Company: NAVN
Filing Date: 2025-09-19
Form Type: S-1
Source: 0001628280-25-042130
Chunk: 72

Company: Navan, Inc.
Filing Date: 2025-09-19
Form: S-1
Chunk 72
---
 taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. Future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program. We employ a shared responsibility model where our customers are responsible for using, configuring and otherwise implementing security measures related to our platform and offerings in a manner that 49 meets applicable cybersecurity standards, complies with laws, and addresses their information security risk. As part of this shared responsibility security model, we make certain security features available to our customers that can be implemented at our customers’ discretion, or identify security areas or measures for which our customers are responsible. In certain cases where our customers choose not to implement, or incorrectly implement, those features or measures, misuse our services, or otherwise experience their own vulnerabilities, policy violations, credential exposure or security incidents, even if we are not the cause of a resulting customer security issue or incident, our customer relationships reputation, and revenue may be adversely impacted. The techniques used to sabotage or to obtain unauthorized access to our information technology systems or those upon whom we rely to process our information change frequently, and we have not always been able in the past and may be unable in the future to anticipate such techniques or implement adequate preventative measures or to stop security breaches in all instances. The recovery systems, security protocols, network protection mechanisms, and other security measures that we have integrated into our information technology systems, which are designed to protect against, detect, and minimize security breaches, may not be adequate to prevent or detect service interruption, system failure, or data loss. Third parties may also attempt to and successfully exploit vulnerabilities in, or obtain unauthorized access to, platforms, systems, networks, and/or physical facilities utilized by us or others upon whom we rely. For more information on this risk, see the section titled “—Risks Related to Our Business and Industry—Dependence on third-party service providers by us and our suppliers involves risks, including security incidents, service disruptions, and operational failures that could compromise confidential information,