Cybersecurity and data breaches

By sector

Sector is the SEC's industry description of the company. Each count opens that sector's quotes below.

528 paragraphs · Computer Peripheral Equipment, NEC show all sectors

In addition to the GDPR, the EU has also enacted legislation that would regulate non-personal data and establish new cybersecurity standards, and other countries, including the U.K., may similarly do so in the future. In particular, the EU Data Act went into effect in 2024 and imposes certain data and cloud service interoperability and switching obligations to enable users to switch between cloud service providers (as well as certain requirements concerning cross-border international transfers of non-personal data outside the EEA). Additionally, the EU’s Network and Information Security Directive II, adopted in 2023, regulates resilience and incident response capabilities of entities operating in a number of sectors, including the digital infrastructure sector and provides for EU member states to have issued implementing legislation by October 2024. Further, DORA became effective in January 2025 and imposes certain requirements on entities in the financial sector and their third-party cloud service providers related to managing and mitigating information and communication technology risk. If we are unable to transfer data, including personal data, between and among countries and regions in which we operate, or are otherwise required to modify our practices, including our data privacy and security controls and procedures, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results.

Read in the 10-K filed Feb 25, 2026 ↗

•Customer trends toward vendor consolidation in cybersecurity may favor competitors offering broader platforms.

Read in the 10-K filed Sep 10, 2026 ↗

Customer trends toward vendor consolidation in cybersecurity may favor competitors offering broader platforms.

Read in the 10-K filed Sep 10, 2026 ↗

Enterprise cybersecurity buyers are increasingly seeking to consolidate their vendors to reduce costs, complexity, and integration challenges. While our platformization strategy is designed to benefit from this trend, consolidation may also create opportunities for competitors, including large cybersecurity platform vendors, cloud hyperscalers, and enterprise software companies, to offer broader bundled solutions that include capabilities in categories where we compete, such as identity security and observability. If customers choose to consolidate with vendors offering more comprehensive suites, or if competitors more successfully utilize acquisitions or partnerships to combine capabilities, we may be at a competitive disadvantage. Furthermore, organizations continuously evaluate their information security priorities and may allocate budgets to solutions offered by our competitors, or may not adopt or expand the use of our solutions, which could adversely affect our business, financial condition, and operating results.

Read in the 10-K filed Sep 10, 2026 ↗

In addition, frontier or foundational AI model providers, or similar companies with advanced large language model capabilities, have entered or may enter the cybersecurity and observability markets, whether directly, through partnerships, or by enabling third parties to build competing security applications on top of their models. These companies possess substantial capital, technical talent, and have developed, or proprietary access to, foundational or frontier AI models. Their ability to rapidly iterate on model capabilities, attract AI research talent, and leverage significant compute infrastructure may allow them to introduce competing security capabilities more quickly or at lower cost than we can. If these or other AI companies develop and commercialize security products or embed security functionality into their broader AI platforms, customers may choose to consolidate their security spend with such providers rather than purchase our solutions, which could adversely affect our revenue, market share, and competitive position.

Read in the 10-K filed Sep 10, 2026 ↗

Vulnerabilities within our AI systems may be identified by researchers or malicious actors before we detect or remediate them, which could result in security incidents, data privacy issues, reputational damage, or loss of customer confidence. Advances in AI have also increased the speed, scale, and sophistication of cybersecurity threat activity, including reducing the time between vulnerability discovery and exploitation. To the extent customers, investors, or other market participants perceive that AI can automate or commoditize aspects of cybersecurity functions, the perceived value of certain cybersecurity solutions could diminish, and customer buying patterns, competitive dynamics, and demand for our products, subscriptions, and support offerings could be adversely affected. Investor and market perceptions regarding AI-related disruption to the cybersecurity industry could adversely affect our business and operating results, or the trading price of our common stock, even if these perceptions do not reflect actual changes in our business, customer demand, competitive positions, or financial performance.

Read in the 10-K filed Sep 10, 2026 ↗

The cybersecurity industry is undergoing a transformation as customers increasingly expect AI-native solutions that are designed from the ground up to leverage AI capabilities. If we fail to anticipate, invest in, or execute on the transition to AI-native platforms, or if our competitors develop AI-native offerings that achieve greater market acceptance, we may miss critical opportunities for growth and market leadership, and our business, including our gross margin, and competitive position could be materially harmed.

Read in the 10-K filed Sep 10, 2026 ↗

Our products and subscriptions are subject to regulatory requirements in a number of foreign jurisdictions, and the scope and complexity of these requirements continue to expand. For example, in China, our products may be required to comply with cybersecurity and data security laws, including the Cybersecurity Law, the Data Security Law, and related regulations, and may be subject to network security review, critical information infrastructure protection requirements, and mandatory product certifications. Other jurisdictions impose similar requirements, including local testing and certification requirements, in-country data storage or processing mandates, source code review or escrow obligations, and restrictions on the use of foreign-developed encryption or security technologies. Compliance with these requirements is costly and time-consuming, and the regulatory landscape in many jurisdictions is evolving and subject to change with limited or no notice. If we are unable to obtain or maintain required certifications, approvals, or authorizations in a timely manner, or if new or revised requirements render our products or subscriptions non-compliant, we may be unable to sell, deploy, or support our products in affected markets, which could result in lost revenue opportunities, reputational harm, and a material adverse effect on our business, financial condition, and operating results.

Read in the 10-K filed Sep 10, 2026 ↗

We are also subject to federal, state, provincial, and foreign laws regarding cybersecurity and the protection of our systems and confidential information. Many jurisdictions have enacted laws, such as the GDPR and the E.U. Network and Information Systems Directive II, requiring companies to adopt cybersecurity risk management measures and notify regulators (and individuals) of data breaches or cybersecurity incidents. If our data security measures fail to adequately protect our systems or confidential information, we could be liable to both our customers and their users for

Read in the 10-K filed Sep 10, 2026 ↗