PagerDuty Inc. Common Stock

Item 1A. Risk Factors

Other than the risk factors below, there have been no material changes from the risk factors described in Part I. Item 1A., Risk Factors in our Annual Report on Form 10-K/A for the year ended January 31, 2024. Our business involves significant risks, some of which are described below. You should carefully consider the following risks, together with all of the other information in this Quarterly Report on Form 10-Q, including our condensed consolidated financial statements and the related notes thereto included elsewhere in this Quarterly Report on Form 10-Q. Any of the following risks could have an adverse effect on our business, results of operations, financial condition or prospects, and could cause the trading price of our common stock to decline. Our business, results of operations, financial condition or prospects could also be harmed by risks and uncertainties not currently known to us or that we currently do not believe are material.

Issues relating to the responsible use of our technologies, including AI in our offerings, may result in reputational and/or financial harm and liability.

We are increasingly building AI capabilities into many of our products and services. Concerns relating to the responsible use of new and evolving technologies, such as AI, in our offerings may result in reputational and/or financial harm and liability and may cause us to incur costs to resolve such issues. For example, AL/ML technologiThere have been no material changes may be insufficient, biased, inaccurate or of poor quality, which could result in customer rejection or skepticism of our products, affect our reputation and brand, and negatively affect our financial results. Furthermore, AI poses emerging legal, social, and ethical issues and presents risks and challenges that could affect its adoption, and therefore our business. If our offerings draw controversy due to their perceived or actual impact on society, such as AI solutions that have unintended consequences or are controversial because of their impact on human rights, privacy, employment, or other social, economic, or political issues, or if we are unable to develop and implement effective internal policies and frameworks relating to the responsible development and use of AI models and systems, we may experience brand, reputational, and/or competitive harm, or could face legal liability. Complying with multiple regulations from different jurisdictions related to AI could increase our cost of doing business, may change the way that we operate in certain jurisdictions, or may impede our ability to offer certain products and services in certain jurisdictions if we are unable to comply with regulations. Our failure to address concerns and regulation relating to the responsible use of AI could slow adoption of AI in our products and services or cause reputational and/or financial harm.

Cyber-attacks, security incidents, and other threats, have occurred and may continue to occur that could allow unauthorized access to our systems or data or our customers systems or data, and could cause us to experience adverse consequences, including, but not limited to, significant costs, litigation and regulatory investigations and actions, and harm to our business and reputation.

Our business involves the processing of personal data and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, sensitive third-party data, business plans, transactions, and financial information (collectively, sensitive data), including sensitive data of our customers and their respective employees. Cyber-attacks, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our or our customers sensitive data and information technology systems, and those of the third parties upon which we rely. Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer hackers, threat actors, hacktivists, organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation-states, and nation-state actors. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities.

42

Like other companies, we and the third parties we rely on have experienced and will continue to experience cyber-attacks and other incidents, and are exposed to threats, that have resulted and could in the future result in, adverse consequences to our business including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences. We face increasing risks of cyber-attacks and other security incidents, and our systems and those of our third-party service providers have been and may continue to be subject to a variety of attacks and threats including malware (including as a result of advanced persistent threat intrusions), social engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), ransomware attacks (which are becoming increasingly severe and prevalent), denial-of-service attacks, such as credential stuffing attacks, credential harvesting, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, personnel misconduct or error, malicious code (such as viruses or worms), loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, floods, attacks enhanced or facilitated by to the Risk Factors described under Part IItem 1AI, and other similar threats. We may be unable to anticipate or prevent techniques used to obtain unauthorized access or to sabotage systems because they change frequently, are increasing in their sophistication and often are not detected until after an incident has occurred.

During times of war and other major conflicts, we (and the third parties upon which we rely) may be vulnerable to a heightened risk of cybersecurity threats, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our services.

Remote work has become more common and has increased risks to our information technology systems and data, as more of our employees utilize network connections, computers and devices outside our premises or network, including working at home, while in transit and in public locations. Furthermore, future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as . Risk Factors in our systems could be negatively affected by vulnerabilities present in acquired or integrated entities systems and technologies. Additionally, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.

In addition, our reliance on third-party service providers could introduce new cybersecurity risks and vulnerabilities, including supply-chain attacks, and other threats to our business operations. We rely on third-party service providers and technologies to operate critical business systems to process sensitive data in a variety of contexts, including, without limitation, encryption and authentication technology, employee email, cloud-based infrastructure, data center facilities, content delivery to customers, and other functions. We also rely on third-party service providers to provide other products, services, parts, or otherwise to operate our business. Our ability to monitor these third parties information security practices is limited, and these third parties may not have adequate information security measures in place. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences.

While we may be entitled to damages if our third-party service providers fail to satisfy their data privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties infrastructure in our supply chain or our third-party partners supply chains have not been compromised.

Any of the previously identified or similar threats could cause a security incident, production downtime or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our or our customers sensitive data or our information technology systems, or those of the third parties upon whom we rely. A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely) to provide our services.

We may expend significant resources, or modify our business activities to try to protect against incidents. Additionally, certain data privacy and security obligations may require us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and sensitive data.

43

While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We taAnnual Report on Forma 10-K/A, as amended by the Riske steps to detect and remediate vulnerabilities, but we may not be able to detect and remediate all vulnerabilities because the threats and techniques used to exploit the vulnerability change frequently and are often sophisticated in nature. Therefore, such vulnerabilities could be exploited but may not be detected until after a security incident has occurred. Any unremediated high risk or critical vulnerabilities may pose material risks to our business.

Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities. Even if we have issued or otherwise made available patches or information for vulnerabilities in our software applications, products or services, our customers may be unwilling or unable to deploy such patches and use such information effectively and in a timely manner for measures that require customer action.

In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position.

The reliability and continuous availability of our service is critical to our success. However, software such as ours can contain errors, defects, security vulnerabilities or software bugs that are difficult to detect and correct, particularly when such vulnerabilities are first introduced or when new versions or enhancements of our service are released. Additionally, even if we are able to develop a patch or other fix to address such vulnerabilities, such a fix may be difficult to push out to our customer-facing services or otherwise be delayed. Additionally, our business depends upon the appropriate and successful implementation of our service by our customers. If our customers fail to use our service according to our specifications, our customers may suffer a security incident on their own systems or other adverse consequences. Even if such an incident is unrelated to our security practices, it could result in our incurring significant economic and operational costs in investigating, remediating, and implementing additional measures to further protect our customers from their own vulnerabilities, and could result in reputational harm. Applicable data privacy and security obligations may require us to notify relevant stakeholders of security incidents. Such disclosures are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences.

Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. While we maintain general liability insurance coverage and coverage for errors or omissions, we cannot assure you that such coverage would be adequate or would otherwise protect us from liabilities or damages with respect to claims alleging compromises of customer data, that such coverage will continue to be available to us on acceptable terms or at all, or that such coverage will pay future claims. The successful assertion of one or more large claims against us that exceeds our available insurance coverage, or results in changes to our insurance policies (including premium increases or the imposition of large deductible or co-insurance requirements), could have an adverse effect on our business.

If we (or a third party upon whom we rely) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive data (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; interruptions in our operations (including availability of data); financial loss; and other similar harms. Security incidents and attendant consequences may prevent or cause customers to stop using our services, deter new customers from using our services, and negatively impact our ability to grow and operate our business.

Additionally, our sensitive data or those of our customers could be leaked, disclosed, or revealed as a result of or in connection with our employees, personnels, or vendors use of generative AI technologies, including our own. Any sensitive data (including confidential, competitive, proprietary, or personal data) that is inputted into a generative AI/ML platform could be leaked or disclosed to others, including if sensitive information is used to train third parties AI/ML model. Additionally, where an AI/ML model ingests personal data and makes connections using such data, those technologies may reveal other personal or sensitive data generated by the model.

44

 Factors described under Part IItem 1A. Risk Factors in our Quarterly Report on Form 10-Q for the quarter ended July 31, 2024.