ServiceNow (NOW) Risk Analysis

Our success depends significantly on our ability to protect our proprietary technology and our brand under patent, copyright, trademark, trade secret and other IP protections in the U.S. and other jurisdictions. The IP protection we have for our technology may be insufficient, and any IP acquired in the future may not provide competitive advantages or other value. In addition, our IP may be contested, circumvented, found unenforceable or invalidated, and we may not be able to prevent third parties from infringing upon them. Further, legal standards relating to the validity, enforceability and scope of protection of IP rights vary. Despite our efforts to protect our proprietary rights, policing unauthorized use of our IP and technology is difficult, and we may be required to spend significant resources to monitor and protect our IP rights. Unauthorized parties may attempt to copy or obtain and use, or may have copied or obtained and used, our technology to develop products and services that provide features and functionality similar to ours. Our competitors could also independently develop services equivalent to ours, and our IP rights may not be broad enough for us to prevent them from utilizing their developments to compete with us. Reverse engineering, unauthorized copying or other misappropriation of our proprietary technology could enable third parties to benefit from our technology without paying us for it. We may initiate claims or litigation against third parties for infringement or misappropriation of our proprietary rights or to establish the validity of our proprietary rights. However, we may be adversely affected if we are unable to prevent third parties from infringing upon or misappropriating our IP rights or are required to incur substantial costs defending our IP rights. Third parties may challenge or invalidate our IP rights through administrative proceedings, litigation or allowing contractual rights to expire. There is considerable patent and other IP development activity and claims and related litigation regarding patent and IP rights in our industry. Our competitors, other third parties, including practicing entities and non-practicing entities, own large numbers of patents, copyrights, trademarks and trade secrets, which they may use and have used to assert claims of infringement, misappropriation or other violations of IP rights against us. Moreover, the patent portfolios of many of our competitors and other third parties may be larger than ours. This disparity may increase the risk that our competitors or other third parties may sue us for patent infringement and may limit our ability to counterclaim for patent infringement or settle through patent cross-licenses. We have recorded material charges for legal settlements of such claims in the past. Further, upon expiration of any agreements that allow us to use third-party IP, we may be unable to renew such agreements on favorable terms, if at all, in which case we may face IP litigation or may need to cease offering or to modify our products and services to remove such components. In addition, our subscription agreements generally require us to defend our customers against claims that our technology infringes the IP rights of third parties. Any claim or litigation, whether or not resolved in our favor, could result in significant expense to us, divert the efforts of our personnel and may result in counterclaims against us. If claims are successfully asserted against us and we are found to be infringing upon, misappropriating or otherwise violating the IP rights of others, we could be required to pay substantial damages and/or make substantial ongoing royalty payments; comply with an injunction and cease offering or modify our products and services; comply with other unfavorable terms, including settlement terms; and indemnify our customers and business partners, obtain costly licenses on their behalf and/or refund fees or other payments previously paid to us. Further, the mere existence of any lawsuit, or any interim or final outcomes, and the public statements related to it (or absence of such statements) by the press, analysts and litigants could be unsettling to our customers and prospective customers. This could adversely impact our customer satisfaction and related renewal rates, cause us to lose potential sales, and could also be unsettling to investors or prospective investors and cause a substantial decline in our stock price. Effective patent, trademark, copyright and trade secret protection may not be available in every country in which we offer services. The laws of some foreign countries may not offer effective protection for, or be as protective of, IP rights as those in the U.S., and mechanisms for enforcement of IP rights or available remedies may be inadequate, ineffective or scarce. Additionally, the IP ownership and license rights of new technologies and the use of outputs therefrom, such as AI, which we are increasingly building into our product offerings, have not been fully addressed by U.S. and foreign courts interpreting current and new laws or regulations, and the use or adoption of such technologies in our products and services may expose us to potential IP claims; breach of a data license, software license, or website terms of service allegations; claimed violations of privacy rights; and other tort claims. If such laws or regulations require increased transparency, it may impair protection of our trade secrets or other IP.

In the ordinary course of our business, we store, transmit, generate, and process our and our customers' confidential, proprietary and sensitive data. As our business expands across the globe, the number of employees, contractors, vendors and other third parties remotely accessing our systems continues to grow. Our growing business operations increase our exposure to cyberattacks by a range of actors, who have used and will continue to use assorted tactics, techniques, and procedures, including malicious code, ransomware, social engineering, business email compromises, supply chain attacks, denial of service attacks and similar internet-enabled, fraudulent activity, and the frequency of those attacks have become more common. Additionally, as AI technologies continue to advance, threat actors can leverage these technologies to develop more sophisticated attack methods that are increasingly automated, targeted, coordinated and more difficult to defend against. The proliferation of these technologies could enable less skilled threat actors to initiate attacks and increase the frequency, scale and impact of security incidents. Further, during times of war and other major conflicts, we and our third-party providers may be vulnerable to a heightened risk of geopolitically motivated attacks, including cyberattacks, that could materially disrupt our systems and operations, supply chain and ability to provide our services. Cybersecurity threats are not limited to actors operating in the systems we control directly. Our increasing reliance on third-party providers and public cloud infrastructure introduces new cybersecurity risks to our business operations. Third-party security incidents have occurred in the past and are likely to continue, as we rely on third-party service providers and technologies to operate business systems in a variety of contexts. Supply chain attacks have also increased in frequency and severity. We cannot guarantee that our third-party service providers or our supply chain infrastructure have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our platform, systems and network or the systems and networks of third parties that support us and our business. Our ability to monitor the data security measures of our third-party providers is limited, and we necessarily depend in part on our providers to have in place and maintain adequate security measures to protect against unauthorized access, cyberattacks and the mishandling of data. Further, employee error or malfeasance in configuring, maintaining and using these services could impact our ability to monitor and secure them effectively. We have identified vulnerabilities in our products and services in the past and expect to continue to do so in the future. Consistent with our vulnerability management program, we prioritize security risks and consider their severity and potential impact in determining whether and when to remediate or mitigate them. In addition, we cannot be certain that we will be able to prevent, detect or remediate all vulnerabilities, and there have been delays and may continue to be delays in developing patches that can be effectively deployed to address vulnerabilities. Further, security researchers and other entities and individuals have actively searched for, published and/or exploited actual and potential vulnerabilities in our products or services and will likely continue to do so in the future. Also, certain persons, including researchers, have in the past not abided by, and may in the future not abide by, our responsible disclosure program, which has resulted in, and could in the future result in the compromise of our systems or our or our customers' data. Moreover, the incorporation of third-party, AI-generated or open-source software code into our or our customers' systems increases the risk of exploitation of vulnerabilities. We also have inherited and may in the future inherit additional security risks from acquiring or partnering with other companies. In most instances, our customers are responsible for configuring and determining access levels to the data held in their particular instance for their employees and service providers. While our software is delivered with certain preset configurations, we understand that our customers require flexibility to configure the ServiceNow AI Platform to their specific business needs. We work closely with our customers to help them evaluate their security configurations, including providing guidance to align configuration settings with their business needs. Yet, in configuring our platform, both our employees and customers have made errors in the past and may do so again in the future. We are aware that, on occasion, both our customers and ServiceNow have configured certain settings on our platform, or retained preset configurations, in ways that may not align with preferred or recommended security levels, which can result in, and has resulted in, information being made more widely accessible than intended. Such misconfigurations can be, and have been, identified publicly, increasing the risk of data being exposed unintentionally. In certain cases, customers may misconfigure their systems and claim that they were not properly informed of the risks to their configuration. Our data security system and data governance framework, designed to protect our and our customers' information and prevent data loss, may not be effective at preventing, detecting, responding to or remediating material breaches caused by intentional or unintentional actions or inactions by employees, contractors or third parties. Techniques used to sabotage or to obtain unauthorized access to systems are constantly evolving and may go undetected until we become aware of a successful attack. Moreover, we have experienced security incidents, which may reoccur in the future, that resulted in unauthorized access to, loss or inadvertent disclosure of confidential, proprietary and sensitive information. We have observed attempts by third parties to induce or deceive our employees, contractors or users to fraudulently obtain access to our or our customers' data or assets. In addition, our employees have fallen victim to phishing attacks in the past and are likely to again in the future. Further, despite our security measures, employees, contractors and other individuals (some of whom are supported by nation states) have gained, and in the future may gain, access to our systems to search for and exploit actual or potential vulnerabilities in our products or services or inflict other harms, such as deploying malware or stealing data. An actual or perceived security breach or compromise can have a material effect on ServiceNow's operations, finances and reputation. The adverse consequences can include accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to data; disruptions to our services; diversion of funds; litigation; indemnification and other contractual obligations; regulatory investigations; government fines and penalties; reputational damage; negative publicity; business and operational interruptions; loss of sales, customers and partners; mitigation and remediation expenses; and other material costs and liabilities. In addition, the assessment and response to security incidents, as well as implementation of appropriate safeguards to protect against future incidents, can lead to material economic and operational consequences. These consequences can result regardless of whether the incident is suffered by us, affects our third-party service providers or stems from customers' action or inaction. Moreover, even if a breach is unrelated to our security programs or practices, it could still cause us reputational harm and require us to undertake significant efforts to assess and respond to the breach, including further protecting our customers from their own security risks. There can be no assurance that any limitations of liability provisions in our subscription agreements, terms of use or other agreements would be enforceable or adequate or would otherwise protect us from any such liabilities or damages with respect to any particular claim. In addition, while we maintain insurance coverage to cover potential financial losses, we cannot be certain that such coverage will continue to be available on acceptable terms or in sufficient amounts to cover potential financial losses from a security incident or that an insurer will not deny coverage as to any future claim.