Guardant Health, Inc.

Current report

Cybersecurity incidents, including attacks facilitated by artificial intelligence, as well as those of our third-party service providers, could compromise sensitive information related to our business, prevent us from accessing it and expose us to substantial liability, which could adversely affect our business and reputation.

Current report

We depend on information technology systems for significant elements of our operations, including our laboratory information management system, our computational biology system, our knowledge management system, our customer reporting and our GuardantConnect software platform. Our information technology systems store a wide variety of information critical to our business, including research and development information, patient data, commercial information and business and financial information. Our information technology systems and those of our third-party service providers are vulnerable to cybersecurity incidents, including ransomware, phishing, structured query language injections, social engineering schemes, insider threats, artificial intelligence, or AI, tool supported attacks, and distributed denial-of-service attacks conducted by actors including computer attackers, foreign governments and cyber terrorists, all of which could compromise this information or disrupt our operations. The frequency, intensity, and sophistication of cybersecurity incidents have significantly increased worldwide in recent years, including as a result of the increasing sophistication in the development and use of AI tools.

Current report

AI may enable malicious actors to automate attacks, increase their speed, scale and sophistication, and exploit previously unknown or unremediated system vulnerabilities. We expect the use of AI to identify, and potentially exploit, vulnerabilities in information technology systems to become more prevalent. These developments may shorten the time between vulnerability discovery and exploitation and make attacks more difficult to detect and counteract. Because techniques used to obtain unauthorized access or to sabotage systems change frequently and generally are not recognized until launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative measures.

Current report

We and certain of our service providers are from time to time subject to cybersecurity incidents. For example, we recently learnedof unauthorized access to our electronic ordering portal, which some physicians use to place test orders, receive and look up results, and other customer facing interfaces. We promptly initiated ourcybersecurity incident response procedures to contain the activity, assess and investigate the nature and scope of the incident and implement appropriate remedial measures. While the full scope of unauthorized access remains under investigation, at this time we believe that an unauthorized party accessed certain patient records. This incident has not materially disrupted our business operations or its ability to serve patients. While we do not believe this or any other cybersecurity incident we’ve experienced is material as of the date of this Quarterly Report on Form 10-Q, future cybersecurity incidents could materially impact our ability to operate our business as well as our results of operations and financial position.

Current report

A cybersecurity incident could result in unauthorized access to, disclosure, loss or misuse of sensitive information, interruptions or delays in our services, loss of customers, reputational harm, regulatory investigations or enforcement actions, fines, penalties, litigation and other consequences. Failures or significant downtime of our information technology or telecommunications systems or those used by our third-party service providers could prevent us from performing our comprehensive genomic analysis, preparing and providing reports to pathologists and oncologists, billing payers, processing reimbursement appeals, handling patient or physician inquiries, conducting research and development activities and managing the administrative aspects of our business. Cybersecurity incidents may remain undetected for an extended period, and we can provide no assurance that we or our vendors will be able to detect, prevent or contain the effects of such attacks or other information security risks or threats in the future. As cybersecurity threats evolve, including through the use of AI tools, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities, and these efforts may not be successful. Any of these consequences could adversely affect our business, results of operations and financial position.

Current report — wording carried from elsewhere

During the third quarter of fiscal 2026, there were no material changes to our previously disclosed risk factors, other than the following: