Fastly (FSLY) Risk Analysis

We receive, store, process, collect, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share information that relates to individuals and/or constitutes "personal data," "personal information," "personally identifiable information," or similar terms under applicable data privacy laws (collectively, "Personal Information"). Our handling of Personal Information is subject to a variety of obligations related to privacy and data security, including laws and regulations, contractual obligations, internal and external privacy policies, guidance, industry standards, and other obligations that govern the processing of Personal Information. Additionally, we are or may become subject to other laws and regulations around the world with respect to the Internet related to, among other things, content moderation, security requirements, critical infrastructure designations, Internet resiliency, law enforcement access to information, net neutrality, data localization requirements, and restrictions on social media or other content. For example, in the United States, federal, state, and local governments have enacted numerous privacy and data security laws, including data breach notification laws, Personal Information privacy laws, consumer protection laws (e.g., Section 5 of the FTC Act), and other similar laws (e.g., wiretapping laws). In the past few years, numerous U.S. states have enacted comprehensive privacy and data security laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their Personal Information. As applicable, such rights may include the right to access, correct, or delete certain Personal Information, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain Personal Information, including sensitive Personal Information, such as conducting data privacy impact assessments or requiring prior consent. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020, collectively ("CCPA") applies to Personal Information of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights related to their Personal Information. The CCPA allows for statutory fines for noncompliance (up to $7,988 per violation), as well as a private right of action for individuals affected by certain data breaches to recover significant statutory damages. Similar laws have been enacted in numerous other states, and proposed at the federal and local levels, and we expect more states to pass similar laws in the future, which could increase our compliance costs and adversely affect our business. Outside of the United States, an increasing number of foreign laws and regulations apply to privacy and data security. For example, the European Union's General Data Protection Regulation ("EU GDPR"), the United Kingdom's GDPR ("UK GDPR" and collectively "GDPR"), Brazil's General Data Protection Law (Lei Geral de Proteção de Dados Pessoais) (Law No. 13,709/2018), Canada's Personal Information Protection and Electronic Documents Act and Canada's Anti-Spam Legislation, and China's Personal Information Protection Law impose strict requirements for processing the Personal Information of individuals. Since we are under the supervision of relevant data protection authorities in both the EEA and the UK, we may be fined under both the EU GDPR and UK GDPR for the same breach. Penalties for certain breaches are up to the greater of EUR 20 million / GBP 17.5 million or 4% of our global annual turnover. In addition to fines, a breach of the GDPR may result in regulatory investigations, reputational damage, orders to cease or change our data processing activities, enforcement notices, assessment notices for a compulsory audit and/or civil claims (including class actions). We may also become subject to new laws in the EU that regulate cybersecurity and non-personal information. For example, the European Union Data Act ("Data Act") became applicable in September 2025. The Data Act establishes new requirements for providers of data processing services (including cloud and SaaS) into the EU. The Data Act requires providers to enable customers to switch to other providers or on-premise solutions and to port customer data within certain timeframes; remove technical, contractual, and commercial obstacles to service switching (including switching charges); and include certain mandatory terms in customer contracts. Failure to comply with the Data Act can result in regulatory enforcement and fines, civil claims, and reputational damage. Depending on how all these laws are interpreted, we may have to adapt our business practices and products to comply with such obligations. In relation to such cross border transfers of personal data, we expect the existing legal complexity and uncertainty regarding international personal data transfers to continue, and international transfers to the United States and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators. As the regulatory guidance and enforcement landscape in relation to data transfers continue to develop, we could suffer additional costs, complaints and/or regulatory investigations or fines; we may have to stop using certain tools and vendors and make other operational changes; we may have to implement alternative data transfer mechanisms under the GDPR and/or take additional compliance and operational measures; and/or it could otherwise affect the manner in which we provide our services, and could adversely affect our business, operations and financial condition. In relation to data transfers from the EEA to the United States, the EU-US Data Privacy Framework ("DPF") was approved by the European Commission in July 2023 as an effective EU GDPR data transfer mechanism to U.S. entities self-certified under the DPF. The UK Extension to the DPF followed in October 2023, as an effective UK GDPR data transfer mechanism to U.S. entities self-certified under the UK Extension to the DPF. In addition to government regulation, privacy advocates, and industry groups may propose new and different self-regulatory standards that may apply to us. We may publish privacy policies, marketing materials and other statements, such as compliance with certain certifications or self-regulatory principles, regarding privacy and data security. If these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences. We may also be bound by contractual obligations related to privacy and data security, and our efforts to comply with such obligations may not be successful. For example, certain privacy and data security laws, such as the GDPR and the CCPA, require our customers to impose specific contractual restrictions on their service providers. Additionally, in limited circumstances, under various privacy and data security laws and other obligations, we may be required to obtain certain consents to process Personal Information. Our inability or failure to do so could result in adverse consequences. Laws relating to the liability of providers of online services for activities of their users and other third parties are currently being tested by a number of claims, including actions based on invasion of privacy and other torts, unfair competition, copyright and trademark infringement, and other theories based on the nature and content of the materials searched, the ads posted, or the content provided by users. Outages of our platform may draw additional scrutiny or focused legislation from regulators. In addition, the United States or foreign jurisdictions may establish new laws or regulations regarding the Internet or online services. These new laws and regulations may affect our products and infrastructure, which could cause us to incur substantial costs to comply, expose us to regulatory scrutiny, criminal or civil liability, require us to fundamentally change our products or operations, or otherwise have an adverse effect on our business. Obligations relating to privacy and data security (and customers' data privacy expectations) are evolving, increasingly stringent, and create uncertainty, and may result in increasing scrutiny. Such obligations may be subject to different applications and interpretations, and which may be inconsistent and conflicting among different jurisdictions. Preparing for and complying with these obligations require us to devote significant resources and may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process Personal Information on our behalf. Because the interpretation and application of privacy and data security related obligations are uncertain, they may be interpreted or applied in a manner that is inconsistent with our existing data management practices or the functionality of our platform. We could be required to fundamentally change our business activities and practices or modify our software, which could have an adverse effect on our business. Future restrictions on the collection, use, sharing, or disclosure of data or additional requirements for express or implied consent of our customers, partners, or end users for the use and disclosure of such information could require us to incur additional costs or modify our platform, possibly in a material manner, and could limit our ability to develop new functionality. We may at times fail (or be perceived to have failed) in our efforts to comply with our privacy and data security obligations or other laws and regulations with respect to the Internet. Moreover, despite our efforts, our personnel or third parties on whom we rely may fail to comply with such obligations, which could negatively impact our business operations. Any failure or perceived failure by us or third parties upon whom we rely to comply with obligations, relating to privacy and data security or the Internet may result in significant consequences including but not limited to reputational harm, governmental investigations and enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar), litigation (including class-action claims), additional reporting requirements and/or oversight, bans on processing Personal Information, and orders to destroy or not use Personal Information. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to: loss of customers; interruptions or stoppages in our business operations; inability to process personal information or to operate in certain jurisdictions; limited ability to develop or commercialize our products; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or substantial changes to our business model or operations.

We are expanding our international operations and staff to better support our growth into international markets. Our corporate structure and associated transfer pricing policies contemplate future growth into the international markets, and consider the functions, risks, and assets of the various entities involved in the intercompany transactions. The amount of taxes we pay in different jurisdictions may depend on: the application of the tax laws of the various jurisdictions, including the United States, to our international business activities; changes in tax rates; new or revised tax laws or interpretations of existing tax laws and policies; and our ability to operate our business in a manner consistent with our corporate structure and intercompany arrangements. The taxing authorities of the jurisdictions in which we operate may challenge our methodologies for pricing intercompany transactions pursuant to our intercompany arrangements or disagree with our determinations as to the income and expenses attributable to specific jurisdictions. If such a challenge or disagreement were to occur, and our position was not sustained, we could be required to pay additional taxes, interest, and penalties, which could result in one-time tax charges, higher effective tax rates, reduced cash flows, and lower overall profitability of our operations. Our financial statements could fail to reflect adequate reserves to cover such a contingency.

The market in which we compete is relatively new and subject to rapid technological change, evolving industry standards and regulatory changes, as well as changing customer needs, requirements, and preferences. The success of our business will depend, in part, on our ability to adapt and respond effectively to these changes on a timely basis. If we are unable to develop and sell new products that satisfy and are adopted by our customers and provide enhancements, new features, and capabilities to our platform that keep pace with rapid technological and industry change, our revenue and operating results could be adversely affected. Further, some of our prospective customers may require custom development of features as part of their purchase decision, or our existing customers may require us to develop custom features. If we are unable to meet their requirements, they may look to our competitors or internal solutions that eliminate reliance on third-party providers, and our revenue and operating results could be adversely affected. Further, prioritizing such custom features can be difficult to adapt to other customers and may require significant engineering resources. If new technologies emerge that enable large Internet platform companies to utilize their own data centers and implement delivery approaches that limit or eliminate reliance on third-party providers like us, or that enable our competitors to deliver competitive products and applications at lower prices, more efficiently, more conveniently, or more securely, such technologies could adversely impact our ability to compete. If our platform does not allow us or our customers to comply with the latest regulatory requirements, our existing customers may decrease their usage on our platform or leave our platform and new customers will be less likely to adopt our platform. Our platform must also integrate with a variety of network, hardware, mobile, and software platforms and technologies, and we need to continuously modify and enhance our products and platform capabilities to adapt to changes and innovation in these technologies. If developers widely adopt new software platforms, we would have to attempt to develop new versions of our products and enhance our platform's capabilities to work with those new platforms. These development efforts may require significant engineering, marketing, and sales resources, all of which would affect our business and operating results. Any failure of our platform's capabilities to operate effectively with future infrastructure platforms, technologies, and software platforms could reduce the demand for our platform. If we are unable to respond to these changes in a cost-effective manner, our products may become less marketable and less competitive or obsolete, and our business may be harmed. In particular, the market for AI solutions is evolving rapidly. We may not be successful in our AI initiatives or our competitors may incorporate AI into their products or market their AI solutions more successfully than us, which could adversely affect our business (such as by impairing our ability to compete effectively against our competitors), reputation, or financial results. For example, we may encounter challenges such as a lack of talented personnel, inability to secure necessary infrastructure, or the possibility that the AI products we utilize or develop may not deliver their intended value. Each of these challenges would adversely impact our ability to effectively execute our strategy of leveraging AI in our products and to enhance our business operations. In addition to ongoing investments to use AI to enhance our business operations, we are enabling AI workloads for our customers and leveraging AI in a manner that is designed to enhance our platform's usability and capabilities. However, our AI-focused products and services may not be successful or may fail to meet customer expectations, which could impair our ability to compete effectively and adversely affect our financial results. In addition, AI may change the way our industry identifies and responds to cybersecurity threats, and businesses that are slow or fail to adopt or offer new technologies to address increased cybersecurity threats may face a competitive disadvantage. If we are unable to use AI effectively or use AI less successfully than our competitors, it could impair our ability to compete effectively against our competitors, adversely affect our business and result in competitive disadvantages. Moreover, our platform is highly technical and complex. For example, our delivery products may rely on knowledge of Varnish Configuration Language ("VCL") to utilize certain features. Potential developers may be unfamiliar or opposed to working with VCL and therefore decide to not adopt our platform, which may harm our business.

Our industry is characterized by the existence of a large number of patents, copyrights, trademarks, trade secrets, and other intellectual property rights. From time to time, we may be required to defend against litigation claims by other companies based on allegations of infringement or other violations of their intellectual property rights. Many of these companies have the capability to dedicate substantially greater resources than us to enforce their intellectual property rights and to defend claims that may be brought against them. Therefore, we may not be able to withstand any such third-party intellectual property claims. In addition, we may be required to defend against litigation claims by patent holding companies or other adverse patent owners that have no relevant product revenue. If a third party is able to obtain an injunction preventing us from accessing such third-party intellectual property rights, or if we cannot license or develop technology for any infringing aspect of our business, we would be forced to limit or stop selling products impacted by the claim or injunction or cease business activities covered by such intellectual property, and may be unable to compete effectively. Any inability to license third-party technology in the future would have an adverse effect on our business and operating results, and would adversely affect our ability to compete. We may also be contractually obligated to indemnify our customers or other third parties in the event of a claim of infringement of a third party's intellectual property rights. We receive demands for such indemnification from time to time and expect to continue to do so. Responding to and defending such claims, regardless of their merit, can be time consuming, costly, distracting to our management and damage our reputation, business, and brand. Lawsuits are time-consuming and expensive to resolve and they divert management's time and attention. Although we carry insurance, our insurance may not cover potential claims of this type or may not be adequate to indemnify us for all liability that may be imposed. We cannot predict the outcome of lawsuits, and the results of any such actions may harm our business.

Our business depends on providing our customers with fast, efficient, and reliable distribution of applications and content over the Internet, and we rely on IT Systems to provide our products and services, including for internal and external operations that are critical to our business. "IT Systems" includes computer systems, hardware, software, technology infrastructure and websites and networks. In the ordinary course of business, we and the third parties upon which we rely, collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share Sensitive Information. "Sensitive Information" includes our, our customers', and our customers' end users' proprietary, confidential, and sensitive data, including personal information, intellectual property, trade secrets, and encryption keys. Maintaining the security and availability of our platform, IT Systems, and Sensitive Information is a critical issue for us and our customers, and we expend significant resources, and may need to fundamentally change our business activities and modify our practices and operations, in an effort to protect against security incidents and to mitigate, detect, and remediate actual and potential vulnerabilities. Cyber-attacks, malicious Internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our Sensitive Information and IT Systems, and those of the third parties upon which we rely. Such threats are prevalent and continue to become more so. They are difficult to detect, and come from a variety of sources and threat actors, including "hacktivists," personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors. Some threat actors engage in cyber-attacks for geopolitical reasons and in conjunction with military conflicts and defense activities. We have in the past been subject to cyber-attacks from third parties, including parties who we believe are sponsored by government actors. Since our customers share our multi-tenant architecture, cyber-attacks on any one of our customers could have a negative effect on our other customers. In the past, these attacks have significantly increased the bandwidth used on our platform and have strained our network. During times of war and other major conflicts, we, the third parties upon which we rely, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our IT Systems and operations, supply chain, and ability to produce, sell, and distribute our services. We and the third parties upon which we rely are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code, malware (including as a result of advanced persistent threat intrusions), DDoS attacks, account takeover attacks, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, attacks facilitated or enhanced by AI such as prompt injection or AI model inversion attacks, loss of data or other information technology assets, adware, telecommunications failures, natural disasters, and other similar threats. For example, we have experienced DDoS attacks of significant size and severity that caused us to invest resources into improving our systems, and we expect to continue to be subject to DDoS and other forms of attacks in the future, particularly as they have become more prevalent in our industry. Similarly, we have been the target of phishing and social engineering schemes that may be designed to, among other things, improperly gain access to our Sensitive Information or fraudulently obtain payments or funds from us. Further, we are not immune from the possibility of a malicious insider compromising our IT Systems or misappropriating our Sensitive Information. In particular, severe ransomware attacks are becoming increasingly prevalent, and can lead to significant interruptions in our operations, compromise of our or our service providers' IT Systems, loss of Sensitive Information and revenue, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to a number of factors, including applicable laws or regulations prohibiting such payments. We are incorporated into the supply chain of a number of companies worldwide and, as a result, if our services are compromised, a significant number or, in some instances, all of our customers and their data could be simultaneously affected. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties' infrastructure in our supply chain or our third-party partners' supply chains have not been compromised. The potential liability and associated consequences we could suffer as a result of such a large-scale event could be catastrophic and result in irreparable harm. Future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our IT Systems could be negatively affected by vulnerabilities present in acquired or integrated entities' systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our IT Systems and security program. We rely on third-party service providers and technologies to operate critical IT Systems and to process Sensitive Information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, content delivery to customers, and other functions. Like many other companies, our ability to monitor third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy and data security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. Any adverse impact to the availability, integrity, or confidentiality of our Sensitive Information or IT Systems, including as a result of the previously identified or similar threats, could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our Sensitive Information or our IT Systems, or those of the third parties upon whom we rely. A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely) to provide our platform, products and services. In addition, as we expand our emphasis on selling security-related products, we may become a more attractive target for attacks on our infrastructure intended to destabilize, overwhelm, or shut down our platform. For example, we have had security incidents in the past that have tested the limits of our infrastructure and impacted the performance of our platform. In addition to experiencing a security incident, third parties may gather, collect, or infer Sensitive Information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. Further, Sensitive Information of the Company or our customers could be leaked, disclosed, or revealed as a result of or in connection with our employees', personnel's, or vendors' use of generative AI technologies. Moreover, certain privacy and data security obligations may require us to implement and maintain specific or industry-standard or reasonable security measures to protect our IT Systems and Sensitive Information, and a failure to do so could result in material financial penalties and other materially adverse consequences. While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. Additionally, we may not be able to detect and remediate all vulnerabilities because the threats and techniques used to exploit the vulnerability change frequently and are often sophisticated in nature. For example, as new technology, particularly AI, makes it easier to detect and understand vulnerabilities, it may become easier for third parties to exploit such vulnerabilities. These vulnerabilities pose material risks to our business, and they may not be detected until after a security incident has occurred or at all. Further, we may need to dedicate greater time and resources to vulnerability detection and remediation than in the past and may experience delays in developing and deploying more advanced measures designed to detect and remediate any identified vulnerabilities. Applicable privacy and data security obligations may require us to notify relevant stakeholders, including affected individuals, customers, regulators, and investors of security incidents. For example, SEC rules require disclosure on Form 8-K of the nature, scope and timing of any material cybersecurity incident and the reasonably likely impact of such incident. Compliance with such disclosure efforts is costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences. If we (or a third party upon whom we rely) experience any adverse impact to the availability, integrity, or confidentiality of our IT Systems or Sensitive Information, we may experience adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight, restrictions on processing Sensitive Information (including personal data); litigation (including class action claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions or degradation of performance in our services (including availability of data); financial loss; and other similar harms. Security incidents and attendant consequences may also impact customers' systems and data, and cause customers to stop using our platform, products, and services, cause us to offer pricing and other concessions, deter new customers from using our platform, products, and services, result in litigation, and negatively impact our ability to grow and operate our business. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our privacy and data security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and data security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.

Our customers must have Internet access in order to use our platform. Some Internet providers may take measures that affect their customers' ability to use our platform, such as degrading the quality of the content we transmit over their lines, giving that content lower priority, giving other content higher priority than ours, blocking our content entirely, or attempting to charge their customers more for using our platform. In January 2018, the Federal Communications Commission (the "FCC"), repealed the "network neutrality" rules adopted during the Obama Administration, which barred Internet service providers from blocking or slowing down access to online content, protecting services like ours from such interference. The 2018 decision was largely affirmed by the United States Court of Appeals for the District of Columbia Circuit, subject to a remand to consider several issues raised by parties that supported network neutrality, and in November 2020 the FCC affirmed its decision to repeal the rules. On October 19, 2023, the FCC adopted a notice of proposed rulemaking that would reinstate the network neutrality rules, and asked for comment on that proposal and on potential changes to those rules. On April 25, 2024, the FCC voted to restore the network neutrality rules which bring back a national standard for broadband reliability, security, and consumer protection. On August 1, 2024, the United States Court of Appeals for the Sixth Circuit granted a stay of the network neutrality rules. On January 2, 2025, the United States Court of Appeals for the Sixth Circuit struck down the FCC's network neutrality rules, ruling that the FCC lacks statutory authority to impose its proposed net neutrality policies and therefore exceeded its authority in imposing the net neutrality regulations. We cannot predict the impact of such rules or the outcome of any legal challenges to such rules on our operations or business. A number of states have adopted or are adopting or considering legislation or executive actions that would regulate the conduct of broadband providers. For example, California, Vermont, and Maine have state-specific network neutrality laws in effect. In addition, the status of state regimes may be affected by the FCC's action in its new network neutrality proceeding. We cannot predict whether any FCC order or other state initiatives will be enforced, modified, overturned, or vacated by legal action of the court, federal legislation, or the FCC. To the extent network operators attempt to interfere with our platform, absent network neutrality rules, attempt to interfere with our services, extract fees from us to deliver our platform, or otherwise engage in discriminatory practices, our business could be adversely impacted. Within such a regulatory environment, we could experience discriminatory or anti-competitive practices that could impede our domestic and international growth, cause us to incur additional expense, or otherwise harm our business. At the same time, re-adoption of network neutrality rules could affect the services used by us and our customers by restricting the offerings made by Internet service providers or reducing their incentives to invest in their networks. Such actions could limit or reduce the quality of Internet access services and have an adverse impact on the quality of the services we provide to our customers.

To meet our customers' rapidly evolving demands, we invest substantial resources in research and development of enhanced products to incorporate additional functionality or expand the use cases that our platform addresses. Maintaining adequate research and development resources, such as the appropriate personnel and development technology, to meet the demands of the market is essential. If we are unable to develop products internally due to inadequate or ineffective research and development resources, we may not be able to address our customers' needs on a timely basis or at all. In addition, if we seek to supplement our research and development capabilities or the breadth of our products through acquisitions, such acquisitions could be expensive and we may not successfully integrate acquired technologies or businesses into our business. When we develop or acquire new or enhanced products, we typically incur expenses and expend resources upfront to develop, market, promote, and sell the new offering. Therefore, when we develop or acquire and introduce new or enhanced products, they must achieve high levels of market acceptance in order to justify the amount of our investment in developing or acquiring and bringing them to market. Our new products or enhancements and changes to our existing products could fail to attain sufficient market acceptance for many reasons, including: - failure to predict market demand for functionality accurately and a failure to supply products that meet this demand in a timely fashion;- defects, errors, or failures;- negative publicity about our platform's performance or effectiveness;- changes in the legal or regulatory requirements, or increased legal or regulatory scrutiny, adversely affecting our platform;- emergence of a competitor that achieves market acceptance before we do;- delays in releasing enhancements to our platform to the market; and - introduction or anticipated introduction of competing products by our competitors. If our platform and any future enhancements do not achieve adequate acceptance in the market, or if products and technologies developed by others achieve greater acceptance in the market, our business could be harmed. Beyond overall acceptance of our platform by our customers, it is important that we maintain and grow acceptance of our platform among the developers that work for our customers. We rely on developers to choose our platform over other options they may have, and to continue to use and promote our platform as they move between companies. These developers often make design decisions and influence the product and vendor processes within our customers. If we fail to gain or maintain their acceptance of our platform, our business would be harmed.

To grow our business, we must continue to attract new customers, in particular, large customers, and generate revenue from those new customers. To do so, we must successfully convince potential customers of the benefits and the value of our platform. This may require significant and costly sales efforts that are targeted at larger enterprises and senior management of these potential customers. Sales to large customers may involve longer sales cycles as a result of customers requiring considerable time to evaluate our platform, requiring participation in a competitive purchasing process, having more formal processes for approval of purchases, and more complex requirements. These factors significantly impact our ability to add new customers and increase the time, resources, and sophistication required to do so. In addition, numerous other factors, some of which are out of our control, may now or in the future impact our ability to acquire new customers, including potential customers' commitments to other providers, real or perceived costs of switching to our platform, our failure to expand, retain, and motivate our sales and marketing personnel, our failure to develop or expand relationships with potential customers and channel partners, failure by us to help our customers to successfully deploy our platform, negative media or industry or financial analyst commentary regarding us or our solutions, litigation, and deteriorating general economic conditions. If we fail to attract new customers, particularly large customers, as a result of these and other factors our business will likely be harmed. In addition, our ability to grow and generate incremental revenue depends on our ability to maintain and grow our relationships with our existing large customers so that they continue and increase their usage of our platform. If these customers do not maintain and increase their usage of our platform, our revenue may decline and our results of operations will likely be harmed. For some of our products, we charge our customers based on their usage of our platform. Most of our customers, including some of our largest large customers, do not have long-term contractual financial commitments to us. Some of our customers, who generally do not include our large customers, enter into "click-through" agreements with us via our self-service model, and agree to a minimum monthly fee by signing up online with a credit card, and can easily terminate their subscriptions, or switch to a less expensive plan, at will with little advance notice. In addition, most of our current customer contracts are only one year in duration and these customers may not use our platform in a subsequent year. In order for us to maintain or improve our results of operations, it is important that our customers, in particular, our large customers, use our platform in excess of their commitment levels, if any, and continue to use our platform on the same or more favorable terms. Our ability to retain our largest customers and expand their usage could be impaired for a variety of reasons, including customer budget constraints, customer satisfaction, changes in our customers' underlying businesses, changes in the type and size of our customers, pricing changes, competitive conditions (including customers building their own CDNs), the acquisition of our customers by other companies, governmental actions, or the possibility thereof, and general economic conditions. Because many of our largest customers' minimum usage commitments for our platform are relatively low compared to their expected usage, it can be easy for certain customers to quickly reallocate usage or switch from our platform to an alternative platform altogether. In addition, certain customers may reduce or cease their use of our products at any time without penalty or termination charges, even after they have expanded usage in prior periods. We base our decisions about expense levels and investments on estimates of our future revenue and anticipated rate of growth. Many of our expenses are fixed cost in nature for some minimum amount of time, such as colocation and bandwidth, so if we do experience slower usage growth on our platform it may not be possible to reduce costs in a timely manner or without the payment of fees to exit certain obligations early. If any of these events were to occur, our business may be harmed. In addition, many of our customers have negotiated and may continue to negotiate lower rates in exchange for an agreement to renew, expand their usage in the future, or adopt new products. As a result, in certain cases, even though customers have not reduced their usage of our platform, the revenue we derive from that usage has decreased. If our platform usage or revenue fall significantly below the expectations of the public market, securities analysts, or investors, our business would be harmed, which could cause our stock price to decline. Our future success also depends in part on our ability to expand our existing customer relationships, in particular, with large customers, by increasing their usage of our platform, selling them additional products and upgrading their existing products. The rate at which our customers increase their usage of our platform and purchase products from us depends on a number of factors, including our ability to grow our platform and maintain the security and availability of it, develop and deliver new features and products, maintain customer satisfaction, general economic conditions and pricing and services offered by our competitors. If our efforts to increase usage of our platform by, or sell new and additional products to, our large customers are not successful, our business would be harmed. In addition, even if our largest customers increase their usage of our platform, we cannot guarantee that they will maintain those usage levels for any meaningful period of time. In addition, because many of our products endeavor to deliver increased efficiency and functionality, the successful sale of a new or additional product to an existing customer could result in a reduction of the customer's overall usage of our platform.

We believe that our success has depended, and continues to depend, on the efforts and talents of senior management and key employees, including Artur Bergman, our Chief Technology Officer. There have been, and from time to time, there may continue to be, changes in our management team resulting from the hiring or departure of executives and key employees, or the transition of executives within our business, which could disrupt our business. For example, Charles Compton began serving as our new Chief Executive Officer, replacing Todd Nightingale, effective June 16, 2025. Such changes in our executive management team may be disruptive to our business. Some of our executive officers and members of our management team have been with us for a short period of time and we continue to develop key functions within various aspects of our business. We are also dependent on the continued service of our existing software engineers because of the complexity of our platform. Our senior management, including Mr. Compton and Mr. Bergman, and key employees are employed on an at-will basis. We cannot ensure that we will be able to retain the services of any member of our senior management or other key employees or that we would be able to timely replace members of our senior management or other key employees should any of them depart. The loss of one or more of our senior management or other key employees could harm our business.

Our business depends on the timely supply of certain parts and components to construct our servers or POPs. We rely on a limited number of suppliers for several components of the equipment we use to operate our network and provide products to our customers. Our reliance on these suppliers exposes us to risks including reduced control over production costs and constraints based on the then current availability, terms, and pricing of these components, including pricing changes as a result of inflationary pressures. The technology industry has experienced and may continue to experience widespread component shortages and delivery delays, including as a result of geopolitical conflict, public health crises, and natural disasters. We have experienced, and may continue to experience, component shortages and pricing increases from certain of our suppliers as a result of increased demand for such components. Moreover, geopolitical conflicts, including international trade disputes, may disrupt or delay our supply chain for these components or lead to pricing increases. For example, the United States has imposed or indicated an intention to impose tariffs on certain countries which may lead to retaliatory actions such as counter-tariffs and increase production costs and disruptions in our supply chain. The United States and other jurisdictions have also leveraged various trade and value chain requirements, including on environmental and social criteria, which may make sourcing more costly, require us to change suppliers, or otherwise adversely impact our operations. Further, it is possible that government policy changes, including policy changes made with little to no advance notice, and related uncertainty about policy changes could increase market volatility. If our supply of certain components is further disrupted or delayed, there can be no assurance that we will be able to obtain adequate replacements for the existing components or that supplies will be available on terms and prices that are favorable to us, if at all. Any disruption or delay in the supply of our hardware components has in the past and may in the future limit capacity expansion or replacement of defective or obsolete equipment or cause other constraints on our operations that could damage our customer relationships and harm our business. To ensure adequate supply of parts and components, we must forecast server needs and expenses and place orders sufficiently in advance with our suppliers based on estimates of future demand for network capacity. As we continue to experience growth, we may face challenges managing adequate server capacity due to potential component delays, shortages, price increases, hardware efficiencies gained through internal development, or any potential changes in server architecture including due to technological advances or obsolescence. For example, as a result of increasing deployment and adoption of artificial intelligence ("AI") technologies, demand for network capacity may increase and our server needs and expenses may increase as a result. Additionally, increased energy consumption, including as a result of AI adoption, climate-related events, energy market volatility, and power grid disruptions, may increase energy prices, which could cause increases in the operational costs related to our servers and POPs. We may incur charges in future periods related to server management or incorrectly forecast our network capacity needs in future periods. If we have excess server capacity, we have in the past needed to, and may in the future need to, write-down or write-off server assets, which may materially harm our operating results. For example, in the year ended December 31, 2025, we recognized certain equipment, internal-use software project and right-of-use asset related write-off charges of $0.4 million. Conversely, if we underestimate network capacity needs, we may in future periods be unable to meet demand and be required to incur higher costs to secure necessary parts and components of our servers, which could adversely affect our customer relationships and harm our business.