CSCO

The global macroeconomic environment can be challenging and uncertain. For example, the impact of uncertainty regarding global central bank monetary policy, the instability in the geopolitical environment in many parts of the world (including as a result of the on-going ongoing Russia and Ukraine war, Middle East conflicts and wars, and China-Taiwan relations), government-related disruptions or shutdowns, and other disruptions may continue to put pressure on global economic conditions. If global economic and market conditions were to deteriorate, we may experience material harm to our business, operating results, and financial condition.

Manufacturing capacity and component supply constraints, as we saw with memory in the first quarter six months of fiscal 2026, could be significant issues for us as they have been in certain prior periods. We have been and expect to continue to be adversely impacted by an increase in the cost of certain memory components which are currently constrained. We purchase components from a variety of suppliers and use several contract manufacturers to provide manufacturing services for our products. During the normal course of business, in order to improve manufacturing lead-time performance and to help ensure adequate component supply, we enter into agreements with contract manufacturers and suppliers that either allow them to procure inventory based upon criteria as defined by us or that establish the parameters defining our requirements. In certain instances, these agreements allow us the option to cancel, reschedule, and adjust our requirements based on our business needs prior to firm orders being placed. In recent periods, we have increased our efforts in procuring components in order to meet customer expectations, such as we have done in past periods due to supply constraints, which in turn contributes to an increase in inventory and purchase commitments. For example, in fiscal 2025 and in the first quarter six months of fiscal 2026, we entered into additional purchase commitments with contract manufacturers and suppliers related to manufacturing Cisco Silicon One One, memory components and other products to meet demand from hyperscalers and other customers. We expect to continue entering into these additional purchase commitments in fiscal 2026. These past efforts and additional purchase commitments significantly increased our supply chain exposure, which resulted in negative impacts to our product gross margin in recent periods and may result in further negative impacts in future periods. For example, on August 26, 2025, we settled a legal dispute with a supplier relating to purchase obligations arising under long-term supply arrangements, which resulted in a charge to product cost of sales in the fourth quarter of fiscal 2025. These supply chain exposures include potential material excess and obsolete or other charges if product demand significantly decreases for a sustained duration, we are unable to generate demand for certain products planned for development, or we are otherwise unable to mitigate these supply chain exposures. Product demand conditions for future periods can be difficult to predict or may persist longer than anticipated. For additional information and a further discussion of impacts and risks related to our inventory commitments and our purchase commitments with contract manufacturers and suppliers, see “Results of Operations—Product Gross Margin—Supply Chain Impacts and Risks”, “Liquidity and Capital Resources—Inventory Supply Chain” and Note 14 to the Consolidated Financial Statements.

Sales to the service provider and cloud market have been characterized by large and sporadic purchases. Although service provider and cloud product orders increased during the first quarter and second quarters of fiscal 2026, at various times in the past we have experienced significant weakness in product orders from the service provider and cloud market. Product orders from the service provider and cloud market could decline in the future and, as has been the case in the past, such weakness could persist over extended periods of time given fluctuating market conditions. Products in the service provider and cloud market could also face a high degree of customer concentration, with bespoke product designs and features that would be difficult to sell to alternate customers should the primary customer reduce its product orders with Cisco. Sales activity in this industry depends upon the stage of completion of expanding network infrastructures; the availability of funding; and the extent to which service provider and cloud customers are affected by regulatory, economic, and business conditions in the country of operations. Weakness in orders from this industry, including as a result of any slowdown in capital expenditures by service providers (which may be more prevalent during a global economic downturn, or periods of economic, political or regulatory uncertainty), could materially harm our business, operating results, and financial condition. Such slowdowns may continue or recur in future periods. Orders from this industry could decline for many reasons other than the competitiveness of our products and services within their respective markets. For example, in the past, many of our service provider and cloud customers have been negatively impacted by slowdowns in the general economy, by overcapacity, by changes in the service provider and cloud market, by regulatory developments, and by constraints on capital availability, resulting in business failures and substantial reductions in spending and expansion plans. These conditions have negatively impacted our business and operating results in the past, and could materially harm our business and operating results in any future period. Finally, service provider and cloud customers typically have longer implementation cycles; require a broader range of services, including design services; demand that vendors take on a larger share of risks; often require acceptance provisions, which can lead to a delay in revenue recognition; and expect financing from vendors. All these factors can add further risk to business conducted with service providers.

We currently incorporate AI technology in certain of our commercial offerings and in our business operations. Our research and development of AI technology remains ongoing. AI presents risks and challenges and may result in unintended consequences, including inadvertent disclosure or misuse of intellectual property, confidential, personal, and/or competitive information, that could affect our reputation, our further AI development or our and our customers’ adoption and use of this technology. AI algorithms and training methodologies may be flawed. Additionally, AI technologies are complex and rapidly evolving, and we face significant competition in the market and from other companies regarding such technologies. Leveraging AI capabilities to potentially improve our internal functions and operations also presents risks, costs, and challenges. While we aim to develop and use AI responsibly and attempt to identify and mitigate ethical and legal issues and risks presented by its use, we may be unsuccessful in identifying or resolving issues and risks before they arise. The AI-related legal and regulatory landscape is complex and constantly evolving and therefore remains uncertain and may be inconsistent from jurisdiction to jurisdiction. Our obligations to comply with the this complex and evolving legal and regulatory landscape could entail significant compliance or other costs or limit our ability to incorporate certain AI capabilities into our offerings. AI-related issues, deficiencies and/or failures could also give rise to legal and/or regulatory action (including with respect to proposed legislation regulating AI in jurisdictions such as the European Union and others, and as a result of new and different applications of existing and new data protection, privacy, cybersecurity, intellectual property, and other laws); laws and regulations); damage our reputation; or otherwise materially harm our business.

As of the end of the first second quarter of fiscal 2026, we have senior unsecured notes outstanding in an aggregate principal amount of $24.8 billion that mature at specific dates from calendar year 2026 through 2064. We have also established a commercial paper program under which we may issue short-term, unsecured commercial paper notes on a private placement basis up to a maximum aggregate amount outstanding at any time of $15.0 billion, and we had $3.5 $5.5 billion in commercial paper notes outstanding under this program as of October 25, 2025. January 24, 2026. There can be no assurance that our incurrence of this debt or any future debt, including any additional debt to refinance maturing debt, will be a better means of providing liquidity to us than would our use of our existing cash resources. Further, we cannot be assured that our maintenance of this indebtedness or incurrence of future indebtedness will not negatively impact our operating results or financial condition. In addition, changes by any rating agency to our credit rating can negatively impact the value and liquidity of both our debt and equity securities, as well as the terms upon which we may borrow under our commercial paper program or future debt issuances.

We are subject to evolving and sometimes conflicting, laws, regulations, policies, and investor and other stakeholder expectations concerning environmental, social, and governance matters, such as environmental sustainability and climate change, matters both in the United States and internationally. Any initiatives, goals, or commitments we disclose in this regard involve risks and uncertainties and could be difficult to achieve and costly to implement. For example, in September 2021, we announced our goal to achieve net zero across all scopes of greenhouse gas emissions by 2040, the achievement of which relies, in large part, on the accuracy of our estimates and assumptions around the enhanced power efficiency of our products, the adoption of renewable energy at customer and supplier sites, and the adoption of certain of our products and services by our customers. We could fail to achieve, or be perceived to fail to achieve, our 2040 net zero goal or other initiatives, goals, or commitments. In addition, in a climate where there are changing and increasingly divergent views on where our focus should be on these matters, our initiatives, goals, or commitments, or any revisions to them, are often criticized and the accuracy, adequacy, or completeness of such disclosures challenged. Our actual or perceived failure to achieve our initiatives, goals, or commitments, or otherwise successfully manage investor or other stakeholder expectations on these matters, could negatively impact our reputation or otherwise harm our business.

Third parties, including customers, have in the past and may in the future assert claims or initiate litigation related to exclusive patent, copyright, trademark, and other intellectual property rights to technologies and related standards that are relevant to us. These assertions have increased over time as a result of our growth growth, trends in patent policy and at the United States Patent and Trademark Office, and the general increase in the pace of patent claims assertions, particularly in the United States. Because of the existence of a large number of patents in the information technology field, the secrecy of some pending patents, and the rapid rate of issuance of new patents, it is not economically practical or even possible to determine in advance whether a product or any of its components infringes or will infringe on the patent rights of others. The asserted claims and/or initiated litigation can include claims against us or our manufacturers, suppliers, or customers, alleging infringement of their proprietary rights with respect to our existing or future products or components of those products. Regardless of the merit of these claims, they can be time-consuming, result in costly litigation and diversion of technical and management personnel, or require us to develop a non-infringing technology or enter into license agreements. Where claims are made by customers, resistance even to unmeritorious claims could damage customer relationships. There can be no assurance that licenses will be available on acceptable terms and conditions, if at all, or that our indemnification by our suppliers will be adequate to cover our costs if a claim were brought directly against us or our customers. Furthermore, because of the potential for high court awards, including injunctive relief, that are not necessarily predictable, it is not unusual to find even arguably unmeritorious claims settled for significant amounts. If any infringement or other intellectual property claim made against us by any third party is successful, if we are required to indemnify a customer with respect to a claim against the customer, or if we fail to develop non-infringing technology or license the proprietary rights on commercially reasonable terms and conditions, our business, operating results, and financial condition could be materially harmed. For additional information regarding our indemnification obligations, see Note 14(e) to the Consolidated Financial Statements contained in this report. Our exposure to risks associated with the use of intellectual property may be increased as a result of acquisitions, as we have a lower level of visibility into the development process with respect to such technology or the care taken to safeguard against infringement risks. Further, in the past, third parties have made infringement and similar claims after we have acquired technology that had not been asserted prior to our acquisition.

We experience cyber attacks and other attempts to gain unauthorized access on a regular basis to (i) our products and services (together, our “solutions”) and (ii) the servers, data centers, networks, systems, and cloud-based services operated or enabled by us, or by third parties upon which we rely, on or through which our and third-party data are stored, processed, or can be accessed (collectively, our “IT environment”). We anticipate continuing to be increasingly subject to such attempts as cyber attacks become more sophisticated and difficult to predict and protect against. Furthermore, the emergence and maturation of AI capabilities has led to new and/or more effective methods of cyber attacks. Despite our active implementation of security and other measures, our solutions and IT environment have been, and continue to be, vulnerable to cyber attacks, incidents, data breaches, malware, inadvertent error, disruptions, failures, physical security breaches, tampering or other theft or misuse, including by employees, malicious actors (including criminals and activists) and by insider threats (including employees and contingent workers, and malicious actors. workers). Additionally, nation-state actors or their agents have in the past successfully attacked our IT environment and have also exploited vulnerabilities in our solutions to carry out attacks, and we anticipate that these attacks and the exploitation of vulnerabilities in our solutions will continue and may intensify during periods of diplomatic or armed conflict or other geopolitical tensions. Further, a cyber attack, vulnerability exploitation, or other incident could go undetected and persist in our environments, or those of our customers or third-party providers upon which we rely, for extended periods. Cyber-related events have caused, and in the future could result in, compromise to, or the disruption of access to, the operation of our solutions and IT environment or those of our customers or third-party providers upon which we rely, or result in confidential confidential, private or otherwise sensitive information stored on our systems or our customers’ or other third-party systems being improperly accessed, processed, disclosed now (or in the future), or being lost or stolen. Efforts to limit the ability of malicious actors to disrupt the operations of the Internet or undermine our security efforts are costly to implement and may not be successful. Breaches of security in our IT environment, our customers’ or third-party providers’ networks, or in third-party products we use, regardless of whether the breach is attributable to a vulnerability in our solutions, a failure by us to timely mitigate or apply a security fix for products we use that are found vulnerable, or a failure to maintain the digital security infrastructure or security tools that protect the integrity of our solutions and IT environment, could, in each case, result in claims of legal and/or regulatory action against us, damage our reputation or otherwise materially harm our business. The occurrence of a cyber attack, data breach or other incident could subject us to direct or indirect liability to our customers, data subjects, suppliers, business partners, employees, and others, give rise to legal and/or regulatory action, could damage our reputation or could otherwise negatively impact our business, any of which could materially harm our business, operating results, and financial condition.

Global privacy and data related laws and regulations, including cybersecurity laws, are evolving, extensive, and complex. Compliance with these laws and regulations is difficult and costly. In addition, evolving legal requirements restricting or controlling the collection, processing, use, sharing, access or cross-border transmission of data, including regulation of cloud-based services, could materially affect our customers’ ability to use, and our ability to sell, our products and services. The interpretation and application of these laws in some instances is are uncertain, and our legal obligations and customer requirements are subject to frequent changes. For example, the European Union’s (“EU”) General Data Protection Regulation (“GDPR”) and Data Act apply to our activities conducted from an establishment in the EU or related to products and services offered in the EU and imposes a range of compliance obligations regarding the handling of personal and industrial data for both ourselves and our customers. Additionally, we are subject to the California Privacy Rights Act, Singapore’s Personal Data Protection Act, and other laws, regulations, and obligations around the world that govern the handling of data. Our actual or perceived failure to comply with applicable laws and regulations or other obligations relating to the use of data and protecting data from unauthorized access, use, or other processing, could subject us to claims of liability, give rise to legal and/or regulatory action, damage our reputation, and/or otherwise negatively impact our business, any of which could materially harm our operating results and financial condition.

Changes in regulatory requirements applicable to the industries and sectors in which we operate, in the United States and in other countries, could materially affect our operations and the sales and use of our products and services. In particular, economic sanctions and changes to export and import control requirements have impacted and may continue to impact our ability to sell and support our products and services in certain jurisdictions. In addition, changes in telecommunications regulations could impact our service provider customers’ purchase of our products and services, and they could also impact sales of our own regulated offerings. Government and other customers’ procurement policies, priorities, regulations, technology initiatives and/or other obligations often give rise to evolving privacy, cybersecurity, operational resilience, data governance, sourcing, or other requirements; the failure or delay in meeting and maintaining compliance with such requirements could negatively impact our business, including by limiting our ability to sell products and services, directly or indirectly, to public sector, critical infrastructure, and other customers. Additional areas of uncertainty that could impact sales of our products and services include laws, regulations, or customer procurement requirements related to encryption technology, data, AI, privacy, cybersecurity, sovereignty, localization, operational resilience, environmental sustainability (including climate change), human rights, product certification, product and digital accessibility, country of origin, sourcing and sourcing, national security security, and other security controls applicable to our offerings and supply chain. Changes in regulatory requirements or our actual or perceived failure to comply (or to enable our customers to comply when using our offerings) with applicable laws, regulations, or other obligations could materially harm our business, operating results, and financial condition.