Company: ASAN
Filing Date: 2025-12-02
Form Type: 10-Q
Source: 0001477720-25-000237
Chunk: 298

Company: Asana, Inc.
Filing Date: 2025-12-02
Form: 10-Q
Item: Part I, Item 8
Chunk 298
---
 force and channel partners to support our growth.

49

If our information technology systems, or those of third parties with whom we work, or our data are compromised or operate in an unintended way, we could experience adverse consequences, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences.

Operating our business and platform involves the collection, processing, storage, and transmission of sensitive, regulated, proprietary and confidential information, including our personal information and business information and those of our customers. As a result, we and the third parties with whom we work face a variety of evolving threats, including but not limited to ransomware attacks, which could cause security incidents. Security incidents can and do compromise the confidentiality, integrity, and availability of this information or our systems. Such incidents include, but are not limited to, cyber-attacks, software bugs and vulnerabilities, malicious internet-based activity, online and offline fraud, server malfunctions, software or hardware failures, email account takeovers, malicious code, malware (including as a result of advanced persistent threat intrusion), viruses, social engineering (including through deep fakes, which are increasingly more difficult to identify, and phishing attacks), ransomware, supply chain attacks and vulnerabilities through our third-party partners, denial-of-service attacks, credential stuffing, credential harvesting, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fire, floods, attacks enhanced or facilitated by AI, and other similar threats, efforts by individuals or groups of hackers and sophisticated organizations, including state-sponsored organizations, threat actors, “hacktivists,” organized criminal threat actors, errors or malfeasance of our personnel, logic flaws, implementation flaws, and other misconfigurations and security vulnerabilities in the software or systems on which we rely. For example, in June 2025, we suffered a flaw in the implementation of our Model Context Protocol feature that potentially led to certain data in the instances of certain customers being accessible to other users of this feature. Additionally, we have been impacted by the use of automated or other fraudulent processes designed to circumvent controls to conduct fraud, send spam, or to execute an account takeover. We anticipate such activity to continue. These abuses, exploits, and other potential causes of security breaches and incidents, and the steps that we take to address them may result in a loss of anticipated revenue, increased costs to protect against or remediate these issues, or cause harm to our reputation and