Company: NAVN
Filing Date: 2025-09-19
Form Type: S-1
Source: 0001628280-25-042130
Chunk: 71

Company: Navan, Inc.
Filing Date: 2025-09-19
Form: S-1
Chunk 71
---
 vendors and data centers that we use, have experienced, and may in the future experience, cybersecurity attacks and threats, including threats or attempts to disrupt our information technology infrastructure and unauthorized attempts to gain access to sensitive or confidential information. Cybersecurity incidents and malicious internet-based activity continue to increase, and providers of cloud-based services have frequently been targeted by such attacks. These cybersecurity challenges, including threats to our own IT infrastructure or those of our customers or third-party providers, may take a variety of forms ranging from stolen credit cards, compromised business and personal information, errors or malfeasance of our personnel, including personnel who have authorized access to our systems and/or information, customer employee fraud, account takeover, social engineering (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), ransomware, malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing attacks, credential harvesting, personnel misconduct or error, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, floods, attacks enhanced or facilitated by AI, and other similar threats. In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, ability to provide our offerings, loss of sensitive data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. These could be initiated by individuals or groups of hackers or sophisticated cyber criminals (including the deployment of harmful malware such as malicious code, viruses, and worms). State-sponsored cybersecurity attacks could also harm our business, financial condition, results of operations, and prospects. Threat actors, nation-states, and nation-state-supported actors now engage, and are expected to continue to engage, in cyber-attacks, including for geopolitical reasons and in connection with military conflicts and operations. During times of war and other major conflicts, we and the third parties upon which we rely may be vulnerable to heightened risk of these attacks, including cyber-attacks that could significantly disrupt our systems and operations, supply chain, and ability to provide our services. It may be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident. Our efforts to do so may not be successful. Actions