Workday (WDAY) Risk Analysis

Developing software applications and related enhancements, features, and modifications, including those involving AI, including generative and agentic AI or other emerging technologies, is expensive, and the investment in product development often involves a long return on investment cycle. We believe that we must continue to dedicate a significant amount of resources to our development efforts to maintain our competitive position. Accelerated application introductions and short application life cycles require high levels of expenditures that could adversely affect our operating results if not offset by revenue increases. However, we may not receive significant revenues from these investments for several years, if at all. If we are unable to provide new features, enhancements to user experience, and modifications in a timely and cost-effective manner that achieve market acceptance, align with customer expectations, and that keep pace with rapid technological developments and changing regulatory landscapes, it may negatively impact our customer renewal rates, limit the market for our solutions, or impair our ability to attract new customers and our business and operating results could be adversely affected. For example, AI is propelling advancements in technology, but if we fail to innovate and keep up with advancements in AI technology, if Workday's AI-powered solutions, including our current and planned agentic AI solutions, fail to be delivered as planned or at all, fail to operate as expected or to meet customer expectations, if we fail to successfully monetize our AI-powered solutions, or if we do not have sufficient access to development resources and the technologies required to build and improve our applications, our business and reputation may be harmed.

Our applications involve the storage and transmission of our customers' and other users' sensitive and proprietary information, including personal or identifying information regarding our customers, their employees, job candidates, customers, prospects, and suppliers, as well as financial, accounting, health, and payroll data. Additionally, our operations and the availability of the services we provide also depend on our information technology systems. As a result, a compromise of our applications or systems, or unauthorized access to, acquisition, use, tampering, release, alteration, theft, loss, or destruction of sensitive data, or unavailability of data or our applications, has and could disrupt our operations or impact the availability or performance of our applications; expose us and our customers to regulatory obligations and enforcement actions, litigation, investigations, remediation and indemnity obligations, or supplemental disclosure obligations; damage our reputation and brand; or result in loss of customer, consumer, and partner confidence in the security of our applications, an increase in our insurance premiums, suspension or loss of authorization under the Federal Risk and Authorization Management Program ("FedRAMP") or other authorizations, impairment to our business, and other potential liabilities or related fees, expenses, or loss of revenues. The financial and personnel resources we employ to implement and maintain security measures, including our information security risk insurance policy, may not be sufficient to address our security needs. The security measures we have in place vary in maturity across the organization and may not be sufficient to protect against security risks, preserve our operations and services and the integrity of customer and personal information, and prevent data loss, misappropriation, and other security breaches. Our logging may not be and has not been sufficient to fully investigate the scope of an incident. Our information systems have been and may in the future be compromised by computer hackers, employees, contractors, or vendors, as well as software bugs, human error, technical malfunctions, or other malfeasance. Cybersecurity threats and attacks are often targeted at companies such as ours and may take a variety of forms ranging from individuals or groups of security researchers, including those who appear to offer a solution to a vulnerability in exchange for some compensation, and insiders, to sophisticated hacker organizations, including state-sponsored actors who may launch coordinated attacks, or attacks motivated by the type of data that is processed by our customers, including our public sector customers, on our platform. These threats may be directed not only at us, but also at third parties in our supply chain, including cloud service providers, software vendors, open-source software maintainers, and other service providers or partners whose products or services are integrated with or support our platform and solutions. In the normal course of business, we are and have been the target of malicious cyber-attack attempts and have experienced other security events, including those involving attempts to exploit vulnerabilities in third-party technologies or services on which we rely. As our market presence grows and as our ecosystem of partners, integrations, and service providers expands, we face increased risks of cybersecurity attack or other security threats, including supply chain attacks. Additionally, as AI technologies, including generative AI models, develop rapidly, threat actors are using these technologies to create sophisticated new attack methods that are increasingly automated, targeted, and coordinated and more difficult to defend against. Threat actors may also target our AI models in ways that we cannot yet anticipate. Examples of key cybersecurity risks include viruses, worms, ransomware, and other malicious software programs, along with social engineering attacks, fraud, credential theft or abuse, exploitation of software bugs or other defects, targeted attacks against cloud services and other hosted software, and exploitation of unmanaged software or systems, any of which can result in a compromise of our applications or systems and the data we store or process, and can result in disclosure of Workday confidential information and intellectual property, production downtimes, reputational harm, and an increase in costs to the business. For example, in August 2025, we were targeted as part of a social engineering campaign against many large organizations, resulting in unauthorized access to some of our internal systems including some commonly available business contact information in our third-party customer relationship management platform. As the techniques used to obtain unauthorized access or sabotage systems change frequently, are becoming increasingly sophisticated and complex, and often are not identified until they are launched against a target, and because evidence of unauthorized activity may not have been captured or retained, or may be proactively destroyed by unauthorized actors, we may be unable to anticipate or timely detect these attacks, assess the true impact they may have on our business and operations, or to implement adequate preventative measures. Any cyber-attacks and other security events may have a significant or material impact on our business and operating results. There may also continue to be attacks targeting any vulnerabilities in our applications, internally built infrastructure, enhancements, and updates to our existing offerings, or in the many different underlying networks and services that power the internet that our products depend on, most of which are not under our control or the control of our vendors, partners, or customers. Systems and processes designed to protect our applications, systems, software, and data, as well as customer data and other user data, and to prevent data loss and detect security breaches, may not be effective against all cybersecurity threats or perceived threats. We have been subject to such incidents, including through third-party service providers and in connection with acquisitions we have made. In addition, our software development practices have not and may not identify all potential privacy or security issues, and inadvertent disclosures of data have occurred and may occur again. Additionally, remote work and resource access, including our hybrid work model, has and may continue to result in an increased risk of cybersecurity-related events, including phishing and other social engineering attacks, exploitation of any cybersecurity flaws that may exist, an increase in the number cybersecurity threats or attacks, and other security challenges as a result of our employees and our service providers continuing to work remotely from non-corporate managed networks. These risks may be further heightened by efforts by malicious actors to obtain or misuse authorized access credentials through deception or impersonation, including by posing as legitimate employees, contractors, or by infiltrating our workforce or service providers through fraudulent recruitment, onboarding, or credential-harvesting activities. If successful, such attacks could enable threat actors to gain persistent access to our systems, move laterally within our environment, exfiltrate sensitive data, disrupt operations, or facilitate additional cyber-attacks, and may be more difficult to detect or prevent due to the use of seemingly legitimate accounts and remote access tools. Furthermore, we have acquired or partnered with a number of companies, products, services, and technologies over the years, and incorporated third-party products, services, and technologies into our own products and services. Addressing security issues associated with acquisitions, partnerships, incorporated technologies, and our supply chain requires significant resources, and we have inherited and may in the future inherit additional risks upon integration with or use by Workday. In addition, if a high-profile security breach occurs with respect to an industry peer, our customers and potential customers may generally lose trust in the security of financial management, spend management, human capital management, planning, or analytics applications, or in cloud applications for enterprises in general. Any or all of these issues could negatively affect our ability to attract new customers, cause existing customers to elect to terminate or not renew their subscriptions, result in reputational damage, cause us to pay remediation and indemnity costs and/or issue service credits or refunds to customers for prepaid and unused subscription services, or result in lawsuits, regulatory fines, or other action or liabilities, any of which could adversely affect our business and operating results. We rely on sophisticated information systems and technology, including those provided by third parties, for the secure collection, processing, transmission, and storage of confidential, proprietary, and personal information, and to support our business operations and the availability of our applications. In the past several years, supply chain attacks have increased in frequency and severity. As we are both a provider and consumer of information systems and technology, we are at higher risk of being impacted either directly or indirectly by these attacks. The control systems, cybersecurity program, infrastructure, physical facilities of, and personnel associated with third parties that we rely on or partner with are beyond our control. Our customers may authorize third-party technology providers to access their customer data and any unauthorized use of the third-party technology may result in unauthorized access to such data. The audits we periodically conduct of some of our third-party vendors do not guarantee the security of and may be unable to prevent security events impacting the information technology systems of third parties that are part of our supply chain or that provide valuable services to us, which have resulted and could result in the unauthorized access to data of Workday, our employees, our customers, our third-party partners, or other end users; acquisition, destruction, alteration, use, tampering, release, unavailability, theft or loss of confidential, proprietary, or personal data of Workday, our employees, our customers, our third-party partners, or other end users; or the disruption of our operations and our ability to conduct our business or the availability of our applications; or could otherwise adversely affect our business, financial condition, operating results, or reputation.

We are regularly involved with claims, suits, purported class or representative actions, and may be involved in regulatory and government investigations and other proceedings, involving competition, intellectual property, data security and privacy, bankruptcy, tax and related compliance, labor and employment, commercial disputes, and other matters. Such claims, suits, actions, regulatory and government investigations, and other proceedings can impose a significant burden on management and employees, could prevent us from offering one or more of our applications, services, or features to others, could require us to change our technology or business practices, or could result in monetary damages, fines, civil or criminal penalties, and have and could continue to cause reputational harm or other adverse consequences. Adverse outcomes in some or all of these claims may result in significant monetary damages or injunctive relief that could adversely affect our ability to conduct our business. The litigation and other claims are subject to inherent uncertainties and management's view of these matters may change in the future. A material adverse impact in our condensed consolidated financial statements could occur for the period in which the effect of an unfavorable outcome becomes probable and reasonably estimable.

We operate and are subject to taxes in the U.S. and numerous other jurisdictions throughout the world. Changes to federal, state, local, or international tax laws on income, sales, use, indirect, or other tax laws, statutes, rules, regulations, or ordinances on multinational corporations have recently been enacted or are currently being considered by the U.S. and other countries where we do business. Contemplated legislative initiatives include, but are not limited to, changes to transfer pricing policies and definitional changes to permanent establishment that could be applied solely or disproportionately to services provided over the internet. These contemplated tax initiatives, if finalized and adopted by countries, may ultimately impact our effective tax rate and could adversely affect our sales activity resulting in a negative impact on our operating results and cash flows. In addition, existing tax laws, statutes, rules, regulations, or ordinances could be interpreted, changed, modified, or applied adversely to us (possibly with retroactive effect), which could require us to pay additional tax amounts, fines or penalties, and interest for past amounts. Existing tax laws, statutes, rules, regulations, or ordinances could also be interpreted, changed, modified, or applied adversely to our customers (possibly with retroactive effect), which could require our customers to pay additional tax amounts with respect to services we have provided, fines or penalties, and interest for past amounts. If we are unsuccessful in collecting such taxes from our customers, we could be held liable for such costs, thereby adversely impacting our operating results and cash flows. If our customers must pay additional fines or penalties, it could adversely affect demand for our services. Significant judgment is often required in the determination of our worldwide provision for income taxes. Our effective tax rate could be impacted by changes in the valuation of deferred tax assets and liabilities and our ability to utilize them. We are also subject to tax examinations and it is possible that the final determination of any examinations will have an adverse effect on our operating results or financial position.

The markets for enterprise cloud applications, including AI-powered solutions, are highly competitive, with relatively low barriers to entry for some applications or services. Some of our competitors are larger and have greater name recognition, significantly longer operating histories, access to larger customer bases, larger marketing budgets, and significantly greater resources to devote to the research, development, promotion, and sale of their products and services than we do. This may allow our competitors to respond more effectively than us to new or emerging technologies and changes in market conditions. Our primary competitors are Oracle and SAP, well-established providers of financial management and HCM applications, which have long-standing relationships with customers and partners. Some customers may be hesitant to switch vendors or to adopt cloud applications such as ours and may prefer to maintain their existing relationships with competitors. We also face competition from other enterprise software vendors, from regional competitors that only operate in certain geographic markets, and from vendors of specific applications that address only one or a portion of our applications, some of which offer cloud-based or AI-powered solutions. These vendors include, without limitation: Anaplan, Inc., ADP, Coupa Software Inc., Dayforce, Inc., Microsoft, ServiceNow, Inc., and UKG Inc. We may also face greater competition from non-specialist solutions relying on generic large language models ("LLMs"), generative AI, and general-purpose agents to address a broad range of business needs. In order to take advantage of customer demand for cloud and AI-powered applications, legacy vendors are expanding their cloud or AI-powered applications through acquisitions, strategic alliances, and organic development. In addition, other cloud or AI platform companies that provide services in different target markets or industries may develop applications or acquire companies that operate in our target markets or industries, and some potential customers may elect to develop their own internal applications. As the market evolves and as existing and new market participants introduce new types of technologies, such as generative and agentic AI, and different approaches that enable organizations to address their HCM and financial needs, our ability to maintain market differentiation may affect our competitive position. Furthermore, our current or potential competitors may be acquired by, or merge with, third parties with greater available resources and the ability to initiate or withstand substantial price competition. Our competitors may also establish cooperative relationships among themselves or with third parties that may further enhance their offerings, integrations, or resources. Many of our competitors also have major distribution agreements with consultants, system integrators, and resellers and such partners may prefer to maintain their existing relationships with competitors. With the introduction of new technologies, such as generative AI, we expect competition to intensify in the future. As we attempt to sell our products and solutions to potential and current customers, we must demonstrate that our products and solutions are superior to other solutions available to their organizations, including generic LLMs, software created using natural language prompts and generative AI (referred to as vibe coding) and other emerging technologies. If our competitors' products, services, or technologies, including generative and agentic AI capabilities, become more accepted than our products, if their customer support efforts are preferred by customers, if they are successful in bringing their products or services to market earlier than ours, if they scale at a faster rate, or if their products or services are more technologically capable or resonate more with the market than ours, including having more or easier to use integrations for software solutions used and preferred by our customers, then our revenues could be adversely affected. In addition, our competitors may offer their products and services at a lower price, or may offer price concessions, delayed payment terms, financing terms, or other terms and conditions that are more enticing to potential customers. Due to the complex nature of implementing financial management solutions, the lifecycle of the contracts for such solutions tends to be long. Therefore, if we lose a current customer to a competitor or fail to secure a prospective customer for financial management solutions, there is a long duration before we will be able to approach that customer again with our sales efforts for such solutions. Pricing pressures and increased competition could result in reduced sales, reduced margins, losses, or a failure to maintain or improve our competitive market position, any of which could adversely affect our business and operating results.

We believe that developing and maintaining widespread positive awareness of our brand is critical to our growth and that the importance of maintaining positive brand awareness will increase as competition in our markets increases. Successfully promoting and maintaining our brand will depend on our ability to provide reliable solutions that meet the needs of our customers, our ability to successfully differentiate our products and solutions from those of our competitors, and the effectiveness of our marketing efforts. However, brand promotion activities may not generate the awareness or increased revenues we anticipate, and even if they do, any increase in revenues may not offset the significant expenses we incur in promoting our brand. If we fail to successfully promote and maintain positive awareness of our brand, or we fail to expand positive awareness of our newer solutions or products, we may fail to attract or retain customers necessary to realize a sufficient return on our brand-building investments. We have and may continue to experience reputational harm from, among other things, the introduction of new products, features, or services that do not meet customer expectations; our use of new and evolving technologies, including AI; service outages or disruptions; issues with product quality or performance; backlash from customers, government entities, or other stakeholders that disagree with our product offering decisions or public policy, ethical, or political positions; significant litigation or regulatory or government actions that negatively reflect on our business practices; and data security breaches or compliance failures. Additionally, the performance of our partners may affect our brand and reputation if customers do not have a positive experience with our partners' solutions or services. Any unfavorable publicity or perception of our brand or our applications, including any unfavorable candidate or end user experience, could negatively impact our ability to attract and retain customers and also make it more difficult to hire and retain employees.

We operate on a global scale, and as a result, our business and revenues are impacted by global economic and geopolitical conditions. Global economic developments, including new or increased tariffs, geopolitical volatilities and conflicts, downturns or recessions, political instability, and global health crises may negatively affect us or our ability to accurately forecast and plan our future business activity. In addition, volatile economic and geopolitical situations have led and could lead to further economic disruption. Any sustained adverse impacts from these and other recent macroeconomic events could materially and adversely affect our business, financial condition, operating results, and earnings guidance that we may issue from time to time, which could have a material effect on the value of our Class A common stock. Our future revenues rely on continued demand by existing customers and the acquisition of new customers who may be subject to economic hardship due to recent macroeconomic events, including concerns about the impact of potential or imposed tariffs, inflation or the interest rate environment, and may delay or reduce their enterprise software spending to preserve capital and liquidity. In connection with recent macroeconomic events, we have experienced and may continue to experience delays in purchasing decisions from existing and prospective customers, increased demand for price concessions and delayed payment terms, and a reduction in customer demand. Our business, financial condition, and operating results may be negatively impacted in future periods due to the prolonged impacts of recent macroeconomic events, which may not be fully reflected in our operating results and overall financial performance until future periods. To the extent recent macroeconomic events adversely affect our business, financial condition, and operating results, it may also have the effect of heightening many of the other risks described in this "Risk Factors" section.

The growth of our business and future prospects depends on our ability to further expand our operations and increase our sales outside of the U.S. as a percentage of our total revenues. Operating globally requires significant resources and management attention and subjects us to regulatory, economic, and political risks that are different from those in the U.S. Our investments and efforts to further expand internationally may not be successful in creating additional demand for our applications outside of the U.S. or in effectively selling subscriptions to our applications in all of the markets we enter. Risks associated with doing business on a global scale that could adversely affect our business, include: - the need to develop, localize, and adapt our applications and customer support for specific countries;- the need to successfully develop and execute on a localized go-to-market strategy;- the need to adhere to local laws and regulations, including those related to data localization, privacy, and anti-corruption, which may make it more difficult to penetrate certain international market segments with highly specialized compliance, contracting, and data sovereignty requirements;- difficulties in appropriately staffing and managing foreign operations and providing appropriate compensation and benefits for local markets;- difficulties in leveraging executive presence, maintaining company culture globally, and conforming with local cultural contexts and customs;- increased travel, real estate, infrastructure, and legal and regulatory compliance costs associated with international operations;- different pricing environments, longer sales cycles, and longer trade receivables payment cycles, and collections issues;- new and different sources of competition;- potentially weaker protection for intellectual property and other legal rights than in the U.S. and practical difficulties in enforcing intellectual property and other rights;- laws, contracting approaches, customs, and business practices favoring local vendors over U.S.-based companies, which may be increased by geopolitical tensions;- restrictive governmental actions focused on cross-border trade, such as import and export restrictions, duties, quotas, potential or imposed tariffs, trade disputes, and barriers or sanctions, as well as any retaliatory actions, that may prevent us from offering certain portions of our products or services to a particular market, may increase our operating costs, or may subject us to monetary fines or penalties;- compliance challenges related to the complexity of multiple, conflicting, and changing governmental laws and regulations, including employment, tax, privacy, intellectual property, financial services, AI, and data protection laws and regulations, as well as challenges with differing legal, alternative dispute, and regulatory systems;- increased compliance costs related to government regulatory reviews or audits, including those related to international cybersecurity and sustainability requirements;- increased financial accounting and reporting burdens and complexities;- the effects of currency fluctuations on our revenues and expenses and customer demand for our services;- restrictions on the transfer of funds;- adverse tax consequences and tax rulings; and - unstable economic and political conditions. Certain of the above factors have and may continue to negatively impact our ability to sell our applications and offer services globally, reduce our competitive position in foreign markets, increase our costs of global operations, reduce demand for our applications and services from global customers, or subject us to legal or regulatory liability. Additionally, the majority of our international costs are denominated in local currencies and we anticipate that over time an increasing portion of our sales contracts may be outside the U.S. and will therefore be denominated in local currencies. Fluctuations in the value of foreign currencies, which may be amplified by macroeconomic events, may impact our operating results when translated into U.S. dollars. Such fluctuations may also impact our ability to predict our future results accurately. If we are not able to successfully hedge against the risks associated with foreign currency fluctuations, our financial condition and operating results could be adversely affected.

Our corporate headquarters are located in Pleasanton, California, and we host our applications in data centers operated by third parties located in the U.S., Europe, Canada, and the Asia-Pacific region. The west coast of the U.S. contains active earthquake zones and the southeast is subject to seasonal hurricanes or other extreme weather conditions. Additionally, we rely on internal technology systems, our website, our network, and third-party infrastructure and enterprise applications, which are located in a wide variety of regions, for our development, marketing, operational support, hosted services, and sales activities. In the event of a major earthquake, hurricane, or other natural disaster, or a catastrophic event such as fire, power loss, telecommunications failure, vandalism, civil unrest, cyber-attack, geopolitical instability, war, terrorist attack, acts of violence, insurrection, pandemics or other public health emergencies, or the effects of climate change (such as drought, flooding, heat waves, wildfires, increased storm severity, and sea level rise), we may be unable to continue our operations and have, and may in the future, endure system interruptions, and may experience delays in our product development, lengthy interruptions in our services, breaches of data security, and loss of critical data, all of which could cause reputational harm or otherwise have an adverse effect on our business and operating results. In addition, the impacts of climate change on the global economy and our industry are rapidly evolving. We may be subject to increased regulations, reporting requirements, standards, or stakeholder expectations regarding climate change that may impact our business, financial condition, and operating results.

Our success and future growth depend largely upon the continued services of our executive officers, other members of senior management, and other key employees. We do not have employment agreements with our executive officers or other key employees that require them to continue to work for us for any specified period, and they could terminate their employment with us at any time. In February 2026, Aneel Bhusri, formerly Executive Chair, assumed the role of CEO and Carl Eschenbach ceased to serve as CEO. Key employee and executive leadership changes have the potential to disrupt our business, impact our ability to preserve our culture, negatively affect our ability to attract and retain talent, or otherwise have a serious adverse effect on our business and operating results. We have and may continue to execute our growth plan through strategic investments to attract and retain executive officers, senior management, or other key employees that may not be offset by increased performance or revenues. To execute our growth plan, we must attract, enable, develop, and retain highly qualified talent. Our ability to compete and succeed in a highly competitive environment is directly correlated to our ability to recruit and retain highly skilled and experienced employees, especially in the areas of product development, cybersecurity, senior sales executives, and engineers with significant experience in designing and developing software and internet-related services, especially in AI and emerging technologies. The expansion of our sales infrastructure, both domestically and internationally, is necessary to grow our customer base and business. Our business may be adversely affected if our efforts to attract and enable new members of our direct sales force do not generate a corresponding increase in revenues. We have experienced, and we expect to continue to experience, significant competition in hiring and retaining employees with appropriate qualifications. We must also continue to retain, develop, and motivate existing employees through our compensation practices, company culture, and career development opportunities. The compensation and incentives we have available to attract, retain, and motivate employees may not meet the expectations of current and prospective employees as the competition for talent intensifies. For example, our equity awards may become less effective if our stock price decreases or increases at a slower rate than our talent competitors. Further, our current and future office environments and hybrid work policy may not meet the expectations of our employees or prospective employees, and may amplify challenges in recruiting and retention. We believe that a critical component of our success has been our corporate culture and core values. As we continue to grow and change, we may find it difficult to maintain our corporate culture among a larger number of employees who are dispersed throughout various geographic regions, including difficulties due to managing the complexities of communicating with all employees. Efforts to restructure our workforce may be disruptive and adversely impact employee morale or our corporate culture. Failure to maintain or adapt our culture could negatively affect our ability to attract new employees or to retain our current employees and our business and future growth prospects could be adversely affected.