CSCO

As a result of a variety of factors discussed in this report, our revenue for a particular quarter is difficult to predict, which can be exacerbated during periods when the global macroenvironment is challenging and can result in market uncertainty. Our revenue may grow at a slower rate than in past periods, or decline as it did in certain prior periods on a year-over-year basis. Our ability to meet financial expectations could also be negatively impacted if the nonlinear sales pattern seen in some of our past quarters recurs in future periods. We have also experienced periods of time during which shipments have exceeded net bookings or manufacturing or other issues have delayed shipments, leading to nonlinearity in shipping patterns. In addition to making it difficult to predict revenue for a particular period, nonlinearity in shipping can increase costs, because irregular shipment patterns result in periods of underutilized capacity and periods in which overtime expenses may be incurred, as well as in potential additional inventory management-related costs. In addition, to the extent that manufacturing or other issues and any related component shortages result in delayed shipments in the future, and particularly in periods in which our contract manufacturers are operating at higher levels of capacity, it is possible that revenue for a quarter could be negatively impacted if such matters occur and are not remediated within the same quarter.

A reduction or interruption in supply, including disruptions on our global supply chain, caused in part by public health emergencies, geopolitical tensions (including as a result of China-Taiwan relations, relations or Middle East conflicts or wars, increasing tariffs or any other trade tensions) tensions or disruptions) or a significant natural disaster (including as a result of climate change); a significant increase in the price of one or more components (including as a result of inflation); a failure to adequately authorize procurement of inventory by our contract manufacturers; a failure by suppliers to deliver on our contracts; IT-related failure or disruption; a failure to appropriately cancel, reschedule, or adjust our requirements based on our business needs; or a decrease in demand for our products could materially harm our business, operating results, and financial condition and could materially damage customer relationships. Furthermore, as a result of binding price or purchase commitments with suppliers, we may be obligated to purchase components at prices that are higher than those available in the current market. In the event that we become committed to purchase components at prices in excess of the current market price when the components are actually used, our gross margins could decrease. In addition, vendors may be under pressure to allocate product to certain customers for business, regulatory or political reasons, and/or demand changes in agreed pricing as a condition of supply. Although we have generally secured additional supply or taken other mitigation actions when significant disruptions have occurred, if similar situations occur in the future, they could materially harm our business, results of operations, and financial condition.

Manufacturing capacity and component supply constraints, as we saw with memory in the first six nine months of fiscal 2026, could be significant issues for us as they have been in certain prior periods. We have been and expect to continue to be adversely impacted by an increase in the cost of certain memory components which are currently constrained. We purchase components from a variety of suppliers and use several contract manufacturers to provide manufacturing services for our products. During the normal course of business, in order to improve manufacturing lead-time performance and to help ensure adequate component supply, we enter into agreements with contract manufacturers and suppliers that either allow them to procure inventory based upon criteria as defined by us or that establish the parameters defining our requirements. In certain instances, these agreements allow us the option to cancel, reschedule, and adjust our requirements based on our business needs prior to firm orders being placed. In recent periods, we have increased our efforts in procuring components in order to meet customer expectations, such as we have done in past periods due to supply constraints, which in turn contributes to an increase in inventory and purchase commitments. For example, in fiscal 2025 and in the first six nine months of fiscal 2026, we entered into additional purchase commitments with contract manufacturers and suppliers related to manufacturing Cisco Silicon One, memory components and other products to meet demand from hyperscalers and other customers. We expect to continue entering into these additional purchase commitments in fiscal 2026. These past efforts and additional purchase commitments significantly increased our supply chain exposure, which resulted in negative impacts to our product gross margin in recent periods and may result in further negative impacts in future periods. For example, on August 26, 2025, we settled a legal dispute with a supplier relating to purchase obligations arising under long-term supply arrangements, which resulted in a charge to product cost of sales in the fourth quarter of fiscal 2025. These supply chain exposures include potential material excess and obsolete or other charges if product demand significantly decreases for a sustained duration, we are unable to generate demand for certain products planned for development, or we are otherwise unable to mitigate these supply chain exposures. Product demand conditions for future periods can be difficult to predict or may persist longer than anticipated. For additional information and a further discussion of impacts and risks related to our inventory commitments and our purchase commitments with contract manufacturers and suppliers, see “Results of Operations—Product Gross Margin—Supply Chain Impacts and Risks”, “Liquidity and Capital Resources—Inventory Supply Chain” and Note 14 to the Consolidated Financial Statements.

Sales to the service provider and cloud market have been characterized by large and sporadic purchases. Although service provider and cloud product orders increased during the first and second quarters of fiscal 2026, in recent quarters, at various times in the past we have experienced significant weakness in product orders from the service provider and cloud market. Product orders from the service provider and cloud market could decline in the future and, as has been the case in the past, such weakness could persist over extended periods of time given fluctuating market conditions. Products in the service provider and cloud market could also face a high degree of customer concentration, with bespoke product designs and features that would be difficult to sell to alternate customers should the primary customer reduce its product orders with Cisco. Sales activity in this industry depends upon the stage of completion of expanding network infrastructures; the availability of funding; and the extent to which service provider and cloud customers are affected by regulatory, economic, and business conditions in the country of operations. Weakness in orders from this industry, including as a result of any slowdown in capital expenditures by service providers (which may be more prevalent during a global economic downturn, or periods of economic, political or regulatory uncertainty), could materially harm our business, operating results, and financial condition. Such slowdowns may continue or recur in future periods. Orders from this industry could decline for many reasons other than the competitiveness of our products and services within their respective markets. For example, in the past, many of our service provider and cloud customers have been negatively impacted by slowdowns in the general economy, by overcapacity, by changes in the service provider and cloud market, by regulatory developments, and by constraints on capital availability, resulting in business failures and substantial reductions in spending and expansion plans. These conditions have negatively impacted our business and operating results in the past, and could materially harm our business and operating results in any future period. Finally, service provider and cloud customers typically have longer implementation cycles; require a broader range of services, including design services; demand that vendors take on a larger share of risks; often require acceptance provisions, which can lead to a delay in revenue recognition; and expect financing from vendors. All these factors can add further risk to business conducted with service providers.

In recent years, we have shifted our business model to deliver more recurring software and subscription offerings. This shift in our business model was accelerated by recent acquisitions, including our acquisition of Splunk in the third quarter of fiscal 2024. Market acceptance of our software subscription offerings, which includes our as-a-service solutions, can be affected by a variety of factors, including: security, reliability, performance, terms of service, support terms, customer preference, community engagement, concerns regarding data privacy or data protection, and the enactment of laws or regulations in jurisdictions in which we operate. To generate sales growth for our software subscription offerings, we need to convince potential customers to purchase new licenses or subscriptions and generate timely renewals and additional purchases from existing customers. Any failure to do so could result in decreased revenue, reduced sales, increased churn or otherwise negatively impact our results of operations and financial condition. Further, growth of our software subscription offerings depends, in part, on the ability of customers to use and access these solutions. We have experienced, and may in the future experience, interruptions in service, storage failures, and other performance-related problems due to a variety of factors, such as infrastructure and software changes, human or software errors, capacity constraints, unauthorized access, denial of service or other cyber attacks. attacks, and our potential exposure to these problems is increasing as increasingly powerful AI capabilities emerge and are widely disseminated among threat actors. In some instances, we may not be able to timely identify the cause or causes of these performance problems and, even if timely identified, we may be unable to timely remediate the underlying cause. It may become increasingly difficult to maintain and improve our performance for our software subscription offerings, especially during peak usage times and as our solutions become more complex and our user traffic increases. Performance-related issues of our software subscription offerings may result in increased operational costs, delays in new feature rollouts, customer loss, reputational damage, and legal or regulatory liability, including liability under customer contracts or for losses suffered by our customers.

In response to changes in industry and market conditions, we may be required to strategically realign our resources and to consider restructuring, disposing of, or otherwise exiting businesses. Any resource realignment, or decision to limit investment in or dispose of or otherwise exit businesses, may result in the recording of special charges, such as inventory and technology-related write-offs, workforce reduction or restructuring costs, charges relating to consolidation of excess facilities, or claims from third parties who were resellers or users of discontinued products. Our estimates with respect to the useful life or ultimate recoverability of our carrying basis of assets, including purchased intangible assets, could change as a result of such assessments and decisions. Although in certain instances our supply agreements allow us the option to cancel, reschedule, and adjust our requirements based on our business needs prior to firm orders being placed, our loss contingencies may include liabilities for contracts that we cannot cancel with contract manufacturers and suppliers. Further, our estimates relating to the liabilities for excess facilities are affected by changes in real estate market conditions. Additionally, we are required to perform goodwill impairment tests on an annual basis and between annual tests in certain circumstances, and future goodwill impairment tests may result in a charge to earnings. From time to time we initiate restructuring plans. For example, we initiated a restructuring plan in the fourth quarter of fiscal 2026, for which we expect such plan to be substantially completed by the end fiscal 2027. Our business may not be more efficient or effective than prior to implementation of such plans. Our restructuring activities, including any related charges and the impact of the related headcount restructurings, could materially harm our business, operating results, and financial condition.

Our growth depends upon on market growth, our ability to enhance our existing products, and our ability to introduce new products on a timely basis. We intend expect to continue to address the need to develop developing new products and enhance enhancing existing products through acquisitions of other companies, product lines, technologies, and personnel. Acquisitions involve numerous risks, including the following: including:

•Difficulties or delays in integrating the operations (including operations, including IT security), security, systems, technologies, products, and personnel of the acquired companies, particularly companies with companies that have large and widespread global operations and/or or complex products (such as Splunk)

•Diversion of management’s attention from normal daily day-to-day operations of the business and the challenges of managing larger and more widespread complex operations resulting from following acquisitions

•Initial dependence •Dependence on unfamiliar supply chains or relatively small smaller supply partners

•Incur tax expenses expense related to the effect of acquisitions on our legal structure

Mergers and acquisitions of high-technology technology companies are inherently risky and subject to many factors outside of our control, and there can be no assurance can be given that our previous past or future acquisitions will be successful and or will not materially harm our business, operating results, or financial condition. Failure to successfully manage and successfully integrate acquisitions could materially harm our business and operating results. Prior acquisitions have produced mixed results, ranging from successful new products and technologies to failures to achieve expected benefits. Even when where an acquired company has already developed and marketed existing products, there can be no assurance that product enhancements will be made in completed on a timely fashion basis or that pre-acquisition due diligence will have has identified all possible issues that might arise with respect to such products. potential issues. In addition, mergers and acquisitions could affect our future effective tax rate. Risks described associated with respect to new product development also apply to acquisitions.

We maintain an investment portfolio of various holdings, types, and maturities. Our portfolio includes available-for-sale debt investments and equity investments, the values of which are subject to market price volatility. If such investments suffer market price declines, as we experienced with some of our investments in the past, we may recognize in earnings the decline in the fair value of our investments below their cost basis. Our privately held investments non-marketable equity securities are subject to risk of loss of investment capital. These investments are inherently risky because the markets for the technologies or products they have under development are typically in the early stages and may never materialize. We could lose our entire investment in these companies. For information regarding the market risks associated with the fair value of portfolio investments and interest rates, refer to the section titled “Quantitative and Qualitative Disclosures About Market Risk.”

The continued threat of terrorism and heightened security and military action in response thereto, or any other current or future acts of terrorism, war (such as the ongoing Russia-Ukraine war and Middle East conflicts and wars), and other events (such as economic sanctions, trade restrictions or disruptions and reactions of the governments, markets and the general public, including the sanctions and restrictions related to the ongoing Russia-Ukraine war) war or arising out of the current conflicts and wars in the Middle East) may cause further disruptions to the economies of the United States and other countries and create further uncertainties or could otherwise negatively impact our business, operating results, and financial condition. Likewise, events such as loss of infrastructure and utilities services such as energy, transportation, or telecommunications could have similar negative impacts. To the extent that such disruptions or uncertainties result in delays or cancellations of customer orders or the manufacture or shipment of our products, our business, operating results, and financial condition could be materially harmed.

As of the end of the second third quarter of fiscal 2026, we have senior unsecured notes outstanding in an aggregate principal amount of $24.8 $23.0 billion that mature at specific dates from calendar year 2026 through 2064. We have also established a commercial paper program under which we may issue short-term, unsecured commercial paper notes on a private placement basis up to a maximum aggregate amount outstanding at any time of $15.0 billion, and we had $5.5 $8.4 billion in commercial paper notes outstanding under this program as of January 24, April 25, 2026. There can be no assurance that our incurrence of this debt or any future debt, including any additional debt to refinance maturing debt, will be a better means of providing liquidity to us than would our use of our existing cash resources. Further, we cannot be assured that our maintenance of this indebtedness or incurrence of future indebtedness will not negatively impact our operating results or financial condition. In addition, changes by any rating agency to our credit rating can negatively impact the value and liquidity of both our debt and equity securities, as well as the terms upon which we may borrow under our commercial paper program or future debt issuances.

We experience cyber attacks and other attempts to gain unauthorized access on a regular basis to (i) our products and services (together, our “solutions”) and (ii) the servers, data centers, networks, systems, and cloud-based services operated or enabled by us, or by third parties upon which we rely, on or through which our and third-party data are stored, processed, or can be accessed (collectively, our “IT environment”). We anticipate continuing to be increasingly subject to such attempts as cyber attacks become more sophisticated sophisticated, numerous, and difficult to predict and protect against. Furthermore, the rapid emergence, widespread dissemination, and maturation of AI capabilities has led to increases in the speed, scale, and effectiveness of cyber attacks or other attempts to gain unauthorized access. Such increases are expected to continue, further reducing the time to identify and mitigate threats. Despite our active implementation of security and other measures, our solutions and IT environment have been, and continue to be, vulnerable to cyber attacks, incidents, data breaches, malware, inadvertent error, disruptions, failures, physical security breaches, tampering or other theft or misuse, including by malicious actors (including criminals and activists) and by insider threats (including employees and contingent workers). Additionally, nation-state actors or their agents have in the past successfully attacked our solutions and IT environment and have also exploited vulnerabilities in our solutions to carry out attacks, and we anticipate that these attacks and the exploitation of vulnerabilities in our solutions will continue and may intensify during periods of diplomatic or armed conflict or other geopolitical tensions. Further, a cyber attack, vulnerability exploitation, or other incident could go undetected and persist in our environments, solutions and IT environment, or those of our customers or third-party providers upon which we rely, for extended periods. Cyber-related events have caused, and in the future could result in, compromise to, or the disruption of access to, the operation of our solutions and IT environment or those of our customers or third-party providers upon which we rely, or result in confidential, private or otherwise sensitive information stored on our systems or our customers’ or other third-party systems being improperly accessed, processed, disclosed now (or in the future), or being lost or stolen. Efforts to limit the ability of malicious actors to disrupt the operations of the Internet or undermine our security efforts are costly to implement and may not be successful. Breaches of security in our solutions or IT environment, our customers’ or third-party providers’ networks, or in third-party products we use, regardless of whether the breach is attributable to a vulnerability in our solutions, a failure by us to timely mitigate or apply a security fix for products we use that are found vulnerable, or a failure to maintain the digital security infrastructure or security tools that protect the integrity of our solutions and IT environment, could, in each case, result in claims of legal and/or regulatory action against us, damage our reputation or otherwise materially harm our business. The occurrence of a cyber attack, data breach or other incident could subject us to direct or indirect liability to our customers, data subjects, suppliers, business partners, employees, and others, give rise to legal and/or regulatory action, could damage our reputation or could otherwise negatively impact our business, any of which could materially harm our business, operating results, and financial condition.

The products and services (together, our “solutions”) we sell to customers, the third-party products and components that we integrate into our solutions and use in our operations, and the cloud-based services operated or enabled by us, or by third parties upon which we rely, inevitably contain vulnerabilities or security defects (despite our efforts to prevent and detect them through secure development lifecycle practices, testing, or other means), which have not been remedied or cannot be disclosed without compromising security. We also make prioritization decisions in determining which vulnerabilities or security defects to fix and the timing of these fixes. Even when we prioritize a vulnerability or security defect, in certain instances it has taken, and in the future could take, time for us to develop and test a remedy and the remedy may ultimately be insufficient to fully fix the issue or may be found to create other issues. Rapidly accelerating advances in AI technology are enabling threat actors, or autonomous systems, to identify and exploit vulnerabilities across both software and hardware with little or no delay between discovery and exploitation, including so-called “zero-minute” vulnerabilities, increasing the likelihood and speed of successful cyber attacks. These advances also show AI technology can rapidly chain otherwise low-severity, unrelated vulnerabilities into more severe combined exploits, complicating prioritization of security updates. As a result of these advances in AI technology, the time available to detect, assess and remediate vulnerabilities before exploitation has been significantly reduced or eliminated, increasing the risk of unauthorized access to, or compromise of, solutions we sell to customers, the third-party products and components that we integrate into our solutions and use in our operations, and the cloud-based services operated or enabled by us or by third parties upon which we rely. In addition, workarounds or other mitigation efforts with our solutions and in our and customer environments in certain instances have not been, and in the future may not be, available available, sufficient, or sufficient timely to protect customers prior to a security update being made available. Vulnerabilities can persist even after we have issued security updates if we have not identified and addressed the root cause of a particular vulnerability, if we are required to issue incomplete or preliminary mitigations as new threats rapidly emerge, if customers have not installed the most recent updates, if the attackers exploited the vulnerabilities before a security update is applied (such as to install additional malware to further compromise customers’ systems), or if a previously patched vulnerability is inadvertently reintroduced due to a security regression during future development or a changed deployment. Additionally, customers may also desire to test security updates before they can be deployed which can delay implementation. When customers do not deploy security updates in a timely manner, use solutions that are end of life and no longer receive security updates, decide not to upgrade to the latest versions of our solutions containing security updates or security enhancements, configure our solutions in insecure ways, or fail to sufficiently monitor activity on those solutions, they are left vulnerable. In addition, we rely on third-party providers of software (including open source) and cloud-based services on which our and third-party data is stored or processed, and we cannot control the timing at which third-party providers remedy vulnerabilities, which could leave us vulnerable. Further, any failure by us to timely implement, or by our customers to timely adopt, post-quantum cryptography in our solutions or IT systems as it becomes available could render existing cryptographic protections ineffective upon the emergence of viable quantum computing, exposing pre-quantum encrypted data and systems to compromise. Failure to comply with internal security policies and standards, including secure development lifecycle practices, failure to prevent or promptly mitigate vulnerabilities and security defects, failure of companies that we have acquired to have adequate organizational security practices, prioritization errors in remedying vulnerabilities or security defects, failure of third-party providers to remedy vulnerabilities or security defects, or customers not deploying security updates in a timely manner, deciding not to upgrade solutions, or configuring our solutions in insecure ways ways, could, in each case, result in claims of legal and/or regulatory action against us, damage our reputation, or otherwise materially harm our business.

Changes in regulatory requirements applicable to the industries and sectors in which we operate, in the United States and in other countries, could materially affect our operations and the sales and use of our products and services. In particular, economic sanctions and changes to export and import control requirements have impacted and may continue to impact our ability to sell and support our products and services in certain jurisdictions. In addition, changes in telecommunications regulations could impact our service provider customers’ purchase and use of our products and services, and they could also impact sales of our own regulated offerings. Government and other customers’ procurement policies, priorities, regulations, technology initiatives and/or other obligations often give rise to evolving privacy, cybersecurity, operational resilience, data governance, sourcing, or other requirements; the failure or delay in meeting and maintaining compliance with such requirements could negatively impact our business, including by limiting our ability to sell products and services, directly or indirectly, to public sector, critical infrastructure, and other customers. Additional areas of uncertainty that could impact sales of our products and services include laws, regulations, or customer procurement requirements related to encryption technology, data, AI, privacy, cybersecurity, sovereignty, localization, operational resilience, environmental sustainability (including climate change), human rights, product certification, product and digital accessibility, country of origin, sourcing, national security, and other security controls applicable to our offerings and supply chain. Changes in regulatory requirements or our actual or perceived failure to comply (or to enable our customers to comply when using our offerings) with applicable laws, regulations, or other obligations could materially harm our business, operating results, and financial condition.