Company: NCNO
Filing Date: 2025-04-01
Form Type: 10-K
Source: 0001902733-25-000026
Chunk: 80

Company: nCino, Inc.
Filing Date: 2025-04-01
Form: 10-K
Item: Item 1A
Chunk 80
---
 to our customers and their clients, we rely heavily on the data security technology practices and policies adopted by these third-party providers. A vulnerability in a third-party provider’s software or systems, a failure of our third-party providers’ safeguards, policies or procedures, or a breach of a third-party provider’s software or systems could result in the compromise of the confidentiality, integrity, or availability of our systems or the data housed in our solutions.

Cyberattacks and other malicious internet-based activity, including increased threats from the use of AI, continue to increase and evolve, and cloud-based providers of products and services have been and are expected to continue to be targeted. In addition to traditional computer “hackers,” malicious code (such as viruses and worms), phishing, employee theft or misuse, and denial-of-service attacks, sophisticated criminal networks as well as nation-state and nation-state supported actors now engage in attacks, including advanced persistent threat intrusions. Current or future criminal capabilities, discovery of existing or new vulnerabilities, and attempts to exploit those vulnerabilities or other developments, may compromise or breach our systems or solutions. In the event our or our third-party providers’ protection efforts are unsuccessful and our systems or solutions are compromised, we could suffer substantial harm. A security breach could result in operational disruptions, loss, compromise or corruption of customer or client data or data we rely on to provide our solutions, including our analytics initiatives and offerings that impair our ability to provide our solutions and meet our customers’ requirements resulting in decreased revenues and otherwise materially negatively impacting our financial results. Also, our reputation could suffer irreparable harm, causing our current and prospective customers to decline to use our solutions in the future. Further, we could be forced to expend significant financial and operational resources in response to a security breach, including repairing system damage, increasing security protection costs by deploying additional personnel and protection technologies, and defending 

12

against and resolving legal and regulatory claims, all of which could be costly and divert resources and the attention of our management and key personnel away from our business operations.

Federal and state regulations may require us or our customers to notify individuals of data security or privacy incidents involving certain types of personal data or information technology systems, and those laws and regulations continue to evolve to add more reporting requirements on faster timelines. Security compromises experienced by others in our industry, our customers, or us may lead to public disclosures and widespread negative publicity. Any security compromise in our industry, whether actual or perceived, could erode customer confidence in the effectiveness of our security measures, negatively impact our ability to attract new