DocuSign (DOCU) Risk Analysis

From time to time, we have been and may in the future be involved as a party or an indemnitor in legal proceedings, disputes or regulatory inquiries that arise in the ordinary course of business. These may include alleged claims, lawsuits and proceedings regarding labor and employment issues, commercial disagreements, securities law violations and other matters. In particular, companies in the software industry are often required to defend against litigation claims based on allegations of infringement or other violations of intellectual property rights. We have from time to time been subject to intellectual property claims and disputes and may be subject to such claims in the future. In addition, many of these companies have the capability to dedicate substantially greater resources to enforce their alleged intellectual property rights and to defend claims that may be brought against them. Any litigation may also involve patent holding companies or other adverse patent owners that have no relevant product revenue and against which our patents may therefore provide little or no deterrence. If a third party is able to obtain an injunction preventing us from utilizing such third-party intellectual property rights, or if we cannot license or develop technology for any infringing aspect of our business, we would be forced to limit or stop sales of our software or cease business activities employed by such intellectual property and may be unable to compete effectively. Any inability to license third-party technology in the future would have an adverse effect on our business or operating results and would adversely affect our ability to compete. Such disputes may require us to redesign our products, delay releases, enter into costly settlement or license agreements, pay costly damage awards, or face a temporary or permanent injunction prohibiting us from marketing or selling our products and solutions. Requiring us to change one or more aspects of the way we deliver our products and solutions may harm our business. We may also be contractually obligated to indemnify our customers in the event of infringement of a third party's intellectual property rights. Responding to such claims, including those currently pending, regardless of their merit, can be time consuming and costly to defend in litigation and damage our reputation and brand. For more information on our pending legal proceedings, see Item 3. Legal Proceedings of this Form 10-K. Regardless of the merits or ultimate outcome of any claims that have been or may be brought against us or that we may bring against others, lawsuits are time-consuming and expensive to resolve, divert management's time and attention, and could harm our reputation. Although we carry general liability and other forms of insurance, our insurance may not cover potential claims that arise or may not be adequate to indemnify us for all liability that may be imposed. We may also determine that the most cost-effective way to resolve a dispute is to enter into a settlement agreement. Litigation is inherently unpredictable and we cannot predict the timing, nature, controversy or outcome of lawsuits or assure you that the results of any of these actions will not have an adverse effect on our business, operating results or financial condition.

Our operations involve the storage and transmission of customer data, personal data and other sensitive or confidential information, and our corporate environment contains important company data and/or business records, employee data and data from partner, vendor or other relationships, as well as a wide variety of our own internal company, partner and employee information. Our employees, service providers and third parties providing services to us often work on a remote or hybrid arrangement basis, which may involve relying on less secure systems and may increase the risk of cybersecurity-related incidents. We cannot guarantee these private work environments and electronic connections to our work environment have the same robust security measures as those deployed in our physical offices. We also rely on third-party and public-cloud infrastructure, and we depend in part on third-party security measures on such infrastructure to protect against unauthorized access, cyberattacks and the mishandling of customer data. Our ability to monitor our third-party service providers' data security is limited and any breach of our providers' security measures may result in unauthorized access to, or misuse, loss or destruction of, our and our customers' data. We also rely on other third parties, including open-source software providers, model-providers for AI features and others; and vulnerabilities, misconfigurations, or supply chain compromises impacting any of these third parties could adversely impact our systems and data. While we have security measures in place designed to protect our production and development environments and other systems, maintain the integrity of customer, company, partner and employee information, and prevent data loss, misappropriation and other security breaches and incidents, there can be no assurance that such security measures will be effective, or effective at all times. We are a frequent target of cyberattacks and have faced security incidents in the past that did not have a material impact on our operations. In these cases, upon detection, we took prompt action to prevent any additional unauthorized access, put further security controls in place and worked with law enforcement agencies, when appropriate. While we have taken and will continue to take steps to address cyberattacks and security incidents, these efforts to investigate, mitigate, contain, and remediate any such incidents may not always be entirely successful, and there can be no assurance that there will be no impact to our operations from these or similar incidents in the future. Despite our prevention and response efforts, any security incident or breach, even if immaterial and properly addressed, could result in negative publicity, loss of customers, damage to our reputation and could impair our sales and harm our business. Like other organizations providing valuable technology and services, we are subject to increasing cyberattacks from malicious third parties using widely varying and frequently changing tactics, which may be enhanced or facilitated by AI technology, and may include phishing and fraud campaigns targeting our personnel via email, text, instant messaging and voice calls. As AI technologies develop rapidly, threat actors are using these technologies to create new attack methods that are increasingly automated, targeted, and coordinated and more difficult to defend against. In addition, we may face increased risk in our ability to maintain the performance, reliability, security and availability of our products and technical infrastructure to the satisfaction of our customers. We are subject to increasingly frequent and sophisticated cyberattacks, including advanced persistent threats by state-sponsored actors, cyberattacks relying on complex social engineering or "phishing" tactics, ransomware attacks and other methods including credential stuffing and account takeover attacks, prompt injection, deepfakes, denial or degradation of service attacks, malicious code (e.g., viruses and worms), and many other techniques that may lead to the loss, theft or misuse of personal, corporate or financial information, fraudulent payments, identity theft, and disrupting or disabling our services. Bad actors, nation-states, and nation-state-supported actors engage in cyberattacks, including for geopolitical reasons and in connection with global or regional conflicts and operations. The frequency and sophistication of cybersecurity threats against us and our partners, service providers or customers may often become further heightened in connection with such geopolitical tensions. If bad actors gain improper access to our systems or databases or those of our partners, service providers, and other third parties who have access to our data, they may be able to steal, publish, delete, copy, unlawfully or fraudulently use or modify data, including personal information and/or blackmail us to pay a ransom. Additionally, bad actors have misused our platform and/or our brand name to attempt to deceive or defraud others, and may continue to do so. If our efforts to prevent these activities, or limit their impact, are unsuccessful, our reputation and brand could be harmed, we could lose customers, and our business and financial condition could be adversely affected. If our security measures, or the security measures of our partners, service providers, or customers, are compromised, our reputation could be damaged and our ability to attract and retain customers could be adversely affected. We could also be subject to negative publicity, increased costs to remedy any problems and otherwise respond to any incident, monetary and other losses for us or our customers, identity theft for our customers, the inability to expand our business, additional scrutiny, restrictions, fines or penalties from regulatory or governmental authorities, loss of customers and customer confidence in our services, ongoing regulatory oversight, assessments and audits, exposure to civil litigation, and/or a breach of our contracts with third parties. All of the foregoing could expose us to significant liability and harm our business, financial condition, and operating results. Despite significant efforts to identify vulnerabilities and create security barriers to such threats, it is virtually impossible for us, our service providers, our partners and our customers to entirely mitigate these risks. Further, we could be forced to use significant financial and operational resources in response to a cyberattack, security incident, or breach, including repairing system damage, increasing security protection costs, investigating and remediating any information security vulnerabilities, complying with data breach notification obligations and applicable laws, and defending against and resolving legal and regulatory claims, all of which could divert resources and the attention of our management and key personnel away from our business operations and materially and adversely affect our business, financial condition, and operating results. Additionally, there can be no assurance that any limitations of liability provisions in our contracts would be enforceable or adequate in the event of a security breach or would otherwise protect us from any such liabilities or damages with respect to any particular claim. We also cannot be sure that our existing general liability insurance coverage, cybersecurity coverage, and coverage for errors or omissions will continue to be available on acceptable terms or will be available in sufficient amounts to cover one or more large claims, or that insurers will not deny coverage as to any future claim. Furthermore, our insurance coverage may not extend to all risks we face, including all AI-related security risks, and may not cover us for all losses for errors or omissions caused by AI. Cyberattacks or security incidents may result in increased costs for such insurance as well. One or more large, successful claims against us in excess of our available insurance coverage, or changes in our insurance policies, including premium increases or large deductible or coinsurance requirements, could have an adverse effect on our business, operating results and financial condition.

Our products and solutions address a market that is evolving and highly competitive. We have customers in a wide variety of industries, including real estate, financial services, insurance, manufacturing, and healthcare and life sciences. We intend to continue to expand our sales efforts internationally, where many countries may have less familiarity with and acceptance of e-signature products. It is difficult to predict customer demand for our products and solutions, customer retention and expansion rates, the size and growth rate of the market for agreement automation, the entry of competitive products or the success of existing competitive products. We expect that we will continue to need intensive sales efforts to educate prospective customers, particularly enterprise and commercial customers and international customers, about the uses and benefits of our products and solutions. Additionally, we face competition from different companies depending on the product or solution. For example, our primary global e-signature competitor is currently Adobe Acrobat Sign. We also face competition from a select number of vendors that focus on specific industries, geographies or product areas such as contract lifecycle management and advanced contract analytics. We may also face greater competition from non-specialist solutions relying on generic large language models ("LLMs"), generative AI and general-purpose agents to address a broad range of business needs. As we attempt to sell our products and solutions to new and existing customers, we must convince them that our products and solutions are superior to other solutions available to their organizations, including generic LLMs, software created using natural language prompts and generative AI (referred to as vibe coding) and other emerging technologies. Many of our competitors have longer operating histories than us, significantly greater financial, technical, marketing and other resources, stronger brand and customer recognition, larger intellectual property portfolios and broader global distribution. As a result, our competitors may be able to respond more quickly and effectively than we can to new or changing opportunities, technologies, standards or customer requirements. Our competitors may also offer lower pricing than we do or bundle certain competing products and services at a lower price. Further, we could lose customers if our competitors develop new competitive products and solutions, acquire competitive products, reduce prices, form strategic alliances with other companies, are acquired by third parties with greater resources or develop and market new technologies that render our existing or future products less competitive, unmarketable or obsolete. For example, advances in AI and other technologies may fundamentally alter the market for our services in unpredictable ways and reduce customer demand. If we are unable to effectively compete, our business, operating results and financial condition would be harmed.

Sales of subscriptions to our eSignature product account for the substantial majority of our subscription and professional services revenue. Although we continue to add to our suite of other products and solutions in our IAM platform for automating the agreement process, we expect that we will be substantially dependent on our eSignature product to generate revenue for the foreseeable future. As a result, our operating results could suffer due to: ?any decline in demand for our eSignature product;?the failure of our eSignature product to maintain market acceptance;?the market for electronic signatures failing to grow, or growing more slowly than we expect;?new products and technologies from our competitors that replace or represent an improvement over our eSignature product;?new technological innovations or standards that our eSignature product does not address;?changes in regulations;?sensitivity to our current or future pricing;?our inability to release enhanced versions of our eSignature product on a timely basis; and ?macro- and micro-economic factors, including inflation, changes in interest rates or foreign exchange rates, increased debt and equity market volatility, tariffs and changes in trade policies and practices, geopolitical conflict or public health crises. We have experienced, and may continue to experience, declines and fluctuations in the demand for our eSignature product due to a number of factors, including changing patterns of customer adoption and retention, shifts in customer spending levels, a highly competitive market, and general economic and global market conditions. We will need to maintain or increase sales of subscriptions to our eSignature product, in addition to increasing the usage and adoption of our other product offerings, in order to support our growth and operating objectives. If customer adoption and expansion of our eSignature product falls below our expectations, our business, financial condition, and operating results would be adversely affected.

We believe that promoting and maintaining the Docusign brand is important to supporting continued acceptance of our existing and future solutions, attracting new customers to our products and solutions and retaining existing customers. We also believe that the importance of our brand will increase as competition in our market increases. Successfully promoting and maintaining our brand will depend largely on the effectiveness of our marketing efforts, and our ability to provide reliable and useful solutions to meet the needs of our customers at competitive prices, maintain our customers' trust, continue to develop new functionality and solutions and successfully differentiate our products and solutions from those of our competitors. Additionally, the performance of our partners may affect our brand and reputation if customers do not have a positive experience with our partners' services. We invest significantly in sales and marketing activities to attract new customers and expand use cases with existing customers, but these activities may not generate customer awareness or yield increased revenue, and even if they do, any increased revenue may not offset the expenses we incurred in building our brand. If we fail to successfully promote and maintain our brand, we may fail to attract enough new customers or retain our existing customers to the extent necessary to realize a sufficient return on our brand-building efforts, and our business could suffer. Further, we have also made public commitments to our corporate environmental, social, and governance ("ESG") and human capital management initiatives, including reductions in carbon emissions and fostering a culture that celebrates and harnesses the strength of our people. Any perceived changes in our dedication to these commitments or our failure to achieve progress in these areas on a timely basis, or at all, could adversely impact our relationships with our customers and employees and affect our reputation and the value of our brand.

Our operating results may vary based on the impact of changes in our industry or the global economy on us and our existing and prospective customers. The revenue growth and profitability of our business depend on demand for our products and solutions. Current or future economic and global market uncertainties or downturns could adversely affect our business and operating results. Economic uncertainty and associated macro-economic conditions make it difficult for our customers and us to accurately forecast and plan future business activities, and could cause our customers to slow spending on our products. Negative conditions in the general economy both in the U.S. and abroad, including conditions resulting from inflation, changes in interest rates or foreign exchange rates, tariffs and changes in trade policies and practices, gross domestic product growth, financial and credit market fluctuations, geopolitical conflict, natural catastrophes and the effects of climate change, public health crises, and terrorist attacks in the U.S., Europe, the Asia Pacific region or elsewhere, could cause a decrease in business investments, including spending on information technology, and negatively affect the growth of our business. In addition, unfavorable conditions in certain industry sectors could impact customers or partners disproportionately, which could also impact the demand for our products. To the extent our products and solutions are perceived by customers and potential customers as costly, or too difficult to deploy or migrate to, our revenue may be disproportionately affected by delays or reductions in general information technology spending. Also, competitors, many of whom are larger and more established than we are, may respond to market conditions by lowering prices and attempting to lure away our customers. In addition, the increased pace of consolidation in certain industries may result in reduced overall spending on our products and solutions. We cannot predict the timing, strength or duration of any economic slowdown, instability or recovery, generally or within any particular industry. If the economic conditions of the general economy or markets in which we operate worsen from present levels, our business, operating results and financial condition could be adversely affected.

A component of our growth strategy involves the further expansion of our operations and customer base internationally. In each of the years ended January 31, 2026, 2025, and 2024 total revenue generated from customers outside the U.S. was 29%, 28%, and 26% of our total revenue. As of January 31, 2026, we have offices in 12 countries and approximately 40% of our full-time employees were located outside of the U.S. We are continuing to adapt to and develop strategies to address international markets but there is no guarantee that such efforts will have the desired effect. We expect that our international activities will continue to grow as we continue to pursue opportunities in existing and new international markets, which will require significant management attention and financial resources. Our current international operations and future initiatives involve a variety of risks, including: ?changes in a specific country's or region's political or economic conditions, including the pace of the digital transformation of business in that country or region;?the need to adapt and localize our products for specific countries, including providing customer support in different languages;?greater difficulty collecting accounts receivable and longer payment cycles;?potential changes in trade relations or business practices or preferences as a result of U.S. policy initiatives;?unexpected changes in laws and regulatory requirements, including but not limited to, taxes or trade laws;?more stringent regulations relating to privacy and data security and the unauthorized use of, or access to, commercial and personal information, particularly in Europe;?differing labor regulations, especially in Europe, where labor laws are generally more advantageous to employees as compared to those in the U.S., including deemed hourly wage and overtime regulations in these locations;?challenges inherent in efficiently managing an increased number of employees;?difficulties in managing a business in new markets with diverse cultures, languages, and customs, as well as legal, alternative dispute and regulatory systems;?increased travel, real estate, infrastructure and legal compliance costs associated with international operations;?currency exchange rate fluctuations;?limitations on our ability to reinvest earnings from operations in one country to fund the capital needs of our operations in other countries;?laws and business practices favoring local competitors or general preferences for local vendors;?limited or insufficient intellectual property protection or difficulties enforcing our intellectual property;?regional or global conflicts, including sanctions or other laws and regulations prohibiting or limiting operations in certain jurisdictions;?political instability or terrorist activities;?exposure to liabilities under anti-corruption and anti-money laundering laws, including the U.S. Foreign Corrupt Practices Act of 1977, as amended ("FCPA"), the U.S. domestic bribery statute contained in 18 U.S.C. § 201, the U.S. Travel Act, the U.K. Bribery Act, and similar laws and regulations in other jurisdictions;?adverse tax burdens and foreign exchange controls that could make it difficult to repatriate earnings and cash; and ?exposure to regional or global public health issues, and to travel restrictions and other measures undertaken by governments in response to such issues. Our limited experience in operating our business internationally increases the risk that any potential future expansion efforts that we undertake may not be successful. If we invest substantial time and resources to further expand our international operations and are unable to do so successfully and in a timely manner, our business and operating results will suffer.

We rely heavily on our network infrastructure and information technology systems, including our security-related systems, for our business operations. A disruption or failure of these systems in the event of online attack, earthquake, fire, terrorist attack, public health crisis, power loss, telecommunications failure or other similar catastrophic event, including as a result of the effects of climate change, could cause system interruptions, delays in accessing our service, reputational harm and loss of critical data or could prevent us from providing our products and solutions to our customers. A catastrophic event that results in the destruction or disruption of our data centers, or our network infrastructure or information technology systems, including any errors, defects or failures in third-party hardware, could affect our ability to conduct normal business operations and adversely affect our operating results. Additionally, while we believe our exposure from the recent conflicts in Ukraine and the Middle East is limited, we could experience unanticipated disruptions to our business as a result of current or future regional and global conflicts, including sanctions or other laws and regulations prohibiting or limiting operations in certain jurisdictions, increased risks of potential cyberattacks, related impacts to our customers, or micro- or macro-economic effects on the global economy.

Our sales contracts are primarily denominated in U.S. dollars, and therefore a substantial portion of our revenue is not subject to foreign currency risk. However, a strengthening of the U.S. dollar could increase the real cost of our offerings to our customers outside of the U.S., which could adversely affect our operating results. In addition, an increasing portion of our operating revenues and operating expenses is earned or incurred outside of the U.S., and an increasing portion of our assets is held outside of the U.S. These operating revenues, expenses and assets are denominated in foreign currencies and are subject to fluctuations due to changes in foreign currency exchange rates. If we are not able to successfully manage, or to implement strategies to manage, against the risks associated with currency fluctuations, our operating results could be adversely affected. Additionally, global events as well as geopolitical developments, including regional conflicts in Europe and the Middle East, fluctuating commodity prices, trade tariff developments and inflation have caused, and may in the future cause, global economic uncertainty and uncertainty about the interest rate environment, which could amplify the volatility of currency fluctuations. We have not engaged in the hedging of foreign currency transactions to date, so we may not be able to effectively offset the adverse financial impacts that may result from unfavorable movements in foreign currency exchange rates, which could adversely affect our operating results.

Our success and future growth depend upon the continued services of highly skilled personnel, including our management team and other key employees. Changes in our management team resulting from the hiring or departure of executives and key employees from time to time could disrupt our business. Any future significant leadership changes or senior management transitions involve inherent risk. In addition, executive leadership transition periods can be disruptive and may result in a loss of personnel with deep institutional or technical knowledge, or result in changes to business strategy or objectives, and may negatively impact our operations and relationships with employees and customers due to increased or unanticipated expenses, operational inefficiencies, uncertainty regarding changes in strategy, decreased employee morale and productivity, and increased turnover. Our future success, and our ability to achieve our operational and business objectives, depends in large part on the successful recruitment, integration and continued service of senior management and other key personnel. In particular, we are highly dependent on the services of our senior management team, many of whom are essential to the development of our technology, platform, future vision, and strategic direction. Our senior management and key employees are employed on an at-will basis, meaning that we may terminate their employment at any time, with or without cause, and they may resign at any time, with or without cause. If we lose one or more of our senior management or other key employees and are unable to find adequate replacements, or if we fail to attract, integrate, retain and motivate members of our senior management team and key employees or otherwise fail to retain a significant portion of our workforce, our business could be harmed. We also are dependent on the continued service of our existing software engineers because of the complexity of our products and solutions. In particular, we compete with many other companies for software developers with high levels of experience and skilled sales and operations professionals in a tight U.S. labor market. We also require skilled product development, marketing, sales, finance and operations professionals, and we may not be successful in attracting and retaining the professionals we need, particularly in our principal U.S. locations in the San Francisco Bay Area and Seattle. Additionally, while we currently employ a hybrid model where most employees have the flexibility to work from home, changes to our workplace arrangements could impact our ability to maintain our corporate culture or productivity, increase attrition or limit our ability to attract employees if individuals prefer to work full time at home or in the office. Competition for employees in our industry (and especially with expertise in AI technology and at our principal U.S. locations) is intense, and many of the companies we compete with for experienced personnel have greater resources than we do. To remain competitive, we may experience increased compensation-related expenses.