VERISIGN INC/CA

Current report

Cybersecurity and Technology Risk Factors

Current report

Attempted security breaches, including from the exploitation of vulnerabilities, cyber-attacks and Distributed Denial of Service (“DDoS”) attacks against our systems and services increase our costs, expose us to potentially material liability, and could materially harm our business and reputation.

Current report

As an operator of critical internet infrastructure, we experience a high rate of cyber-attacks and attempted security breaches targeting our systems and services, including the most sophisticated forms of attacks, such as advanced persistent threat attacks, exploitation of zero-day vulnerabilities, ransomware attacks, and social engineering attacks. The forms of these attacks are constantly evolving and may involve methods, tools, and strategies that may not have been previously identified and may not have been observed until the moment of launch, or until sometime after, making these attacks virtually impossible to anticipate and difficult to defend against. For example, recent advances in AI-based tools have made, and will continue to make, cyber-attacks more sophisticated, harder to defend, and easier and faster to launch. These tools allow for rapid exploitation of vulnerabilities, which hinders our ability to defend against such exploitation. In addition to external threats, our systems and services are subject to insider threat risks, including physical or electronic break-ins, sabotage, and risks from suppliers, such as consultants and advisors, SaaS providers, hardware, software, and network systems manufacturers, regional internet registries, and other vendors, or from current or former contractors or employees. These threats and any resulting security breaches can arise from intentional or unintentional actions. Our continued exposure to these threats and the potential that they could lead to material liability claims against us requires us to expend significant financial and other resources. We have developed policies, standards, and procedures to identify, protect, detect, respond, and recover from threats posed by cybersecurity risks, and failure to comply with these policies, standards, and procedures by our employees or suppliers could limit our ability to effectively manage threats from these cybersecurity risks. Furthermore, we must ensure that our employees stay focused on protecting the

Current report

Company against cybersecurity threats especially in our hybrid work environment, or our ability to effectively manage cybersecurity risks could be impacted. Our failure to effectively manage these security risks, including external and insider threats, could result in material harm to our business, including loss of or delay in revenues, failure to meet service level agreements, material liability claims, failure to maintain market acceptance, injury to our reputation, and increased costs, and could call into question our ability to preserve the security and stability of the internet.

Current report

Security vulnerabilities in our systems and our vendors’ systems, including vulnerabilities in third party software and hardware, pose a material risk to our operations. We use externally-developed technology, systems, and services, including both hardware and software, for a variety of purposes, including compute, storage, encryption and authentication, back-office support, and other functions. We have developed policies, standards, and procedures to reduce the impact of security vulnerabilities in system components, as well as at any vendors where our data is stored or processed. However, such measures cannot provide absolute security. Vulnerabilities could be exploited before a vulnerability has been disclosed or before our remediation is effective and, if so, could cause systems and service interruptions, data loss and other damages. Our failure to identify, remediate, and mitigate security vulnerabilities, including any potential failure to timely replace and upgrade hardware, software, or other technology assets, could result in material harm to our business, including loss of or delay in revenues, failure to meet service level agreements, material liability claims, failure to maintain market acceptance, injury to our reputation, increased costs, and call into question our ability to preserve the security and stability of the internet.

Current report

Our networks have been, and likely will continue to be, subject to DDoS attacks. Recent industry experience has demonstrated that DDoS attacks continue to grow in size and sophistication, due in part to advances in AI-based tools, and have the ability to widely disrupt internet services. We have successfully mitigated DDoS attacks to date; however, there can be no assurance that we will be able to defend against every attack, especially as the attacks increase in size and sophistication. Any attack, even if only partially successful, could disrupt our networks, increase response time, negatively impact our ability to meet our service level agreements, and generally impede our ability to provide reliable service to our customers and the broader internet community. We have historically incurred, and will continue to incur, significant costs to enable our infrastructure to process levels of attack traffic that can be substantially larger than our normal transaction volume. We are employing new technologies and new and different services and capabilities to help mitigate DDoS attacks. If these new technologies, services and capabilities are not effective, our infrastructure could be disrupted, our response times could increase, our ability to meet our service level agreements could be negatively impacted, and our ability to provide reliable service to our customers and the broader internet community could be impeded.

Current report

We are subject to social engineering attacks including phishing, spear phishing, whaling, vishing, smishing, and domain spoofing, which are designed to entice people to divulge sensitive information or take actions that, if successful, could pose a material risk to our operations. The number of such attacks is increasing. Recent advances in AI have automated and increased the velocity and sophistication of these types of attacks as attackers are better able to rapidly create more personalized and targeted communications at scale using information derived from people’s relationships, online behavior and preferences. Social engineering attacks have occurred in concert with ransomware attacks. The various measures we take to mitigate cyber-attacks, including our deployment of advanced tools and implementation of redundant architecture and multiple recovery solutions, as well as conducting continuous security awareness training to address social engineering attacks and periodic exercises to mitigate the threat of ransomware cannot provide absolute security. We still may be subject to successful cyber-attacks despite our efforts. Our failure to prevent such attacks, including any successful social engineering attack, could result in our inability to meet our service level agreements and could otherwise materially harm our business, including from legal claims, governmental investigations and scrutiny, injury to our reputation, and increased costs.

Current report

We do not maintain specific reserves for security breaches, cyber-attacks and DDoS attacks against our systems and the amount of insurance coverage we maintain may be inadequate to cover claims or liabilities relating to such attacks.

Current report

We may introduce undetected or unknown defects into our systems or services, which could materially harm our business and harm our vendors or our customers.

Current report

Despite testing, services as complex as those we offer or develop could contain undetected defects or errors, which could result in service outages or disruptions, compromised customer data, including DNS data, diversion of development resources, injury to our reputation, legal claims, increased insurance costs or increased service costs. Performance of our services, whether or not defective, could have unforeseen or unknown adverse effects on the networks over which they are delivered, on internet users and consumers, and on third-party applications and services that use our services, any of which could result in legal claims against us. While we strive to prevent, detect and remediate defects or errors, they can and do occur and they could result in our inability to meet customer expectations in a timely manner, failure to meet our service level agreements, injury to our reputation, and increased costs.

Current report

Our infrastructure and services are subject to vulnerabilities in the global routing system for the internet, as well as risks arising from internet services providers’ increasing adoption of the Resource Public Key Infrastructure system.

Current report

Routing on the internet depends on the Border Gateway Protocol (“BGP”), which is a protocol that relies on networks within the internet infrastructure acting in a trustworthy manner when sharing information about destinations for connectivity and the routing of internet traffic. As a trust-based protocol, BGP has a number of vulnerabilities that may lead to outages or disrupt our services, including as a result of “route hijacks” that involve accidental or malicious rerouting of internet traffic, or “route leaks” that involve the malicious or unintentional propagation of routing information beyond the intended scope of the originator, receiver, and/or one of the networks along the route’s path. Both route hijacks and route leaks can result in partial or full rerouting of internet traffic for the impacted destinations. These types of events, which are generally beyond our control, could enable an array of attack conditions or service disruptions, and could result in adverse publicity and adversely affect the public’s perception of the security of commerce and communications over the internet, as well as of the security or reliability of our services.

Current report

To address internet routing system vulnerabilities, regional internet registries (“RIRs”) have adopted internet reachability policies based on a system known as the Resource Public Key Infrastructure (“RPKI”). The RIRs allocate internet number resources, such as internet protocol addresses, to enterprises and network operators. We and other registries as well as internet service providers have also adopted or have begun to adopt RPKI. We have limited visibility into the maturity of and investment in the RIRs’ operational and security controls, which are outside of our control. When the availability, integrity, or confidentiality of any of the information in the RPKI system, or systems used to maintain and administer RPKI data and systems, are impacted or otherwise compromised in any of the RIRs, or any network operator that is a relying party of the RPKI system, or the operations or ingestion of data from the RPKI system are otherwise impacted by a known or unknown vulnerability, our services may be negatively impacted. Such impacts may include degraded or full loss of reachability of service addresses in the global internet routing system, resulting in degradation or complete loss of availability of our registration and resolution services. A compromise of the RPKI system and related services, or unintentional or unauthorized manipulation of data therein, may also result in other denial of service attack conditions for our infrastructure and services. The systemic dependencies introduced by the RPKI system and by the relying parties of the RPKI system, including internet service providers, are outside of our control, and systems that depend upon the RPKI may be only as secure as the weakest elements of the RPKI system. Contracting with RIRs for the provision of and access to RPKI services carries material operational risks, as described above, as well as material contractual risks, which may expose us to service disruptions and material liability.

Current report

We could encounter system interruptions or system failures resulting from activities beyond our direct control that could materially harm our business.

Current report

We depend on the uninterrupted operation of our various systems, secure data centers, points of presence around the world and other computer and communication networks. Our systems and operations are vulnerable to damage or interruption from power loss, war, transmission cable cuts and other telecommunications failures, damage or interruption caused by fire, earthquake, and other natural disasters, intentional acts of vandalism, terrorist attacks, unintentional mistakes, or errors. In response to cyber threats or geopolitical conflict, network operators may disconnect from the global internet, limiting access to our DNS resolution services even when our systems remain operational. Our systems and operations also face risks inherent in, or arising from, the terms and conditions of our agreements with service providers to operate our networks and data centers. We are also subject to the risk of state suppression of internet operations. Any of these scenarios could create potential liability and exposure, including from a failure to meet our service level agreements, and could decrease customer satisfaction, materially harming our business, or resulting in adverse publicity and damage to our reputation or call into question our ability to preserve the security and stability of the internet.

Current report

Advances in quantum computing could compromise the security of the public-key cryptography algorithms that have been widely deployed in the industry.

Current report

Quantum computing poses a significant emerging risk to existing encryption standards, potentially enabling data breaches, authentication failures, and other new types of security threats. A “cryptographically relevant quantum computer” (CRQC) could compromise the security of the public-key cryptography algorithms that have been widely deployed in the industry. Although estimates vary on when a CRQC would be broadly available, the possibility exists today of a “harvest now / decrypt later” attack where pre-quantum encrypted data is collected now and held for future analysis by a CRQC. We plan to migrate our enterprise and production systems to post quantum cryptography (“PQC”) algorithms. Any failure by us, our customers, or the industry to implement PQC could expose pre-quantum encrypted data and systems to compromise. In addition, DNSSEC uses pre-quantum algorithms. Technology has not been standardized or deployed to effectively implement PQC for DNSSEC at scale due in part to DNSSEC’s unique operational constraints. Because of the decentralized nature of DNS deployments, the possibility exists that PQC for DNSSEC will not be defined, standardized, and deployed before the emergence of a CRQC. If these risks do materialize, they could have a material adverse effect on our operations, financial condition, results of operations and cash flows.

Current report

Our data centers, our data center systems, including the Shared Registration Systems located at our data centers, and our resolution systems are vulnerable to damage or interruption, which could impede our ability to provide our services, expose us to material liability, and materially harm our reputation.

Current report

Most of the computing infrastructure for our Shared Registration System is located at, and most of our customer information is stored in, data centers we own or lease. These data centers, which are concentrated in the same geographic region, are vulnerable to damage or interruption, including from natural disasters, such as fires, earthquakes, hurricanes, and floods, power loss, hardware or system failures, physical or electronic break-ins, human error or interference. We are also regularly updating and enhancing our network architecture in our data centers and globally distributed resolution systems. If our data center facilities or the updated network architectures, hardware or software upgrades, or security controls do not operate as expected, including the ability to quickly manage services across sites, we could experience service interruptions or outages. A failure in the operation of our Shared Registration System could result in the inability of one or more registrars to register or manage domain names for a period of time. If such a registrar has not implemented robust services in a manner that preserves transactions until processed by the registry, then the failure in the operation of our Shared Registration System could result in permanent loss of transactions at the registrar during that period. A failure in the operation of our Shared Registration System could also impact our ability to provide up-to-date information in our globally distributed resolution systems, which could result in our failure to meet our service level agreements pertaining to our resolution services and impact the resolution of domain names on the internet. We do not carry insurance or designated financial reserves for such interruptions.

Current report

In addition, our services depend on the secure and efficient operation of the internet connections to and from customers to our Shared Registration System residing in our secure data centers as well as our globally distributed resolution systems. These connections depend upon the secure and efficient operation of internet service providers, internet exchange point operators, and internet backbone service providers. Such providers have encountered periodic operational problems or experienced outages in the past beyond our scope of control and may continue to encounter problems and outages or may choose to discontinue their service. If the providers that our connections depend upon do not protect, maintain, improve, and reinvest in their networks or present inconsistent, incorrect, or invalid data regarding routing information or DNS responses through their networks, our business could be harmed.

Current report

A failure in the operation or update of the root zone servers that we operate, the root zone file, the Root Zone Management System, the TLD name servers, the TLD zone files that we operate, or other network functions, could result in, among other problems, (1) a DNS resolution or other service outage or degradation, (2) the deletion of one or more gTLDs or ccTLDs from the internet, (3) the deletion of one or more second-level domain names from the internet, or (4) a misdirection of one or more domain names to different servers. A failure in the operation or update of the supporting cryptographic and other operational infrastructure that we maintain could result in similar consequences. Any of these problems or outages could create potential material liability and exposure from litigation and investigations, could result in a failure to meet our service level agreements, and could decrease customer satisfaction, harming our business. These problems could also result in adverse publicity, decrease the public’s trust in the security of e-commerce and other forms of online presence, or call into question our ability to preserve the security and stability of the internet.

Current report

We retain certain customer and employee information in our data centers and various domain name registration systems. Any physical or electronic break-in or other security breach or compromise of the information stored at our data centers or domain name registration systems may jeopardize the security of information we retain or that is retained in the computer systems and networks of our customers. In such an event, we could face material liability and exposure from litigation and investigations, fail to meet service level agreements, or be at risk of losing various security and standards-based compliance certifications needed for operation of our businesses, and customers could be reluctant to use our services. Any such outcomes could also adversely affect our reputation and harm our business or cause financial losses that are either not insured against or not fully covered through any insurance.

Current report

Our launch of new products or services, or other strategic initiatives, may not be successful.

Current report

We are developing and launching new products and services, including Verisign Informed and . web and in the future may develop other new products and services such as.pki, which we applied for recently. Our success in these initiatives relies in part on our ability to manage early-stage operational issues, unanticipated market obstacles, the ability to attract and develop channel partners, and other business, technical and operational challenges including cybersecurity threats. Any failure to do so could impact the success of these new products or services. In addition, the size and extent of the demand for these new products and services is not precisely known, and they may not obtain market acceptance or may grow more slowly than anticipated. Further, our strategic planning contemplates various potential initiatives, including other new products or services, to enhance revenue or reduce risks to the business. These potential initiatives may not be implemented and if they are, they may not be successful and could give rise to unintended consequences, which could harm our business or reputation, lead to litigation, or scrutiny by regulators or others.

Current report

We face risks from the operation of the root server system and our performance of the Root Zone Maintainer functions under the RZMA.

Current report

Although the overall root server system is redundant and dispersed, an infrastructure or services failure or other disruption of one or more organizations involved in the operation of the root server system could impact the effectiveness of our . com and . net authoritative servers and therefore negatively impact directory services necessary for the operation of the internet. We also have an important operational role in support of a key Internet Assigned Numbers Authority (“IANA”) function as the Root Zone Maintainer. In this role, we provision and publish the authoritative root zone data and make it available to all root server operators under the RZMA with ICANN. If we make errors in the publication of the root zone or experience operational issues that impact the timeliness of updates to the root zone data, we may be subject to material claims challenging the RZMA or our performance under it, including tort claims, and we may not have immunity from, or sufficient indemnification or insurance for, such claims.

Current report

Contractual, Regulatory, Legal and Compliance Risk Factors

Current report

Any loss or modification of our right to operate the . com and . net gTLDs could have a material adverse impact on our business and result in loss of revenues.

Current report

Substantially all of our revenues are derived from our operation of the . com gTLD under our Cooperative Agreement with the DOC and our . com Registry Agreement as well as our operation of the . net gTLD under our .net Registry Agreement. Any loss or modification of our right to operate the . com and . net gTLDs could materially and adversely impact our ability to conduct our business and result in loss of revenues. Our . com and . net Registry Agreements contain “presumptive” rights of renewal upon the expiration of their current terms on November 30, 2030 and June 30, 2029, respectively. ICANN could refuse to renew upon expiration or terminate our . com Registry Agreement or our . net Registry Agreement if, upon proper notice, (1) we fail to cure a fundamental and material breach of certain specified obligations, and (2) we fail to timely comply with a final decision of an arbitrator or court. Additionally, each of the.com and.net Registry Agreements provide that if certain terms of these agreements are not similar to such terms generally in effect in the registry agreements of the five largest gTLDs, then a renewal of these agreements would be upon terms reasonably necessary to render such terms to be similar to the registry agreements for those other gTLDs. Any such terms, if they apply, could be unfavorable to us and have a material adverse impact on our business.

Current report

Standard renewals of the . com Registry Agreement do not require further DOC approval, although the prior written approval of the DOC is required for the removal of, or any changes to the pricing section (other than as approved in Amendment 35 to the Cooperative Agreement), and for changes to certain other specified terms whether such removal or changes are made at a renewal or otherwise. We can provide no assurances that DOC approval would be provided upon our request for any of these changes.

Current report

In addition, under Amendment 35 to the Cooperative Agreement, we have agreed to continue to operate the . com gTLD in a content-neutral manner and to work within ICANN processes to promote the development of content-neutral policies for the operation of the DNS. Such policies and processes could expose us to compliance costs and substantial liability and result in costly and time-consuming investigations or litigation.

Current report

Changes or challenges to the pricing provisions in the.com Registry Agreement could have a material adverse impact on our business.

Current report

Under the terms of the.com Registry Agreement, we may increase the annual fee of each.com domain name registration or renewal by up to 7% over the previous year in each of the final four years of each six-year period. We can provide no assurances that we will exercise such right to increase the annual fee. In addition to this contractual right, we are entitled to increase the annual fee of each.com domain name registration or renewal by up to 7% due to the imposition of any new specifications or policies adopted by ICANN pursuant to the procedures set forth in its bylaws and due process (“Consensus Policies”) or to a documented extraordinary expense resulting from an attack or threat of attack on the security and stability of the DNS (an “Extraordinary Expense”). In addition, our ability to increase the price for.com domain name registrations and renewals due to a Consensus Policy or Extraordinary Expense may occur only in years in which we do not increase the price for.com domain name registrations and renewals as described above. It is uncertain whether circumstances would arise that would permit us to take a price increase due to a Consensus Policy or Extraordinary Expense, or if they do, whether we would seek to increase the price for.com domain name registrations for this reason. A failure to seek and obtain a price increase due to a Consensus Policy or Extraordinary Expense, when applicable, could negatively affect our operating results. We also have the right under the Cooperative Agreement to seek the removal of these pricing restrictions on the.com gTLD if we demonstrate to the DOC that market conditions no longer warrant these restrictions. However, we can provide no assurances whether we will seek the removal of these restrictions, or whether the DOC would approve the removal of these restrictions.

Current report

Our.com Registry Agreement, and the Cooperative Agreement, including their pricing provisions, have been challenged, and could face challenges in the future, through publicity campaigns, governmental scrutiny, media interest, legal challenges, or challenges under ICANN’s accountability mechanisms. Such challenges have arisen, and could in the future, arise from trade organizations, the media, registrars, registrants, and others, particularly when these agreements are being renewed. These challenges, if successful, and even when unmeritorious and/or unsuccessful, could have a material adverse effect on our business.

Current report

Government regulation and the application of new and existing laws in the U.S. and internationally may slow business growth, increase our costs of doing business, create potential material liability and could have a material adverse effect on our business.

Current report

Application of new and existing laws and regulations in the U.S. or internationally to the internet, the domain name industry, or us have imposed and may in the future impose new costs and new restrictions on our business. In the U.S., new or modified Executive Orders or legislation involving the internet, cybersecurity, or in other areas could result in new obligations that could negatively impact our business. In addition, laws and regulations, including those designed to restrict who can register and who can distribute domain names or to require registrants to provide additional documentation to register domain names, have, and may in the future, impose significant additional costs on our business and subject us to additional liabilities or could prevent us from operating in certain jurisdictions. For example, the government of China has indicated that it will issue, and has issued, new regulations, and it has begun to enforce existing regulations differently, including by directing certain implementation models for registry services, that impose additional costs on, and risks to, our provision of registry services in China. These regulations are impacting the demand for domain name registrations in China. These regulations require registries, including us, and China-based registrars, to obtain a government-issued license for each gTLD or ccTLD operating in China. Any failure to obtain or renew the required licenses, or to comply with any license requirements or any updates thereto, or any failure to comply with these regulations or directives, by us or our China-based registrars, could result in significant harm to our business in China including the suspension of some or all of our registry services in China.

Current report

We are also subject to changing laws and regulations that impact whether, how, and under what circumstances we may transfer, process and/or receive certain data that is critical to our operations, including data shared between countries or regions in which we operate, and data shared among our products and services. For example, the data transfer frameworks between the U.S. and E.U. have been subject to legal challenges, which has created uncertain legal obligations.

Current report

New laws, regulations, directives or ICANN policies that require us to obtain and maintain personal information of registrants of domain names in the . com and . net gTLDs could impose material compliance costs and could create new, material legal and other risks to our business.

Current report

If we are required to, or choose to, obtain and maintain personal information of registrants of domain names in the . com and . net gTLDs we could be required to incur significant compliance and legal costs as a result of GDPR and other similar regulations. For example, in 2023, the European Union adopted the Network and Information Security Directive (“NIS 2”) that addresses registrant data. Our current obligations do not require us to obtain and maintain personal information of registrants of domain names. Specific E.U. member state implementations of NIS 2 could create uncertainty about, or change, these obligations. Failure to properly protect such information, if obtained, or failure to comply with GDPR or NIS 2, could expose the Company to material costs and penalties. In addition, new obligations to obtain and maintain personal information of registrants in the . com and . net gTLDs could conflict with certain laws and regulations that may require such personal information be maintained solely within the jurisdiction of the data subject. Furthermore, any such new obligations could increase the cost and risks associated with complying with regulations that require verification of registrant personal information, including for purposes of complying with the economic and trade sanctions programs administered by the Office of Foreign Assets Control (“OFAC”), for example.

Current report

Such laws, regulations, directives or ICANN policies, could give rise to significant claims, inquiries, investigations or other actions against us, which could result in significant costs, damages, fines or penalties and could delay the development of new products, change our current business practices, result in negative publicity, or require significant management time and attention, all or any of which could materially harm our business.

Current report — wording carried from elsewhere

See the “Competition” section in Part I, Item 1 of the 2025 Form 10-K for further information.