ServiceNow 10-Q 2023-09-30

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-Q

(Mark One)

For the quarterly period ended September 30, 2023

OR

Commission File Number: 001-35580

SERVICEN****OW, I****NC.

(Exact name of Registrant as specified in its charter)

ServiceNow, Inc.

2225 Lawson Lane

Santa Clara, California 95054

(Address, including zip code, of Registrant’s principal executive offices)

(408) 501-8550

(Registrant’s telephone number, including area code)

Not Applicable

(Former name, former address and formal fiscal year, if changed since last report.)

Securities registered pursuant to Section 12(b) of the Act**:**

Indicate by check mark whether the Registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the Registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days: Yes ☒ No ☐

Indicate by check mark whether the Registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the Registrant was required to submit such files). Yes ☒ No ☐

Indicate by check mark whether the Registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

If an emerging growth company, indicate by check mark if the Registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the Registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes ☐ No ☒

As of September 30, 2023, there were approximately 205 million shares of the Registrant’s Common Stock outstanding.

TABLE OF CONTENTS

i

PART I

SERVICENOW, INC.

CONDENSED CONSOLIDATED BALANCE SHEETS

(in millions)

See accompanying notes to condensed consolidated financial statements

SERVICENOW, INC.

CONDENSED CONSOLIDATED STATEMENTS OF COMPREHENSIVE INCOME (LOSS)

(in millions, except number of shares which are reflected in thousands and per share data)

(unaudited)

(1)Includes stock-based compensation as follows:

Showing the first 8K of 83K characters. Open the full section

The following discussion and analysis of our financial condition, results of operations and cash flows should be read in conjunction with the (1) unaudited condensed consolidated financial statements and the related notes thereto included elsewhere in this Quarterly Report on Form 10-Q, and (2) the audited consolidated financial statements and notes thereto and management’s discussion and analysis of financial condition and results of operations for the year ended December 31, 2022 included in the Annual Report on Form 10-K filed with the Securities and Exchange Commission (the “SEC”), on January 31, 2023. This Quarterly Report on Form 10-Q contains “forward-looking statements” within the meaning of Section 21E of the Securities Exchange Act of 1934, as amended (the “Exchange Act”). These statements are often identified by the use of words such as “may,” “will,” “expect,” “believe,” “anticipate,” “intend,” “could,” “estimate,” or “continue,” and similar expressions or variations. Forward-looking statements are subject to risks, uncertainties and other factors that could cause actual results and the timing of certain events to differ materially from future results expressed or implied by the forward-looking statements. Factors that could cause or contribute to such differences include, but are not limited to those identified herein, and those discussed in the section titled “Risk Factors” in Part I, Item 1A of our Annual Report on Form 10-K filed with the SEC on January 31, 2023 and in Part II, Item 1A of this Quarterly Report on Form 10-Q and in our other SEC filings. We disclaim any obligation to update any forward-looking statements to reflect events or circumstances after the date of such statements.

Investors and others should note that we announce material financial information to our investors using our investor relations website (https://www.servicenow.com/company/investor-relations.html), SEC filings, press releases, public conference calls and webcasts. We use these channels, as well as social media, to communicate with our investors and the public about our Company, our services and other issues. It is possible that the information we post on social media could be deemed to be material information. Therefore, we encourage investors, the media and others interested in our Company to review the information we post on the social media channels listed on our investor relations website.

Our free cash flow measure included in the section entitled “Key Business Metrics—Free Cash Flow,” is not in accordance with U.S. Generally Accepted Accounting Principles (“GAAP”). This non-GAAP financial measure is not intended to be considered in isolation or as a substitute for, or superior to, financial information prepared and presented in accordance with GAAP. This measure may be different from non-GAAP financial measures used by other companies, limiting its usefulness for comparison purposes. We encourage investors to carefully consider our results under GAAP, as well as our supplemental non-GAAP results, to more fully understand our business.

Overview

ServiceNow was founded on a simple premise: a better technology platform will help work flow better. Our purpose is to make the world work better for everyone. We help global enterprises across industries, universities and governments to digitize their workflows. The Now Platform, seamlessly connects workflows across siloed organizations and systems in a way that unlocks productivity, improves experiences for both employees and customers and delivers real business outcomes. We organize our workflow applications along four primary areas: Technology, Customer and Industry, Employee and Creator. The Now Platform enables our customers’ digital transformation from non-integrated enterprise technology solutions with manual and disconnected processes and activities, to integrated enterprise technology solutions with automation and connected processes and activities. The transformation to digital operations, enabled by the Now Platform, increases our customers’ resiliency and security and delivers great experiences and additional value to their employees and consumers.

We are closely monitoring the unfolding events of the Russian invasion of Ukraine and the current armed conflict in Israel and the Gaza Strip. While these events are still evolving and the outcome remains highly uncertain, we do not believe the conflicts will have a material impact on our business and results of operations. However, if the conflicts continue or worsen, leading to greater global economic disruptions and uncertainty, our business and results of operations could be materially impacted. Our customers in these regions represented an immaterial portion of our net assets as of September 30, 2023 and December 31, 2022, and of our total consolidated revenues for each of the three and nine months ended September 30, 2023 and 2022.

Additionally, other recent macroeconomic events, including rising interest rates, global inflation and bank failures, have led to further economic uncertainty in the global economy. To mitigate risk, our cash and cash equivalents are distributed across several large financial institutions and are not concentrated in one financial institution. We have not experienced any impact to our liquidity or to our current and projected business operations and financial condition due to recent bank failures. In addition, we have policy restrictions in place on the types of securities that can be purchased as part of our available-for-sale debt securities portfolio. These restrictions take industry and company concentration limits into consideration among other things. Furthermore, the majority of our non-marketable equity investments do not have material relationships with any one financial institution, and therefore, we believe that our exposure to loss is immaterial. We will continue to monitor the direct and indirect impact of macroeconomic events on our business and financial results.

See the “Risk Factors” section in Part I, Item 1A of our Annual Report on Form 10-K filed with the SEC on January 31, 2023 and in Part II, Item 1A of this Quarterly Report on Form 10-Q for further discussion of the possible impact of the Russia-Ukraine conflict and the macroeconomic conditions on our business.

Key Business Metrics

Remaining performance obligations. Transaction price allocated to remaining performance obligations (“RPO”) represents contracted revenue that has not yet been recognized, which includes deferred revenue and non-cancellable amounts that will be invoiced and recognized as revenue in future periods. RPO excludes contracts that are billed in arrears, such as certain time and materials contracts, as we apply the “right to invoice” practical expedient under relevant accounting guidance. Current remaining performance obligations (“cRPO”) represents RPO that will be recognized as revenue in the next 12 months.

As of September 30, 2023, our RPO was $14.4 billion, of which 52% represented cRPO. RPO and cRPO increased by 26% compared to September 30, 2022. Factors that may cause our RPO to vary from period to period include the following:

• Foreign currency exchange rates. While a majority of our contracts have historically been in U.S. Dollars, an increasing percentage of our contracts in recent periods has been in foreign currencies, particularly the Euro and British Pound Sterling. Fluctuations in foreign currency exchange rates as of the balance sheet date will cause variability in our RPO.

• Mix of offerings. In a minority of cases, we allow our customers to host our software by themselves or through a third-party service provider. In self-hosted offerings, we recognize a portion of the revenue upfront upon the delivery of the software and as a result, such revenue is excluded from RPO.

• Subscription start date. From time to time, we enter into contracts with a subscription start date

Showing the first 8K of 64K characters. Open the full section

There have been no material changes in our market risk compared to the disclosures in Part II, Item 7A in our Annual Report on Form 10-K for the year ended December 31, 2022, which was filed with the SEC on January 31, 2023.

Evaluation of Disclosure Controls and Procedures

Regulations under the Exchange Act require public companies, including our Company, to maintain “disclosure controls and procedures,” which are defined in Rule 13a-15(e) and Rule 15d-15(e) to mean a company’s controls and other procedures that are designed to ensure that information required to be disclosed in the reports that it files or submits under the Exchange Act is recorded, processed, summarized and reported, within the time periods specified in the SEC’s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed in our reports filed or submitted under the Exchange Act is accumulated and communicated to management, including our principal executive officer and principal financial officer, or persons performing similar functions, as appropriate, to allow timely decisions regarding required or necessary disclosures. In designing and evaluating our disclosure controls and procedures, management recognizes that disclosure controls and procedures, no matter how well conceived and operated, can provide only reasonable, not absolute, assurance that the objectives of the disclosure controls and procedures are met. Additionally, in designing disclosure controls and procedures, our management necessarily was required to apply its judgment in evaluating the cost-benefit relationship of possible disclosure controls and procedures. Our Chief Executive Officer and Chief Financial Officer have concluded, based on the evaluation of the effectiveness of the disclosure controls and procedures by our management as of September 30, 2023, that our disclosure controls and procedures were effective at the reasonable assurance level for this purpose.

Changes in Internal Control over Financial Reporting

There were no changes to our internal control over financial reporting (as such term is defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) that occurred during the quarter ended September 30, 2023 that have materially affected, or is reasonably likely to materially affect, our internal control over financial reporting.

PART II

ITEM 1. LEGAL PROCEEDINGS

From time to time, we are party to litigation and other legal proceedings in the ordinary course of business. While the results of any litigation or other legal proceedings are uncertain, we are not presently a party to any legal proceedings that, if determined adversely to us, would individually or taken together have a material adverse effect on our business, financial position, results of operations or cash flows.

Investing in our securities involves risks. In addition to the risk factor below and information set forth in this Form 10-Q, you should carefully consider the risks and uncertainties described under the section “Risk Factors” in Part I, Item 1A of our Annual Report on Form 10-K filed with the SEC on January 31, 2023 and Part II, Item 1A of our Quarterly Report on Form 10-Q filed with the SEC on July 27, 2023, which could materially and adversely affect our business, financial condition or results of operations. Our business could be harmed by any of these risks or additional risks and uncertainties not presently known to us or that we currently believe to be immaterial. Our stock price could decline due to any of these risks.

Risks Related to the Operation of Our Business

If we or our third-party service providers experience an actual or perceived cybersecurity event, our platform may be perceived as not being secure, and we may lose customers or incur significant liabilities, which would harm our business and operating results.

Our operations involve the storage, transmission and processing of our customers’ confidential, proprietary and sensitive data, which may include personally identifiable information, protected health information, financial information and, in some cases, government information. While we have security measures and a data governance framework in place designed to protect customer information and prevent data loss, these protective mechanisms we have implemented may not be effective at preventing material breaches caused by intentional or unintentional action or inaction by employees or third parties, which may result in the unauthorized access or release of our instances and ultimately our or our customers’ data, IP and other confidential business information. Third parties have attempted to fraudulently induce employees, contractors, or users to disclose information or to gain access to our or our customers’ data, and we have been the target of increasingly sophisticated email and text message scams that attempt to acquire personal information or company assets. Further, we have experienced an increase in the number and sophistication of cyberattacks and security challenges as the growing number of employees, vendors and other third parties that remotely access our systems increase our exposure to attack.

Computer malware, ransomware, viruses, hacking, phishing and denial of service attacks by third parties have become more prevalent in our industry, and similar malicious attacks have been made against our and our third-party service providers’ systems in the past and may occur again in the future. Our employees have fallen victim to phishing attacks in the past and may again in the future. The frequency and sophistication of these attacks have increased, and it appears that cyber crimes and cyber criminal networks, some of which may be state-supported, have substantial resources and may target U.S. enterprises or our customers and their use of our products.

In addition, we have established extensive development and testing environments for our engineers developing new products and features. Security protocols in those environments have necessarily been less rigorous than in environments housing customer data, but a vulnerability or security defect arising out of our development and testing environment could become incorporated in code imported to our environments housing customer data. Similarly, in the unique circumstances where customer data may be utilized in developer environments for testing or learning, that data may be at greater risk. Because techniques used to sabotage, obtain unauthorized access to systems or prohibit authorized access to systems change frequently and generally may not be detected until successfully launched against a target, we have been and may continue to be unable to anticipate these techniques or to implement adequate preventative measures. This has included and may continue to include underlying infiltration of pre-existing systems, including those of our third-party service providers or customers, perpetrated by more sophisticated or state-supported attackers, including foreign cybersecurity attacks on U.S. technology companies and retaliatory cybersecurity attacks stemming from the Russian invasion of Ukraine or other geopolitical tensions. It may also include exploitation of vulnerabilities in third party or open source software code that may be incorporated into our own or our customers’ systems, such as the vulnerability in the Java logging library known as “log4j” identified in late 2021 that affected our industry. The occurrence of these and other more sophisticated or state-supported attack campaigns may increase as geopolitical tensions and intermittent warfare continue or escalate outside of the U.S. For example, due to the Russia-Ukraine conflict, conflict in the Middle East, rising tensions between the U.S. and North Korea and rising tensions with China, we and our customers, third-party vendors and service providers are subject to a heightened risk of cybersecurity attacks, phishing

attacks, viruses, malware, ransomware, hacking or similar breaches from state-supported actors, including attacks that could materially disrupt our systems and operations, supply chain, and ability to make available or sell our products and services.

We devote significant financial and personnel resources to implement and maintain security measures while meeting customer expectations as to the performance of our systems; however, as cybersecurity threats develop and grow more complex and sophisticated over time, such as in connection with geopolitical warfare, we will continue to make significant further investments to protect data and infrastructure, but a residual risk may remain despite our preventative efforts. A security breach suffered by us or our third-party service providers, an attack against our service availability or unauthorized access or loss of data could result in a disruption to our service, litigation, service level agreement claims, indemnification and other contractual obligations, regulatory investigations, government fines and penalties, reputational damage, loss of sales and customers, mitigation and remediation expenses and other significant costs and liabilities. In addition, we may incur significant economic and operational consequences in order to appropriately assess and respond to security incidents and to implement appropriate safeguards to protect against future incidents. We also cannot be certain that insurance coverage will continue to be available on acceptable terms or in sufficient amounts to cover the potentially significant losses that may result from a security incident or an insurer will not deny coverage as to any future claim.

Additionally, as we increase reliance on third-party and public cloud infrastructure, we depend in part on third-party security measures to protect against unauthorized access, cyberattacks and the mishandling of data. However, our ability to monitor our third-party service providers’ data security is limited. Employee error or malfeasance in configuring, maintaining, and using services offered by third-party providers may affect our ability to monitor and secure such services.

While our software is delivered with certain preset configurations, we empower our customers to configure the Now Platform in the manner that best suits their business needs. Further, in most instances, our customers are responsible for administering access to the data held in their particular instance for their employees and service providers. In configuring our platform, ServiceNow employees and customers have made errors in the past and may do so again in the future. We are aware that, on occasion, our customers and ServiceNow have configured certain settings on our platform, or retained preset configurations, in a manner not aligned with their preferred security levels, which can result in, and has resulted in, information being made more widely accessible than intended. Such misconfigurations can be, and have been, identified publicly, increasing the risk of data being exposed unintentionally. We have worked and will continue to work closely with our customers to help them evaluate their security configurations, including providing guidance and taking action designed to help customers align configuration settings with their business needs. In addition, as needed, we have evaluated and modified our own internal configurations, as well as the configurations of the services provided to us by third parties, and will continue to do so. While we offer tools and support, customers are not required to utilize them and may experience a data exposure or suffer a cybersecurity attack on their own systems, unrelated to our own, and allow a malicious actor access to the customer’s information held on our platform. Even if such a breach is unrelated to our security programs or practices, such breach could cause us reputational harm and require us to incur significant economic and operational consequences in order to adequately assess and respond to the breach, including further protecting our customers from their own vulnerabilities, and to implement appropriate safeguards to protect against future breaches. In addition, any misconfiguration or misuse of our software that results in unauthorized access to, or the misuse, loss or destruction of, our and our customers’ data or in a violation of our terms or applicable law may result in reputational harm or liability. Similar risks apply to a breach that results from misconfiguration or misuse of our providers’ services.

Digital supply chain attacks have increased in frequency and severity. We cannot guarantee that third parties and our supply chain infrastructure have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our platform, systems and network or the systems and networks of third parties that support us and our business. Third parties may also exploit vulnerabilities in, or obtain unauthorized access to, platforms, systems, networks, or physical facilities utilized by us or our third-party vendors or service providers. Furthermore, supply chain disruptions due to the Russian invasion of Ukraine (and resulting legal or regulatory developments) and any indirect effects may further complicate any existing supply chain constraints.

ITEM 2. UNREGISTERED SALES OF EQUITY SECURITIES AND USE OF PROCEEDS

Share repurchases of the Company’s common stock for the three months ended September 30, 2023 were as follows:

(1) On May 16, 2023, the Board of Directors authorized a program to repurchase up to $1.5 billion of the Company’s common stock.

Rule 10b5-1 Trading Plans

During the quarter ended September 30, 2023, the following directors and Section 16 officers adopted trading arrangements intended to satisfy the affirmative defense of Rule 10b5-1(c):

• Gina Mastantuono, our Chief Financial Officer, adopted a trading plan on July 28, 2023. The plan, which expires May 24, 2024, provides for the sale of (i) 317 shares of our common stock and (ii) 100% of the (net) shares resulting from the vesting of 8,019 additional (gross) shares of our common stock during the plan period (net shares are net of tax withholding).

• William R. McDermott, our Chief Executive Officer, adopted a trading plan on August 31, 2023. The plan, which expires February 18, 2025, provides for the sale of (i) 30,489 shares of our common stock and (ii) 100% of the (net) shares resulting from the vesting of 9,986 additional (gross) shares of our common stock during the plan period (net shares are net of tax withholding).

• Paul E. Chamberlain, a member of our board of directors, adopted a trading plan on August 21, 2023. The plan, which expires September 3, 2024, provides for the sale of 540 shares of our common stock.

EXHIBIT INDEX

• Indicates a management contract, compensatory plan or arrangement.

** The certifications on Exhibit 32 hereto are deemed not “filed” for purposes of Section 18 of the Exchange Act, or otherwise subject to the liability of that Section. Such certifications will not be deemed incorporated by reference into any filing under the Securities Act of 1933, as amended, or the Exchange Act.

SIGNATURES

Pursuant to the requirements of the Securities Exchange Act of 1934, the Registrant has duly caused this report to be signed on its behalf by the undersigned thereunto duly authorized.