Quiver Quantitative

Risk Factors Dashboard

Once a year, publicly traded companies issue a comprehensive report of their business, called a 10-K. A component mandated in the 10-K is the ‘Risk Factors’ section, where companies disclose any major potential risks that they may face. This dashboard highlights all major changes and additions in new 10K reports, allowing investors to quickly identify new potential risks and opportunities.

View risk factors by ticker

Search filings by term

Risk Factors - NOW

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing

ITEM 1A.RISK FACTORSInvesting in our securities involves risks. You should carefully consider the risks and uncertainties under “Risk Factors Summary” and the more detailed descriptions immediately following the summary, together with all of the other information in this Annual Report on Form 10-K, including our consolidated financial statements and related notes, before making an investment decision. The risks and uncertainties described below are not the only ones we face. The occurrence of any of the following risks or additional risks and uncertainties not presently known to us or that we currently believe to be immaterial could materially and adversely affect our business, financial condition or results of operations. Many risks affect more than one category, and the risks are not in order of significance or probability of occurrence because they have been grouped by categories. Our stock price could decline due to any of these risks.

Risk Factors Summary

This summary of risks below is intended to provide an overview of the risks we face and should not be considered a substitute for the more fulsome risk factors discussed immediately following this summary.

•Risks Related to Our Ability to Grow Our Business

•Laws, regulations and customer expectations regarding the use, storage and movement of data may restrict our ability to continue to optimize our platform and adversely affect our business.

•We participate in intensely competitive markets, and if we do not compete effectively, our business and operating results will be harmed.

•If we fail to innovate in response to rapidly evolving technological and market developments and customer needs, our competitive position and business prospects may be harmed.

•If we are unsuccessful in increasing our penetration of international markets or managing the risks associated with foreign markets, our business and operating results will be adversely affected.

•We rely on our network of partners for an increasing portion of our revenues, and if these partners fail to perform, our ability to sell and distribute our products may be impacted, and our operating results and growth rate may be harmed.

•Doing business with the public sector and heavily-regulated organizations subjects us to risks related to government procurement processes, regulations, and contracting requirements.

•

•Delays in the release of, or actual or perceived defects in, our products may slow the adoption of our latest technologies, reduce our ability to efficiently provide services, decrease customer satisfaction, and adversely impact future product sales.

•As more of our sales efforts are targeted at larger enterprise customers, our sales cycle may become longer and more expensive and we may encounter pricing pressure and implementation and configuration challenges.

•As we acquire or invest in companies and technologies, we may not realize the expected business or financial benefits and the acquisitions and investments may divert our management’s attention and result in additional shareholder dilution.

•Risks Related to the Operation of Our Business

•If we or our third-party service providers experience an actual or perceived cybersecurity event, our platform may be perceived as not being secure, and we may lose customers or incur significant liabilities, which would harm our business and operating results.

•

•Disruptions or defects in our services could damage our customers’ businesses, subject us to substantial liability and harm our reputation and financial results.

•Lawsuits against us by third parties that allege we infringe their intellectual property rights could harm our business and operating results.

•Our intellectual property protections may not provide us with a competitive advantage, and defending our intellectual property may result in substantial expenses that harm our operating results.

•Our use of open source software could harm our ability to sell our products and services and subject us to possible litigation.

•Various factors, including our customers’ business, integration, migration, compliance and security requirements, or errors by us, our partners, or our customers, may cause implementations of our products to be delayed, inefficient or otherwise unsuccessful.

•Natural disasters, including climate change, and other events beyond our control could harm our business.

Table of Contents

•Risks Related to the Financial Performance or Financial Position of Our Business

•Our operating results may vary significantly from period to period, and if we fail to meet the financial performance expectations of investors or securities analysts, the price of our common stock could decline substantially.

•Because we generally recognize revenues from our subscription service over the subscription term, a decrease in new subscriptions or renewals during a reporting period may not be immediately reflected in our operating results for that period.

•

•Changes in our effective tax rate or disallowance of our tax positions may adversely affect our financial position and results.

•Our debt service obligations may adversely affect our financial condition and cash flows from operations.

•Risks Related to General Economic Conditions

•Global economic conditions may harm our industry, business and results of operations.

•Foreign currency exchange rate fluctuations could harm our financial results.

•Risks Related to Ownership of Our Common Stock

•Our stock price is likely to continue to be volatile and could subject us to litigation.

•

Risks Related to Our Ability to Grow Our Business

Laws, regulations and customer expectations regarding the use, storage and movement of data may restrict our ability to continue to optimize our platform and adversely affect our business.

As a cloud-based service provider, we optimize performance of our products and services by utilizing data centers located in, and support provided from, different jurisdictions. As we continue to innovate and improve the offerings on our platform, we leverage machine learning and AI to create more efficient and effective workflows for our customers. Such changes may restrict our ability to use, store or otherwise process data of our customers in connection with providing and supporting our services. In some cases, this could impact our ability to offer our services in certain locations or our customers’ ability to deploy our services globally.

Existing and upcoming laws and regulations globally, including European and state specific privacy laws in the United States (“U.S.”), global trends to regulate the use of AI and machine learning, the ruling of the European Court of Justice in Schrems v. While a new Privacy Shield has been proposed to permit the transfer of data between the U.S. and the European Union, the timing and precise requirements of the Privacy Shield are uncertain, as is the possibility that any agreement would be challenged in court. This offering required a significant investment in financial and human resources, and we may see similar requests for local solutions in other territories.

Changes in our developed or acquired products and how such products utilize data could also alter or increase our compliance requirements. As a result, our innovation and business drivers in developing or acquiring new and emerging technologies and the demand for our products could be impacted.

Table of Contents

We participate in intensely competitive markets, and if we do not compete effectively, our business and operating results will be harmed.

The markets for our enterprise cloud solutions are rapidly evolving and highly competitive, with relatively low barriers to entry. As the market for digital workflow products and offerings matures and new technologies, in-house solutions and competitors enter the market, we find ourselves increasingly competing with solutions and alternative approaches to solving customer needs or experiencing reluctance or unwillingness from customers to migrate away from their current solutions. For example, while the Now Platform was designed to quickly integrate with and offers solutions that are complementary to the offerings of many well-established systems traditionally operating as “systems of record,” competition from those companies has been increasing. Additionally, sources of alternative solutions and approaches include those provided by:

•enterprise application software vendors, such as Oracle, SAP, Salesforce and Workday;

•new technology vendors and entrants;

•in-house solutions of current and prospective customers; and

•cloud-based vendors.

Some of our existing competitors and potential competitors are larger and have greater name recognition and scale, longer operating histories, more established customer relationships, larger marketing budgets and greater financial and technical resources than we do. Competitors and new entrants may be able to respond more quickly and effectively to new or changing opportunities, technologies, standards, customer requirements and buying practices. They may introduce new technology, solve similar problems in different ways or more effectively utilize existing technology that reduces demand for our services. They may utilize acquisitions, integrations or consolidations to offer integrated or bundled products, enhanced functionality or other advantages. “Systems of record” operators may attempt to create technology solutions that would prevent our systems from integrating with theirs. Enterprise software application vendors may reduce the price of or offer free-of-charge competing products, services or subscriptions creating pricing pressures, or bundle them with their other offerings causing our offerings to appear relatively more expensive. Smaller competitors, new technology vendors and new entrants may also accelerate pricing pressures in the various markets in which we compete.

Additionally, companies may expand their services to compete with our services, or we may shift our products and services to compete with current and future competitors in adjacent markets. We have expanded and expect to continue to expand the breadth of our services to include offerings in new markets and industries, the use of our platform by developers and generally in low-code/no-code capabilities. As a result, we expect increasing competition from companies focused on these other areas. If we are not able to compete successfully, we could experience reduced sales and margins, losses or failure of our products to achieve or maintain market acceptance, any of which could harm our business.

If we fail to innovate in response to rapidly evolving technological and market developments and customer needs, our competitive position and business prospects may be harmed.

We compete in markets that continue to evolve rapidly. Accordingly, to compete effectively, we must:

•identify and innovate in the right emerging technologies;

•keep pace with rapidly changing technological developments, such as AI, that may disrupt the enterprise software marketplace;

•accurately predict our customers’ changing digital transformation needs, priorities and adoption practices, including their technology infrastructures and buying and budgetary practices;

•invest in and continually optimize our own technology platform so that we continue to meet the very high-performance expectations of our customers;

•successfully deliver new, scalable platform and database technologies and products to meet customer needs and priorities;

•efficiently integrate with other technologies within our customers’ digital environments;

•expand our offerings into industries and to buyers who are not familiar with our offerings;

•profitably market and sell products to companies in markets where our sales and marketing teams have less experience;

•successfully adapt new pricing models;

Table of Contents

•effectively secure our platform, data and customers’ data, and

•effectively deliver, directly or through our partner ecosystem, the digital transformation process planning, IT systems architecture planning, and product implementation services that our customers require to be successful.

If we fail to meet any of these requirements, our competitive position, strategic relevance and business prospects may be harmed. Customers may be dissatisfied with the change in the manner and scope of how the services are delivered and the resulting change in the pricing model and may resist or be slow to adopt changes to our offerings, all of which may adversely impact our ability to compete.

If we are unsuccessful in increasing our penetration of international markets or managing the risks associated with foreign markets, our business and operating results will be adversely affected.

Sales outside of North America represented 35% and 36% of our total revenues for the years ended December 31, 2022 and 2021, respectively. The growth of our business and future prospects depend on our ability to increase our sales outside the U.S. as a percentage of our total revenues. Additionally, operating in international markets requires significant investment and management attention and subjects us to different regulatory, political and economic risks from those in the U.S. We have made, and will continue to make, substantial investments in data centers, geographic specific service delivery models, advisory councils, cloud computing infrastructure, sales, marketing, partnership arrangements, personnel and facilities as we enter and expand in new geographic markets. When we make these investments, it is typically unclear whether, and when, sales in the new market will justify our investments. Our rate of acquisition of new large enterprise customers, a factor affecting our growth, has been generally lower in territories where we are less established and where there may be increased or changing regulations and operational and IP risks, as compared to our more established locations. Risks inherent with making our products and services available in international markets include, for example:

•compliance with multiple, conflicting and changing governmental laws and regulations, including with respect to employment, tax, competition, COVID-19 and ESG matters;

•requirements to have local partner(s), local entity ownership limitations or technology transfer or sharing requirements, or to comply with data residency and transfer laws and regulations, privacy and data protection laws and regulations, which may increase operational costs and restrictions;

•the risk that illegal or unethical activities of our local employees or business partners will be attributed to or result in liability to us or damage our reputation;

•longer and potentially more complex sales and accounts receivable payment cycles and other collection difficulties;

•different pricing and distribution environments;

•potential changes in international trade policies, tariffs, agreements and practices, including the adoption and expansion of formal or informal trade restrictions or regulatory frameworks favoring local competitors;

•local governmental direction, business practices and/or cultural norms that may favor local competitors;

•cybersecurity and intellectual property risks that are more prevalent in jurisdictions in which we have historically chosen not to operate; and

•localization of our services, including translation into foreign languages and associated expenses.

If we are unable to manage these risks, if our required investments in these international markets are greater than anticipated, or if we are unsuccessful in increasing sales in emerging markets, our revenue growth rate, business and operating results will be adversely affected.

We rely on our network of partners for an increasing portion of our revenues, and if these partners fail to perform, our ability to sell and distribute our products may be impacted, and our operating results and growth rate may be harmed.

An increasing portion of our revenues is generated by sales through our network of partners, including managed service providers and resellers. While we provide our partners with training and programs, including accreditations and certifications, these programs may not be effective or utilized consistently by partners. Changes to our direct go-to-market models may cause friction with our partners and may increase the risk in our partner ecosystem. In addition, our partners may utilize our platform to develop products and services that could potentially compete with products and services that we offer currently or in the future. Concerns over competitive matters or IP ownership could constrain these partnerships. If

Table of Contents

we fail to effectively manage and grow our network of partners, or properly monitor the quality and efficacy of their service delivery, our ability to sell our products and efficiently provide our services may be impacted, and our operating results and growth rate may be harmed.

Doing business with the public sector and heavily-regulated organizations subjects us to risks related to government procurement processes, regulations, and contracting requirements.

However, government certification processes are lengthy and can often be delayed, affecting our business and results of operations. Furthermore, government certification requirements may change, or we may be unable to achieve or sustain one or more government certifications or authorizations. As a result, if such requirements change, our ability to sell into the government sector could be restricted until we meet any revised requirements.

A substantial majority of our sales to date to government entities in the U.S. have been made indirectly through our distributors, resellers or service provider partners. Doing business with government entities presents a variety of risks. The procurement process for governments and their agencies is highly competitive, time-consuming and may be subject to political influence and may involve different rules and conditions on the offering or pricing of products and services. We incur significant up-front time and expense, which subjects us to additional compliance risks and costs, without any assurance that we (or a third-party distributor, reseller or service provider) will win a contract. Further, if we or our partners are successful in receiving a contract award, that award could be challenged during a bid protest process. Bid protests may result in an increase in expenses related to obtaining contract awards or an unfavorable modification or loss of an award. Even if a bid protest were unsuccessful, the delay in the startup and funding of the work under these contracts may cause our actual results to differ materially and adversely from those anticipated.

Our customers also include non-U.S. governments, to which government procurement risks similar to those present in U.S. government contracting and regulatory compliance also apply, particularly in certain emerging markets where our customer base is less established. We have seen challenges to successful awards through bid protest procedures in jurisdictions outside the U.S. As our non-U.S. government business grows, we may see an increase in bid protests as part of the standard government procurement legal procedures that exist in many jurisdictions. In addition, compliance with complex regulations and contracting provisions in a variety of jurisdictions can be expensive and consume significant management resources. In certain jurisdictions, our ability to win business may be constrained by political and other factors unrelated to our competitive position in the market. Each of these difficulties could materially adversely affect our business and results of operations.

In addition, public sector customers may have contractual, statutory or regulatory rights to terminate current contracts with us or our third-party distributors or resellers for convenience or due to a default, though such risk may be assumed by such third-party distributor or reseller. If a contract is terminated for convenience, we may only be able to collect fees for products or services delivered prior to termination and settlement expenses. If a contract is terminated due to a default, we may be liable for excess costs incurred by the customer for procuring alternative products or services or be precluded from doing further business with government entities. Further, we are required to comply with a variety of complex laws, regulations, and contractual provisions relating to the formation, administration, or performance of government contracts that give public sector customers substantial rights and remedies, many of which are not typically found in commercial contracts. For example, a U.S. cybersecurity Executive Order released recently may create heightened future compliance and incident reporting standards. These obligations may apply to us and/or our third-party resellers or distributors whose practices we may not control. Such parties’ non-compliance could impose repercussions with respect to contractual and customer satisfaction issues.

In addition, governments routinely investigate and audit contractors for compliance with these requirements. If, from an audit, it is determined that we have failed to comply with these requirements, we may be subject to civil and criminal penalties and administrative sanctions, including termination of contracts, forfeiture of profits, cost associated with the triggering of price reduction clauses, fines, and suspensions or debarment from future government business, all of which may cause us to suffer reputational harm.

Table of Contents

Further, we are increasingly doing business in heavily regulated industries, such as the financial services, telecommunication, media and television and health care industries. Current and prospective customers in such industries may be required to comply with more stringent regulations in connection with subscribing to and implementing our services or particular regulations regarding third-party vendors that may be interpreted differently by different customers. In addition, regulatory agencies may impose requirements toward third-party vendors that we may not be able to, or may not choose to, meet. In addition, customers in these heavily-regulated industries often have a right to conduct audits of our systems, products and practices. If one or more customers determine that some aspect of our business does not meet regulatory requirements, we may be limited in our ability to continue or expand our business.

If we fail to comply with applicable anti-corruption and anti-bribery laws, export control laws, economic and trade sanctions laws, or other global trade laws, we could be subject to penalties and civil and/or criminal sanctions and our business could be materially adversely affected.

As we continue to expand our business internationally, we will inevitably do more business with large enterprises and the public sector in countries that are perceived to have heightened levels of public sector corruption. We have experienced this in the past and may experience it again in the future. For example, as a result of the Russia-Ukraine conflict, the U.S. and other countries have imposed economic and trade sanctions and export control restrictions against Russia and Belarus. If the conflict continues, the U.S. and other jurisdictions could impose wider economic and trade sanctions as well as export restrictions, which could impact our business opportunities and operations. Any violation of the U.S. Foreign Corrupt Practices Act of 1977, as amended (the “FCPA”), the UK Bribery Act, other applicable anti-corruption and anti-bribery laws, or applicable export control or economic and trade sanctions laws by our employees or third-party intermediaries could result in regulatory investigations and whistleblower complaints, which could subject us to significant risks such as adverse media coverage and/or severe criminal or civil sanctions, which could materially adversely affect our reputation, business, operating results, and prospects.

Delays in the release of, or actual or perceived defects in, our products may slow the adoption of our latest technologies, reduce our ability to efficiently provide services, decrease customer satisfaction, and adversely impact future product sales.

We must successfully continue to release new products and updates to existing products. The success of any release depends on a number of factors, including our ability to manage the risks associated with actual or perceived quality or other defects or deficiencies, delays in the timing of releases or the adoption of releases by customers, and other complications that may arise during the early stages of introducing our products. If releases are delayed or if customers perceive that our releases contain bugs or other defects or are difficult to implement, customer adoption of our new products or updates may be adversely impacted, customer satisfaction may decrease, our ability to efficiently provide our services may be reduced, and our growth prospects may be harmed.

As more of our sales efforts are targeted at larger enterprise customers, our sales cycle may become longer and more expensive and we may encounter pricing pressure and implementation and configuration challenges.

As we target more of our sales efforts at larger enterprise customers, we may face heightened costs, longer sales cycles, greater competition and less predictability in completing some of our sales. If we fail to effectively manage these risks associated with sales cycles and sales to larger enterprise customers, our business, financial condition, and results of operations may be affected.

Table of Contents

As we acquire or invest in companies and technologies, we may not realize the expected business or financial benefits and the acquisitions and investments may divert our management’s attention and result in additional shareholder dilution.

We have acquired or invested in companies and technologies as part of our business strategy and will continue to evaluate and execute potential strategic transactions, including acquisitions of or investments in businesses, technologies, services, products and other assets. We have and will continue to enter into strategic transactions or relationships with other businesses to expand our service offerings, go-to-market and sales efforts, functionality or our ability to provide services in international locations. Although we conduct reasonably extensive due diligence of these businesses, our efforts may not reveal every material issue. Strategic transactions involve numerous risks, including:

•difficulties assimilating or integrating the businesses, technologies, products, personnel or operations of the acquired companies;

•failing to achieve the expected benefits of the acquisition or investment;

•potential loss of key employees of the acquired company;

•inability to maintain relationships with customers and partners of the acquired business;

•potential adverse tax consequences;

•disruption to our business and diversion of management attention and other resources;

•potential financial and credit risks associated with acquired customers;

•dependence on acquired technologies or licenses for which alternatives may not be available to us without significant cost or complexity;

•in the case of foreign acquisitions, the challenges associated with integrating operations across different cultures and languages and any currency and regulatory risks associated with specific countries;

•introducing increased complexity and burden to maintain the technology platform or introducing vulnerabilities or threats by integrating acquired technologies;

•increased data security or privacy compliance requirements from integrating the acquired technology or company;

•impairment to our investments if our investees are unable to obtain future funding on favorable terms or at all; and

•potential unknown liabilities associated with the acquired businesses.

Furthermore, if we finance acquisitions by issuing equity, convertible or other debt securities or loans, our existing shareholders may be diluted, or we could face constraints related to the terms of and repayment obligation related to the incurrence of indebtedness that could affect our stock price. The occurrence of any of these risks could harm our business, operating results and financial condition.

Natural disasters, including climate change, and other events beyond our control could harm our business.

Natural disasters or other catastrophic events may cause damage or disruption to our operations, international commerce and the global economy, and thus could have a negative effect on us. Although we maintain crisis management and disaster response plans, such events could make it difficult or impossible for us to deliver our services to our customers, could decrease demand for our services, and could cause us to incur substantial expense. Our insurance may not be sufficient to cover losses or additional expenses we may sustain. The majority of our research and development activities, offices, IT systems, and other critical business operations are located near major seismic faults in California and Washington.

In addition, the impacts of climate change on the global economy and our industry are rapidly evolving. Any of our primary locations may be vulnerable to the adverse effects of climate change. Changing market dynamics, global policy developments and increasing frequency and impact of extreme weather events on critical infrastructure in the U.S. and elsewhere have the potential to disrupt our business, the business of our customers and third-party suppliers and may cause us to experience higher attrition, losses and additional costs to maintain or resume operations.

Table of Contents

Risks Related to the Operation of Our Business

If we or our third-party service providers experience an actual or perceived cybersecurity event, our platform may be perceived as not being secure, and we may lose customers or incur significant liabilities, which would harm our business and operating results.

Our operations involve the storage, transmission and processing of our customers’ confidential, proprietary and sensitive data, which may include personally identifiable information, protected health information, financial information and, in some cases, government information.

Our employees have fallen victim to phishing attacks in the past and may again in the future. The frequency and sophistication of these attacks have increased, and it appears that cyber crimes and cyber criminal networks, some of which may be state-supported, have substantial resources and may target U.S. enterprises or our customers and their use of our products.

In addition, we have established extensive development and testing environments for our engineers developing new products and features. Similarly, in the unique circumstances where customer data may be utilized in developer environments for testing or learning, that data may be at greater risk. Because techniques used to sabotage, obtain unauthorized access to systems or prohibit authorized access to systems change frequently and generally may not be detected until successfully launched against a target, we have been and may continue to be unable to anticipate these techniques or to implement adequate preventative measures. This has included and may continue to include underlying infiltration of pre-existing systems, including those of our third-party service providers or customers, perpetrated by more sophisticated or state-supported attackers, including foreign cybersecurity attacks on U.S. technology companies and retaliatory cybersecurity attacks stemming from the Russian invasion of Ukraine or other geopolitical tensions. It may also include exploitation of vulnerabilities in third party or open source software code that may be incorporated into our own or our customers’ systems, such as the vulnerability in the Java logging library known as “log4j” identified in late 2021 that affected our industry. The occurrence of these and other more sophisticated or state-supported attack campaigns may increase as geopolitical tensions and intermittent warfare continue or escalate outside of the U.S. For example, due to the Russia-Ukraine conflict, rising tensions between the U.S. and North Korea and rising tensions with China, we and our customers, third-party vendors and service providers are subject to a heightened risk of cybersecurity attacks, phishing attacks, viruses, malware, ransomware, hacking or similar breaches from state-supported actors, including attacks that could materially disrupt our systems and operations, supply chain, and ability to make available or sell our products and services.

We devote significant financial and personnel resources to implement and maintain security measures while meeting customer expectations as to the performance of our systems; however, as cybersecurity threats develop and grow more complex and sophisticated over time, such as in connection with geopolitical warfare, we will continue to make significant further investments to protect data and infrastructure, but a residual risk may remain despite our preventative efforts. A security breach suffered by us or our third-party service providers, an attack against our service availability or unauthorized access or loss of data could result in a disruption to our service, litigation, service level agreement claims, indemnification and other contractual obligations, regulatory investigations, government fines and penalties, reputational damage, loss of sales and customers, mitigation and remediation expenses and other significant costs and liabilities.

Table of Contents

Additionally, as we increase reliance on third-party and public cloud infrastructure, we depend in part on third-party security measures to protect against unauthorized access, cyberattacks and the mishandling of data. However, our ability to monitor our third-party service providers’ data security is limited. Similarly, employee error or malfeasance in configuring, maintaining, and using services offered by third-party providers may affect our ability to monitor and secure such services. Employees have made errors in this area in the past and may do so again in the future. Any breach of our providers’ security measures or misconfiguration or misuse of our software or our providers’ services may result in unauthorized access to, or the misuse, loss or destruction of, our and our customers’ data or in a violation of our terms or applicable law, which may result in reputational harm or liability.

Further, in most instances, our customers administer access to the data held in their particular instance for their employees and service providers.

Digital supply chain attacks have increased in frequency and severity. We cannot guarantee that third parties and our supply chain infrastructure have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our platform, systems and network or the systems and networks of third parties that support us and our business. Third parties may also exploit vulnerabilities in, or obtain unauthorized access to, platforms, systems, networks, or physical facilities utilized by us or our third-party vendors or service providers. Furthermore, supply chain disruptions due to the Russian invasion of Ukraine (and resulting legal or regulatory developments) and any indirect effects may further complicate any existing supply chain constraints.

While we seek to manage these transitions carefully, such changes may result in a loss of institutional knowledge, cause disruptions to our business and negatively affect our business.

Many key individual contributors, particularly in research and development, engineering and sales, are critical to our success and can command very significant compensation in the market. Our ability to achieve significant revenue growth may depend on our success in recruiting, training and retaining sufficient qualified personnel to support our growth. While our hybrid work model, where some employees work remote for part of the week and some employees are fully remote, increased our access to talent, we may not be able to take advantage of a broader talent pool if our competitors offer the same work model or if we continue to lean heavily on our primary operating locations for talent. We are continually evaluating and, as appropriate, enhancing the attractiveness of our compensation packages. Many of our employees, including all of our executive officers, are employed “at-will” and may terminate their employment with us at any time.

In addition, we believe our corporate culture of fostering innovation, teamwork and employee satisfaction has been a key contributor to our success to date. Further, as of December 31, 2022, approximately 27.6% of our employees have been employed by us for a year or less. We must be able to effectively integrate, develop and motivate a large number of new employees, while maintaining the effectiveness of our business execution and the beneficial aspects of our corporate culture. Such challenges may be exacerbated by the hybrid work model.

Table of Contents

Disruptions or defects in our services could damage our customers’ businesses, subject us to substantial liability and harm our reputation and financial results.

Our business depends on our platform to be available without disruption. New defects may be detected in the future and may arise from our increasing use of the public cloud. For example, we provide regular updates to our services, which can contain undetected defects when first released. Defects may also be introduced by our use of third-party software, including open-source software. Disruptions may result from errors we make in developing, delivering, configuring or hosting our services, or designing, installing, expanding or maintaining our cloud infrastructure. Disruptions in service can also result from incidents that are outside of our control, including denial of service or ransomware attacks. They may also be subject to break-ins, sabotage, intentional acts of vandalism and similar misconduct, equipment failure and adverse events caused by operator error or negligence. In addition, an increased use of the public cloud increases our vulnerability to cyberattacks. Despite precautions taken at these centers, problems at these centers have occurred, resulting in interruptions in our services. Such problems could occur again and result in similar or lengthier service interruptions and the loss of customer data. In addition, our customers may use our services in ways that cause disruptions in service for other customers. In addition to data center providers, we also have a large ecosystem of service providers that we use to deliver our products. If there is a compromise to data or other incident with our critical service providers, it may impact our ability to provide our services and reduce our productivity. Our customers use our services to manage important aspects of their businesses, and our reputation and business will be adversely affected if our customers and potential customers believe our services are unreliable. Disruptions or defects in our services may reduce our revenues, cause us to issue credits or pay penalties, subject us to claims and litigation, cause our customers to delay payment or terminate or fail to renew their subscriptions, and adversely affect our ability to attract new customers. Similarly, customers may have unique requirements for system resiliency and performance depending on their business models and customers in highly regulated markets may have more demanding requirements that we may not be able to, or may not choose to, meet. The occurrence of payment delays, service credit, warranty or termination for material breach or other claims against us could result in an increase in our bad debt expense, an increase in collection cycles, an increase to our service level credit accruals, other increased expenses or risks of litigation. We may not have insurance sufficient to compensate us for potentially significant losses that may result from claims arising from disruptions to our services.

Lawsuits against us by third parties that allege we infringe their intellectual property rights could harm our business and operating results.

There is considerable patent and other IP development activity and claims and related litigation regarding patent and IP rights in our industry. We have recorded material charges for legal settlements of such claims in the past. In any IP litigation, regardless of the scope or merit, we may incur substantial costs and attorney’s fees and, if the claims are successfully asserted against us and we are found to be infringing upon, misappropriating or otherwise violating the IP rights of others, we could be required to pay substantial damages and/or make substantial ongoing royalty payments; comply with an injunction and cease offering or modify our products and services; comply with other unfavorable terms, including settlement terms; and indemnify our customers and business partners, obtain costly licenses on their behalf, and/or refund fees or other payments previously paid to us. Further, upon expiration of the term of any agreements that allow us to use third-party IP, we may be unable to renew such agreements on favorable terms, if at all, in which case we may face IP litigation. The mere existence of any lawsuit, or any interim or final outcomes, and the public statements related to it (or absence of such statements) by the press, analysts and litigants could be unsettling to our customers and prospective customers. Any claim or litigation against us could be costly, time-consuming and divert the attention of management and key personnel from our business operations and harm our financial condition and operating results.

Table of Contents

Our intellectual property protections may not provide us with a competitive advantage, and defending our intellectual property may result in substantial expenses that harm our operating results.

Our success depends to a significant degree on our ability to protect our proprietary technology and our brand under patent, copyright, trademark, trade secret and other IP protections in the U.S. and other jurisdictions. Though we seek patent protection for our technology, we may not be successful in obtaining patent protection, and any patents acquired in the future may not provide competitive advantages or other value. In addition, any patents that have been or may be issued or acquired may be contested, circumvented, found unenforceable or invalidated, and we may not be able to prevent third parties from infringing upon them. Further, legal standards relating to the validity, enforceability and scope of protection of IP rights vary.

Despite our efforts to protect our proprietary rights, unauthorized parties may attempt to copy or obtain and use, or may have copied or obtained and used, our technology to develop products and services that provide features and functionality similar to ours. Our competitors could also independently develop services equivalent to ours, and our IP rights may not be broad enough for us to prevent competitors from utilizing their developments to compete with us. Reverse engineering, unauthorized copying or other misappropriation of our proprietary technology could enable third parties to benefit from our technology without paying us for it, which would significantly harm our business.

Our IP rights may be challenged by others or invalidated through administrative proceedings or litigation. Effective patent, trademark, copyright and trade secret protection may not be available in every country in which we offer services. The laws of some foreign countries may not offer effective protection for, or be as protective of, IP rights as those in the U.S., and mechanisms for enforcement of IP rights or available remedies may be inadequate, ineffective or scarce. We may be required to spend significant resources to monitor and protect our IP rights. We have initiated and, in the future, may initiate claims or litigation against third parties for infringement or misappropriation of our proprietary rights or to establish the validity of our proprietary rights. Any litigation, whether or not resolved in our favor, could

Strategies

Alerts

Browse Data

Risk Factors Dashboard

View risk factors by ticker

Search filings by term

Risk Factors - NOW

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing

Strategies

Alerts

Browse Data

Risk Factors Dashboard

View risk factors by ticker

Search filings by term

Risk Factors - NOW

-New additions in green-Changes in blue-Hover to see similar sentence in last filing

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing