Company: NAVN
Filing Date: 2025-10-10
Form Type: S-1/A
Source: 0001628280-25-044812
Chunk: 79

Company: Navan, Inc.
Filing Date: 2025-10-10
Form: S-1/A
Chunk 79
---
, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, floods, attacks enhanced or facilitated by AI, and other similar threats. In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, ability to provide our offerings, loss of sensitive data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. These could be initiated by individuals or groups of hackers or sophisticated cyber criminals (including the deployment of harmful malware such as malicious code, viruses, and worms). State-sponsored cybersecurity attacks could also harm our business, financial condition, results of operations, and prospects. Threat actors, nation-states, and nation-state-supported actors now engage, and are expected to continue to engage, in cyber-attacks, including for geopolitical reasons and in connection with military conflicts and operations. During times of war and other major conflicts, we and the third parties upon which we rely may be vulnerable to heightened risk of these attacks, including cyber-attacks that could significantly disrupt our systems and operations, supply chain, and ability to provide our services. It may be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident. Our efforts to do so may not be successful. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. Future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program. We employ a shared responsibility model where our customers are responsible for using, configuring and otherwise implementing security measures related to our platform and offerings in a manner that 52 meets applicable cybersecurity standards, complies with laws, and addresses their information security risk. As part of this shared responsibility security model, we make certain security features available to our customers that can be implemented at our