DOCU

MKT CAP $15.2BP/E 49.7DIV YIELD —FCF YIELD 7.87%REV TTM $3.4B +8.6%NET INCOME $329.9M +17.4%NET CASH —52W 41.75 – 81.48NEXT EARNINGS Dec 3 EST.SEC XBRL · TTM TO Invalid Date

How DOCU rewrote its risk factors

10-K ITEM 1A · FY2025 → FY2026

Text kept

61%

of sentences unchanged

Added

144

new sentences

Dropped

117

sentences removed

Length

+568

words, now 20,581

New in FY2026

These risks include, but are not limited to, the following: Business and Industry Risks • Any decrease in adoption or sales of our eSignature product, without corresponding adoption or sales of our other solutions in our IAM platform. • Our IAM platform failing to achieve market acceptance or to meet our customers’ evolving needs. • Disruptions to our business, strategy and demand for our solutions due to advances in, and uses of, AI and other technologies. • Any inability to deliver excellent service and support to customers, retain and expand sales to existing customers, and attract new customers. • Damage to our systems, data, reputation, brand and customer trust due to data breaches, cyberattacks, malicious activity, or failures of our (or third party cloud providers’) technical infrastructure. • Our inability to compete in an evolving and highly competitive market. • Any real or perceived improper use of, disclosure of, or access to sensitive customer data. • An over-estimation of our market opportunity. • Any loss of highly skilled personnel, including our management team or other key employees, or inability to attract, integrate and retain such employees necessary to support our business. • Our inability to maintain successful relationships with our strategic partners or to establish and maintain relationships with partners that provide complementary technology. • Any inability to effectively develop and expand our marketing and sales capabilities.
Business and Industry Risks We derive a majority of our revenue from our eSignature product, and slower or declining adoption or sales of our eSignature product, without corresponding adoption or sales of our other products and solutions in our IAM platform, could cause our operating results to suffer.
Sales of subscriptions to our eSignature product account for the substantial majority of our subscription and professional services revenue.
As a result, our operating results could suffer due to: ▪ any decline in demand for our eSignature product; ▪ the failure of our eSignature product to maintain market acceptance; ▪ the market for electronic signatures failing to grow, or growing more slowly than we expect; ▪ new products and technologies from our competitors that replace or represent an improvement over our eSignature product; ▪ new technological innovations or standards that our eSignature product does not address; ▪ changes in regulations; ▪ sensitivity to our current or future pricing; ▪ our inability to release enhanced versions of our eSignature product on a timely basis; and ▪ macro- and micro-economic factors, including inflation, changes in interest rates or foreign exchange rates, increased debt and equity market volatility, tariffs and changes in trade policies and practices, geopolitical conflict or public health crises.
For example, in April 2024, we launched our IAM platform.
Rapid and unpredictable advances in AI and other technologies could reduce demand for our solutions, disrupt our business and strategy, and cause competitive and financial harm.
While we believe recent technological advances complement Docusign’s strategy and will ultimately benefit our business, AI and other technological advances are unpredictable, and there can be no assurance that our strategy will succeed.
We may fail to predict or respond effectively to market demand for AI-powered solutions, or customer concerns regarding those solutions.
Even if we successfully create, market and sell AI-based offerings that meet customer demand, the costs of developing and operating such solutions (including initial training costs and ongoing processing and inference costs) may reduce profitability and adversely affect our results of operations.
Advances in AI have made and may continue to make some foundational capabilities for agreements (such as analyzing, summarizing and comparing text) cheaper and easier to replicate, enabling companies not previously focused on agreements to provide solutions that compete with some or all of ours.
In addition, advances in AI may significantly lower the cost of developing software, enabling companies to quickly and cheaply create agents or other homegrown alternatives that perform some or all of the functions they currently obtain from Docusign.
If providers of large language models, data platform companies, enterprise software companies, “hyperscalers,” or other businesses develop solutions that provide comparable functionality at lower cost or in more convenient formats, demand for our products would suffer and our business, financial condition and results of operations would be adversely affected.
If we are unable to deliver excellent service and support to customers, retain and expand sales to existing customers, and attract new customers, our revenue growth will be adversely affected.
Our ability to retain and grow our customer base depends on our ability to deliver excellent service and support to our customers.
Any failure to maintain high-quality customer support and meet or exceed customer expectations could adversely affect customer retention, growth, and our financial condition and results of operations.
Our renewal and expansion rates may decline or fluctuate as a result of a number of factors, including customer spending levels, customer dissatisfaction, decreases in the number of users with our customers, changes in the type and size of our customers, pricing, competitive conditions, customer attrition and general economic and global market conditions, including as a result of inflation, changes in interest rates, increased debt and equity market volatility, tariffs and changes in trade policies and practices, geopolitical conflicts or public health crises.
If we are unable to improve our renewal rates, our revenue may decline and our business may suffer.
Furthermore, if our customers do not renew their subscriptions for our products and solutions or if they reduce their subscription amounts at the time of renewal, our revenue will decline, and our business, operating results and financial condition will suffer.
We also rely on other third parties, including open-source software providers, model-providers for AI features and others; and vulnerabilities, misconfigurations, or supply chain compromises impacting any of these third parties could adversely impact our systems and data.
While we have security measures in place designed to protect our production and development environments and other systems, maintain the integrity of customer, company, partner and employee information, and prevent data loss, misappropriation and other security breaches and incidents, there can be no assurance that such security measures will be effective, or effective at all times.
We are a frequent target of cyberattacks and have faced security incidents in the past that did not have a material impact on our operations.
While we have taken and will continue to take steps to address cyberattacks and security incidents, these efforts to investigate, mitigate, contain, and remediate any such incidents may not always be entirely successful, and there can be no assurance that there will be no impact to our operations from these or similar incidents in the future.
Like other organizations providing valuable technology and services, we are subject to increasing cyberattacks from malicious third parties using widely varying and frequently changing tactics, which may be enhanced or facilitated by AI technology, and may include phishing and fraud campaigns targeting our personnel via email, text, instant messaging and voice calls.
As AI technologies develop rapidly, threat actors are using these technologies to create new attack methods that are increasingly automated, targeted, and coordinated and more difficult to defend against.
In addition, we may face increased risk in our ability to maintain the performance, reliability, security and availability of our products and technical infrastructure to the satisfaction of our customers.
We are subject to increasingly frequent and sophisticated cyberattacks, including advanced persistent threats by state-sponsored actors, cyberattacks relying on complex social engineering or “phishing” tactics, ransomware attacks and other methods including credential stuffing and account takeover attacks, prompt injection, deepfakes, denial or degradation of service attacks, malicious code (e.g., viruses and worms), and many other techniques that may lead to the loss, theft or misuse of personal, corporate or financial information, fraudulent payments, identity theft, and disrupting or disabling our services.
Bad actors, nation-states, and nation-state-supported actors engage in cyberattacks, including for geopolitical reasons and in connection with global or regional conflicts and operations.
The frequency and sophistication of cybersecurity threats against us and our partners, service providers or customers may often become further heightened in connection with such geopolitical tensions.
If our security measures, or the security measures of our partners, service providers, or customers, are compromised, our reputation could be damaged and our ability to attract and retain customers could be adversely affected.
We could also be subject to negative publicity, increased costs to remedy any problems and otherwise respond to any incident, monetary and other losses for us or our customers, identity theft for our customers, the inability to expand our business, additional scrutiny, restrictions, fines or penalties from regulatory or governmental authorities, loss of customers and customer confidence in our services, ongoing regulatory oversight, assessments and audits, exposure to civil litigation, and/or a breach of our contracts with third parties.
All of the foregoing could expose us to significant liability and harm our business, financial condition, and operating results.
Further, we could be forced to use significant financial and operational resources in response to a cyberattack, security incident, or breach, including repairing system damage, increasing security protection costs, investigating and remediating any information security vulnerabilities, complying with data breach notification obligations and applicable laws, and defending against and resolving legal and regulatory claims, all of which could divert resources and the attention of our management and key personnel away from our business operations and materially and adversely affect our business, financial condition, and operating results.
Furthermore, our insurance coverage may not extend to all risks we face, including all AI-related security risks, and may not cover us for all losses for errors or omissions caused by AI.
For example, our primary global e-signature competitor is currently Adobe Acrobat Sign.
We may also face greater competition from non-specialist solutions relying on generic large language models (“LLMs”), generative AI and general-purpose agents to address a broad range of business needs.
As we attempt to sell our products and solutions to new and existing customers, we must convince them that our products and solutions are superior to other solutions available to their organizations, including generic LLMs, software created using natural language prompts and generative AI (referred to as vibe coding) and other emerging technologies.
For example, advances in AI and other technologies may fundamentally alter the market for our services in unpredictable ways and reduce customer demand.
We collect, store, and process a large amount of customer, employee, partner, and service provider data, including sensitive data.
We collect, store and process personal information and other data from and about our customers, employees, partners and service providers.
Increased regulatory focus on “dark patterns,” data minimization and transparency, along with heightened scrutiny of any statements related to the use of AI, all increase the risk of allegations that our notices and related documentation may be alleged to be non-compliant, deceptive, unfair or otherwise inaccurate.

and 104 more.

Gone since FY2025

These risks include, but are not limited to, the following: Business and Industry Risks • Any decrease in adoption or sales of our eSignature product, without corresponding increases in our other solutions in our IAM platform. • Any inability to attract new customers and retain and expand sales to existing customers. • Our IAM platform failing to achieve market acceptance or to meet our customers’ evolving needs. • Our inability to compete in an evolving and highly competitive market. • Our systems and security measures being compromised or subject to data breaches, cyberattacks, or other malicious activity, and any harm to our business or reputation caused by malicious actors attempting to exploit our technology, platform or brand to defraud others. • Any real or perceived improper use of, disclosure of, or access to sensitive customer data. • An over-estimation of our market opportunity. • Any interruption or delay in performance from our technical infrastructure, including third-party cloud providers. • The implementation of AI in our business, and the legal, regulatory, reputational and business risks relating to its use. • Any loss of highly skilled personnel, including our management team or other key employees, or inability to attract, integrate, and retain such employees necessary to support our business. • Our inability to maintain successful relationships with our strategic partners or to establish and maintain relationships with partners that provide complementary technology. • Any inability to effectively develop and expand our marketing and sales capabilities.
Business and Industry Risks We derive a majority of our revenue from our eSignature product, and slower or declining adoption or sales of our eSignature product, without corresponding increases in the use of our other products and solutions in our IAM platform, could cause our operating results to suffer.
Sales of subscriptions to our eSignature product account for substantially all of our subscription revenue and are the source of substantially all of our professional services revenue.
As a result, our operating results could suffer due to: ▪ any decline in demand for our eSignature product; ▪ the failure of our eSignature product to maintain market acceptance; ▪ the market for electronic signatures failing to grow, or growing more slowly than we expect; ▪ new products and technologies from our competitors that replace or represent an improvement over our eSignature product; ▪ new technological innovations or standards that our eSignature product does not address; ▪ changes in regulations; ▪ sensitivity to our current or future pricing; ▪ our inability to release enhanced versions of our eSignature product on a timely basis; and ▪ macro- and micro-economic factors, including inflation, changes in interest rates or foreign exchange rates, increased debt and equity market volatility, tariffs and trade policy changes, geopolitical conflict or public health crises.
If we are unable to attract new customers and retain and expand sales to existing customers, our revenue growth will be adversely affected.
Our renewal and expansion rates may decline or fluctuate as a result of a number of factors, including customer spending levels, customer dissatisfaction, decreases in the number of users with our customers, changes in the type and size of our customers, pricing, competitive conditions, customer attrition and general economic and global market conditions, including as a result of inflation, changes in interest rates, increased debt and equity market volatility, tariffs and trade policy changes, geopolitical conflicts or public health crises.
If our customers do not renew their subscriptions for our products and solutions or if they reduce their subscription amounts at the time of renewal, our revenue will decline, and our business will suffer.
For example, in April 2024, we launched our new IAM platform.
For example, we have made, and intend to continue making, significant investments in our platform and developing products that incorporate AI, and while we believe that these investments will drive future growth of our business, the development of such new features involves significant risks and costs, and there is no guarantee that any such offerings will ultimately be successful.
For example, our primary global e-signature competitor is currently Adobe Sign.
As we attempt to sell our products and solutions to new and existing customers, we must convince them that our products and solutions are superior to other solutions available to their organizations.
For example, disruptive technologies such as generative AI may fundamentally alter the market for our services in unpredictable ways and reduce customer demand.
While we have security measures in place designed to protect our production and development environments and other systems, maintain the integrity of customer, company, partner and employee information, and prevent data loss, misappropriation and other security breaches and incidents, we are a frequent target of cyberattacks and have faced security incidents in the past that did not have a material impact on our operations.
While we have taken and will continue to take steps to address cyberattacks and security incidents, these efforts may not always be entirely successful, and there can be no assurance that there will be no impact to our operations from these or similar incidents in the future.
Like other organizations providing valuable technology and services, we are subject to increasing cyberattacks from malicious third parties using widely varying and frequently changing tactics, including phishing and fraud campaigns targeting our personnel via email, text, instant messaging and voice calls.
The frequency and sophistication of such threats continues to increase and often becomes further heightened in connection with geopolitical tensions.
In addition, we face increased risk in our ability to maintain the performance, reliability, security and availability of our products and technical infrastructure to the satisfaction of our customers.
Advances in technology and the increasing sophistication of attackers have led to more frequent and effective cyberattacks, including advanced persistent threats by state-sponsored actors, cyberattacks relying on complex social engineering or “phishing” tactics, ransomware attacks and other methods including credential stuffing and account takeover attacks, denial or degradation of service attacks, malicious code (e.g., viruses and worms), and many other techniques that may lead to the loss, theft or misuse of personal, corporate or financial information, fraudulent payments and identity theft.
Bad actors, nation-states, and nation-state-supported actors now engage, and are expected to continue to engage, in cyberattacks, including for geopolitical reasons and in connection with global or regional conflicts and operations.
During major global or regional conflicts, we and our partners, service providers, or customers may be vulnerable to heightened risk of such cyberattacks.
If our security measures, or the security measures of our partners, service providers, or customers, are compromised, our reputation could be damaged, our ability to attract and retain customers could be adversely affected, we could be subject to negative publicity, increased costs to remedy any problems and otherwise respond to any incident, monetary and other losses for us or our customers, identity theft for our customers, the inability to expand our business, additional scrutiny, restrictions, fines or penalties from regulatory or governmental authorities, loss of customers and customer confidence in our services, ongoing regulatory oversight, assessments and audits, exposure to civil litigation, and/or a breach of our contracts with third parties, all of which could expose us to significant liability and harm our business, financial condition, and operating results.
Further, we could be forced to expend significant financial and operational resources in response to a cyberattack or security incident or breach, including repairing system damage, increasing security protection costs, investigating and remediating any information security vulnerabilities, complying with data breach notification obligations and applicable laws, and defending against and resolving legal and regulatory claims, all of which could divert resources and the attention of our management and key personnel away from our business operations and materially and adversely affect our business, financial condition, and operating results.
We obtain and process a large amount of sensitive customer data.
We receive, store and process personal information and other data from and about our customers, employees, partners and service providers.
The publication of our privacy notices and other related documentation that provide commitments about data privacy and security can subject us to potential actions if they are found to be non-compliant, deceptive, unfair, or otherwise misrepresent our actual practices, which could materially and adversely affect our business, financial condition and results of operations, and subject us to investigations, fines or penalties from regulators or government authorities, or civil litigation.
Our actual or perceived failure to comply with laws or regulations could harm our business.” and “Complying with laws and regulations, in particular those related to privacy and data protection, could also result in additional costs and liabilities to us or inhibit sales of our software. ” If we are not able to comply with these laws or regulations or if we become liable under these evolving laws or regulations, we could be directly harmed, and we may be forced to implement new measures to reduce our exposure to this liability.
We use AI-powered tools and services as part of operating our business, and also incorporate AI features and applications into our products and solutions and are making further investments in expanding AI capabilities in our products and solutions.
Our competitors and other third parties may incorporate AI into their products more quickly or more successfully than us, all of which could impair our ability to compete effectively and may adversely affect our results of operations.
This use of AI in our products and solutions may present new and evolving challenges, including reputational harm, competitive harm, and legal liability, and adversely affect our results of operations.
Additionally, AI technology may lower barriers to entry in our industry and we may be unable to effectively compete with the products or services offered by new competitors.
AI-related changes to the products and services on offer may affect our customers’ expectations or requirements in ways we cannot adequately anticipate or adapt to, causing our business to lose sales, market share, or the ability to operate profitably and sustainably.
The development and use of AI features and applications present various intellectual property, data privacy, security and reliability risks that may impact our business.
We may choose to significantly invest in the development and maintenance of proprietary datasets and training models and the development of appropriate protections, safeguards, and policies for handling the processing of data, including transparency of customer data extraction and usage in training models, with our AI features and applications, which may be costly and subject us to legal liability.
Furthermore, any integration of third-party AI models with our products and solutions relies on certain safeguards implemented by the third-party developers of the underlying AI models, including those related to the accuracy, bias, and other variables of the data, and these safeguards may be insufficient.
These risks could negatively impact our business, financial condition, and results of operations.
Federal Trade Commission initiated multiple AI-related inquiries over the past several years and sent requests to technology companies, including Docusign, seeking additional information about their AI usage and policies.
The rapid evolution of AI technologies will require significant resources in research and development in order to develop, test and maintain our platform and products to minimize any potential harmful impact on our business, financial condition, and results of operations.
The continued use in our business and incorporation of AI-powered features and applications into our products and solutions may subject us to new and evolving regulatory scrutiny, litigation, social or ethical concerns, unforeseen operational failures, potential for biased or incorrect outputs, or other risks that could harm our business, reputation, brand, and our results of operations.
For example, if the content, analyses, or recommendations arising from our AI product offerings are, or are alleged to be, inaccurate, deficient, offensive, or biased, or if they have a perceived or actual negative impact on human rights, privacy rights, employment, or in other social contexts, we may experience brand and reputational harm or legal liability, and our business, financial condition, and results of operations may be adversely affected.
Additionally, the significant technical complexity of AI technology will require specialized expertise and may increase compensation-related expenses.

and 77 more.

Sentence-level comparison of Item 1A in the two most recent 10-Ks (FY2025 ↗, FY2026 ↗). A reworded sentence counts as one dropped and one added, so heavy edits read as low “kept”. Headings and page furniture are stripped; nothing is summarised by a model.

Watch DOCU. Know when insiders buy.

One email the day a filing lands. Free.