Cadence Design (CDNS) Risk Analysis

We rely on hardware, software, digital infrastructure and computing networks for both internal and customer-facing operations that are critical to our business (collectively, "IT Systems"). We own and manage certain IT Systems but also rely on third parties for IT Systems and related products and services, including cloud computing. In addition, we and certain third-party providers collect, maintain and process data about our customers, employees, business partners and others, including information that relates to individuals and/or constitutes "personal data," "personal information," "personally identifiable information" or similar terms under applicable data privacy laws (collectively "Personal Information"), as well as proprietary data such as trade secrets (together with Personal Information, "Confidential Information"). We face numerous, evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our IT Systems, Confidential Information, products and services, including from diverse threat actors, such as state-sponsored organizations, opportunistic hackers and malicious insiders, as well as through diverse attack vectors, such as social engineering (including phishing), malware (including ransomware) and denial-of-service attacks, and due to human or technological error, such as misconfigurations, "bugs" or other vulnerabilities in software or hardware. Additionally, advances in technology, an increased level of sophistication and expertise of hackers, widespread access to generative AI, and new discoveries in the field of cryptography increase the risk of significant compromises or breaches of our IT Systems or security measures implemented to protect our systems. From time to time, we and certain of our third-party service providers experience varying degrees of cyberattacks and other security incidents. Any such incidents could compromise our or our providers' IT Systems, which could cause system disruptions or slowdowns and lead to the Confidential Information stored on our or third-party systems being accessed, publicly disclosed, lost or stolen. Any actual or perceived unauthorized access or disclosure to our Confidential Information poses significant risk to our business as it could result in reputational and financial harm and further subject us to liability to our customers, suppliers, business partners and others. For example, as described in our Quarterly Report on Form 10-Q for the period ended March 31, 2026, we learned that a threat actor obtained a limited amount of Confidential Information from certain of our IT systems including a limited amount of test files, configuration setting files and source code files which are not material to our business. We notified law enforcement, and we believe that the incident was contained. There was no operational disruption, and customer environments were not impacted. Cyberattacks are expected to accelerate on a global basis in frequency and magnitude as threat actors are becoming increasingly sophisticated in using techniques and tools – including AI – that circumvent security controls, evade detection and remove forensic evidence. Techniques used to obtain unauthorized access or to sabotage information systems change frequently and include zero-day software vulnerabilities that are unknown until exploited by threat actors. As a result, we may be unable to promptly or effectively detect, investigate, remediate or recover from future attacks or incidents, or to avoid a material adverse impact to our IT Systems, Confidential Information or business. Furthermore, state-supported and geopolitical-related cyberattacks against companies such as ours may increase due to geopolitical conditions. A cyberattack on our IT Systems or IT Systems of one of our third-party providers or customers could result in material adverse impacts due to any or all of the following: compromise to our Cadence Cloud portfolio, which includes both our managed and customer-managed environments, and our data centers and those of our customers and end users; corruption or stealing of Confidential Information such as proprietary information related to our (or our customers') business, products, services and infrastructure or Personal Information; manipulation or stealing of financial data and assets; and/or disruption of our systems and services and those of our customers and others. As a result, we could be exposed to a risk of loss or misuse of Confidential Information, loss of financial assets, business interruption, regulatory investigations, litigation and other liabilities and costs. Because we make extensive use of third-party suppliers and service providers, such as cloud services that support our internal and customer-facing operations, successful cyberattacks that disrupt or result in unauthorized access to third party providers' IT Systems, including those that store our Confidential Information, can materially impact our operations and financial results. Moreover, hardware, software or applications we develop or procure from third parties or through open source solutions may contain defects in design or manufacture or other vulnerabilities and are susceptible to compromise. In addition, we have acquired and continue to acquire companies with less sophisticated security measures, and it takes time to align their security practices to meet our information security policies, procedures and controls, which exposes us to increased cybersecurity and other integration risks. There can be no assurance that our cybersecurity risk management strategy, program, policies, processes and controls will be fully implemented, complied with or effective in protecting any systems or information. An actual or perceived breach of IT Systems or Confidential Information managed by us or a vendor could significantly impact our business through diminished market perception of the effectiveness of our security measures, legal or regulatory actions, substantial fines, penalties and required changes to our business practices, damage to our reputation or our business, loss of existing customers and our ability to obtain new customers (including government customers), significant restoration, remediation and compliance costs, and cause harm to our financial condition. Any or all of the foregoing could materially adversely affect our business, financial condition and results of operations. Also, we cannot guarantee that any costs and liabilities incurred in relation to an attack or incident will be covered by our existing insurance policies or that applicable insurance will be available to us in the future on economically reasonable terms or at all.