Company: NAVN
Filing Date: 2025-09-19
Form Type: S-1
Source: 0001628280-25-042130
Chunk: 73

Company: Navan, Inc.
Filing Date: 2025-09-19
Form: S-1
Chunk 73
---
 disrupt critical business operations, and damage our reputation. Interruptions or delays in these services have impaired and may in the future impair the delivery of our platform, harming our business.” We take steps designed to detect, mitigate, and remediate vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties with whom we work). We have not and may not in the future, however, detect and remediate all such vulnerabilities including on a timely basis. Further, we have and may in the future experience delays in developing and deploying remedial measures and patches designed to address identified vulnerabilities. Even if we have issued or otherwise made patches or information for vulnerabilities in our software applications or offerings, our customers may be unwilling or unable to deploy such patches and use such information effectively and in a timely manner. Vulnerabilities could be exploited and result in a security incident. We and our suppliers have in the past experienced cybersecurity incidents of a limited scale. We may be unable to anticipate or prevent techniques used in the future to obtain unauthorized access or to sabotage systems because they change frequently and often are not detected until after an incident has occurred. We have certain administrative, technical, and physical security measures in place, and we have policies and procedures in place to contractually require service providers to whom we disclose data to implement and maintain reasonable privacy, data protection, and information security measures. Certain data privacy and security obligations have required us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and sensitive information. However, if our privacy protection, data protection, or information security measures or those of the previously mentioned third parties are inadequate or are breached or perceived to have occurred, our reputation and business could be damaged. Recent high-profile security breaches and related disclosures of sensitive data by large institutions suggest that the risk of such events is significant, even if privacy, data protection, and information security measures are implemented and enforced. If sensitive information is lost or improperly disclosed or threatened to be disclosed, we could incur significant costs associated with remediation and the implementation of additional security measures, and may incur significant liability and financial loss, and be subject to regulatory scrutiny, investigations, proceedings, and penalties. 50 Additionally, if our own confidential business information were improperly disclosed, our business, financial condition, results of operations, and prospects could be harmed. A core aspect of our business is the reliability and security of our platform. Any perceived or actual breach of security, regardless of how it occurs or the extent of the breach, could