Company: NAVN
Filing Date: 2025-10-10
Form Type: S-1/A
Source: 0001628280-25-044812
Chunk: 81

Company: Navan, Inc.
Filing Date: 2025-10-10
Form: S-1/A
Chunk 81
---
 they change frequently and often are not detected until after an incident has occurred. We have certain administrative, technical, and physical security measures in place, and we have policies and procedures in place to contractually require service providers to whom we disclose data to implement and maintain reasonable privacy, data protection, and information security measures. Certain data privacy and security obligations have required us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and sensitive information. However, if our privacy protection, data protection, or information security measures or those of the previously mentioned third parties are inadequate or are breached or perceived to have occurred, our reputation and business could be damaged. Recent high-profile security breaches and related disclosures of sensitive data by large institutions suggest that the risk of such events is significant, even if privacy, data protection, and information security measures are implemented and enforced. If sensitive information is lost or improperly disclosed or threatened to be disclosed, we could incur significant costs associated with remediation and the implementation of additional security measures, and may incur significant liability and financial loss, and be subject to regulatory scrutiny, investigations, proceedings, and penalties. 53 Additionally, if our own confidential business information were improperly disclosed, our business, financial condition, results of operations, and prospects could be harmed. A core aspect of our business is the reliability and security of our platform. Any perceived or actual breach of security, regardless of how it occurs or the extent of the breach, could have a significant impact on our reputation as a trusted brand, cause us to lose existing partners or other customers and travelers, prevent us from obtaining new partners and other customers, require us to expend significant funds to remedy problems caused by breaches and implement measures to prevent further breaches, and expose us to legal risk and potential liability including those resulting from governmental or regulatory investigations, class action litigation, and costs associated with remediation, such as fraud monitoring and forensics. Further, applicable privacy and security obligations may require us to notify relevant stakeholders of security incidents. Such disclosures are costly, and the disclosures or the failure to comply with such requirements could lead to adverse consequences. Any actual or perceived security breach at a company providing services to us or our customers could have similar effects. Further, as many of our employees continue to work remotely, such as our customer support agents, these cybersecurity risks are heightened by an increased attack surface across our business and those of our partners and service providers. We have heightened monitoring in the face of such risks, but cannot guarantee that our efforts, or the efforts