Company: DOMO
Filing Date: 2025-09-05
Form Type: 10-Q
Source: 0001505952-25-000075
Chunk: 42

Company: DOMO, INC.
Filing Date: 2025-09-05
Form: 10-Q
Item: Item 1A
Chunk 42
---
 in both frequency and sophistication (including the use of emerging artificial intelligence technologies), and cloud-based platform providers of software and services have been targeted. Many of our employees work remotely at least part of the time, which may pose additional cybersecurity risks. Within cloud service delivery organizations, there is an increased threat from both targeted and non-targeted activities. These activities may originate from threat actor groups with various motivations, including cyber espionage, financial or ideological motivations. We may also face numerous types of attacks, including financial attacks in the form of ransomware/cyber extortion, artificial intelligence-assisted deepfake attacks and disinformation campaigns, fraud, misappropriation of resources (such as, for instance, cryptocurrency mining operations using Domo resources), and malicious attacks such as distributed denial of service with the intention to cause extended period of service downtime, as well as other types of security incidents which could prevent customers from accessing our products and services. Attackers may, in addition to other motivations, seek to render unavailable, destroy, modify, or access without authorization the various types of data we store or otherwise process, including our own data, our customers’ data generally, or data of specific customers. Our employees and contractors who have access to company data as well as customer personal information and/or customer data could be a victim of social engineering tactics such as phishing and business email compromise, which could further lead to malware and/or ransomware being installed on our company assets and which could cause a potential compromise of systems and information. In addition, as we host our platform on third party cloud hosting 

65

services offered by the leading cloud hosting providers, any misconfiguration in the cloud due to our own unintentional error or lack of understanding, or any exploitation of vulnerabilities on those cloud hosting providers’ technology, could lead to unauthorized access, misuse, acquisition, disclosure, loss, alteration, destruction, or other processing of our and our customers’ data, including confidential, sensitive, and other information about individuals. 

We engage third-party service providers to store and otherwise process some of our and our customers’ data, including personal, confidential, sensitive, and other information relating to individuals. Our service providers may also be the targets of cyberattacks and other malicious activity, or may experience security incidents caused by other factors. While we have established a formal third party security risk assessment process to address security risks for our company relating to our key third party service providers, our ability to monitor our service providers’ security measures is limited, and, in any event, third parties or insider threats may be able