Guardant Health, Inc.

Our business, financial condition and operating results are affected by a number of factors, whether currently known or unknown, including risks specific to us or the healthcare industry as well as risks that affect businesses in general. In addition to the information set forth in this Quarterly Report on Form 10-Q, you should consider carefully the factors discussed in Part I, Item 1A, “Risk Factors” in our Annual Report on Form 10-K for the fiscal year ended December 31, 2025, filed with the SEC on February 19, 2026. The risks and uncertainties disclosed in such Annual Report and in this Quarterly Report could materially adversely affect our business, financial condition, cash flows or results of operations and thus our stock price.

These risk factors may be important to understanding other statements in this Quarterly Report and should be read in conjunction with the unaudited condensed consolidated financial statements and related notes in Part I, Item 1, “Financial Statements” and Part I, Item 2, “Management’s Discussion and Analysis of Financial Condition and Results of Operations” of this Quarterly Report. Because of such risk factors, as well as other factors affecting our financial condition and operating results, past financial performance should not be considered to be a reliable indicator of future performance, and investors should not use historical trends to anticipate results or trends in future periods.

During the third quarter of fiscal 2026, there were no material changes to our previously disclosed risk factors, other than the following:

Cybersecurity incidents, including attacks facilitated by artificial intelligence, as well as those of our third-party service providers, could compromise sensitive information related to our business, prevent us from accessing it and expose us to substantial liability, which could adversely affect our business and reputation.

We depend on information technology systems for significant elements of our operations, including our laboratory information management system, our computational biology system, our knowledge management system, our customer reporting and our GuardantConnect software platform. Our information technology systems store a wide variety of information critical to our business, including research and development information, patient data, commercial information and business and financial information. Our information technology systems and those of our third-party service providers are vulnerable to cybersecurity incidents, including ransomware, phishing, structured query language injections, social engineering schemes, insider threats, artificial intelligence, or AI, tool supported attacks, and distributed denial-of-service attacks conducted by actors including computer attackers, foreign governments and cyber terrorists, all of which could compromise this information or disrupt our operations. The frequency, intensity, and sophistication of cybersecurity incidents have significantly increased worldwide in recent years, including as a result of the increasing sophistication in the development and use of AI tools.

AI may enable malicious actors to automate attacks, increase their speed, scale and sophistication, and exploit previously unknown or unremediated system vulnerabilities. We expect the use of AI to identify, and potentially exploit, vulnerabilities in information technology systems to become more prevalent. These developments may shorten the time between vulnerability discovery and exploitation and make attacks more difficult to detect and counteract. Because techniques used to obtain unauthorized access or to sabotage systems change frequently and generally are not recognized until launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative measures.

We and certain of our service providers are from time to time subject to cybersecurity incidents. For example, we recently learnedof unauthorized access to our electronic ordering portal, which some physicians use to place test orders, receive and look up results, and other customer facing interfaces. We promptly initiated ourcybersecurity incident response procedures to contain the activity, assess and investigate the nature and scope of the incident and implement appropriate remedial measures. While the full scope of unauthorized access remains under investigation, at this time we believe that an unauthorized party accessed certain patient records. This incident has not materially disrupted our business operations or its ability to serve patients. While we do not believe this or any other cybersecurity incident we’ve experienced is material as of the date of this Quarterly Report on Form 10-Q, future cybersecurity incidents could materially impact our ability to operate our business as well as our results of operations and financial position.

A cybersecurity incident could result in unauthorized access to, disclosure, loss or misuse of sensitive information, interruptions or delays in our services, loss of customers, reputational harm, regulatory investigations or enforcement actions, fines, penalties, litigation and other consequences. Failures or significant downtime of our information technology or telecommunications systems or those used by our third-party service providers could prevent us from performing our comprehensive genomic analysis, preparing and providing reports to pathologists and oncologists, billing payers, processing reimbursement appeals, handling patient or physician inquiries, conducting research and development activities and managing the administrative aspects of our business. Cybersecurity incidents may remain undetected for an extended period, and we can provide no assurance that we or our vendors will be able to detect, prevent or contain the effects of such attacks or other information security risks or threats in the future. As cybersecurity threats evolve, including through the use of AI tools, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities, and these efforts may not be successful. Any of these consequences could adversely affect our business, results of operations and financial position.