C3.ai Inc.

Company Overview

Business Model: C3 AI is an Enterprise AI application software company that provides a family of fully integrated products: the C3 Agentic AI Platform, C3 AI Applications, and C3 Generative AI. The C3 Agentic AI Platform is an end-to-end platform for developing, deploying, and operating Enterprise AI applications. C3 AI Applications are a portfolio of pre-built, extensible, industry-specific Enterprise AI applications designed to enable digital transformation. C3 Generative AI is a library of agentic AI applications that retrieve data, analyze information, surface insights, and orchestrate workflows. The company's patented model-driven architecture simplifies and accelerates Enterprise AI application development, deployment, and administration. C3 AI software can be deployed on major public cloud infrastructures, private cloud, hybrid environments, or directly on customer servers. Revenue is primarily generated from software subscriptions (84% of total revenue in fiscal year 2025), which include software licenses, Software-as-a-Service offerings, stand-ready Center of Excellence support services, initial production deployments, and usage-based runtime/hosting fees. Professional services (16% of total revenue in fiscal year 2025) include prioritized engineering services, paid implementation, consulting, and training.

Market Position: C3 AI positions itself as a leader in Enterprise AI, offering a solution that mitigates AI vendor lock-in by supporting deployment across various cloud platforms. Its patented model-driven architecture is stated to accelerate development by a factor of 26 and reduce code by up to 99%. The C3 Generative AI offering is highlighted as unique, featuring omni-modal parsing, a dynamic planning agent with multi-agent collaboration, easy agent and tool authoring, on-the-fly custom visualizations, streamlined omni-modal data integration, proprietary fine-tuned foundation models, support for over 130 languages, dynamic LLM/retriever configuration, advanced image/data table querying, air-gapped environment availability, advanced orchestration, and an improved co-pilot LLM. The company has been recognized by various industry bodies, including Fortune 50 AI Innovators, CNBC Disruptor 50, Forbes Cloud 100, and as a Leader in the Forrester Wave: AI/ML Platforms. Its primary competition is identified as internal IT organizations developing custom AI solutions, often integrating open-source software and cloud microservices.

Recent Strategic Developments:

• Consumption-Based Pricing Model: Introduced in the first quarter of fiscal year 2023 to adapt to macroeconomic conditions and customer needs, allowing for smaller initial contract sizes and monthly consumption-based fees (vCPU and vGPU hours) or time-certain multi-period commitments.
• C3 Generative AI Expansion: Launched in early fiscal year 2024 with 28 domain-specific generative AI offerings. Expanded functionalities include omni-modal parsing, dynamic planning agent with multi-agent collaboration, easy agent and tool authoring, and on-the-fly custom visualizations. The C3 Generative AI Accelerator Program was introduced as a three-day workshop for effective implementation.
• Strategic Partnerships:
  • Microsoft Azure: Signed a new multi-year global alliance agreement in September 2024, establishing C3 AI as a preferred AI application software provider on Microsoft Azure, with joint sales, co-marketing, technical integration, and availability in Microsoft’s commercial marketplace.
  • AWS: Expanded strategic collaboration agreement in November 2023 and entered into a new multi-year strategic collaboration agreement in January 2025 to accelerate solution delivery and go-to-market efforts.
  • Google Cloud: Expanded partnership agreement in September 2022 for global joint selling activities and tighter integrations, with all C3 AI Applications optimized for and available in the Google Cloud Marketplace.
  • McKinsey & Company: Entered into a strategic collaboration agreement in January 2025 to accelerate Enterprise AI transformations, combining McKinsey’s AI practice (QuantumBlack) with C3 AI’s software.
  • Baker Hughes: Renewed and expanded strategic partnership in April 2025 through a multi-year agreement focused on co-selling and co-investment in AI solutions for the energy sector.
  • PwC: Entered into a strategic alliance in March 2025 to deploy AI-powered business transformation.
  • Cognizant: Entered into a strategic alliance in April 2025 to deploy and scale Enterprise AI, with an initial focus on healthcare and financial services.
• Intellectual Property: Awarded a foundational U.S. patent (No. 12,111,859) in October 2024 for generative AI agentic technology, covering AI Orchestrator, Autonomy, Multimodal Model Integration, Natural Language Summarization, and Traceability and Security.
• Executive Appointment: Rob Schilling was appointed Executive Vice President and Chief Commercial Officer on June 16, 2025, to oversee all customer-facing operations.

Geographic Footprint: C3 AI has Customer-Entities in more than 15 countries. In fiscal year 2025, 86% of total revenue was generated from the United States, and 11% from Europe, the Middle East and Africa. The company maintains ten international sales locations and plans further expansion. Its principal executive office is in Redwood City, California, with additional offices in the United States, UK, Australia, France, India, Singapore, Netherlands, Italy, Mexico, and Germany.

Financial Performance

Revenue Analysis

Profitability Metrics:

• Gross Margin: 61% (Fiscal Year 2025)
• Operating Margin: -83% (Fiscal Year 2025)
• Net Margin: -74% (Fiscal Year 2025)

Investment in Growth:

• R&D Expenditure: $226.4 million (58% of revenue) in Fiscal Year 2025.
• Capital Expenditures: $3.0 million in Fiscal Year 2025 for purchases of property and equipment.
• Strategic Investments: Significant funds are expended on developing C3 AI Software, expanding the sales force, increasing customer base, and enhancing market awareness.

Business Segment Analysis

C3 AI operates as a single operating and reportable segment. The Chief Executive Officer, as the chief operating decision maker, evaluates the company's financial performance and allocates resources at the consolidated level.

Capital Allocation Strategy

Shareholder Returns:

• Share Repurchases: Not disclosed.
• Dividend Payments: C3 AI has never declared or paid any dividends on its common stock and intends to retain all available funds and future earnings for business operations and expansion.
• Dividend Yield: Not applicable.
• Future Capital Return Commitments: Not disclosed.

Balance Sheet Position:

• Cash and Equivalents (April 30, 2025): $164.4 million
• Total Liabilities (April 30, 2025): $187.6 million (includes $60.3 million in operating lease liabilities). No explicit long-term debt is disclosed.
• Net Cash Position (April 30, 2025): $742.7 million (Cash and cash equivalents + marketable securities) minus $187.6 million (Total liabilities) = $555.1 million.
• Credit Rating: Not disclosed.
• Debt Maturity Profile: Operating lease liabilities have future minimum payments of $9.8 million in fiscal year 2026, $10.4 million in fiscal year 2027, $10.7 million in fiscal year 2028, $11.0 million in fiscal year 2029, and $46.4 million in fiscal year 2030 and thereafter.

Cash Flow Generation:

• Operating Cash Flow (Fiscal Year 2025): -$41.4 million (Net cash used in operating activities).
• Free Cash Flow (Fiscal Year 2025): -$44.4 million (Net cash used in operating activities less purchases of property and equipment and capitalized software development costs).
• Cash Conversion Metrics: Not explicitly disclosed.

Operational Excellence

Production & Service Model: C3 AI's operational philosophy centers on its cloud-native software offerings, which allow for centralized management, updates, and monitoring across diverse deployment environments (public cloud, private cloud, hybrid). The core C3 Agentic AI Platform leverages a patented model-driven architecture, providing an abstraction layer that significantly reduces the complexity and code required for Enterprise AI application development. This architecture is stated to accelerate development by 26 times and reduce code by up to 99%. Automated testing continuously runs approximately 60,000 tests and security scans with each software or infrastructure change to ensure operability across various underlying cloud platforms. The company maintains a professional services organization to support customers in developing and deploying AI applications, with a strategic goal of enabling customer self-sufficiency. For extensive professional services, C3 AI relies on its partner ecosystem to scale deployment and maintain high gross margins.

Supply Chain Architecture: Key Suppliers & Partners:

• Hyperscale Cloud Providers: Microsoft Azure, Amazon Web Services, Google Cloud - provide the underlying infrastructure for hosting and delivering C3 AI Software.
• Industry Partners: Baker Hughes (energy sector), Booz Allen (government, defense, and intelligence sectors) - collaborate on developing, marketing, and selling solutions.
• Consulting and Services Partners: McKinsey & Company, PwC, Fractal, Paradyme, Capgemini, Cognizant - assist with Enterprise AI implementation, consulting, and training.
• Independent Software Vendors: Partners who develop, market, and sell application solutions natively built on or tightly integrated with the C3 Agentic AI Platform.

Facility Network:

• Headquarters: Redwood City, California, comprising approximately 283,015 square feet under a lease expiring in March 2033.
• Other Offices: 16 additional offices globally, including locations in the United States (Tysons, VA; Houston, TX; New York City, NY; Atlanta, GA; Chicago, IL; Huntsville, AL; Minneapolis, MN), UK (London), Australia (Sydney), France (Paris), India (Bengaluru), Singapore, Netherlands (Amsterdam), Italy (Rome), Mexico (Guadalajara), and Germany (Munich).
• Data Centers: Utilizes third-party data center hosting facilities located in the United States, Asia, and Europe.

Operational Metrics: Not explicitly disclosed in the filing.

Market Access & Customer Relationships

Go-to-Market Strategy: C3 AI employs a highly leveraged go-to-market model combining a global field sales force with significant alliance partnerships. Distribution Channels:

• Direct Sales: A global field sales force organized geographically and by vertical market, focused on expanding within existing customers and acquiring new ones.
• Channel Partners: Strategic alliances with major technology and consulting firms, including Microsoft Azure, Amazon Web Services, Google Cloud, McKinsey & Company, Baker Hughes, Booz Allen, Fractal, Paradyme, Capgemini, PwC, and Cognizant. These partners extend market coverage and facilitate customer engagement.
• Digital Platforms: C3 AI Applications are integrated into Microsoft’s commercial marketplace incentive programs and are available in the Azure Marketplace and Google Cloud Marketplace.

Customer Portfolio: Enterprise Customers:

• Lighthouse Customers: Historically, the strategy has focused on high-value engagements with large global early adopters in industries such as financial services, manufacturing, defense, oil and gas, utilities, healthcare, and life sciences. These customers serve as proof points for broader market adoption.
• Customer Concentration: Two separate Customer-Entities accounted for 19% and 12% of total revenue for the fiscal year ended April 30, 2025. For the fiscal year ended April 30, 2024, two separate Customer-Entities accounted for 27% and 14% of total revenue. At April 30, 2025, three separate Customer-Entities accounted for 15%, 14%, and 12% of accounts receivable.
• Target Markets: Initial focus on oil and gas, federal, aerospace and defense, energy and utilities, manufacturing, and financial services. Expanded into state and local governments, agriculture, food processing and consumer packaged goods, professional services, telecommunications, and hospitals and healthcare, with a goal to move down-market to small and medium business segments.

Geographic Revenue Distribution:

• North America: 86% of total revenue (Fiscal Year 2025)
• Europe, the Middle East and Africa: 11% of total revenue (Fiscal Year 2025)
• Asia Pacific: <1% of total revenue (Fiscal Year 2025)
• Rest of World: <1% of total revenue (Fiscal Year 2025)
• Growth Markets: The international market for Enterprise AI software is large and growing, representing a significant opportunity for continued expansion.

Competitive Intelligence

Market Structure & Dynamics

Industry Characteristics: The market for C3 AI's products is intensely competitive, characterized by rapid technological change, evolving customer requirements, and frequent new platform and application introductions. The broader market for data management, machine learning, analytics, and AI platforms continues to evolve. Industry Growth: The global public cloud market was expected to approach $500 billion in 2023, IoT devices to exceed 55 billion in 2023, and the AI software market is expected to exceed $450 billion in the current year (2025), indicating explosive growth.

Competitive Positioning Matrix:

Direct Competitors

Primary Competitors:

• Internal IT organizations: Companies' own custom-developed AI platforms and applications, often integrating open-source software and cloud microservices.
• Commercial enterprise and point solution software providers: Offerings that address specific aspects of C3 AI's solutions.
• Open-source software providers: Offer data management, machine learning, and analytics solutions.
• Public cloud providers: Offer discrete tools and microservices for data management, machine learning, and analytics functionality (e.g., AWS, Microsoft Azure, Google Cloud, which are also strategic partners).
• System integrators: Companies like Accenture and Lockheed Martin that develop and provide custom software solutions.

Emerging Competitive Threats: New innovative start-up companies, larger companies making significant investments in research and development, and the introduction of disruptive technologies or entirely new platforms. The availability of open-source software can also lower barriers to entry for competitors.

Competitive Response Strategy: C3 AI's strategy includes continuous heavy investment in research and development to maintain technology leadership and introduce new products, expanding its direct enterprise sales and service organization, growing its ecosystem of strategic partners, and leveraging its consumption-based pricing model to facilitate customer adoption. The company also focuses on brand awareness, market education, and thought leadership, particularly in generative AI.

Risk Assessment Framework

Strategic & Market Risks

Market Dynamics: C3 AI faces risks from the Enterprise AI market failing to grow as expected or businesses not adopting its software. Rapid technological changes and the introduction of new platforms by competitors could impair its competitiveness. The company's sales cycles can be long and unpredictable, especially for large subscriptions, requiring significant time and expense without guaranteed sales. Macroeconomic uncertainties, including labor shortages, supply chain disruptions, inflation, and interest rate fluctuations, could reduce demand, lengthen sales cycles, and impact collections. Historically, a limited number of customers have accounted for a substantial portion of revenue, posing a risk if these customers do not renew or reduce their spend. Changes in subscription or pricing models, particularly the consumption-based model, could adversely affect operating results and revenue visibility. Technology Disruption: The introduction of new AI platforms and applications by competitors or the development of entirely new technologies could render C3 AI Software obsolete. Customer Concentration: A significant portion of C3 AI's revenue has historically come from a limited number of high-value customer contracts, making the company vulnerable to non-renewal or reduced spending from these key customers.

Operational & Execution Risks

Supply Chain Vulnerabilities: C3 AI relies on third-party public cloud providers (AWS, Microsoft Azure, Google Cloud) for hosting and delivering its software. Any interruptions or delays in these services could impair C3 AI Software and harm the business. Product Defects & Errors: The inherent complexity of C3 AI Software means it may contain material defects or errors, particularly with new introductions or integrations, which could lead to negative publicity, data security issues, and costly remediation. Talent Management: Intense competition for highly qualified personnel (executives, data scientists, engineers, sales) poses a risk to attracting and retaining talent, potentially hindering business strategy execution. Maintaining company culture amidst rapid growth is also a challenge. Growth Management: Rapid growth places significant strain on management, operational, and financial resources, requiring substantial expenditures and effective integration of a growing global employee base. Interoperability: The inability to ensure C3 AI Software interoperates seamlessly with a variety of third-party software applications, including those of partners and competitors, could reduce competitiveness. Maintenance & Support: Failure to offer high-quality maintenance and support services could harm customer relationships and business reputation. Catastrophic Events: The business is susceptible to disruptions from catastrophic events such as natural disasters, power outages, cyberattacks, political unrest, and war, which could interrupt service or lead to data loss.

Financial & Regulatory Risks

Market & Financial Risks: C3 AI is exposed to foreign currency exchange rate fluctuations, as a portion of its revenue (6% in FY2025) and expenses (7% in FY2025) are denominated in non-U.S. dollar currencies, and it does not currently maintain a hedging program. The company has a history of net losses and anticipates continued operating losses, which may necessitate additional capital that may not be available on favorable terms. Regulatory & Compliance Risks: C3 AI is subject to stringent and evolving data privacy and security laws globally, including HIPAA, CCPA, GDPR, UK GDPR, and emerging AI regulations like the EU AI Act. Non-compliance could lead to regulatory investigations, litigation, fines, and reputational harm. Cybersecurity threats, including ransomware and phishing attacks, pose risks of system compromise, data breaches, and business disruption. The company is also subject to U.S. export control and trade sanctions laws (EAR, OFAC) and anti-corruption laws (FCPA, UK Bribery Act), with non-compliance potentially leading to liability and reputational damage. Legal Proceedings: C3 AI is currently involved in a putative securities class action lawsuit and six shareholder derivative actions, alleging misstatements and breaches of fiduciary duty. Additionally, the company has filed a lawsuit against Enel Global Services S.r.l. for misappropriation of trade secrets and breach of contract, seeking €2.1 billion in damages, with Enel having counter-sued. The outcomes of these legal proceedings are uncertain and could have a material adverse effect.

Geopolitical & External Risks

Geopolitical Exposure: Expanding international operations subjects C3 AI to increased business and economic risks, including differing pricing environments, longer sales cycles, compliance with diverse legal and regulatory systems, and challenges in protecting intellectual property. Political actions, trade protection measures, and economic sanctions (e.g., related to the Russia-Ukraine conflict) could limit the ability to provide software internationally. Trade Relations: Changes in diplomatic and trade relationships, including tariffs and trade barriers, could adversely affect business opportunities. Sanctions & Export Controls: Compliance with U.S. export control and economic sanctions laws is critical, and any failure could result in significant penalties and harm to international competitiveness.

Innovation & Technology Leadership

Research & Development Focus: C3 AI's R&D efforts are centered on continually developing and refining its solutions, including adding new features, increasing functionality and speed, and enhancing usability. Core Technology Areas:

• C3 Agentic AI Platform: Focuses on an end-to-end application development and runtime environment, leveraging its patented model-driven architecture for rapid development and deployment of enterprise-grade AI applications.
• C3 AI Applications: Continuous development of a portfolio of pre-built, extensible, industry-specific and application-specific SaaS Enterprise AI applications across various sectors.
• C3 Generative AI: Significant investment in generative AI technologies, combining large language models, agentic AI, reinforcement learning, natural language processing, and the C3 Agentic AI Platform to provide high-accuracy, domain-specific insights with features like omni-modal parsing and dynamic planning agents. Innovation Pipeline: The company plans a wide range of new functions and products in the coming years, with a strong emphasis on generative AI to enhance existing offerings and create new applications.

Intellectual Property Portfolio:

• Patent Strategy: C3 AI maintains a broad patent portfolio, with 35 issued U.S. patents, 30 issued international counterpart patents, over 60 patent applications pending in the United States, and 104 patent applications pending internationally. These patents protect core technologies, including the model-driven architecture and generative AI agents. Issued patents expire between 2033 and 2043.
• Key Patented Technologies: Include AI Orchestrator, Autonomy, Multimodal Model Integration, Natural Language Summarization, and Traceability and Security, particularly for generative AI agents.
• IP Litigation: C3 AI is currently involved in a lawsuit against Enel Global Services S.r.l. for misappropriation of trade secrets and breach of contract, and Enel has counter-sued regarding patent ownership.

Technology Partnerships:

• Strategic Alliances: Collaborations with hyperscale cloud providers (Microsoft Azure, AWS, Google Cloud) for infrastructure and services.
• Research Collaborations: Established the C3.ai Digital Transformation Institute (C3.ai DTI) in February 2020 as a research consortium with academic institutions (e.g., UC Berkeley, UIUC) to advance AI for business, government, and society. This agreement expired in February 2025.

Leadership & Governance

Executive Leadership Team

Leadership Continuity: Thomas M. Siebel, the founder and CEO, is considered critical to the company's overall management, sales strategy, culture, strategic direction, engineering, and operations. Jim H. Snabe, a Board member, assumed the interim role of Special Advisor to the CEO as of February 18, 2025, due to Mr. Siebel's vision impairment, though Mr. Siebel stated his ability to manage the business was not impacted.

Board Composition: The Board of Directors includes Thomas M. Siebel, Lisa A. Davis, Richard C. Levin, Michael G. McCaffery, Alan Murray, Condoleezza Rice, Bruce Sewell, Jim H. Snabe, KR Sridhar, Stephen M. Ward, Jr., General John Hyten, Ret., and Kenneth A. Goldman. The board is classified, and directors can only be removed for cause. The Audit Committee has specific oversight responsibilities related to cybersecurity.

Human Capital Strategy

Workforce Composition:

• Total Employees: As of April 30, 2025, C3 AI had 1,181 full-time employees.
• Geographic Distribution: 933 employees are based in the United States, and 248 are in international locations.
• Skill Mix: The company emphasizes attracting and retaining exceptionally talented, highly educated, experienced, and motivated employees who are domain experts in their respective fields.

Talent Management: Acquisition & Retention: C3 AI faces intense competition for executives, data scientists, engineers, software developers, and sales personnel. The company's hiring process is highly selective. Retention strategies include compensation practices, company culture, and career development opportunities. Diversity & Development: The company provides development programs, training, and leadership development initiatives. Culture & Engagement: C3 AI has cultivated a high-performance culture based on four core values: Drive and Innovation Propelling Growth, Natural Curiosity to Solve the Impossible, Professional Integrity Governing All Endeavors, and Collective Intelligence. The company has received awards such as Glassdoor Best Place to Work.

Environmental & Social Impact

Environmental Commitments: Climate Strategy: Not explicitly detailed in terms of specific emissions targets, carbon neutrality commitments, or renewable energy sourcing strategies. Supply Chain Sustainability: Not explicitly detailed in the filing.

Social Impact Initiatives:

• Community Investment: The C3.ai Digital Transformation Institute (C3.ai DTI), a research consortium established in February 2020, was dedicated to accelerating the benefits of AI for business, government, and society. The agreement for this initiative expired in February 2025.
• Product Impact: The C3 AI Sustainability Suite helps customers decrease greenhouse gas emissions, meet ESG expectations, and reduce energy costs. C3 Generative AI for Government Programs aims to improve the efficiency and effectiveness of public benefits programs for constituents and government agencies.

Business Cyclicality & Seasonality

Demand Patterns:

• Seasonal Trends: The company notes that seasonal purchasing or consumption patterns of its customers can cause fluctuations in its annual and quarterly results.
• Economic Sensitivity: C3 AI's business and financial condition are impacted by adverse macroeconomic conditions, including labor shortages, supply chain disruptions, inflation, interest rate fluctuations, and recession risks, which can lead to reduced demand and lengthened sales cycles.
• Industry Cycles: Not explicitly detailed in the filing.

Planning & Forecasting: The company acknowledges difficulty in predicting customer adoption rates and demand for its C3 AI Software. Sales cycles can be long and unpredictable, particularly for large subscriptions, making the timing of sales difficult to forecast.

Regulatory Environment & Compliance

Regulatory Framework: Industry-Specific Regulations: C3 AI's business activities are subject to various federal, state, local, and foreign laws, rules, and regulations. This includes compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) for health information. International Compliance: The company is subject to data privacy and security laws such as Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Japan’s Act on the Protection of Personal Information, Singapore’s Personal Data Protection Act, the European General Data Protection Regulation (GDPR), and the UK data protection regime (UK GDPR). The EU AI Act, which entered into force in August 2024 and becomes fully applicable in August 2026, could impose significant restrictions and obligations if C3 AI or its customers are classified as developing or using "high-risk" AI systems. Trade & Export Controls: C3 AI is subject to U.S. export control and trade and economic sanctions laws and regulations, including the U.S. Department of Commerce’s Export Administration Regulations (EAR) and regulations administered by the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC). Legal Proceedings: C3 AI is currently involved in a putative securities class action lawsuit and six shareholder derivative actions, alleging violations of federal securities laws and breaches of fiduciary duty. Additionally, the company has filed a lawsuit in Italy against Enel Global Services S.r.l. for misappropriation of trade secrets and breach of contract, seeking €2.1 billion in damages, with Enel having initiated counter-lawsuits regarding patent ownership.

Tax Strategy & Considerations

Tax Profile:

• Effective Tax Rate: The effective tax rate differs from the U.S. federal statutory rate primarily due to a full valuation allowance on the company’s U.S. deferred tax assets.
• Geographic Tax Planning: C3 AI is subject to income taxes in the United States and various international jurisdictions.
• Tax Reform Impact: The company's ability to utilize net operating losses (NOLs) is subject to limitations under the Tax Cuts and Jobs Act of 2017 (Tax Act) and the CARES Act, with federal NOL deductibility limited to 80% of taxable income after December 31, 2020. State-level NOL utilization has also been temporarily suspended or limited in certain periods (e.g., California for 2020-2022 and 2024-2026).
• Net Operating Losses: As of April 30, 2025, C3 AI had federal NOL carryforwards of approximately $764.7 million (expiring beginning 2029) and state NOL carryforwards of approximately $310.7 million (expiring beginning 2029).
• Tax Credits: Federal research and development tax credit carryforwards of approximately $25.9 million (expiring beginning 2026) and state research and development tax credit carryforwards of approximately $18.9 million (do not expire).
• Valuation Allowance: A full valuation allowance of $320.9 million was established on U.S. deferred tax assets as of April 30, 2025, due to cumulative losses and expected future losses.
• Unrecognized Tax Benefits: As of April 30, 2025, total gross unrecognized tax benefits were $22.6 million.

Insurance & Risk Transfer

Risk Management Framework: C3 AI has a comprehensive cybersecurity risk management program designed to identify, assess, and mitigate cybersecurity risks. This program includes regular vulnerability scanning, penetration testing by independent security professionals, threat intelligence monitoring, and a risk assessment framework that incorporates third-party vendor risk assessment. Security controls include network security (firewalls, IDS/IPS, DLP), endpoint security (antivirus, anti-malware, MDM), access controls (least privilege), and data security (encryption). The company also provides regular security awareness and training for employees. Insurance Coverage: The company's insurance policies may not adequately compensate for all losses from natural disasters or security incidents, and coverage for errors and omissions may not always be available on acceptable terms or deny coverage. Risk Transfer Mechanisms: C3 AI's agreements with customers and other third parties generally include indemnification provisions for intellectual property infringement and other liabilities, though contractual limitations on liability may not be fully enforceable in all situations. Governance: Management is responsible for the overall implementation and effectiveness of the cybersecurity program, with the VP of Information Security leading the cybersecurity team and reporting to the VP of Cloud Infrastructure. The Audit Committee of the Board of Directors provides specific oversight for cybersecurity, including reviewing security controls and incident response plans. C3 AI holds certifications under ISO 27001, ISO 27017, SOC 2 Type II, HIPAA, NIST 800-171, and FedRamp.