Company: ASAN
Filing Date: 2025-12-02
Form Type: 10-Q
Source: 0001477720-25-000237
Chunk: 301

Company: Asana, Inc.
Filing Date: 2025-12-02
Form: 10-Q
Item: Part I, Item 8
Chunk 301
---
 during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.

The previously identified or similar threats could cause a security breach or incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our information technology systems and confidential, proprietary, and sensitive information, or those of the third parties with whom we work. For example, periodically we become aware of attempts to phish Asana employees or attempts to circumvent spam protections we’ve put in place in our product. A security incident or other interruption could disrupt our ability (and that of third parties with whom we work) to provide our products or services or could impact our reputation.

Any compromise or breach of our security measures, or those of the third parties with whom we work, could also violate applicable privacy, data protection, security, and other laws, and cause significant legal and financial exposure, adverse publicity, and a loss of confidence in our security measures, which could have a material adverse effect on our business, results of operations, and financial condition. Applicable privacy, data protection, and security obligations may also require us, or we may voluntarily choose, to notify relevant stakeholders, such as governmental authorities, partners, customers, investors, and affected individuals, of security breaches or incidents, or take other action, such as providing credit monitoring and identity theft protection services, and we have done such notifications in the past. Such notifications may involve inconsistent requirements and are costly, and the notifications or the failure to comply with such applicable requirements could lead to adverse consequences. 

Any actual or perceived security breach or incident suffered by us or a third party with whom we work may cause us to experience material adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing confidential, proprietary, and sensitive data (including personal information); litigation 

51

(including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions in our operations (including availability of data); financial loss; and other similar harms. Security incidents and material attendant consequences may cause customers to stop using our services, deter new customers from using our services, and negatively impact our ability to grow and operate our business. 

Additionally, our contracts may not contain limitations of liability, and even when they do, there can be no assurance