Snowflake (SNOW) Risk Analysis

In the ordinary course of our business, we store, transmit, generate, and process our, our customers', and our business partners' confidential and proprietary data. Such data includes sensitive data, such as personal information, protected health information, and financial data. We use third-party service providers, sub-processors, and technology to help us deliver services to our customers and their end-users, as well as for our internal business operations. We also use third-party technology to assist with securing our environment and providing access to our platform. Some of our customers also use third-party service providers to assist with their use of our platform or third-party technology, such as connectors and agent-to-platform integration protocols (such as the Model Context Protocol), to access our platform. These third-party service providers may process, store, or transmit data of our employees, partners, customers, and customers' end-users or may otherwise be used to help operate our platform and corporate systems. In addition, AI models, agents, and large datasets are increasingly integrated into our, our customers', and other third parties' systems, which are susceptible to unique and evolving attack techniques such as prompt injection, jailbreaking, hijacking, data poisoning, model inversion, and model theft (or model extraction). We, our customers and business partners, and these third parties face a variety of evolving and increasing cybersecurity and data threats related to this complex network of technology. Cybersecurity threats come from a variety of sources, including traditional computer "hackers," internal and external personnel (such as through exfiltration or misuse), sophisticated nation-states, nation-state-supported actors, and AI technologies, including systems that may act autonomously or otherwise behave in unintended, unpredictable, or malicious ways. Cybersecurity threat actors can use a wide variety of methods, often enhanced or facilitated by AI, including unauthorized intrusions, denial-of-service attacks, ransomware attacks, business email compromises, computer malware, infostealer malware, social engineering attacks (including through deep-fakes and phishing), internal and external personnel misconduct or error, supply-chain attacks, software vulnerabilities, and software or hardware disruptions or failures, all of which are prevalent in our industry and our customers' and partners' industries. These methods change frequently and are becoming increasingly difficult to detect, particularly as AI enables threat actors to identify novel software and system vulnerabilities to exploit previously unknown vulnerabilities before they can be remediated. Threat actors who successfully compromise networks or systems may use such unauthorized access as a vector to compromise other networks and systems. Threat actors' goals often include disrupting a company's operations or ability to provide services, obtaining unauthorized access to platforms, systems, networks, or physical facilities in which data is stored or processed, or through which data is transmitted, stealing data, and demanding ransomware payments. There can be no assurance that security measures designed to protect against security incidents will be effective, that we will be able to detect, mitigate, or remediate vulnerabilities in our products and information security systems (such as our hardware and software, including that of third parties upon which we rely) on a timely basis, or that our efforts to investigate, mitigate, contain, and remediate any security or data incidents that do occur will be successful. In general, cybersecurity incidents or security vulnerabilities (both in our internal environment and third-party environments we may not control), as well as actions taken by us or third parties to detect, investigate, mitigate, contain, and remediate them, could lead to significant interruptions in our operations, outages, loss of data and income, reputational harm, diversion of funds, increased insurance costs, and other harm to our business and competitive position. We also may be unwilling or unable to make ransom payments due to, for example, applicable laws or regulations prohibiting such payments, the negative precedent such payments would set, or uncertainty over whether such payments would result in the threat actor deleting stolen data or otherwise delivering on their promised course of action. In addition, the risk of cybersecurity and data incidents will increase as we continue to expand our product offerings and geographic footprint, grow our customer and partner base, expand our AI offerings, acquire operating companies, increase our technological integrations with external environments, provide technical consulting services where our personnel are operating within customer environments, and process, store, and transmit increasingly large amounts and increasingly sensitive and highly regulated types of data. In particular, certain new product offerings, including through both internal development and strategic acquisitions, may pose different or greater data and security risks than our traditional offerings. These products include, for example, features and functionality that access, take instructions from, and operate on large amounts of data inside and outside our platform, that are customized based on customer specifications, that use agent-to-platform integration protocols to interact with our or third-party systems, or or that are deployed to or accessible from external environments where we have no or limited visibility or control, such as distributed endpoints (e.g., a user's local device) and publicly accessible networks, which increase the potential attack surface for threat actors. If our security measures designed to mitigate and defend against these risks are not effective or if our customers fail to effectively implement them, we or our customers may experience unintended access to or actions taken with respect to our or their systems or data. Any security breach of our platform, our operational systems, our software (including open-source software), our physical facilities, or the systems of our third-party service providers or sub-processors, or the perception that one has occurred, or unintended access or operations within our customers' or partners' systems, data, or technology, could result in claims that we have breached customer contracts or other legal obligations. In addition, we may be subject to, and have received in the past, requests by regulators (including members of Congress) for information about our security practices, our public statements about our security program, experiences, and issues. Alleged failures, problems, or issues related to our information security or our customers' use of our platform, including following such information requests, could result in additional investigations; actions from a variety of regulators, including state attorneys general, the Department of Justice, the Federal Trade Commission (FTC), and the SEC; litigation; indemnity obligations; fines; penalties; mitigation and remediation costs; reputational harm; diversion of management's attention; customer relationship issues; and other liabilities and damage to our business. Security or data incidents and their resulting consequences, including negative publicity, may also cause customers to stop using our platform, deter existing or prospective customers from using our platform, and negatively impact our ability to grow and operate our business. Further, cybersecurity incidents have in the past and may in the future lead customers or prospective customers to attempt to negotiate contractual terms that are less favorable to us, such as broader indemnification obligations, more stringent cybersecurity requirements, and higher limitations of liability. We may incur liability or suffer reputational harm for cybersecurity even if we do not control the applicable security measures or if we are not at fault. Our customers have experienced, and may in the future experience, security incidents in connection with their use of our platform that harm our customer relationships and our reputation, even when such incidents are due to vulnerabilities, policy violations, inadequate security controls, third party integrations, or credential exposures that we do not cause or control. There have been and may continue to be supply chain attacks targeting third party software to which customers provide access credentials to their Snowflake accounts. We operate under a shared responsibility cybersecurity model where we are responsible for the security of our platform and underlying cloud infrastructure, while our customers are responsible for selecting, enabling, and configuring security and operational controls for their individual environments in a manner that meets applicable cybersecurity standards and effectively reduces their information security risk. Some customers also use third-party external authentication tools, in which case we do not have visibility into whether adequate access controls (such as multi-factor authentication (MFA) or network restrictions) are being enforced. Regardless of whether customers use our authentication tools or external tools, if customers allow static access credentials, they are responsible for ensuring that the credentials remain private and are rotated on a regular basis. If our customers do not implement, or incorrectly implement, the security tools and features we offer and support within our platform or otherwise fail to fulfill their responsibilities under our shared responsibility cybersecurity model, there is a higher risk that they will be the victim of cybersecurity or data incidents, which may harm our customer relationships, our reputation, and our business, which has occurred in the past and may happen again in the future. We have contractual and other legal obligations to notify customers and other parties of certain incidents, and may choose to make such notifications even if not legally required to do so. For example, SEC rules require disclosure on Form 8-K of the nature, scope, and timing of any material cybersecurity incident and the reasonably likely impact of such incident. Determining whether a cybersecurity incident is notifiable or reportable may not be straightforward, and any such mandatory disclosures are costly and could lead to negative publicity, loss of customer or partner confidence in the effectiveness of our security measures, diversion of management's attention, governmental investigations, and the expenditure of significant capital and other resources to investigate, respond to, or alleviate problems caused by the actual or perceived security breach. Our insurance coverage may not be adequate for liability arising from data security breaches involving us or our customers or other third parties, indemnification obligations, or other liabilities. The successful assertion of one or more large claims against us that exceeds our available insurance coverage or results in changes to our insurance policies (including premium increases or the imposition of large deductible or co-insurance requirements) could have an adverse effect on our business. In addition, we cannot be sure that our existing insurance coverage and coverage for errors and omissions will continue to be available on acceptable terms or that our insurers will not deny coverage as to any future claim, particularly as we continue to expand our product offerings with different security risk profiles. For example, in May 2024, we became aware that cybersecurity threat actors had accessed a number of our customers' Snowflake accounts as a result of such customers' failure to fulfill certain of their obligations under our shared responsibility cybersecurity model (e.g., implementing MFA and network access policies). Even though we did not identify any evidence suggesting this activity was caused by or otherwise related to any vulnerability or misconfiguration of our systems, or a breach of our platform's security or our environment, we have been the subject of numerous lawsuits, regulatory investigations, and lawmaker inquiries relating to these customer incidents. Since May 2024, we have been made aware of additional cyberattacks on customers' Snowflake accounts using similar methods intended to take advantage of customers' failures to implement appropriate security safeguards (e.g., MFA and network access policies). We are unable to predict the outcome or timeline of these matters or whether any additional requests, inquiries, lawsuits, investigations or other government actions may arise. We have suffered and may continue to suffer negative publicity and reputational damage, including due to the misperception that our customers' incidents resulted from a vulnerability, misconfiguration or breach of our platform's security or systems and malicious activity within our environment. In addition, we may experience a loss of existing customers or face claims by customers, and it is possible that we are not able to fully recover any losses relating to these matters through any applicable insurance coverage or we may be required to seek indemnification from breached customers to mitigate our damages, which may be unsuccessful or impractical. These matters, together with any additional inquiries, regulatory or governmental investigations, or other disputes that result from these customer security incidents, have in the past and will continue to require us to divert resources and may harm our reputation, business, financial condition, or results of operations. Finally, some of our employees work remotely, including while traveling for business, which increases our cybersecurity risk, creates data accessibility concerns, and makes us more susceptible to security breaches or business disruptions. Any of the foregoing could have a material adverse effect on our business, financial condition, results of operations, or prospects.

From time to time, we may become subject to legal proceedings and claims, such as claims brought by our customers in connection with commercial disputes, cybersecurity incidents, employment claims, including claims related to the loss of employee equity grants upon termination, intellectual property claims, or securities class actions or other claims related to volatility in the trading price of our common stock. For example, we are named in certain securities class action lawsuits in federal court alleging federal securities law violations, a class action lawsuit in federal court alleging copyright infringement in connection with our large language model training, and numerous class action lawsuits alleging common law and statutory claims in connection with cybersecurity matters. See the section titled "Legal Proceedings" for more information. Litigation has resulted and could continue to result in substantial costs and diversion of management's attention and resources, which might seriously harm our business, financial condition, and results of operations. Our existing insurance might not cover such claims, provide sufficient payments to cover all the costs to resolve one or more such claims, or continue to be available on terms acceptable to us (including premium increases or the imposition of large deductible or co-insurance requirements). A claim brought against us that is uninsured or underinsured could result in unanticipated costs, potentially harming our business, financial position, and results of operations.

We are subject to data privacy and protection laws, regulations, guidance, external and internal policies and other documentation, industry standards, certifications, and contractual and other obligations that apply to the collection, transmission, storage, use, and other processing of personal and sensitive information. These obligations are rapidly evolving, extensive, complex, and include inconsistencies and uncertainties. Examples of recent and anticipated developments that have impacted or could impact our business include the following: - The European Union's (EU) General Data Protection Regulation (GDPR) and the United Kingdom's General Data Protection Regulation (U.K. GDPR) established strict requirements applicable to the handling of personal information. - The EU's Digital Operational Resilience Act (DORA), which became effective as of January 17, 2025, applies to financial entities, such as banks, insurance companies, and investment firms, as well as their information and communication technology third-party service providers. DORA aims to promote resiliency against operational disruptions in the financial sector. - India's Digital Personal Data Protection Act (DPDP Act) imposes strict rules regarding the collection, use, processing and storage of personal data in India. The phased implementation of the DPDP Act began in November 2025, which is expected to become fully effective on May 14, 2027. - Certain other jurisdictions have enacted data localization laws and cross-border personal information transfer laws, such as Brazil, China, and Saudi Arabia, which could make it more difficult for us to transfer personal information across jurisdictions (such as transferring or receiving personal or other sensitive information that originates in the EU, China, or Saudi Arabia), or to enable our customers to transfer or replicate their data across jurisdictions using our platform. Existing mechanisms that may facilitate cross-border personal information transfers may change or be invalidated. Because our business model involves transmitting and mobilizing data across geographical areas, an inability or material limitation on our ability to transfer personal data to the United States or other countries could materially impact our business operations and revenue. - In the United States, federal, state, and local governments have enacted or proposed data privacy and security laws and regulations, including data breach notification laws, personal data privacy laws, cross-border data transfer regimes, and consumer protection laws. For example, the U.S. Department of Justice issued a rule entitled "Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons," which places prohibitions or restrictions on certain data transactions involving the transfer of certain personal information to countries of concern (e.g., China, Russia, Iran) or individuals/entities located in or subject to the control of those jurisdictions. This rule impacts certain business activities such as vendor engagements, employment of certain individuals, and investor agreements. Violations of the rule could lead to significant civil and criminal fines and penalties. Additionally, numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. Such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making and, if exercised, may adversely impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act, as amended (CCPA), provides increased privacy rights and protections, including the ability of individuals to opt out of specific disclosures of their personal information, and provides for fines and allows private litigants affected by certain data breaches to recover significant statutory damages. Other U.S. states have adopted, or are considering adopting, similar laws. - The certifications we maintain and the standards that apply to our platform (or those we may maintain or that may apply in the future), such as the U.S. Federal Risk and Authorization Management Program (FedRAMP), U.S. DoW Impact Level 4 (IL4) and Impact Level 5 (IL5), Payment Card Industry Data Security Standards (PCI-DSS), International Organization for Standardization (ISO)/International Electrotechnical Commission (IEC) 27001, System and Organization Controls (SOC), Health Information Trust Alliance Common Security Framework (HI-TRUST CSF), GovRAMP, among others, are becoming and may become more stringent. - We are and may become subject to new laws that specifically regulate non-personal data. For example, we are subject to certain parts of the EU's Data Act, which imposes certain data and cloud service interoperability and switching obligations to enable users to switch between cloud service providers without undue delay or cost, as well as certain requirements concerning cross-border international transfers of, and governmental access to, non-personal data outside the European Economic Area. Additionally, in the EU, the Network and Information Security Directive (NIS2) regulates resilience and incident response capabilities of entities operating in a number of sectors, including the digital infrastructure sector (such as cloud computing service providers). Once fully implemented, non-compliance with NIS2 may lead to significant fines. These and other similar legal and regulatory developments could contribute to legal and economic uncertainty, increase our exposure to liability, affect how we design, market, and sell our platform, and impact how we operate our business, how our customers and partners process and share data, how we process and use data, and how we transfer personal data from one jurisdiction to another, any of which could increase our costs, require us to take on more onerous obligations in our contracts, impact our ability to operate in certain jurisdictions, and/or negatively impact the types of data available on or the demand for our platform. We incur substantial costs to comply with such laws and regulations, to meet the demands of our customers relating to their own compliance with applicable laws and regulations, and to establish and maintain internal policies, self-attestations, and third-party certifications supporting our compliance programs. Our customers may delegate certain of their GDPR compliance or other privacy or security law obligations to us, and we may otherwise be required to expend resources to assist our customers with such compliance obligations. Any actual or perceived non-compliance with applicable data privacy and security obligations by us, our customers, or our third-party service providers and sub-processors could result in proceedings, investigations, litigation, or claims against us by regulatory authorities, customers, or others, leading to reputational harm, higher liability and indemnity obligations, significant fines, litigation costs, additional reporting requirements or oversight, bans on processing personal information, orders to destroy or not use personal information, limitations in our ability to develop or commercialize our platform, inability to process personal information or operate in certain jurisdictions, and other damages. For example, if regulators assert that we have failed to comply with the GDPR or U.K. GDPR, we may be subject to significant fines, as well as potential data processing restrictions and penalties. In addition, private plaintiffs have become increasingly active in bringing privacy- and information security-related claims against companies, including class action claims. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for significant statutory damages, depending on the volume of data and the number of violations. Even if we are not determined to have violated these laws and other obligations, investigations into these issues typically require the expenditure of significant resources and generate negative publicity. In addition, any failure by us or our third-party service providers and sub-processors to comply with applicable obligations could result in proceedings against us. Certain regulators, such as the FTC, may prohibit our use of certain personal information as a result of such proceedings. Any of these events could have a material adverse effect on our business, financial condition, and results of operations. We publish privacy policies, certifications and other documentation regarding our security program and our collection, processing, use, and disclosure of personal information or other confidential information. We or our vendors may fail to comply with these policies, certifications, or documentation, or may be perceived to have failed to do so. We also from time to time make public statements regarding the data privacy and security features of our products, which may draw scrutiny from regulators or private parties. Claims by regulators or private parties that we have failed to follow our published statements or documentation or otherwise violated individuals' privacy rights, misrepresented or made inaccurate claims about our products, or failed to comply with security or data protection laws, even if we are not found liable, could be expensive and time-consuming to defend and could result in adverse publicity that could harm our business.

The markets in which we operate are rapidly evolving and highly competitive. In recent years, we have adopted open data formats like Apache Iceberg tables to allow customers to use our platform to process data stored in external customer-controlled environments outside of Snowflake, and we have introduced a significant number of new features and expanded into new product categories like AI and transactions. These changes are driving increased competition, both because there is less customer "lock in" when our products are used in external environments, and also because we are competing across more product categories, each of which is subject to distinct customer requirements and preferences. Our success depends on our ability to continue to effectively innovate in response to changing market dynamics. Our current competitors include: - large, well-established, public cloud providers that generally compete in all of our markets, including AWS, Azure, and GCP;- private cloud companies and less-established public cloud companies with products that compete in some or all of our markets;- other established vendors of legacy database solutions or big data offerings;- providers of AI products and services;- observability solution providers, particularly those with strong technological, marketing, and sales positions; and - new or emerging entrants seeking to develop competing technologies. We compete based on various factors, including price, performance, product features, breadth of use cases, multi-cloud availability, ability to offer state-of-the-art AI models and agentic AI solutions, brand recognition and reputation, customer support, technical services, and differentiated capabilities, including ease of implementation and data migration, ease of administration and use, scalability and reliability, data governance, security and compatibility with existing standards, programming languages, third-party products, and the ability to operate in hybrid environments. Many of our competitors have substantially greater brand recognition, customer relationships, and financial, technical, and other resources than we do, and may be able to respond more effectively than us to new or changing opportunities, technologies, standards, customer requirements, and buying practices. Some of our privately-held competitors also have greater operational flexibility than we do, including the ability to make strategic long-term business decisions without the short-term financial performance pressure, market expectations, and public disclosure obligations that affect public companies. In addition, we may not be able to respond to market opportunities as quickly as smaller companies or offer as many discounts or free services as our competitors. Our support of open data formats may also reduce switching costs between us and our competitors. We currently offer our platform on the public clouds provided by AWS, Azure, and GCP, which are also some of our primary competitors. Currently, a substantial majority of our business is run on the AWS public cloud. There is risk that one or more of these public cloud providers could use its respective control of its public clouds to embed innovations or privileged interoperating capabilities in competing products, bundle competing products, provide us unfavorable pricing, leverage its public cloud customer relationships to exclude us from opportunities, and treat us and our customers differently with respect to terms and conditions or regulatory requirements than it would treat its similarly situated customers. Further, they have the resources to acquire, invest in, or partner with existing and emerging providers of competing technologies and thereby accelerate adoption of those competing technologies. All of the foregoing could make it difficult or impossible for us to provide products and services that compete favorably with those of the public cloud providers. Companies with which we have strategic partnerships and alliances in some areas may be competitors in other areas, and this trend may increase, particularly as we expand our product offerings. Additionally, companies that are strategic partners in some areas of our business may acquire or form alliances with our competitors, thereby reducing their business with us. We also face and may in the future face increased competition from some of our customers and vendors, including observability solution providers and AI model providers. Further, some customers use drivers and/or connectors to connect our platform to third-party applications or databases. Attempts by third-party application or database providers to restrict the use of drivers and connectors may make it more difficult for customers to use our platform, which could lead to reduced sales and consumption. Any inability to effectively manage these complex relationships could materially harm our business, results of operations, and financial condition. In addition, enterprise adoption of AI may significantly transform our competitive landscape. Frontier AI model providers may seek to vertically integrate their offerings by expanding into the data storage and management layers and developing their own database solutions. In addition, companies have begun to use AI to develop their own software, reducing their need to purchase third-party solutions. If this occurs to the existing and prospective customers of our platform, our market share could decline and our business could be harmed. For all of these reasons, competition may negatively impact our ability to acquire new customers and maintain and grow use of our platform, put downward pressure on our prices and gross margins, or lead us to take greater risks, any of which could materially harm our business, reputation, results of operations, revenue retention rate, and financial condition.

Historically, we have received a higher volume of orders from new and existing customers in the fourth fiscal quarter of each year. As a result, we have historically seen higher non-GAAP free cash flow in the first and fourth fiscal quarters of each year, and our sequential growth in remaining performance obligations has historically been the highest in the fourth fiscal quarter of each year. We may not be successful in our attempt to align our cash outflows with our cash receipts, particularly since we expect this seasonality to become more pronounced as we continue to target large enterprise customers based on their procurement, budgeting, and deployment cycles. In addition, while consumption is typically lower during holidays, the magnitude of any decrease is difficult to predict and that may result in inaccurate financial guidance. For more information about non-GAAP free cash flow, including a definition of non-GAAP free cash flow and a reconciliation of net cash provided by operating activities, which is the most directly comparable financial measure calculated in accordance with U.S. generally accepted accounting principles (GAAP), to free cash flow, see the section titled "Management's Discussion and Analysis of Financial Condition and Results of Operations."

We believe that maintaining and enhancing our brand identity and reputation is critical to our relationships with, and to our ability to attract and retain, customers, partners, investors, and employees. The successful promotion of our brand depends on a number of factors, including our ability to continue to develop and deliver reliable, high-quality, and cost-effective products and services that meet the needs of our customers; our sales and marketing efforts, including effectiveness at developing a positive presence within our industry through participation in industry events and key media coverage; the influence of customer testimonials and use cases on the perception of our brand; effective integration into our platform of products and services we acquire or invest in; and our ability to differentiate our products from those of our competitors. The promotion of our brand requires us to make substantial expenditures, which we anticipate will increase as our market becomes more competitive. Our brand promotion activities may not be successful or generate the awareness or increased revenue we expect, and even if they do, any increase in revenue may not offset the significant expenses we incur in the efforts to build our brand. In addition, independent industry or financial analysts often provide reviews of our platform, as well as products and services of our competitors, and perception of our platform in the marketplace may be significantly influenced by these reviews. If these reviews are negative, or less positive as compared to those of our competitors' products and services, our brand may be adversely affected. Negative media coverage could also adversely affect our brand and reputation. If we do not successfully maintain and enhance our brand, our business may not grow, we may have reduced pricing power relative to competitors and we could lose customers or fail to attract potential customers, or fail to hire and retain employees, all of which would materially and adversely affect our business, results of operations, and financial condition.

Our results of operations may vary based on the impact of changes in our industry or the global economy on us or our customers and potential customers. Negative conditions or volatility in the general economy both in the United States and abroad, including conditions resulting from changes in gross domestic product growth, financial and credit market fluctuations, bank failures, international trade relations, inflation, tariffs and trade wars, extended U.S. federal government shutdowns, and interest rate fluctuations, or the existence of epidemics, pandemics or other public health crises, political turmoil and geopolitical conflicts, natural catastrophes, warfare, or terrorist attacks on the United States, Europe, the Asia-Pacific region, Japan, or elsewhere, could cause a decrease in business investments, including spending on cloud technologies, and negatively affect the growth of our business. For example, the existing tariffs and continued threats of new or increased tariffs, sanctions, trade restrictions and trade barriers, ongoing changes in the United States and foreign government trade policies, various ongoing military conflicts and rising geopolitical tensions globally, including the ongoing military conflicts in the Middle East and between Russia and Ukraine as well as the rising tensions between China and Taiwan, have created volatility in the global capital markets and energy markets, have had and may continue to have disruptive impact on the global economy, and could have further global economic consequences, including disruptions of the global supply chain. Tariffs and rising fuel costs may also increase the costs for AWS, Azure, and/or GCP to provide cloud infrastructure services, which may in turn increase the costs for us to use such services when we renew our agreements with them. In addition, unfavorable conditions in the general economy, including tariffs and trade wars, as well as surging fuel costs, may negatively impact our customers' budgets or cash flow, which could impact the contract terms, including payment terms, our customers demand from us. Competitors, many of whom are larger and have greater financial resources than we do, may respond to challenging market conditions by lowering prices in an attempt to attract our customers. We cannot predict the timing, strength, or duration of any economic slowdown, instability, or recovery, generally or within any particular industry.

Our platform and the public cloud infrastructure on which our platform relies are vulnerable to damage or interruption from catastrophic events, such as earthquakes, hurricanes, floods, fires, power loss, telecommunication failures, cyber attacks, military conflict or war, terrorist attacks, criminal acts, sabotage, other intentional acts of vandalism and misconduct, geopolitical events, and epidemics, pandemics or other public health crises. Some of our U.S. corporate offices in which we operate and certain of the public cloud data centers on which our platform runs are located in the San Francisco Bay Area and Pacific Northwest, regions known for seismic activity. Despite any precautions we may take, the occurrence of a natural disaster or other unanticipated problems at our facilities or the facilities of our public cloud providers could result in disruptions, outages, and other performance and quality problems. Our customers are also subject to the risk of catastrophic events. If any such events occur, demand for our platform may decrease. If we are unable to develop and maintain adequate plans to ensure that our business functions continue to operate during and after a catastrophic event and to execute successfully on those plans if such an event occurs, our business could be seriously harmed.

Our sales are currently denominated in U.S. dollars, Euros, British pounds, Australian dollars, Canadian dollars, Brazilian reals, and Indian rupees, and will likely be denominated in other currencies in the future. Because we report our results of operations and revenue in U.S. dollars, we currently face exposure to foreign currency translation risk and may in the future face other foreign currency risks. If we are not able to successfully hedge against the risks associated with currency fluctuations, our results of operations could be adversely affected. For example, a strengthening of the U.S. dollar could increase the real cost of our platform to international customers, which could adversely affect our results of operations. In addition, as our international operations expand, an increasing portion of our operating expenses is incurred outside the United States. These operating expenses are denominated in foreign currencies and are subject to fluctuations due to changes in foreign currency exchange rates. Exposure to these risks and fluctuations could adversely affect our financial position, results of operations, and cash flows.

Our success depends in part on the continued services of our executive officers, as well as our other key employees in the areas of research and development and sales and marketing. From time to time, there may be changes in our executive management team or other key employees resulting from the hiring or departure of these personnel. Our executive officers and other key employees are employed on an at-will basis, which means that their employment with us can be terminated by either party at any time for any reason. For example, in February 2024, Sridhar Ramaswamy was appointed as Chief Executive Officer to replace Frank Slootman. Following our Chief Executive Officer transition, we experienced several executive leadership transitions, including the following transitions that occurred since the beginning of fiscal 2026: in March 2025, Michael Gannon was appointed as Chief Revenue Officer to replace Christopher W. Degnan; in September 2025, Brian Robins was appointed to replace Michael P. Scarpelli as Chief Financial Officer upon his retirement; and in March 2026, Jonathan Beaulier was appointed as Chief Revenue Officer to succeed Mr. Gannon. Loss of additional executive officers, key employees, any otherwise significant turnover or attrition could harm morale, cause additional personnel to depart, degrade customer and partner relationships, cause us to incur unanticipated costs to hire and train replacement personnel, and introduce operational delays or risks, each of which could harm our operating results. In addition, to execute our growth plan, we must attract and retain highly qualified personnel. Competition for these personnel is intense, especially for executive leadership, engineers experienced in designing and developing cloud-based data platform products, including products with AI capabilities, and experienced sales, customer support, and professional services personnel. We also are dependent on the continued service of our existing software engineers because of the sophistication of our platform. In order to support our growing business, we will need to continue to hire in new locations around the world and manage remote/hybrid working policies in certain areas, which may add to the complexity and costs of our business operations. From time to time, we have experienced, and we expect to continue to experience, difficulty in hiring and retaining employees with appropriate qualifications, including skilled AI engineers and qualified sales and marketing personnel, many of whom are in high demand and command high compensation packages. Many of the companies with which we compete for experienced personnel have greater resources than we have and can provide more competitive compensation and benefits. In addition, prospective and existing employees (including members of executive management) often consider the value and other terms of the equity awards they receive to be an important part of their employment compensation package. Our stock price fluctuated significantly during portions of fiscal 2027 and fiscal 2026. If the actual or perceived value of our equity awards declines or undergoes significant volatility, or if our existing employees receive significant proceeds from liquidating their previously vested equity awards, it may adversely affect our ability to recruit and retain key employees. Furthermore, current and prospective employees may believe that their equity award offers have limited upside, and our competitors may be able to offer more appealing compensation packages. In order to retain our existing employees and manage potential attrition, including as a result of any stock price decreases and market volatility that impact the actual or perceived value of our equity awards, we have issued and may continue to issue additional equity awards or provide our employees with increased cash compensation, which could negatively impact our results of operations and be dilutive to stockholders. For example, our stock-based compensation, net of amounts capitalized, represented 34% of our revenue for fiscal 2026 and 41% for fiscal 2025, and we expect stock-based compensation to remain substantial even if we are successful in reducing it as a percentage of our revenue. Finally, if we hire employees from competitors or other companies, their former employers may attempt to assert that we or these employees have breached our or their legal obligations, resulting in a diversion of our time and resources. We also believe our culture has been a key contributor to our success to date and that the critical nature of the platform that we provide promotes a sense of greater purpose and fulfillment in our employees. As our workforce becomes larger and more distributed around the world or as our executive management team changes, we may not be able to maintain important aspects of our culture. Any failure to preserve our culture could negatively affect our ability to retain and recruit personnel. If we fail to attract and recruit new personnel or fail to retain and motivate our current personnel, our business and future growth prospects would be harmed.