Reputable outlets only (Reuters, WSJ, CNBC, Barron's, and peers). More on Google News ↗
What Changed
Risk factors · Feb 20, 2025 → Feb 18, 2026
25 added · 34 removed between the two most recent 10-Ks. The risks a company starts — or stops — disclosing are often the story.
Newly disclosed
For example, in the European Union, the Network and Information Security Directive (EU) 2022/2555 (“NIS2”), and in the United Kingdom, the Network and Information Systems Regulations 2018, establish requirements related to risk management, security incident reporting, and business continuity for certain entities.
For example, in April 2025, we notified customers of access by an unauthorized third party to a number of Datadog source code repositories arising from compromised employee account credentials.
For example, Brazil enacted the General Data Protection Law, New Zealand enacted the New Zealand Privacy Act, Australia enacted the Australia Privacy Act, China enacted its Personal Information Protection Law, Canada has enacted the Personal Information Protection and Electronic Documents Act, and various related provincial laws and India enacted the Information Technology Act.
Further, countries and states are applying their data and consumer protection laws to AI technologies, and particularly generative AI and interactive chatbots.
We may also encounter new risks, challenges, and unintended consequences as a result of our use of AI.
Even in the absence of tariffs or other trade restrictions, the related uncertainty with respect to international trade may lead to continuing volatility in U.S. and global financial and economic conditions and commodity markets, declining consumer confidence, significant inflation and diminished expectations for the economy, and ultimately reduced usage and demand for our products.
We may require additional capital to support the growth of our business, and this capital might not be available on acceptable terms, if at all. 15 We have funded our operations since inception primarily through equity and debt financings and sales of our products.
As a result of these and other factors, we may be unable to attract new customers, which may have an adverse effect on our business, financial condition and results of operations. 16 Failure to effectively develop and expand our sales and marketing capabilities could harm our ability to increase our customer base and achieve broader market acceptance of our products.
Some of our customers may be subject to the EU’s Digital Operational Resilience Act (DORA) and similar regulatory requirements in the United Kingdom related to operational resilience, which has led and will lead certain of our customers to negotiate additional specific provisions with us, including certain mandatory risk management, transparency and continuity provisions.
However, such unauthorized access may increase our vulnerability to certain attacks at a later date through exploitation of our source code, including the exploitation of potential vulnerabilities in the Datadog platform or products, or information stored within the source code.
Interruptions or performance problems associated with our products and platform capabilities may adversely affect our business, financial condition and results of operations. 19 Our continued growth depends in part on the ability of our existing and potential customers to access our products and platform capabilities at any time and within an acceptable amount of time.
If we do not help our customers quickly resolve issues and provide effective ongoing support, our ability to maintain and expand our subscriptions to existing and new customers could suffer, and our reputation with existing or potential customers could suffer. 23 Acquisitions, strategic investments, partnerships, or alliances could be difficult to identify, pose integration challenges, divert the attention of management, disrupt our business, dilute stockholder value, and adversely affect our business, financial condition and results of operations.
No longer disclosed
For example, Brazil enacted the General Data Protection Law, New Zealand enacted the New Zealand Privacy Act, China enacted its Personal Information Protection Law, Canada introduced the Digital Charter Implementation Act and India enacted the Information Technology Act.
If we do not help our customers quickly resolve issues and provide effective ongoing support, our ability to maintain and expand our subscriptions to existing and new customers could suffer, and our reputation with existing or potential customers could suffer.
Acquisitions, strategic investments, partnerships, or alliances could be difficult to identify, pose integration challenges, divert the attention of management, disrupt our business, dilute stockholder value, and adversely affect our business, financial condition and results of operations.
In addition, if the resulting business from such a transaction fails to meet our expectations, our business, financial condition and results of operations may be adversely affected or we may be exposed to unknown risks or liabilities. 22 Industry and Competitive Risks If we fail to adapt and respond effectively to rapidly changing technology, evolving industry standards, changing regulations, or to changing customer needs, requirements or preferences, our platform and products may become less competitive.
These encryption products and the underlying technology may be exported outside of the United States only with the required export authorizations, including by license, a license exception, or other appropriate government authorizations, including the filing of an encryption classification request or self-classification report.
Furthermore, our activities are subject to U.S. economic sanctions laws and regulations administered by the Office of Foreign Assets Control that prohibit the shipment of most products and services to embargoed jurisdictions or sanctioned parties without the required export authorizations.
Violations of U.S. sanctions or export control regulations can result in significant fines or penalties and possible incarceration for responsible employees and managers. 28 If our channel partners fail to obtain appropriate import, export, or re-export licenses or permits, we may also be adversely affected through reputational harm, as well as other negative consequences, including government investigations and penalties.
Also, various countries, in addition to the United States, regulate the import and export of certain encryption and other technology, including import and export licensing requirements, and have enacted laws that could limit our ability to distribute our products or could limit our end-customers’ ability to implement our products in those countries.
Changes in our products or future changes in export and import regulations may create delays in the introduction of our platform in international markets, prevent our end-customers with international operations from deploying our platform globally or, in some cases, prevent the export or import of our products to certain countries, governments, or persons altogether.
We can be held liable for the corrupt or other illegal activities of these third-party intermediaries, our employees, representatives, contractors, partners and agents, even if we do not explicitly authorize such activities.
If we fail to retain and motivate members of our management team or other key employees, or fail to attract additional qualified personnel to support our operations, our business and future growth prospects would be harmed.
Government demand and payment for our products are affected by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our products.