Workday, Inc.

Previous wording

We must also continue to retain, develop, and motivate existing employees through our compensation practices, company culture, and career development opportunities. The compensation and incentives we have available to attract, retain, and motivate employees may not meet the expectations of current and prospective employees as the competition for talent intensifies. For example, our equity awards may become less effective if our stock price decreases or increases at a slower rate than our talent competitors. Further, our current and future office environments and hybrid work policy may not meet the expectations of our employees or prospective employees, and may amplify challenges in recruiting and retention. We believe that a critical component of our success has been our corporate culture and core values. As we continue to grow and change, we may find it difficult to maintain our corporate culture among a larger number of employees who are dispersed throughout various geographic regions, including difficulties due to managing the complexities of communicating with all employees. Efforts to restructure our workforce may be disruptive and adversely impact employee morale or our corporate culture. Failure to maintain or adapt our culture could negatively affect our ability to attract new employees or to retain our current employees and our business and future growth prospects could be adversely affected.

Current wording

We must also continue to retain, develop, and motivate existing employees through our compensation practices, company culture, and career development opportunities. The compensation and incentives we provide to attract, retain, and motivate employees may not meet the expectations of current and prospective employees as the competition for talent intensifies, and if our stock price decreases or increases at a slower rate than our talent competitors, our equity awards become less effective. As a part of our annual refresh grant cycle in May 2026, we awarded additional equity grants to our most critical talent to bolster their commitment to our company and to further incentivize their performance towards our goals. Further, our current and future office environments and hybrid work policy may not meet the expectations of our employees or prospective employees, and may amplify challenges in recruiting and retention. We believe that a critical component of our success has been our corporate culture and core values. As we continue to grow and change, we may find it difficult to maintain our corporate culture among a larger number of employees who are dispersed throughout various geographic regions, including difficulties due to managing the complexities of communicating with all employees. Efforts to restructure our workforce may be disruptive and adversely impact employee morale or our corporate culture. Failure to maintain or adapt our culture could negatively affect our ability to attract new employees or to retain our current employees and our business and future growth prospects could be adversely affected.

Previous wording

Developing software applications and related enhancements, features, and modifications, including those involving AI, including generative and agentic AI or other emerging technologies, is expensive, and the investment in product development often involves a long return on investment cycle. We believe that we must continue to dedicate a significant amount of resources to our development efforts to maintain our competitive position. Accelerated application introductions and short application life cycles require high levels of expenditures that could adversely affect our operating results if not offset by revenue increases. However, we may not receive significant revenues from these investments for several years, if at all. If we are unable to provide new features, enhancements to user experience, and modifications in a timely and cost-effective manner that achieve market acceptance, align with customer expectations, and that keep pace with rapid technological developments and changing regulatory landscapes, it may negatively impact our customer renewal rates, limit the market for our solutions, or impair our ability to attract new customers and our business and operating results could be adversely affected. For example, AI is propelling advancements in technology, but if we fail to innovate and keep up with advancements in AI technology, if Workday’s AI-powered solutions, including our current and planned agentic AI solutions, fail to be delivered as planned or at all, fail to operate as expected or to meet customer expectations, if we fail to successfully monetize our AI-powered solutions, or if we do not have sufficient access to development resources and the technologies required to build and improve our applications, our business and reputation may be harmed.

Current wording

Developing software applications and related enhancements, features, and modifications, including those involving AI, including generative and agentic AI or other emerging technologies, is expensive, and the investment in product development often involves a long return on investment cycle. We believe that we must continue to dedicate a significant amount of resources to our development efforts to maintain our competitive position. Accelerated application introductions and short application life cycles require high levels of expenditures that could adversely affect our operating results if not offset by revenue increases. However, we may not receive significant revenues from these investments for several years, if at all. If we are unable to provide new features, enhancements to user experience, and modifications in a timely and cost-effective manner that achieve market acceptance, align with customer expectations, and that keep pace with rapid technological developments and changing regulatory landscapes, it may negatively impact our customer renewal rates, limit the market for our solutions, or impair our ability to attract new customers and our business and operating results could be adversely affected. For example, AI is propelling advancements in technology, but rapid deployment of generative and agentic AI technologies can increase operational, legal, and reputational risks. If we fail to innovate and keep up with advancements in AI technology; if Workday’s AI-powered solutions, including our current and planned agentic AI solutions, fail to be delivered as planned or at all, fail to operate as expected, or fail to meet customer expectations; if our AI solutions generate inaccurate, incomplete, or misleading outputs and if our customers rely on or use such outputs to their detriment; if we fail to successfully monetize our AI-powered solutions; or if we do not have sufficient access to development resources and the technologies required to build and improve our applications, our business and reputation may be harmed.

Previous wording

We continue to seek opportunities to enter into new markets and/or new lines of business, some of which we may have very limited or no experience in. For example, we have and continue to make significant targeted investments in entering the medium-enterprise and U.S. federal government markets and see our success in these markets as key contributors to our future growth. Additionally, we have made and continue to make significant investments in platform offerings and AI, including generative AI and agentic capabilities. As an entrant to new markets and new lines of business, we may not be effective in convincing prospective customers that our solutions will address their needs, and we may not accurately estimate our infrastructure needs, human resource requirements, or operating expenses with regard to these new markets and new lines of business. We may also fail to accurately anticipate adoption rates of these new lines of business or their underlying technology. Also, we may not be able to properly price our solutions in these new markets, which could negatively affect our ability to sell to customers. The markets and monetization strategies for certain of our offerings, including our agentic AI solutions and Workday Data Cloud, remain relatively new and uncertain and as a result, our expansion into such offerings, and related investments, may present additional risks and challenges. For example, we offer certain AI and platform capabilities through a subscription-based flexible pricing model and may increase the number of products through which we do so. We have limited experience with determining optimal pricing under this model and expect a continued need for additional customer education within the sales cycle. Consequently, we may have lower levels of adoption of our AI solutions than we expect, which could negatively impact our business and operating results. Furthermore, customers in these new markets or of the new lines of business may demand more or different features and professional services, which may require us to devote even greater research and development, sales, support, and professional services resources to such customers. If we fail to generate adequate revenues from these new markets and lines of business, or if we fail to do so within the envisioned timeframe, it could have an adverse effect on our business, financial condition, and operating results.

Current wording

We continue to seek opportunities to enter into new markets and/or new lines of business, some of which we may have very limited or no experience in. For example, we have and continue to make significant targeted investments in entering the medium-enterprise and U.S. federal government markets and see our success in these markets as key contributors to our future growth. Additionally, we have made and continue to make significant investments in platform offerings and AI, including generative AI and agentic capabilities. As an entrant to new markets and new lines of business, we may not be effective in convincing prospective customers that our solutions will address their needs, and we may not accurately estimate our infrastructure needs, human resource requirements, or operating expenses with regard to these new markets and new lines of business. We may also fail to accurately anticipate adoption rates of these new lines of business or their underlying technology. Also, we may not be able to properly price our solutions in these new markets, which could negatively affect our ability to sell to customers. The markets and monetization strategies for certain of our offerings, including our agentic AI solutions and Workday Data Cloud, remain relatively new and uncertain and as a result, our expansion into such offerings, and related investments, may present additional risks and challenges. For example, we offer certain AI and platform capabilities through a subscription-based flexible pricing model and may increase the number of products through which we do so. Our success is dependent on our ability to determine optimal pricing under this model, our ability to educate customers and effectively market and sell our AI solutions, the level of adoption and usage of our AI solutions by our customers, and our costs to deliver these solutions. Furthermore, customers in these new markets or of the new lines of business may demand more or different features and professional services, which may require us to devote even greater research and development, sales, support, and professional services resources to such customers. If we fail to generate adequate revenues from these new markets and lines of business, or if we fail to do so within the envisioned timeframe, it could have an adverse effect on our business, financial condition, and operating results.

Previous wording

•lack of experience in new markets, products, or technologies;

Current wording

•lack of experience in new geographies, markets, products, or technologies;

Previous wording

Our applications involve the storage and transmission of our customers’ and other users’ sensitive and proprietary information, including personal or identifying information regarding our customers, their employees, job candidates, customers, prospects, and suppliers, as well as financial, accounting, health, and payroll data. Additionally, our operations and the availability of the services we provide also depend on our information technology systems. As a result, a compromise of our applications or systems, or unauthorized access to, acquisition, use, tampering, release, alteration, theft, loss, or destruction of sensitive data, or unavailability of data or our applications, has and could disrupt our operations or impact the availability or performance of our applications; expose us and our customers to regulatory obligations and enforcement actions, litigation, investigations, remediation and indemnity obligations, or supplemental disclosure obligations; damage our reputation and brand; or result in loss of customer, consumer, and partner confidence in the security of our applications, an increase in our insurance premiums, suspension or loss of authorization under the Federal Risk and Authorization Management Program (“FedRAMP”) or other authorizations, impairment to our business, and other potential liabilities or related fees, expenses, or loss of revenues.

Current wording

Our applications involve the storage and transmission of our customers’ and other users’ sensitive and proprietary information, including personal or identifying information regarding our customers, their employees, job candidates, customers, prospects, and suppliers, as well as financial, accounting, health, and payroll data. Additionally, our operations and the availability of the services we provide also depend on our information technology systems. As a result, a compromise of our applications or systems, or unauthorized access to, acquisition, use, tampering, release, alteration, theft, loss, or destruction of sensitive data, or unavailability of data or our applications, has and could disrupt our operations or impact the availability or performance of our applications; expose us and our customers to regulatory obligations and enforcement actions, litigation, investigations, remediation and indemnity obligations, or supplemental disclosure obligations; damage our reputation and brand; result in loss of customer, consumer, and partner confidence in the security of our applications; result in an increase in our insurance premiums, suspension or loss of authorization under the Federal Risk and Authorization Management Program (“FedRAMP”) or other authorizations; impair our competitive position; and result in other potential liabilities or related fees, expenses, or loss of revenues, any of which could adversely affect our business and operating results.

Previous wording

The financial and personnel resources we employ to implement and maintain security measures, including our information security risk insurance policy, may not be sufficient to address our security needs. The security measures we have in place vary in maturity across the organization and may not be sufficient to protect against security risks, preserve our operations and services and the integrity of customer and personal information, and prevent data loss, misappropriation, and other security breaches. Our logging may not be and has not been sufficient to fully investigate the scope of an incident. Our information systems have been and may in the future be compromised by computer hackers, employees, contractors, or vendors, as well as software bugs, human error, technical malfunctions, or other malfeasance.

Current wording

In the normal course of business, we are and have been the target of malicious cyber-attack attempts and have experienced and may in the future experience other security events, including the compromise of our information systems by computer hackers, employees, contractors, or vendors, as well as those involving attempts to exploit vulnerabilities in third-party technologies or services on which we rely and those involving software bugs, human error, technical malfunctions, or other malfeasance. The financial and personnel resources we employ to implement and maintain security measures, including our information security risk insurance policy, may not be sufficient to address our security needs. The security measures we have in place vary in maturity across the organization and may not be sufficient to protect against security risks, preserve our operations and services and the integrity of customer and personal information, and prevent data loss, misappropriation, and other security breaches. Our logging may not be and has not been sufficient to fully investigate the scope of an incident.

Previous wording

Cybersecurity threats and attacks are often targeted at companies such as ours and may take a variety of forms ranging from individuals or groups of security researchers, including those who appear to offer a solution to a vulnerability in exchange for some compensation, and insiders, to sophisticated hacker organizations, including state-sponsored actors who may launch coordinated attacks, or attacks motivated by the type of data that is processed by our customers, including our public sector customers, on our platform. These threats may be directed not only at us, but also at third parties in our supply chain, including cloud service providers, software vendors, open-source software maintainers, and other service providers or partners whose products or services are integrated with or support our platform and solutions. In the normal course of business, we are and have been the target of malicious cyber-attack attempts and have experienced other security events, including those involving attempts to exploit vulnerabilities in third-party technologies or services on which we rely. As our market presence grows and as our ecosystem of partners, integrations, and service providers expands, we face increased risks of cybersecurity attack or other security threats, including supply chain attacks. Additionally, as AI technologies, including generative AI models, develop rapidly, threat actors are using these technologies to create sophisticated new attack methods that are increasingly automated, targeted, and coordinated and more difficult to defend against. Threat actors may also target our AI models in ways that we cannot yet anticipate. Examples of key cybersecurity risks include viruses, worms, ransomware, and other malicious software programs, along with social engineering attacks, fraud, credential theft or abuse, exploitation of software bugs or other defects, targeted attacks against cloud services and other hosted software, and exploitation of unmanaged software or systems, any of which can result in a compromise of our applications or systems and the data we store or process, and can result in disclosure of Workday confidential information and intellectual property, production downtimes, reputational harm, and an increase in costs to the business. For example, in August 2025, we were targeted as part of a social engineering campaign against many large organizations, resulting in unauthorized access to some of our internal systems including some commonly available business contact information in our third-party customer relationship management platform. As the techniques used to obtain unauthorized access or sabotage systems change frequently, are becoming increasingly sophisticated and complex, and often are not identified until they are launched against a target, and because evidence of unauthorized activity may not have been captured or retained, or may be proactively destroyed by unauthorized actors, we may be unable to anticipate or timel…

Excerpt shortened here; the source contains the full paragraph.

Current wording

Cybersecurity threats and attacks are often targeted at companies such as ours and may take a variety of forms ranging from individuals or groups of security researchers, to insiders, to sophisticated hacker organizations, including state-sponsored actors and financially motivated actors. These threats may be directed at us or at third parties in our supply chain, including cloud service providers, software vendors, open-source software maintainers, and other service providers or partners whose products or services are integrated with or support our platform and solutions. As our market presence grows and as our ecosystem of partners, integrations, and service providers expands, we face increased risks of cybersecurity attack or other security threats, including supply chain attacks. Additionally, as AI technologies, including generative AI models, develop rapidly, threat actors are using these technologies to create sophisticated new attack methods that are increasingly automated, targeted, damaging, and more difficult to defend against. Threat actors may also target our AI models and related infrastructure in ways that we cannot yet anticipate. Further, remote work and resource access, including our hybrid work model, has and may continue to result in an increased risk of cybersecurity-related events, including phishing and other social engineering attacks, exploitation of any cybersecurity flaws that may exist, an increase in the number cybersecurity threats or attacks, and other security challenges as a result of our employees and our service providers continuing to work remotely from non-corporate managed networks. Examples of key cybersecurity risks include viruses, worms, ransomware, and other malicious software programs, along with social engineering attacks, fraud, credential theft or abuse, exploitation of software bugs or other defects, targeted attacks against cloud services and other hosted software, and exploitation of unmanaged software or systems. As the techniques used to obtain unauthorized access or sabotage systems change frequently, are becoming increasingly sophisticated and complex, and often are not identified until they are launched against a target, and because evidence of unauthorized activity may not have been captured or retained, or may be proactively destroyed by unauthorized actors, we may be unable to anticipate or timely detect these attacks, assess the true impact they may have on our business and operations, or to implement adequate preventative measures. Any cyber-attacks and other security events may have a significant or material impact on our business and operating results.

Previous wording

Furthermore, we have acquired or partnered with a number of companies, products, services, and technologies over the years, and incorporated third-party products, services, and technologies into our own products and services. Addressing security issues associated with acquisitions, partnerships, incorporated technologies, and our supply chain requires significant resources, and we have inherited and may in the future inherit additional risks upon integration with or use by Workday. In addition, if a high-profile security breach occurs with respect to an industry peer, our customers and potential customers may generally lose trust in the security of financial management, spend management, human capital management, planning, or analytics applications, or in cloud applications for enterprises in general. Any or all of these issues could negatively affect our ability to attract new customers, cause existing customers to elect to terminate or not renew their subscriptions, result in reputational damage, cause us to pay remediation and indemnity costs and/or issue service credits or refunds to customers for prepaid and unused subscription services, or result in lawsuits, regulatory fines, or other action or liabilities, any of which could adversely affect our business and operating results.

Current wording

Furthermore, we have acquired or partnered with a number of companies, products, services, and technologies over the years, and incorporated third-party products, services, and technologies into our own products and services. Addressing security issues associated with acquisitions, partnerships, incorporated technologies, and our supply chain requires significant resources, and we have inherited and may in the future inherit additional risks upon integration with or use by Workday. In addition, if a high-profile security breach occurs with respect to an industry peer, our customers and potential customers may generally lose trust in the security of financial management, spend management, human capital management, planning, or analytics applications, or in cloud applications for enterprises in general.

Previous wording

We rely on sophisticated information systems and technology, including those provided by third parties, for the secure collection, processing, transmission, and storage of confidential, proprietary, and personal information, and to support our business operations and the availability of our applications. In the past several years, supply chain attacks have increased in frequency and severity. As we are both a provider and consumer of information systems and technology, we are at higher risk of being impacted either directly or indirectly by these attacks. The control systems, cybersecurity program, infrastructure, physical facilities of, and personnel associated with third parties that we rely on or partner with are beyond our control. Our customers may authorize third-party technology providers to access their customer data and any unauthorized use of the third-party technology may result in unauthorized access to such data. The audits we periodically conduct of some of our third-party vendors do not guarantee the security of and may be unable to prevent security events impacting the information technology systems of third parties that are part of our supply chain or that provide valuable services to us, which have resulted and could result in the unauthorized access to data of Workday, our employees, our customers, our third-party partners, or other end users; acquisition, destruction, alteration, use, tampering, release, unavailability, theft or loss of confidential, proprietary, or personal data of Workday, our employees, our customers, our third-party partners, or other end users; or the disruption of our operations and our ability to conduct our business or the availability of our applications; or could otherwise adversely affect our business, financial condition, operating results, or reputation.

Current wording

We rely on sophisticated information systems and technology, including those provided by third parties, for the secure collection, processing, transmission, and storage of confidential, proprietary, and personal information, and to support our business operations and the availability of our applications. In the past several years, supply chain attacks have increased in frequency and severity. As we are both a provider and consumer of information systems and technology, we are at higher risk of being impacted either directly or indirectly by these attacks. The control systems, cybersecurity program, infrastructure, physical facilities of, and personnel associated with third parties that we rely on or partner with are beyond our control. Our customers may authorize third-party technology providers to access their customer data and any unauthorized use of the third-party technology may result in unauthorized access to such data. The audits we periodically conduct of some of our third-party vendors are unable to prevent security events impacting the information technology systems of third parties we rely on.

Previous wording

Legal requirements related to collecting, storing, handling, retaining, and transferring (collectively, “processing”) personal data are rapidly evolving at both the national and international level in ways that require our business to adapt to comply with applicable laws and support customer compliance. As the complexity of our products grows, the regulatory focus on privacy intensifies worldwide, and jurisdictions increasingly consider and adopt privacy laws, the risks related to our business’s processing of personal data also grow. In addition, possible adverse interpretations of existing privacy-related laws and regulations by regulators in jurisdictions where our customers operate, as well as the potential adoption of new privacy-related requirements, could impose significant obligations affecting our business or prevent us from offering certain services in jurisdictions where we operate.

Current wording

Legal requirements related to collecting, storing, handling, retaining, and transferring (collectively, “processing”) personal data are rapidly evolving at both the national and international level in ways that require our business to adapt to comply with applicable laws and support customer compliance. As the complexity of our products grows, the regulatory focus on privacy intensifies worldwide, and jurisdictions increasingly consider and adopt privacy laws, the risks related to our business’s processing of personal data also grow. The volume and complexity of these regulatory requirements may continue to increase, including in response to heightened geopolitical tensions and the rapid adoption of AI technologies. In addition, possible adverse interpretations of existing privacy-related laws and regulations by regulators in jurisdictions where our customers operate, as well as the potential adoption of new privacy-related requirements, could impose significant obligations affecting our business or prevent us from offering certain services in jurisdictions where we operate.

Previous wording

The global data privacy compliance landscape continues to become increasingly complex, fragmented, and financially relevant to business operations. As a result, our data processing creates current and prospective risks related to increased regulatory compliance costs, government enforcement actions and/or financial penalties for non-compliance, and reputational harm. For example, the EU-U.S. Data Privacy Framework (“DPF”) is in place under which EU data can legally be transferred to the U.S. However, it is facing legal challenges. As legal challenges to the DPF remain unresolved, uncertainty may continue regarding the legal requirements for transferring personal data from Europe, an integral aspect of our business that remains governed by, and subject to, General Data Protection Regulation (“GDPR”) requirements. Failure to comply with the GDPR data processing requirements by either ourselves or our subprocessors could lead to regulatory enforcement actions, which can result in monetary penalties of up to 4% of worldwide revenue, private lawsuits, reputational damage, and loss of customers. Other EU laws, including the EU Data Act, which primarily governs access to and use of non-personal data generated by digital services, have been, and may continue to be implemented, interpreted, and enforced in ways that impose additional rules and restrictions on the deployment, operation, or use of our products and services and may require us to adapt our business practices or contractual arrangements to comply with such requirements. Other countries such as Russia, China, Vietnam, and India have also passed or are in the process of passing laws imposing new requirements, including requirements related to consent and varying degrees of restrictive data residency or localization.

Current wording

The global privacy and data protection compliance landscape continues to become increasingly complex, fragmented, and financially relevant to business operations. As a result, our data processing creates current and prospective risks related to increased regulatory compliance costs, government enforcement actions and/or financial penalties for non-compliance, and reputational harm. For example, the EU-U.S. Data Privacy Framework (“DPF”) is in place and provides one method under which EU data can legally be transferred to the U.S. However, it is facing legal challenges. As legal challenges to the DPF remain unresolved, uncertainty may continue regarding the legal requirements for transferring personal data from Europe, an integral aspect of our business that remains governed by, and subject to, General Data Protection Regulation (“GDPR”) requirements. Gaps in compliance with the GDPR data processing requirements by either ourselves or our subprocessors could lead to regulatory enforcement actions, which can result in monetary penalties of up to 4% of worldwide revenue, private lawsuits, reputational damage, and loss of customers. Other EU laws, including the EU Data Act, which primarily governs access to and use of non-personal data generated by digital services, have been, and may continue to be implemented, interpreted, and enforced in ways that impose additional rules and restrictions on the deployment, operation, or use of our products and services and may require us to adapt our business practices or contractual arrangements to comply with such requirements. In addition, potential changes to the laws and regulations that relate to the processing of personal data, including legislative proposals pending in the EU and elsewhere, may change the scope or timing of our compliance obligations. Other countries such as Russia, China, Vietnam, and India have also passed or are in the process of passing laws imposing new requirements, including requirements related to consent and varying degrees of restrictive data residency or localization.

Previous wording

Regulatory developments in the U.S. present additional risks. For example, the California Consumer Privacy Act (“CCPA”) took effect on January 1, 2020, and the California Privacy Rights Act (“CPRA”), which expands upon the CCPA, came into effect on January 1, 2023. The CCPA and CPRA give California consumers, including employees, certain rights similar to those provided by the GDPR, and also provide for statutory damages or fines on a per violation basis that could be very large depending on the severity of the violation. In addition, numerous states have enacted, or are considering, comprehensive privacy laws and other laws that touch on the processing of personal data in specific contexts, including in connection with artificial intelligence and automated systems, further contributing to a fragmented and evolving regulatory landscape that has and may continue to create compliance challenges.

Current wording

Other regulatory developments in the U.S. present additional risks. For example, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives California consumers, including employees, certain rights similar to those provided by the GDPR, and also provide for statutory damages or fines on a per violation basis that could be very large depending on the regulator's assessed severity of the violation. In addition, numerous states have enacted, or are considering, comprehensive privacy laws and other laws that touch on the processing of personal data in specific contexts, including in connection with AI and automated systems. Certain of these laws and related regulations, including those governing the use of automated decision-making technologies in employment and other consequential decisions, have recently taken effect or will take effect in the near term, further contributing to a fragmented and evolving regulatory landscape that has and may continue to create compliance challenges.

Previous wording

Furthermore, the U.S. Congress is considering numerous privacy bills, and the U.S. Federal Trade Commission continues to bring enforcement actions for unfair or deceptive data protection practices and may undertake its own privacy-related rulemaking. In addition to government activity, privacy advocacy and other industry groups have established or may establish various new, additional, or different self-regulatory standards that customers may require us to adhere to, which may place additional burdens on us. Increasing sensitivity of individuals to the unauthorized processing of personal data, whether real or perceived, and an increasingly uncertain trust climate has and may continue to create negative public reaction to technologies, products, and services such as ours or otherwise expose us to liability.

Current wording

Furthermore, the U.S. Congress has considered, and may in the future adopt, federal privacy-related legislation and data regulation, and regulators, including the U.S. Federal Trade Commission, have brought and continue to bring enforcement actions related to data protection practices and may undertake its own privacy-related rulemaking. In addition to government activity, privacy advocacy and other industry groups have established or may establish various new, additional, or different self-regulatory standards that customers may require us to adhere to, which may place additional burdens on us. Increasing sensitivity of individuals to the unauthorized processing of personal data, whether real or perceived, and an increasingly uncertain trust climate has and may continue to create negative public reaction to technologies, products, and services such as ours or otherwise expose us to liability.

Previous wording

Taken together, the costs of compliance with and other obligations imposed by data protection laws and regulations have and may continue to require modification of our services and operations, limit use or adoption of our services, slow the pace at which we close sales transactions, or otherwise adversely affect our business. In addition, data protection laws, regulations and related enforcement activities may lead to significant fines, penalties, or liabilities for noncompliance. These requirements may impact how personal data must be stored, accessed, and deleted within the products and services and impose certain limitations on how it may be used or shared. Further, the perception of privacy concerns, whether or not valid, may inhibit the adoption, effectiveness, or use of our applications or otherwise impact our business. Compliance with applicable laws and regulations regarding personal data may require changes in services, business practices, or internal systems that result in increased costs, lower revenue, reduced efficiency, or greater difficulty competing with foreign-based firms which could adversely affect our business and operating results.

Current wording

Taken together, the costs of compliance with and other obligations imposed by privacy and data protection laws and regulations have and may continue to require modification of our services and operations, limit use or adoption of our services, slow the pace at which we close sales transactions, or otherwise adversely affect our business. In addition, privacy and data protection laws, regulations and related enforcement activities may lead to significant fines, penalties, or liabilities for noncompliance. These requirements may impact how personal data must be stored, accessed, and deleted within the products and services and impose certain limitations on how it may be used or shared. Further, the perception of privacy concerns, whether or not valid, may inhibit the adoption, effectiveness, or use of our applications or otherwise impact our business. Compliance with applicable laws and regulations regarding personal data may require changes in services, business practices, or internal systems that result in increased costs, lower revenue, reduced efficiency, or greater difficulty competing with foreign-based firms which could adversely affect our business and operating results.

Previous wording

Our typical sales cycles for many new customers are six to twelve months but can extend for eighteen months or more, and we expect that this lengthy sales cycle may continue or expand as customers increasingly adopt applications across our platform. We have seen and may continue to see instances of increased scrutiny from existing and prospective customers and the lengthening of certain sales cycles. Longer sales cycles could cause our operating and financial results to suffer in a given period. Accordingly, the effect of significant downturns in sales and market acceptance of new applications, as well as potential changes in our pricing policies or rate of renewals, may not be fully reflected in our operating results until future periods. Additionally, we may be unable to adjust our cost structure to reflect any such changes in revenues. As a result, increased growth in the number of our customers could result in our recognition of more costs than revenues in the earlier periods of the terms of our agreements. Our subscription model also makes it difficult for us to rapidly increase our revenues through additional sales in any period, as subscription services revenues from new customers generally are recognized over the applicable subscription term. Furthermore, our subscription-based model is largely based on the size of our customers’ employee headcount. Therefore, the addition or loss of employees by our customers, including any significant reductions in force by our customers, or customer insolvencies resulting from severe economic hardship, can and has had an impact on our subscription services revenues. Prolonged decreases in our customers’ headcounts can materially impact our business and operating results in any given period.

Current wording

Our typical sales cycles for many new customers are six to twelve months but can extend for eighteen months or more, and we expect that this lengthy sales cycle may continue or expand as customers increasingly adopt applications across our platform. We have seen and may continue to see instances of increased scrutiny from existing and prospective customers and the lengthening of certain sales cycles. For example, we have recently experienced lengthening of certain sales cycles, particularly within net new opportunities. The extended sales cycles are particularly evident in the government, higher education, and healthcare industries which are tied to federal funding. Longer sales cycles could cause our operating and financial results to suffer in a given period. Accordingly, the effect of significant downturns in sales and market acceptance of new applications, as well as potential changes in our pricing policies or rate of renewals, may not be fully reflected in our operating results until future periods. Additionally, we may be unable to adjust our cost structure to reflect any such changes in revenues. As a result, increased growth in the number of our customers could result in our recognition of more costs than revenues in the earlier periods of the terms of our agreements. Our subscription model also makes it difficult for us to rapidly increase our revenues through additional sales in any period, as subscription services revenues from new customers generally are recognized over the applicable subscription term. Furthermore, our subscription-based model is largely based on the size of our customers’ employee headcount. Therefore, the addition or loss of employees by our customers, including any significant reductions in force by our customers, or customer insolvencies resulting from severe economic hardship, can and has had an impact on our subscription services revenues. Prolonged decreases in our customers’ headcounts can materially impact our business and operating results in any given period.

Previous wording

As of April 30, 2026, our Co-Founder and CEO Emeritus, David Duffield, together with his affiliates, held voting rights with respect to approximately 38 million shares of Class B common stock and 0.1 million shares of Class A common stock. As of April 30, 2026, our Co-Founder, CEO, and Chair of our Board of Directors, Aneel Bhusri, together with his affiliates, held voting rights with respect to approximately 8 million shares of Class B common stock and 0.4 million shares of Class A common stock. In addition, Mr. Bhusri held unvested equity awards representing approximately 1 million shares of Class A common stock. Further, Messrs. Duffield and Bhusri have entered into a voting agreement under which each has granted a voting proxy with respect to certain Class B common stock beneficially owned by him effective upon his death or incapacity as described in our registration statement on Form S-1 filed in connection with our IPO. Messrs. Duffield and Bhusri have each initially designated the other as their respective proxies. Accordingly, upon the death or incapacity of either Mr. Duffield or Mr. Bhusri, the other would individually continue to control the voting of shares subject to the voting proxy. Collectively, the shares described above represent a substantial majority of the voting power of our outstanding capital stock. As a result, Messrs. Duffield and Bhusri have the ability to control the outcome of matters submitted to our stockholders for approval, including the election of directors and any merger, consolidation, or sale of all or substantially all of our assets. As stockholders, even as controlling stockholders, they are entitled to vote their shares in their own interests, which may not always be in the interests of our stockholders generally.

Current wording

As of July 31, 2026, our Co-Founder and CEO Emeritus, David Duffield, together with his affiliates, held voting rights with respect to approximately 36 million shares of Class B common stock and 0.1 million shares of Class A common stock. As of July 31, 2026, our Co-Founder, CEO, and Chair of our Board of Directors, Aneel Bhusri, together with his affiliates, held voting rights with respect to approximately 8 million shares of Class B common stock and 0.5 million shares of Class A common stock. In addition, Mr. Bhusri held unvested equity awards representing approximately 1.1 million shares of Class A common stock. Further, Messrs. Duffield and Bhusri have entered into a voting agreement under which each has granted a voting proxy with respect to certain Class B common stock beneficially owned by him effective upon his death or incapacity as described in our registration statement on Form S-1 filed in connection with our IPO. Messrs. Duffield and Bhusri have each initially designated the other as their respective proxies. Accordingly, upon the death or incapacity of either Mr. Duffield or Mr. Bhusri, the other would individually continue to control the voting of shares subject to the voting proxy. Collectively, the shares described above represent a substantial majority of the voting power of our outstanding capital stock. As a result, Messrs. Duffield and Bhusri have the ability to control the outcome of matters submitted to our stockholders for approval, including the election of directors and any merger, consolidation, or sale of all or substantially all of our assets. As stockholders, even as controlling stockholders, they are entitled to vote their shares in their own interests, which may not always be in the interests of our stockholders generally.

Previous wording

(2)In September 2025, our Board of Directors authorized the repurchase of up to $4.0 billion of our outstanding shares of Class A common stock. For further information, see Note 13, Stockholders’ Equity, of the Notes to Condensed Consolidated Financial Statements included in Part I, Item 1 of this report.

Current wording

(2)In September 2025, our Board of Directors authorized the repurchase of up to $4.0 billion of our outstanding shares of Class A common stock. As of July 31, 2026, this share repurchase program was fully completed with no authorization remaining. For further information, see Note 13, Stockholders’ Equity, of the Notes to Condensed Consolidated Financial Statements included in Part I, Item 1 of this report.