Company: NET
Filing Date: 2025-10-30
Form Type: 10-Q
Source: 0001477333-25-000141
Chunk: 484

Company: Cloudflare, Inc.
Filing Date: 2025-10-30
Form: 10-Q
Item: Part I, Item 8
Chunk 484
---
. It is virtually impossible for us to entirely mitigate the risk of these security threats and the security, performance, and reliability of our network and products has been in the past, and may be in the future, disrupted by third parties, including nation-

72

states, competitors, hackers, disgruntled employees, former employees, or contractors. For example, in November 2023, we detected that a likely nation-state threat actor had gained unauthorized access to one of our internal systems. While we immediately began investigating the intrusion and believe we cut off the threat actor’s access prior to significant impact on our customer data or systems, we expect we will continue to be subject to similar threats of unauthorized access in the future and we may not be as successful in quickly identifying such intrusions and mitigating the impacts of such intrusions. We also face the possibility of security threats from other sources, such as employee or contractor errors (such as errors in utilizing AI or machine learning in our products or in the operation of our business) or malfeasance. For example, hostile third parties, including nation-states and their agents, in the past have sought direct or indirect employment at Cloudflare, or attempted to bribe, extort, or otherwise manipulate our employees or contractors to compromise our network and products and in the future other hostile third parties may take similar actions. As our business grows and we employ more employees and engage more contractors in more countries around the world, our ability to supervise the actions of our employees and contractors will decrease and the risk of an employee or contractor error or act of malfeasance will increase. These security threats from third parties are also likely to increase as the numbers, sizes, and types of customers using our network and products increases, particularly our customers that are involved in particularly sensitive industries or activities, such as banking and finance companies and governmental entities or in relation to elections in the United States or elsewhere. Additionally, AI and machine learning may increase cybersecurity risks we face through, for example, being used to increase the prevalence or intensity of cyber attacks.

While we have implemented security measures internally and have integrated security measures into our network and products, these measures have not always functioned as expected and have not always detected or prevented all unauthorized activity, prevented all security breaches or incidents, mitigated all security breaches or incidents, or protected against all attacks or incidents and these types of security failures could occur again in the future. For example, we have experienced multiple social engineering attacks where third parties have attempted, and in limited cases succeeded, in breaching