Company: FSLY
Filing Date: 2025-08-06
Form Type: 10-Q
Source: 0001517413-25-000218
Chunk: 90

Company: Fastly, Inc.
Filing Date: 2025-08-06
Form: 10-Q
Item: Part I, Item 4
Chunk 90
---
 may be unwilling or unable to make such payments due to a number of factors, including applicable laws or regulations prohibiting such payments. 

We are incorporated into the supply chain of a number of companies worldwide and, as a result, if our services are compromised, a significant number or, in some instances, all of our customers and their data could be simultaneously affected. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised. The potential liability 

58

and associated consequences we could suffer as a result of such a large-scale event could be catastrophic and result in irreparable harm. 

Future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.

We rely on third-party service providers and technologies to operate critical business systems to process Sensitive Information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, content delivery to customers, and other functions. Like many other companies, our ability to monitor third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy and data security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.

Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our Sensitive Information or our information technology systems, or those of the third parties upon whom we rely. A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely) to provide our platform, products and services. 

In addition, as we expand our emphasis on selling security-related products, we may become a more attractive target for attacks on our infrastructure intended to destabilize, overwhelm, or shut down our platform. For example,