CRM

MKT CAP $199.2BP/E —DIV YIELD 0.71%FCF YIELD 7.61%REV TTM $43.9B +11.2%NET INCOME $9.7B +45.0%NET DEBT $31B52W 150.12 – 266.23SEC XBRL · TTM TO Invalid Date

How CRM rewrote its risk factors

10-K ITEM 1A · FY2025 → FY2026

Text kept

33%

of sentences unchanged

Added

227

new sentences

Dropped

222

sentences removed

Length

−1,112

words, now 16,611

New in FY2026

Risk Factor Summary Operational and Execution Risks • Any breaches in our security measures or those of our third-party data center providers, cloud computing platform providers, customers, partners, or other third-party vendors, or the underlying Internet infrastructure that cause unauthorized access to, disclosure, alteration, corruption, destruction or loss of customer data, our data or our IT systems, or disruption of authorized access thereto. • Any defects or disruptions in our services that diminish demand for our services. • Any interruptions or delays in services from third parties, including data center hosting facilities, cloud computing platform providers and other hardware and software vendors, as well as Internet infrastructure, or from our inability to adequately plan for and manage service interruptions or infrastructure capacity requirements. • An inability to realize the expected business or financial benefits of company and technology acquisitions. • Strain on our personnel resources and infrastructure from supporting our existing and growing customer base or an inability to scale our operations and increase productivity. • Customer attrition, or our inability to accurately predict subscription renewals and upgrade rates. • Disruptions caused by periodic changes to our sales organization. • Exposure to risks inherent in international operations from sales to customers outside the United States. • A more time-consuming and expensive sales cycle, pricing pressure and implementation and configuration challenges for sales efforts to larger enterprise customers. • Any loss of key members of our management team or development and operations personnel, or inability to attract and retain employees necessary to support our operations and growth. • Any failure in the delivery of high-quality professional and technical support services related to our online applications.
Strategic and Industry Risks • An inability to compete effectively in the intensely competitive markets in which we participate. • Any failure to expand our services and to develop and integrate our existing services in order to keep pace with technological developments. • An inability to maintain and enhance our brands. • Partial or complete loss of invested capital, or significant changes in the fair value, of our strategic investment portfolio. • Any discontinuance by third-party developers and vendors in embracing our technology delivery model and enterprise cloud computing services, or customers asking us for warranties for third-party applications, integrations, data and content. • Social, ethical, and regulatory issues, including the development, deployment, use or capabilities of AI in our offerings. • The evolving landscape related to environmental, social and governance matters.
Legal and Regulatory Risks • Privacy concerns and laws as well as evolving regulation of cloud computing, AI services, increased restriction of cross-border data transfers and other regulatory developments. • Evolving industry-specific regulations, requirements, interpretive positions or standards. • Lawsuits against us by third parties for various claims, including alleged infringement of proprietary rights. • Any failure to obtain registration or protection of our intellectual property rights. • Risks related to government contracts and related procurement regulations. • Governmental sanctions and export and import controls that could impair our ability to compete in international markets and may subject us to liability.
Risks Related to Owning Our Common Stock • Fluctuations in our quarterly results. • Volatility in our stock price and associated litigation. • Provisions in our governing documents and Delaware law that might discourage, delay or prevent a change of control of the Company or changes in our management.
General Risks • Volatile and significantly weakened global economic conditions. • The occurrence of natural disasters and other catastrophic events beyond our control. • The long-term impact of climate change on our business.
Operational and Execution Risks If our security measures, or those of our third-party data center providers, cloud computing platform providers, customers, partners, other third-party vendors or the underlying Internet infrastructure, are breached or otherwise compromised, resulting in the unauthorized access to, disclosure, alteration, corruption, destruction or loss of customer data, our data or our IT systems, or disruption of authorized access thereto, our services may be perceived as insecure, customers may reduce or terminate their use of our services, and we may incur significant reputational harm, legal liability, regulatory scrutiny or a negative financial impact.
Our services and underlying infrastructure have in the past and may in the future be breached or compromised, including, for example, as a result of the following: • attempts to fraudulently induce our employees, customers, partners, or third-party vendors to disclose sensitive information to gain unauthorized access to our or our customers’ data or IT systems; • efforts by threat actors, including criminal organizations, state-sponsored actors and nation-states, to launch coordinated cyberattacks or supply chain attacks on our infrastructure or that of our third-party vendors, including through ransomware, destructive malware, distributed denial-of-service attacks or exploitation of previously unknown “zero-day” vulnerabilities; • attempts to misuse our marketing, advertising, messaging or social products and functionalities to impersonate persons or organizations and disseminate information that is false, misleading or malicious; • vulnerabilities arising from new technologies and infrastructures, including those from acquisitions, enhancements and updates to our existing products, and the adoption and deployment of AI technologies within our products, services, internal systems, which may introduce novel security, data governance, or operational risks; • vulnerabilities in products or components within the broad ecosystem in which our services operate and upon which they depend; • attacks on, or vulnerabilities in, the underlying networks and services that power the Internet on which our products depend, most of which are not under our control or the control of our third-party vendors, partners or customers; and • employee or contractor errors, omissions or intentional acts that compromise our security systems.
Although we devote significant resources to protecting our data and IT systems, we can provide no assurances that our security measures, including systems and processes designed to protect the confidentiality, integrity and availability of our customers’ and our customers’ customers’ proprietary and sensitive data, will be effective or that a material cybersecurity incident will not occur.
Our ability to mitigate these risks may be impacted by the following: • evolving and increasingly sophisticated techniques used to breach or disrupt IT systems and infrastructure, including the use or exploitation of AI technologies by threat actors to accelerate, scale or personalize cyberattacks, which may increase speed and effectiveness and limit our ability to anticipate, detect or mitigate such threats; • the increasing complexity of our internal IT systems as we integrate acquired businesses and adopt new technologies and data-sharing models; and • our limited control over our customers, partners, and third-party vendors (including those authorized by customers to access their data), or over the processing of data by such third parties, which may limit our ability to maintain the integrity or security of such transmissions or processing.
In the normal course of business, we and our customers are and have been the target of malicious cyberattacks and other security threats.
Although to date we have not identified any security incidents involving our systems that have had a material financial impact on us, there can be no assurance that future incidents will not be material or significant.
As our market presence grows, we may face increased risks of cyberattacks and other security threats.
Additionally, as AI technologies, including generative and agentic AI, continue to evolve, threat actors are using and exploiting these technologies to enhance the sophistication, scale, speed and effectiveness of security threats that may be more difficult to detect and defend against.
Any delay in detecting, containing, or remediating a cybersecurity incident may result in additional harm, and in certain cases the full scope and impact of any such incident may not be immediately apparent.
A cybersecurity incident could result in unauthorized access to, or the loss or denial of authorized access to, our IT systems or data, or those of our customers, including intellectual property and other proprietary, sensitive or confidential information.
We are subject to contractual, regulatory and other legal obligations to notify relevant stakeholders of certain security incidents.
For example, SEC rules require disclosure on Form 8-K of the nature, scope and timing of any material cybersecurity incident and the reasonably likely impact of such incident.
Assessing whether an incident is material or reportable may require complex judgment and investigation, and disclosure of an incident may itself adversely affect our reputation, customer relationships and exposure to legal or regulatory proceedings.
A security incident or related disclosure could result in loss of confidence in the security of our services, harm our reputation, negatively impact future sales, disrupt our business operations, increase insurance premiums and result in legal, regulatory and financial liability.
Additionally, it may take considerable time for us to investigate and evaluate the full impact of cybersecurity attacks, particularly for sophisticated attacks, which may inhibit our ability to provide prompt, full and reliable information about the incident to our customers, regulators and the public.
Further, there can be no assurance that our insurance coverage will be sufficient in type or amount to cover the losses arising from a cybersecurity incident.
In addition, prevention, detection, investigation and remediation of actual or suspected vulnerabilities or incidents, including determining whether notification or disclosure is required, may not be straightforward, may result in significant direct and indirect costs, including increased infrastructure and security spending and the diversion of resources from development activities.
We have in the past and may in the future identify defects in or experience disruptions to our services.
Such issues may arise in a variety of circumstances, including from customers using our services in unanticipated ways that disrupt access for other customers; from employee, contractor or other third-party action or inaction; or from the complexity of our services, which incorporate a variety of hardware, proprietary software and third-party and open-source software.
We have experienced and may in the future experience defects in our, our customers’, or third-party vendors’ products and components, which may create vulnerabilities that inadvertently permit unauthorized access to protected customer data.
We can provide no assurance that such defects or vulnerabilities will not occur in the future, have a material adverse effect on our business or subject us to substantial liability.
Vulnerabilities in open-source, proprietary or third-party products and components can persist even after security patches have been issued if updates are not timely implemented or if threat actors exploit vulnerabilities before remediation is complete.
Since our customers rely on our products and services for important aspects of their operations, errors, defects, service disruptions or other performance issues have in the past adversely impacted our customers and could do so in the future.
As a result, customers could elect to not renew their services, delay or withhold payment or make warranty or other claims against us.
Such outcomes could reduce future sales, increase in our allowance for doubtful accounts, increase collection cycles and expose us to litigation and related expenses.
Any interruptions or delays in services from third parties, including data center hosting facilities, cloud computing platform providers and other hardware and software vendors, as well as Internet infrastructure, or from our inability to adequately plan for and manage service interruptions or infrastructure capacity requirements, could impair the delivery of our services and harm our business.
We rely on third-party data center hosting facilities and cloud computing platform providers located in the United States and other countries, as well as the many different underlying networks and services that power the Internet, to deliver our products and services and operate critical business systems.
We also rely on hardware purchased or leased from, software licensed from, and cloud computing platforms provided by third parties in order to offer our products and services, including database software, hardware and data from multiple vendors.
Any disruption, degradation or failure of our systems, or those of the third parties on which we rely, could result in service interruptions and harm our business.
We have experienced service interruptions and interruptions may occur in the future.
As our reliance on these third-party systems increases, and particularly on third-party cloud computing platforms, our exposure to service interruptions and performance or quality issues may also increase.
Service interruptions or other performance or quality issues may cause us to issue credits or pay penalties, cause customers to assert warranty or other claims or terminate their subscriptions, and adversely affect attrition rates and our ability to attract new customers, which could reduce revenue.
Our business and reputation would also be harmed if our customers and potential customers perceive our services as unreliable.
For many of our offerings, our production environment and customer data are replicated at geographically separate facilities.
Certain offerings, including those added through acquisitions, may be delivered through alternate facilities or arrangements.

and 187 more.

Gone since FY2025

Risk Factor Summary Operational and Execution Risks • Any breaches in our security measures or those of our third-party data center hosting facilities, cloud computing platform providers or third-party service partners, or the underlying infrastructure of the Internet that cause unauthorized access to a customer’s data, our data or our IT systems, or the blockage or disablement of authorized access to our services. • Any defects or disruptions in our services that diminish demand for our services. • Any interruptions or delays in services from third parties, including data center hosting facilities, cloud computing platform providers and other hardware and software vendors, as well as internet availability, or from our inability to adequately plan for and manage service interruptions or infrastructure capacity requirements. • An inability to realize the expected business or financial benefits of company and technology acquisitions. • Strain on our personnel resources and infrastructure from supporting our existing and growing customer base or an inability to scale our operations and increase productivity. • Customer attrition, or our inability to accurately predict subscription renewals and upgrade rates. • Disruptions caused by periodic changes to our sales organization. • Exposure to risks inherent in international operations from sales to customers outside the United States. • A more time-consuming and expensive sales cycle, pricing pressure and implementation and configuration challenges as we target more of our sales efforts at larger enterprise customers. • Any loss of key members of our management team or development and operations personnel, or inability to attract and retain employees necessary to support our operations and growth. • Any failure in the delivery of high-quality professional and technical support services related to our online applications.
Strategic and Industry Risks • An inability to compete effectively in the intensely competitive markets in which we participate. • Any failure to expand our services and to develop and integrate our existing services in order to keep pace with technological developments. • An inability to maintain and enhance our brands. • Partial or complete loss of invested capital, or significant changes in the fair value, of our strategic investment portfolio. • Any discontinuance by third-party developers and providers in embracing our technology delivery model and enterprise cloud computing services, or customers asking us for warranties for third-party applications, integrations, data and content. • Social and ethical issues, including the use or capabilities of AI in our offerings. • The evolving landscape related to ESG matters.
Legal and Regulatory Risks • Privacy concerns and laws as well as evolving regulation of cloud computing, increased restriction of cross-border data transfers and other regulatory developments. • Evolving industry-specific regulations, requirements, interpretive positions or standards. • Lawsuits against us by third parties for various claims, including alleged infringement of proprietary rights. • Any failure to obtain registration or protection of our intellectual property rights. • Risks related to government contracts and related procurement regulations. • Governmental sanctions and export and import controls that could impair our ability to compete in international markets and may subject us to liability.
Risks Related to Owning Our Common Stock • Fluctuations in our quarterly results. • Volatility in the market price of our common stock and associated litigation. • Provisions in our certificate of incorporation and bylaws and Delaware law that might discourage, delay or prevent a change of control of the Company or changes in our management.
General Risks • Volatile and significantly weakened global economic conditions. • The occurrence of natural disasters and other events beyond our control. • The long-term impact of climate change on our business.
Operational and Execution Risks If our security measures or those of our third-party data center hosting facilities, cloud computing platform providers or third-party service partners, or the underlying infrastructure of the Internet are breached, and unauthorized access is obtained to a customer’s data, our data or our IT systems, or authorized access is blocked or disabled, our services may be perceived as not being secure, customers may curtail or stop using our services, and we may incur significant reputational harm, legal exposure and liabilities, or a negative financial impact.
Our services and underlying infrastructure may in the future be materially breached or compromised as a result of the following: • third-party attempts to fraudulently induce our employees, partners or customers to disclose sensitive information to gain access to our customers’ data or IT systems, or our data or our IT systems; • efforts by hackers or sophisticated groups, such as criminal organizations, state-sponsored organizations or nation-states, to launch coordinated cyberattacks on internally built infrastructure or on third-party cloud-computing platform providers, including ransomware, destructive malware and distributed denial-of-service attacks; • third-party attempts to abuse our marketing, advertising, messaging or social products and functionalities to impersonate persons or organizations and disseminate information that is false, misleading or malicious; • vulnerabilities existing within new technologies and infrastructures, including those from acquired companies, or resulting from enhancements and updates to our existing service offerings; • vulnerabilities in the products or components across the broad ecosystem that our services operate in conjunction with and are dependent on; • attacks on, or vulnerabilities in, the many different underlying networks and services that power the Internet that our products depend on, most of which are not under our control or the control of our vendors, partners or customers; and • employee or contractor errors or intentional acts that compromise our security systems.
These risks are mitigated, to the extent possible, by our ability to maintain and improve business and data governance policies and enhance processes and internal security controls, including our ability to escalate and respond to known and potential risks.
We can provide no assurances that our security measures, including implemented systems and processes designed to protect our customers’ and our customers’ customers’ proprietary and other sensitive data, will provide absolute security or otherwise be effective or that a material breach will not occur.
For example, our ability to mitigate these risks may be impacted by the following: • evolving techniques used to breach or sabotage IT systems and infrastructure, including as a result of the increased use of AI technologies by bad actors, which are generally not recognized until launched against a target, and could result in our being unable to anticipate or implement adequate measures to prevent such techniques; • the increasing complexity of our internal IT systems as we incorporate and secure IT environments from acquired companies and early adoption of new technologies and new ways of sharing data; and • our limited control over our customers or third-party technology providers (including those authorized by customers to access their data), or the processing of data by third-party technology providers, which may not allow us to maintain the integrity or security of such transmissions or processing.
In the normal course of business, we are and have been the target of malicious cyberattacks and have experienced other security incidents.
Although, to date, such identified security events have not had a material financial impact, there can be no assurance that future cyberattacks will not be material or significant.
Additionally, as our market presence grows, we may face increased risks of cyberattacks or security threats, and as AI technologies, including generative AI models, develop rapidly, threat actors are using these technologies to create new sophisticated attack methods that are increasingly automated, targeted and coordinated and more difficult to defend against.
A security breach or incident could result in unauthorized parties obtaining access to, or the denial of authorized access to, our IT systems or data, or our customers’ systems or data, including intellectual property and proprietary, sensitive or other confidential information.
We have contractual and other legal obligations to notify relevant stakeholders of security breaches.
For example, SEC rules require disclosure on Form 8-K of the nature, scope and timing of any material cybersecurity incident and the reasonably likely impact of any such incident.
A security breach or resulting mandatory disclosure could result in a loss of confidence in the security of our services, damage our reputation, negatively impact our future sales, disrupt our business and lead to increases in insurance premiums and legal, regulatory and financial exposure and liability.
Further, there can be no assurance that our insurance coverage will be sufficient to cover the financial, legal, business, or reputational losses that may result from a cybersecurity incident or breach of our IT systems.
Finally, the detection, prevention and remediation of known or potential security vulnerabilities, including determining whether a cybersecurity incident is notifiable or reportable, may not be straightforward and may result in additional financial burdens due to additional direct and indirect costs to respond to or alleviate problems caused by the actual or perceived security breach, such as additional infrastructure capacity spending to mitigate any system degradation and the reallocation of resources from development activities.
We have in the past and may in the future find defects in or experience disruptions to our services.
Such issues may arise in a variety of circumstances, including due to our customers using our services in unanticipated ways that may cause a disruption in services for other customers attempting to access their data; as a result of employee, contractor or other third-party action or inaction; or due to the complexity of our services, which incorporate a variety of hardware, proprietary software and third-party and open-source software.
We may also encounter difficulties integrating acquired or licensed technologies into our services and in augmenting the technologies we use to meet quality standards that are consistent with our brand and reputation, which may result in our services containing errors or defects.
We have experienced and may in the future experience defects in our products that create vulnerabilities that inadvertently permit access to protected customer data.
We can provide no assurance that such product defects or other vulnerabilities will not occur in the future, have a material adverse effect on our business or subject us to substantial liability.
Vulnerabilities in open source or any proprietary or third-party product can persist even after security patches have been issued if customers have not installed the most recent updates, or if the attackers exploited the vulnerabilities before patching was complete.
Since our customers use our services for important aspects of their business, errors, defects, disruptions in service or other performance problems have in the past adversely impacted our customers’ businesses and could do so in the future.
As a result, customers could elect to not renew our services or delay or withhold payment to us.
We could also lose future sales or customers may make warranty or other claims against us, which could result in an increase in our allowance for doubtful accounts, an increase in collection cycles for accounts receivable or the expense and risk of litigation.
Any interruptions or delays in services from third parties, including data center hosting facilities, cloud computing platform providers and other hardware and software vendors, as well as internet availability, or from our inability to adequately plan for and manage service interruptions or infrastructure capacity requirements, could impair the delivery of our services and harm our business.
We currently rely on third-party data center hosting facilities and cloud computing platform providers located in the United States and other countries, as well as the many different underlying networks and services that power the Internet, to deliver our products, services and business operations and to operate critical business systems.
We also rely on computer hardware purchased or leased from, software licensed from, and cloud computing platforms provided by, third parties in order to offer our services, including database software, hardware and data from a variety of vendors.
Any disruption or damage to, or failure of our systems generally, including the systems of third-party providers we rely on, could result in service interruptions and harm our business.
We have from time to time experienced service interruptions and such interruptions may occur in the future.
As we increase our reliance on these third-party systems, particularly with respect to third-party cloud computing platforms, our exposure to damage from service interruptions or other performance or quality issues may increase.
Service interruptions or other performance or quality issues may cause us to issue credits or pay penalties, cause customers to make warranty or other claims against us or to terminate their subscriptions, and adversely affect our attrition rates and our ability to attract new customers, all of which would reduce our revenue.
Our business and reputation would also be harmed if our customers and potential customers believe our services are unreliable.
For many of our offerings, our production environment and customers’ data are replicated in a separate facility located elsewhere.
Certain offerings, including some offerings of companies added through acquisitions, may be served through alternate facilities or arrangements.
We do not control the operation of any of these facilities, and they may be vulnerable to damage or interruption from earthquakes, floods, fires, power loss, telecommunications failures and similar events.
They may also be subject to break-ins, sabotage, intentional acts of destruction or vandalism or similar misconduct, as well as local administrative actions, changes to legal or permitting requirements and litigation to stop, limit or delay operation.

and 182 more.

Sentence-level comparison of Item 1A in the two most recent 10-Ks (FY2025 ↗, FY2026 ↗). A reworded sentence counts as one dropped and one added, so heavy edits read as low “kept”. Headings and page furniture are stripped; nothing is summarised by a model.

Watch CRM. Know when insiders buy.

One email the day a filing lands. Free.