Dynatrace (DT) Risk Analysis

Patent and other IP disputes are common in the markets in which we compete. Some companies in the markets in which we compete, including some of our competitors, own large numbers of patents, copyrights, trademarks, and trade secrets, which they may use to assert claims of infringement, misappropriation, or other violations of IP rights against us, our partners, our technology partners, or our customers. As the number of patents and competitors in our market increases, allegations of infringement, misappropriation, and other violations of IP rights may also increase. Our broad solution portfolio and the competition in our markets further exacerbate the risk of additional third-party IP claims against us in the future. In addition, non-practicing entities are driving a growing number of patent lawsuits and demands. Any allegation of infringement, misappropriation, or other violation of IP rights by a third party, even those without merit, could cause us to incur substantial costs and resources defending against the claim, could distract our management from our business, and could cause uncertainty among our customers or prospective customers, all of which could have an adverse effect on our business, operating results, and financial condition. We cannot assure you that we are not infringing or otherwise violating any third-party IP rights. Furthermore, third parties that bring allegations against us may have the capability to dedicate substantially greater resources to enforce their IP rights and to defend against similar allegations that may be brought against them than we do. We have received, and may in the future receive, notices alleging that we have misappropriated, misused, or infringed other parties' IP rights, including allegations made by our competitors, and, to the extent we gain greater market visibility, we face a higher risk of being the subject of IP infringement assertions. There also is a market for acquiring third-party IP rights and a competitor, or other entity, could acquire third-party IP rights and pursue similar assertions based on the acquired IP. They may also make such assertions against our customers or partners. An adverse outcome of a dispute may require us to take several adverse steps such as pay substantial damages, including potentially treble damages, if we are found to have willfully infringed a third party's patents or copyrights; cease making, using, selling, licensing, importing, or otherwise commercializing solutions that are alleged to infringe or misappropriate the IP of others; expend additional development resources to attempt to redesign our solutions or otherwise to develop non-infringing technology, which may not be successful; enter into potentially unfavorable royalty or license agreements in order to obtain the right to use necessary technologies or IP rights or have royalty obligations imposed by a court; or indemnify our customers, partners, and other third parties. Any damages or royalty obligations we may become subject to, or any prohibition against our commercializing our solutions as a result of an adverse outcome could harm our business and operating results. Additionally, our agreements with customers and partners include indemnification provisions, under which we agree to indemnify them for losses suffered or incurred as a result of allegations of IP infringement and, in some cases, for damages caused by us to property or persons or other third-party allegations. Furthermore, we have agreed in certain instances to defend our partners against third-party claims asserting infringement of certain IP rights, which may include patents, copyrights, trademarks, or trade secrets, and to pay judgments entered on such assertions. Large indemnity payments could harm our business, operating results, and financial condition.

Our business and continued growth depends on the ability of our customers to access our platform and solutions, particularly our cloud-based solutions, at any time and within an acceptable amount of time. In addition, our ability to access certain third-party SaaS solutions is important to our operations and the delivery of our customer support and professional services, as well as our sales operations. We have experienced, and may in the future experience, service disruptions, outages, and other performance problems both in the delivery of our SaaS solutions, and in third-party SaaS solutions we use due to a variety of factors, including infrastructure changes, malicious actors including disgruntled employees, human or software errors, or capacity constraints. We have experienced disruptions, outages, or performance problems in the past causing some of our services to be unavailable for a limited period of time. While none of these occurrences have been material to our business, future events could be more impactful. As AI technologies are increasingly used and deployed, infrastructure capacity requirements (including network capacity and computing power and energy requirements) may increase and agentic systems may act faster and at greater scale, which could lead to an increase in service interruptions that we experience. We utilize a multi-tenant structure, meaning that generally, our customers are hosted on a shared platform. As such, any interruption in service could affect a significant number of our customers. In some instances, we or our third-party service providers may not be able to identify the cause or causes of these performance problems within an acceptable period of time. It may become increasingly difficult to maintain and improve the performance of our SaaS solutions as they become more complex. If our SaaS solutions are unavailable or degraded or if our customers are unable to access features of our SaaS solutions within a reasonable amount of time or at all, our business would be adversely affected. In addition, if any of the third-party SaaS solutions that we use were to experience a significant or prolonged outage or security breach, our business could be adversely affected. We currently host our Dynatrace solutions on cloud infrastructure hyperscaler providers, such as AWS, Azure and GCP. Our Dynatrace solutions reside on hardware operated by these providers. Our operations depend on protecting the virtual cloud infrastructure hosted by a hyperscaler by maintaining its configuration, architecture, features, and interconnection specifications, as well as the information stored in these virtual data centers and which third-party Internet service providers transmit. Although we have disaster recovery plans, including the use of multiple hyperscaler locations, any incident affecting a hyperscaler's infrastructure that may be caused by fire, flood, severe storm, earthquake, or other natural disasters, actual or threatened public health emergencies, cyber-attacks, terrorist or other attacks, and other similar events beyond our control could negatively affect our platform and our ability to deliver our solutions to our customers. A prolonged hyperscaler service disruption affecting our SaaS platform for any of the foregoing reasons would negatively impact our ability to serve our customers and could damage our reputation with current and potential customers, expose us to liability, cause us to lose customers, or otherwise harm our business. We may also incur significant costs for using alternative equipment or taking other actions in preparation for, or in reaction to, events that damage the hyperscaler services we use. Hyperscalers have the right to terminate our agreements with them upon material uncured breach following prior written notice. If any of our hyperscaler service agreements are terminated, or there is a lapse of service, we would experience interruptions in access to our platform as well as significant delays and additional expense in arranging new facilities and services and/or re-architecting our solutions for deployment on a different cloud infrastructure, which would adversely affect our business, operating results, and financial condition.

Many of our customers are large enterprises, whose purchasing decisions, budget cycles and constraints, and evaluation processes are unpredictable and out of our control. During recessionary times, or when there is volatility or uncertainty in the global economy or in the economies of the countries in which we operate, our sales cycles may be elongated and our customers' purchasing decisions may be delayed or cancelled. In addition, we are experiencing, and we may continue to experience, an increase in the number of large, strategic deals where customers are looking to make broader observability architecture decisions. These deals come with a higher degree of variability, longer sales cycles, greater uncertainty of completing the sale, and specially negotiated terms. The length of our sales cycle, from initial evaluation to payment for our subscriptions, can range from several months to over a year and can vary substantially from customer to customer. Our sales efforts involve significant investment of resources in field sales, partner development, marketing, and educating our customers about the use, technical capabilities, and benefits of our platform and services. Customers often undertake a prolonged evaluation process, which frequently involves not only our platform, but also those of other companies or the consideration of internally developed alternatives, including those using open source software. Some of our customers initially deploy our platform on a limited basis, with no guarantee that they will deploy our platform widely enough across their organization to justify our substantial pre-sales investment. As a result, it is difficult to predict exactly when, or even if, we will make a sale to a potential customer or if we can increase sales to our existing customers. We have experienced seasonal and end-of-quarter concentration of our transactions and variations in the number and size of transactions that close in a particular quarter, which impacts our ability to grow revenue over the long term and plan and manage cash flows and other aspects of our business and cost structure. Our transactions vary by quarter, with the third and fourth fiscal quarters typically being our largest. In addition, within each quarter, a significant portion of our transactions occur in the last two weeks of that quarter. Large individual sales may also occur in quarters subsequent to those we anticipate, which may make it difficult to forecast our expected sales cycle. If expectations for our business turn out to be inaccurate, our revenue growth may be adversely affected over time and we may not be able to adjust our cost structure on a timely basis and our cash flows and results of operations may suffer.

Our solutions are subject to export and import control and economic sanctions laws and regulations, including the U.S. Export Administration Regulations administered by the U.S. Commerce Department's Bureau of Industry and Security and the economic and trade sanctions regulations administered by the U.S. Treasury Department's Office of Foreign Assets Control. Exports, re-exports, and transfers of our software and services, and the transfer or release of our proprietary technology must be made in compliance with these laws and regulations. Obtaining the necessary authorizations, including any required license for a particular sale, may be time consuming, is not guaranteed and may result in the delay or loss of sales opportunities. Various countries regulate the import of encryption technology. Changes in the encryption or other technology incorporated into our solutions or in applicable export or import laws and regulations may delay the introduction and sale of our solutions in international markets, prevent customers from deploying our solutions or, in some cases, prevent the export or import of our solutions to certain countries, regions, governments, or persons altogether. Recently, due in part to the geopolitical landscape and national security concerns, some countries in which Dynatrace operates have increasingly restricted trade. Changes in sanctions, export, or import laws and regulations, in the enforcement or scope of existing laws and regulations, or in the countries, regions, governments, persons, or technologies targeted by such laws and regulations, could also result in decreased use of our solutions or in our ability to sell our solutions in certain countries. Even though we take precautions to prevent our solutions from being provided to restricted countries or persons, our solutions could be provided to those targets by our resellers or customers despite such precautions, and our customers may choose to host their systems including the Dynatrace platform using a hosting vendor that is a restricted person. The decreased use of our solutions or limitation on our ability to export or sell our solutions could adversely affect our business, while violations of these export and import control and economic sanctions laws and regulations could have negative consequences for us and our personnel, including government investigations, administrative fines, civil and criminal penalties, denial of export privileges, suspension or debarment from government contracts for a time, incarceration, and reputational harm.

We are subject to U.S. federal, state, and international laws, regulations, and standards relating to the collection, use, disclosure, retention, security, transfer, and other processing of personal data. The legal and regulatory frameworks for privacy, data protection and security issues worldwide are rapidly evolving and as a result, implementation standards, potential fines, enforcement practices, and litigation risks are likely to remain uncertain for the foreseeable future. - In the United States, state legislatures continue to propose and pass comprehensive privacy legislation, including data breach notification laws, personal data privacy laws, and consumer protection laws. For example, the California Consumer Privacy Act ("CCPA"), as amended by the California Privacy Rights Act, gives California residents rights to access and delete their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used. The CCPA also provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. The CCPA has prompted a number of proposals for new federal and state-level privacy legislation, and in some states, efforts to pass comprehensive privacy laws have been successful. To date, numerous other states have enacted laws that impose privacy obligations that are similar to the CCPA and we also anticipate that more states will pass similar legislation. The existence of comprehensive privacy laws in different states in the country will add additional complexity, variation in requirements, restrictions, and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data, and has resulted in and will result in increased compliance costs and/or changes in business practices and policies. - Plaintiffs' attorneys have sent demand letters and initiated claims and class action lawsuits alleging that companies' uses of online trackers, such as cookies and pixels, constitutes a violation of state wiretapping laws, primarily the California Invasion of Privacy Act. To date, companies have settled most of these claims, though a risk of costly legal proceedings now exists for business practices that are common. We have been subject to some of these actions and may become subject to additional such actions in the future. - Outside of the United States, virtually every jurisdiction in which we operate has established its own privacy, data protection and/or data security legal framework with which we or our customers must comply, including, but not limited to, the EU and United Kingdom ("UK"). ?In the EU and UK, data protection laws are stringent and continue to evolve, resulting in possible significant operational costs for internal compliance and risk to our business. The EU has adopted the EU GDPR, and the UK has incorporated the EU GDPR into its national laws ("UK GDPR", together with EU GDPR referred to as GDPR) which imposes strict obligations on the processing of personal data. These requirements encompass: (i) providing information to individuals regarding data processing activities; (ii) ensuring a legal basis or condition applies to the processing of personal data and, where applicable, obtaining consent from individuals to whom the data processing relates; (iii) responding to data subject requests; (iv) imposing requirements to notify the competent national data protection authorities and data subjects of personal data breaches; (v) implementing safeguards in connection with the security and confidentiality of the personal data; (vi) accountability requirements; and (vii) taking certain measures when engaging third-party processors. Serious breaches of the GDPR may result in monetary penalties of up to €20 million (or £17.5 million in the UK) or 4% of worldwide annual revenue, whichever is greater, for violations. In addition to the GDPR, other European legislative proposals and current laws and regulations apply to cookies and similar tracking technologies, electronic communications, and marketing, with an increased focus on online behavioral advertising. ?Many jurisdictions outside of Europe where we do business directly or through resellers today and may seek to expand our business in the future, are also considering or have enacted comprehensive data protection legislation, cybersecurity legislation, or both. These include Australia, Brazil, China, Japan, Mexico, Saudi Arabia, Singapore, and United Arab Emirates. - We are subject to various data transfer rules related to our ability to transfer data from one country to another. For example, regulators and legislators in the U.S. are increasingly scrutinizing and restricting certain personal data transfers and transactions involving foreign countries. For example, the U.S. Department of Justice's January 8, 2025 rule on "Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons" prohibits data brokerage transactions involving certain sensitive personal data categories, including health data, genetic data, and biospecimens, to countries of concern, including China. The regulations also restrict certain investment agreements, employment agreements and vendor agreements involving such data and countries of concern, absent specified cybersecurity controls. Actual or alleged violations of these regulations may be punishable by criminal and/or civil sanctions and may result in exclusion from participation in federal and state programs. These restrictions limit our ability to transfer certain data or require us to guarantee a certain level of protection when transferring data from one country to another. - We are also subject to data localization laws in certain countries that may, for example, require personal information of citizens to be collected, stored, and modified only within that country. These and similar regulations may interfere with our intended business activities, inhibit our ability to expand into those markets, require modifications to our offerings or services, or prohibit us from continuing to offer services in those markets without significant additional costs. The regulatory framework both in the United States and internationally governing the collection, processing, storage, use and sharing of certain information, particularly financial and other personal information, is rapidly evolving and is likely to continue to be subject to uncertainty and varying interpretations. It is possible that these laws may be interpreted and applied in a manner that is inconsistent with laws in other jurisdictions or which our existing data management practices or the features of our services and platform capabilities. We therefore cannot yet fully determine the impact these or future laws, rules, regulations, and industry standards may have on our business or operations. In addition to the laws and regulations to which we are subject regarding the collection, processing, storage, use, and sharing of certain information, our contracts with customers include specific obligations regarding the protection of confidentiality and the permitted uses of personally identifiable and other proprietary information. We also publicly post documentation regarding our practices concerning the collection, processing, use, and disclosure of data. Although we endeavor to comply with our published policies and documentation and the various laws and regulations that we are subject to, we may at times fail to do so or be alleged to have failed to do so. Any failure or perceived failure by us, or any third parties with which we do business, to comply with our posted privacy policies and product documentation or privacy laws or regulations, changing consumer expectations, evolving laws, rules, and regulations, industry standards, or contractual obligations to which we or such third parties are or may become subject, may result in actions or other claims against us by governmental entities or private actors, the expenditure of substantial costs, time and other resources or the imposition of significant fines, penalties or other liabilities, which could, individually or in the aggregate, materially and adversely affect our business, financial condition, and results of operations. In addition, any such action, particularly to the extent we were found to be guilty of violations or otherwise liable for damages, would damage our reputation and adversely affect our business, financial condition, and results of operations. Additionally, our customers may be subject to differing privacy laws, rules, and legislation, which may mean that they require us to be bound by varying contractual requirements applicable to certain other jurisdictions. Adherence to such contractual requirements may impact our collection, use, processing, storage, sharing, and disclosure of various types of information, including financial information and other personal information, and may mean we become bound by, or voluntarily comply with, self-regulatory or other industry standards relating to these matters that may further change as laws, rules, and regulations evolve. Complying with these requirements and changing our policies and practices may be onerous and costly, and we may not be able to respond quickly or effectively to regulatory, legislative, and other developments. These changes may in turn impair our ability to offer our existing or planned features, products, and services and/or increase our cost of doing business. As we expand our customer base, these requirements may vary from customer to customer, further increasing the cost of compliance and doing business.

Our ability to succeed depends in significant part on the experience and expertise of our senior management team. From time to time, there may be changes in our senior management team resulting from the hiring or departure of executives. In the last three years, we hired a new Chief People Officer, Chief Customer Officer, Chief Revenue Officer, Chief Marketing Officer, and various new sales and marketing leaders in their organizations, among other leadership changes. Our employment agreements with members of our senior management team do not require them to remain employed with us for any specified period. Accordingly, and despite our efforts to retain our senior management team, they could terminate their employment with us at any time, subject to any applicable notice period. The loss of a member of senior management team could disrupt our operations and negatively impact employee morale and our culture. After their termination, such person could go to work for one of our competitors after the expiration of any applicable non-compete period, and the restrictions on non-competition may in any case be difficult to enforce depending on the circumstances. The loss of members of our senior management team, particularly if closely grouped, could disrupt our operations, negatively impact employee morale and our culture, and adversely affect our ability to formulate and execute our business plan and thus, our business, operating results, and prospects could be adversely affected. If we fail to develop effective succession plans for our senior management team, and to identify, recruit, onboard, train and integrate strategic hires, our business, operating results, and financial condition could be adversely affected.