Pure Storage (PSTG) Risk Factors

In the ordinary course of our business, we collect, store, transmit and otherwise process proprietary, confidential and sensitive data, including by using our internal systems, networks and servers, which may include intellectual property, our proprietary business information and that of our customers, suppliers and business partners and sales data, which may, on occasion, include personally identifiable information. Additionally, we design and sell products that allow our customers to store their data. We also rely on third-party service providers and technologies to operate our business and elements of our infrastructure and our business operations depend, in part, on the success of these third parties' own cybersecurity measures. The security of our networks and those of our third-party service providers, and the intrusion protection features of our products are critical to our operations and business strategy. Cyberattacks, malicious internet-based activity and online and offline fraud are prevalent and continue to increase. We have been, and may in the future be, subject to attempts to gain unauthorized access to our systems. For example, in June 2024, we were the subject of a security incident involving a third party that temporarily gained unauthorized access to a single Snowflake data analytics workspace. The workspace did not include compromising information such as passwords for customer systems, or any of the data that is stored on the customer systems, but did contain telemetry information that we use to provide proactive customer support services. The threats to our information systems and information and those of third parties on whom we rely, include traditional computer "hackers," social engineering schemes (for example, attempts to induce fraudulent invoice payments or divert money from us), phishing attacks, faulty password management, software bugs, malicious code (such as viruses and worms), malware installation, personnel misconduct or error, theft, denial-of-service attacks (such as credential stuffing), advanced persistent threat intrusions, server malfunction, software or hardware failures, loss of data or other computer assets, adware, as well as attacks from nation-state and nation-state supported actors. These threats are also becoming increasingly difficult to detect. AI technologies may also be used in connection with certain attacks, resulting in heightened risks of security breaches and incidents. Additionally, ransomware attacks, including those from organized criminal threat actors, nation-states and nation-state supported actors, are becoming increasingly prevalent and severe and could lead to significant interruptions, delays, or outages in our operations, disruptions in our services, loss of data, loss of income, significant extra expense to restore data or systems, reputational loss and the diversion of funds. To alleviate the financial, operational and reputational impact of a ransomware attack, it may be preferable to make extortion payments, but we may be unwilling or unable to do so (including, for example, if applicable laws or regulations prohibit such payments). Similarly, supply chain attacks have increased in frequency and severity, and there have been high-profile incidents of third-party service providers causing widespread disruptions to their customers' infrastructure due to errors in their SaaS offerings. We cannot guarantee that third parties and infrastructure in our supply chain have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our Platform, systems and network or the systems and networks of third parties that support us and our business. Moreover, we may have limited remedies against third-party providers in the event of a service disruption. We devote significant resources to network security, authentication technologies, data encryption, employee training and other security measures designed to protect our systems and data, including to secure the transmission and storage of data and prevent third-party access to our data or accounts, but there can be no assurance that our security measures or those of our service providers, partners and other third parties upon whom we rely will be effective in protecting against a security incident or the material adverse impacts that may arise from a security incident. Notwithstanding our efforts, we may fail to detect the existence of security breaches or incidents, Malicious third parties might use techniques that we are unable to defend against to compromise and infiltrate our systems. The techniques used by malicious actors change frequently and are often not recognized until launched against a target. Any destructive or intrusive breach of our internal systems could result in the information stored on our networks, including, without limitation, source code for our products and services or the networks and systems of third parties upon whom we rely being accessed, publicly disclosed, lost or stolen. Additionally, an effective attack on our Platform could disrupt the proper functioning of our Platform, allow unauthorized access to sensitive, proprietary or confidential information of ours or our customers, disrupt or temporarily interrupt our and our customers' operations or cause other destructive outcomes, including the theft of information sufficient to engage in fraudulent transactions. The risk that these types of events could seriously harm our business is likely to increase as we expand our network of channel partners, resellers and authorized service providers and operate in more countries. The economic costs to us to eliminate or alleviate cybersecurity risks and vulnerabilities could be significant and may be difficult to anticipate or measure because the damage may differ based on the identity and motive of the programmer or hacker, which are often difficult to identify. If any of these types of security incidents occurs and we are unable to protect our Platform, systems and data, or if we are perceived to have such a security incident, our relationships with our business partners and customers could be materially damaged, our reputation and brand could be materially harmed, use of our Platform could decrease and we could be exposed to a risk of loss or litigation, including, without limitation, class action litigation, and other possible liabilities. A security incident could also result in government enforcement actions that could include investigations, fines, penalties, audits and inspections, additional reporting requirements and/or oversight, temporary or permanent bans on all or some processing of personal information. Moreover, applicable data protection laws, contracts, policies and other data protection obligations may require us to notify relevant stakeholders of security incidents, including affected individuals, customers, regulators, and credit reporting agencies. Such disclosures are costly and the disclosures or the failure to comply with such requirements could lead to material adverse impacts such as negative publicity, loss of customer confidence in our services or security measures, investigations and private or government claims. Security incidents that impact our information technology systems could also result in breaches of our contracts (some of which may not have liability limitations and/or require us to indemnify affected parties) and could lead to litigation with customers, partners or other relevant stakeholders. These proceedings could force us to spend money in defense or settlement, divert management's time and attention, increase our costs of doing business and adversely affect our reputation or otherwise adversely affect our business.

Our ability to increase our revenue depends on our ability to attract, motivate, and retain qualified sales, engineering and other key employees, including our management. These positions may require candidates with specific backgrounds in software and the storage industry, and competition for employees with such expertise is intense. We have from time to time experienced, and we expect to continue to experience, difficulty in hiring and retaining highly skilled employees with appropriate qualifications. To the extent that we are successful in hiring to fill these positions, we may need a significant amount of time to train new employees before they are effective and efficient in performing their jobs. Further, we face new challenges regarding workforce planning, employee expectations regarding the ability to work from home or remotely and maintaining employee productivity, as well as higher employee turnover and slower hiring rates. If we are unable to adequately address these challenges, our ability to recruit and retain employees and to ensure employee productivity could be negatively affected. From time to time, there may be changes in our management team, which could create short term uncertainty. All of our employees, including members of our management team and executive officers, are generally employed on an at-will basis, which means that they could terminate their employment with us at any time. If we are unable to attract, motivate and retain qualified sales, engineering and other key employees, including our management or if they are unable to work effectively, our business and operating results could suffer.

Changes in federal, state, or international tax laws or tax rulings could adversely affect our effective tax rate and our operating results. We generally conduct our international operations through wholly owned subsidiaries and report our taxable income in various jurisdictions worldwide based upon our business operations in those jurisdictions. Given proposed tax legislation and other global tax developments, we continue to evaluate our corporate structure and intercompany relationships. The Tax Cuts and Jobs Act of 2017 amendments to Internal Revenue Code (IRC) Section 174 require that specific research and experimental expenditures be capitalized and amortized over five years if incurred in the U.S. or fifteen years if incurred in a foreign jurisdiction beginning in our fiscal 2023. Although Congress is considering legislation that would defer, modify or repeal this capitalization and amortization requirement, the possibility that this will happen is uncertain. If this requirement is not deferred, modified or repealed, we may continue to incur additional cash taxes. Our intercompany relationships are, and after the implementation of any changes to our corporate structure will continue to be, subject to complex transfer pricing regulations administered by taxing authorities in various jurisdictions. The relevant taxing authorities may disagree with our determinations as to the income and expenses attributable to specific jurisdictions. If such a disagreement were to occur, and our position were not sustained, we could be required to pay additional taxes, interest and penalties, which could result in tax charges, higher effective tax rates, reduced cash flows and lower overall profitability of our operations.

Our operations and performance depend in part on worldwide economic conditions and the economic health of our current and prospective customers. Recent macroeconomic and geopolitical events, including inflation, elevated interest rates, geopolitical tensions, and political and fiscal challenges in the United States and abroad, have, and may continue to have, an adverse effect on the budgets, confidence and demand of our customers, particularly in the United States where we derive the majority of our revenue. These pressures create a great deal of uncertainty and affect our customer demand, margins, costs and operations. Macroeconomic conditions can and do further exacerbate other risks discussed in this "Risk Factors" section, such as risks related to our sales and marketing efforts. If we are unable to successfully manage the effects of these pressures, our business, operating results, cash flows and financial condition may be adversely affected.

We maintain operations outside of the United States, which we have been expanding and intend to continue to expand in the future. As a company headquartered in the United States, conducting and expanding international operations subjects us to costs and risks that we may not face in the United States, including: - exposure to foreign currency exchange rate risk;- difficulties in collecting payments internationally;- managing and staffing international operations;- establishing relationships with channel partners in international locations;- increased travel, infrastructure and legal compliance costs associated with international locations;- requirements to comply with a wide variety of laws and regulations associated with international operations, including taxes, customs and licensing requirements;- significant fines, penalties and collateral consequences if we or our partners fail to comply with anti-bribery laws;- heightened risk of improper, unfair or corrupt business practices in certain geographies;- potentially adverse tax consequences, including repatriation of earnings;- increased financial accounting and reporting burdens and complexities;- political, social and economic instability abroad, terrorist attacks, war (such as the conflicts in Israel and Ukraine) and security concerns in general; and - reduced or varied protection for intellectual property rights in some countries. The occurrence of any of these risks could negatively affect our international operations and, consequently, our business, operating results and financial condition generally.

We and our suppliers have operations in locations, including our headquarters in California, that are subject to earthquakes, fires, floods and other natural catastrophic events, such as climate change, severe weather and geological events, which could disrupt our operations or the operations of our customers and suppliers. Our customers affected by a natural disaster could postpone or cancel orders of our products, which could negatively impact our business. Moreover, should any of our key suppliers fail to deliver components to us as a result of a natural disaster, we may be unable to purchase these components in necessary quantities or may be forced to purchase components in the open market at significantly higher costs. We may also be forced to purchase components in advance of our normal supply chain demand to avoid potential market shortages. Our business interruption insurance may be insufficient to compensate us for losses due to a significant natural disaster or due to man-made factors. Any natural catastrophic events may also prevent our employees from being able to reach our offices in any jurisdiction around the world, and therefore impede our ability to conduct business as usual. In addition, man-made factors, such as acts of war, terrorism or malicious computer viruses, and public health epidemics or pandemics, could cause disruptions in our or our customers' businesses or the economy as a whole. To the extent that these disruptions result in delays or cancellations of customer orders or the deployment of our products, our business, operating results and financial condition could be harmed.