Company: ASAN
Filing Date: 2025-12-02
Form Type: 10-Q
Source: 0001477720-25-000237
Chunk: 381

Company: Asana, Inc.
Filing Date: 2025-12-02
Form: 10-Q
Item: Part I, Item 2
Chunk 381
---
 detecting and successfully defending against them. 

It may be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident and our efforts to do so may not be successful. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems.

We expend resources and modify our business activities to try to protect against security incidents. Additionally, certain privacy, data protection, and security obligations require us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and confidential, proprietary, and sensitive information.

While we have implemented security measures designed to protect against security incidents, we have suffered security incidents in the past and there can be no assurance that these measures will be effective. We take steps designed to detect, mitigate, and remediate vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties with whom we work). We have not been, and may not in the future, be able 

50

to detect and remediate all vulnerabilities, including on a timely basis. Further, we have experienced (and may in the future experience) delays in developing and deploying remedial measures designed to address such identified vulnerabilities. Vulnerabilities in the past have been, and in the future could be, exploited and result in a security incident. 

Additionally, we rely on or partner with third-party vendors and systems that have made representations as to their security measures but there can be no assurance that they will maintain their own security measures appropriately. Breaches of our security measures or those of our third parties, including supply chain attacks or other threats to our business operations, could result in unauthorized access to our sites, networks, systems, and accounts; unauthorized access to, and misappropriation of, individuals’ personal information or other sensitive, confidential or proprietary information of ourselves, our customers, or other third parties; viruses, worms, spyware, or other malware being served from our platform, mobile application, networks, or systems; deletion or modification of content or the display of unauthorized content on our platform; interruption, disruption, or malfunction of operations or our ability to provide our services; costs relating to breach remediation, deployment of additional personnel and protection technologies, and response to governmental investigations and media inquiries and coverage; engagement of third-party experts