Company: FSLY
Filing Date: 2025-08-06
Form Type: 10-Q
Source: 0001517413-25-000218
Chunk: 91

Company: Fastly, Inc.
Filing Date: 2025-08-06
Form: 10-Q
Item: Part I, Item 4
Chunk 91
---
 we have had security incidents in the past that have tested the limits of our infrastructure and impacted the performance of our platform. 

In addition to experiencing a security incident, third parties may gather, collect, or infer Sensitive Information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. Further, Sensitive Information of the Company or our customers could be leaked, disclosed, or revealed as a result of or in connection with our employees’, personnel’s, or vendors’ use of generative AI technologies.

Certain privacy and data security obligations may require us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and Sensitive Information.

While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We take steps to detect and remediate vulnerabilities, but we may not be able to detect and remediate all vulnerabilities because the threats and techniques used to exploit the vulnerability change frequently and are often sophisticated in nature. Therefore, such vulnerabilities could be exploited but may not be detected until after a security incident has occurred. These vulnerabilities pose material risks to our business. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities. 

Applicable privacy and data security obligations may require us to notify relevant stakeholders, including affected individuals, customers, regulators, and investors of security incidents. For example, SEC rules require disclosure on Form 8-K of the nature, scope and timing of any material cybersecurity incident and the reasonably likely impact of such incident. Compliance with such disclosure efforts is costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences. If we (or a third party upon whom we rely) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences, such as government enforcement actions (for example, investigations, fines penalties, audits, and inspections); additional reporting requirements and/or oversight, restrictions on processing Sensitive Information (including personal data); litigation (including class action claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions or degradation of performance in our services (including availability of data); financial loss; and other similar harms. Security incidents and attendant consequences may cause customers to stop using our platform, products, and services, cause us to offer pricing and other concessions, deter new customers from