robocalls and robotexts, such as the implementation of call authentication technologies, and other compliance requirements. At the state level, some states have adopted, proposed or may propose, regulations that may subject us to additional registration, reporting, resiliency and/or compliance obligations, including laws similar to the TCPA.
We are also subject to varying international licensing obligations and communications regulations, including related to reporting requirements, provision of emergency services and of information to support emergency services, number portability, combatting scam and fraud, payment into universal service funds, and licensing fees, among others. As we expand into new countries, our potential regulatory and licensing obligations, and related scrutiny, increase. The international landscape continues to evolve, and in many cases involves significant uncertainties related to how the CPaaS business model fits into the communications regulatory framework. There is significant variation in requirements across international jurisdictions, including as to whether some or all of the services we offer are considered regulated telecommunications services. In addition, certain of our products may be used by customers located in countries where voice and other forms of Internet Protocol (“IP”) communications may be illegal or require special licensing or in countries on a U.S. embargo list, and users in such countries may continue to use our products in those countries notwithstanding the illegality or embargo, or a local partner that we use to
provide services may not comply with applicable governmental regulations, subjecting us to potential penalties or governmental actions that may be costly, harm our business and damage our brand and reputation.
Both in the United States and internationally, these requirements continue to change. For example, new federal, state, or international requirements could impose more or different robocall or robotext mitigation measures, limit the customers we are able to serve, extend telecommunications regulations to our non-interconnected VoIP services or messaging products, subject us to additional registration, reporting or resiliency compliance obligations, or subject us to other fees, taxes or obligations. The changing nature of these requirements increases the associated compliance costs, operational challenges, possibility of enforcement actions and other associated risks, and new or changed requirements, or interpretations or judicial actions related to them, may also adversely affect our business, results of operations and financial condition.
Read in the 10-K ↗
The Federal Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (the “CAN-SPAM Act”) establishes certain requirements for commercial email messages and transactional email messages and specifies penalties for the
Read in the 10-K ↗
which may be imposed on us and responsible employees or managers; criminal liability, which may be imposed on us and responsible employees or managers; and, in extreme cases, the incarceration of responsible employees or managers.
Read in the 10-K ↗
Events or changes in circumstances may require us to record impairment charges related to our intangible assets, goodwill or investments.
Read in the 10-K ↗
As another example, the Organization for Economic Co-operation and Development (the “OECD”) has proposed a global minimum tax (“Pillar Two”), contemplating a minimum tax rate of 15% for large multinational companies, and various countries have proposed or enacted implementing legislation. Notwithstanding the OECD’s side-by-side elective safe harbor announced in January 2026 for U.S. parented groups, we may still face increased tax rates, compliance complexity and tax provision volatility as a result of Pillar Two.
Read in the 10-K ↗
New in the latest 10-Q
2 paragraphs in the 10-Q filed Oct 30, 2026 with nothing like them in the 10-Q filed Aug 7, 2026 (at least half the words must differ; new numbers alone do not count). Quoted exactly, grouped by the item heading above them. This is text that changed, not a judgement of how serious it is.
Risk Factors
• the use of AI to rapidly and more effectively discover and exploit vulnerabilities;
Read in the 10-Q ↗
Other information
On September 1, 2026, Aidan Viggiano, our Chief Financial Officer, adopted a Rule 10b5-1 trading plan providing for (i) the sale of shares of our common stock issuable upon the vesting and settlement of 66,760 RSUs outstanding prior to the adoption of the plan, in addition to certain shares Ms. Viggiano acquires upon the vesting and settlement of any RSUs that may be granted after the adoption of the plan, in each case, net of shares sold in mandatory transactions to cover withholding taxes, plus (ii) the sale of up to 58,972 shares at target (or 117,944 shares at maximum, representing the maximum number of shares issuable under the PSUs) of our common stock upon the vesting of performance stock units (“PSUs”), the precise number of shares to vest and settle to be determined based on the Company’s achievement against certain performance conditions, net of shares sold in mandatory transactions to cover withholding taxes. The number of shares listed above for Ms. Viggiano includes shares subject to limit orders that may or may not execute. Trading will not commence under Ms. Viggiano’s new Rule 10b5-1 trading plan until her previous Rule 10b5-1 trading plan terminates by its terms. The duration of the new plan is until September 7, 2027 or earlier if all transactions under the plan have been completed.
Read in the 10-Q ↗
The 10-Q's risk factors against the 10-K
Item 1A of the 10-Q filed Oct 30, 2026 against Item 1A of the 10-K filed Feb 24, 2026.
A 10-Q repeats only the risks that changed, so a 10-K paragraph that is missing from it is not counted as removed.
Added is a paragraph with nothing like it in the 10-K, Reworded a sentence that is in both with several words changed,
Quiet changes a sentence in both where one to four words changed and one is a hedge or a modal
(cut words struck through, new words highlighted and underlined).
Text on the page, not a score; each links to the filing at sec.gov.
Added10-Q 2026-10-30 vs 10-K 2026-02-24
• unwanted, fraudulent or illegal usage of or activity relating to our products;
Added10-Q 2026-10-30 vs 10-K 2026-02-24
macroeconomic conditions than those that rely primarily on subscription revenue. Additionally, increased prices resulting from the effects of tariffs and inflation could increase our operating expenses.
Added10-Q 2026-10-30 vs 10-K 2026-02-24
Our financial performance in recent periods may not be indicative of future performance, and we may not be able to maintain profitability in the future.
Added10-Q 2026-10-30 vs 10-K 2026-02-24
our business, results of operations and financial condition. Our ability to respond to fee increases may also be constrained by equivalent increases by other providers in a particular market, fees that are disproportionately large compared to underlying prices paid by our customers, or market or other conditions limiting our ability to increase the prices we charge for our products.
Added10-Q 2026-10-30 vs 10-K 2026-02-24
• attacks facilitated or enhanced by AI, including agentic AI and deep fakes; and
Added10-Q 2026-10-30 vs 10-K 2026-02-24
• the use of AI to rapidly and more effectively discover and exploit vulnerabilities;
Added10-Q 2026-10-30 vs 10-K 2026-02-24
our products and platform may be negatively impacted, our customers may experience outages or reduced service levels, and our business may be adversely affected.
Added10-Q 2026-10-30 vs 10-K 2026-02-24
to re-engineer our products or platform, damage our reputation, give rise to increased scrutiny regarding our use of open source software, result in customer dissatisfaction and may adversely affect our business, results of operations and financial condition.
Added10-Q 2026-10-30 vs 10-K 2026-02-24
The deployment of agentic AI - systems that autonomously execute multi-step tasks - introduces risks that are distinct from those of traditional AI features resulting from unintended or unauthorized actions that disrupt our internal operations and service delivery or create unknown or unexpected compliance risks. These risks may be difficult to monitor or prevent given the autonomous nature of such systems.
Added10-Q 2026-10-30 vs 10-K 2026-02-24
Our ability to mitigate the risks associated with AI will depend on our effective maintenance, training, monitoring and enforcement of appropriate policies, procedures and controls governing the use of AI tools, the results of any such use by us and our partners, and compliance with such policies and procedures by our workforce. Any unauthorized use or misuse of AI by our employees undermines our ability to protect against the AI-related risks described above.
Added10-Q 2026-10-30 vs 10-K 2026-02-24
Many of the foregoing activities are increasingly being facilitated or enhanced by AI and other evolving technologies. AI agents operating through our platform have the potential to facilitate communications and fraudulent schemes with a scale, speed and sophistication that may evade existing fraud and compliance controls or evolve faster than controls can evolve to match, violate carrier policies, or breach applicable law.
Reworded10-Q 2026-10-30 vs 10-K 2026-02-24
If we fail to comply with these laws, we and certain of our employees could be subject to substantial civil or criminal penalties, including: the possible loss of export privileges; fines, which may be imposed on us and responsible employees or managers; criminal liability, which may be imposed on us and responsible employees or managers; and, in extreme cases, the incarceration of responsible employees or managers.
Reworded10-Q 2026-10-30 vs 10-K 2026-02-24
Reworded10-Q 2026-10-30 vs 10-K 2026-02-24
Any failure to implement and maintain effective internal control over financial reporting also could adversely affect the results of periodic management evaluations and annual independent registered public accounting firm attestation reports regarding the effectiveness of our internal control over financial reporting that we are required to include in our periodic reports that will be filed with the SEC.
Reworded10-Q 2026-10-30 vs 10-K 2026-02-24
Reworded10-Q 2026-10-30 vs 10-K 2026-02-24
In addition, certain of our products may be used by customers located in countries where voice and other forms of Internet Protocol (“IP”) communications may be illegal or require special licensing or in countries on a U.S. embargo list, and users in such countries may continue to use our products in those countries notwithstanding the illegality or embargo, or a local partner that we use to provide services may not comply with applicable governmental regulations, subjecting us to potential penalties or governmental actions that may be costly, harm our business and damage our brand and reputation.
Reworded10-Q 2026-10-30 vs 10-K 2026-02-24
Although we maintain incident management and disaster response plans, in the event of a major disruption caused by a natural disaster or man-made problem, we may be unable to continue our operations and may endure system interruptions and outages, reputational harm, delays in our development activities, lengthy interruptions in service, security breaches and incidents and loss or unavailability of critical data, any of which could adversely affect our business, results of operations and financial condition.
Reworded10-Q 2026-10-30 vs 10-K 2026-02-24
Additionally, the instability in the political environment in many parts of the world, including in the United States, geopolitical instability, including related to conflicts in the Middle East, and changes and uncertainty with respect to trade policies, actual or threatened tariffs, treaties, government regulations, executive orders, directives and enforcement priorities, as well as any ongoing or potential U.S. federal government shutdown, have contributed to further disruptions in global trade and have adversely affected, and may continue to adversely affect affect, the global economy and/or our business.
Reworded10-Q 2026-10-30 vs 10-K 2026-02-24
For example, uncertainty regarding the impact of tariffs on certain countries imposed by the U.S. administration, as well as uncertainty related thereto, and potential or actual retaliatory measures taken by trade partners, measures, have adversely affected trade relations, put increased pressure on pressured supply chains, and led to increased market volatility, and such effects may continue.
Reworded10-Q 2026-10-30 vs 10-K 2026-02-24
In addition, if the third-party technology and intellectual property we use has errors, service outages, security vulnerabilities, or otherwise malfunctions, our business operations or the functionality of our products and platform may be negatively impacted, our customers may experience outages or reduced service levels, and our business may be adversely affected.
Reworded10-Q 2026-10-30 vs 10-K 2026-02-24
Court of Appeals for the Sixth Circuit struck down the FCC’s net neutrality rules, and it is the current federal regulatory environment makes the adoption of similar rules unlikely that similar federal rules will be adopted. in the near term.
Reworded10-Q 2026-10-30 vs 10-K 2026-02-24
For example, in the European Union (“EU”), the General Data Protection Regulation (“GDPR”) imposes significant requirements regarding the processing of personal information, including related to transparency, individuals’ privacy rights, compliance contracting, data minimization, data breach notification, data retention, security, and international data transfers.
Reworded10-Q 2026-10-30 vs 10-K 2026-02-24
If our efforts to increase the adoption and usage of our products or sell additional products to existing customers are less effective or more expensive or time-consuming than we expect or are otherwise ineffective, expect, including as a result of the rapidly evolving AI landscape, then our business, results of operations and financial condition would be adversely affected.
Quiet changes10-Q 2026-10-30 vs 10-K 2026-02-24
Adoption of these types of accounting standards and any difficulties in implementation of changes in accounting principles, including the ability to modify our accounting systems, could cause us to fail to meet our financial reporting obligations, which could result in regulatory discipline and harm investors' confidence in us.
The first 25 of 49 are shown (at most 12 of each type).
Work on TWLO in a spreadsheet:
Excel workbook (a sheet per section, ten years by column, charts, links to the filings) ·
CSV.
For a Google Sheet that stays up to date, paste =IMPORTDATA("https://tickdelta.com/company/TWLO/export.csv") into a cell.