Company: ASAN
Filing Date: 2025-12-02
Form Type: 10-Q
Source: 0001477720-25-000237
Chunk: 380

Company: Asana, Inc.
Filing Date: 2025-12-02
Form: 10-Q
Item: Part I, Item 2
Chunk 380
---
 intrusion), viruses, social engineering (including through deep fakes, which are increasingly more difficult to identify, and phishing attacks), ransomware, supply chain attacks and vulnerabilities through our third-party partners, denial-of-service attacks, credential stuffing, credential harvesting, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fire, floods, attacks enhanced or facilitated by AI, and other similar threats, efforts by individuals or groups of hackers and sophisticated organizations, including state-sponsored organizations, threat actors, “hacktivists,” organized criminal threat actors, errors or malfeasance of our personnel, logic flaws, implementation flaws, and other misconfigurations and security vulnerabilities in the software or systems on which we rely. For example, in June 2025, we suffered a flaw in the implementation of our Model Context Protocol feature that potentially led to certain data in the instances of certain customers being accessible to other users of this feature. Additionally, we have been impacted by the use of automated or other fraudulent processes designed to circumvent controls to conduct fraud, send spam, or to execute an account takeover. We anticipate such activity to continue. These abuses, exploits, and other potential causes of security breaches and incidents, and the steps that we take to address them may result in a loss of anticipated revenue, increased costs to protect against or remediate these issues, or cause harm to our reputation and brand.

Ransomware attacks, including those perpetrated by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations and our ability to provide our products or services, loss of confidential, proprietary, and sensitive information and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we, the third parties with whom we work, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our services. Threats such as these are constantly evolving and therefore grow increasingly sophisticated and complex, which in turn increases the difficulty of