QTWO · CIK 1410384
What Q2 Holdings, Inc. told the SEC could break it.
Q2 Holdings' disclosures trace back to its position as a SaaS provider to banks. Substantially all of its revenue comes from a single industry — financial services, especially regional and community financial institutions plus FinTechs — so a banking-sector downturn, consolidation or customer distress would broadly hit its business. That role also makes it a high-value cyber target: its platform processed over $4 trillion in transactions in 2025, security incidents have already occurred, and it depends on third-party public cloud and internet providers whose disruptions have hurt it before and could again, since the platform cannot run without them.
3 self-disclosed vulnerabilities, pulled from its own filings, each in the company’s words, with the source. This is the risk register almost nobody reads.
In its own words
What could break it.
Other disclosures
- Financial-services / RCFI industry concentrationmedium
Substantially all of Q2's revenue comes from a single industry — financial services, especially regional and community financial institutions (RCFIs) plus FinTechs and Alt-FIs — so a banking-sector downturn, FI consolidation or distress among those customers would broadly hit its revenue.
“We derive substantially all of our revenues from customers in the financial services industry, and in particular RCFIs, and any econom”
SEC filing →As of 2026 - Third-party public-cloud infrastructure dependencemedium
Q2 runs its digital banking platform on third-party public cloud and internet service providers; disruptions to those services or internet access have adversely affected its business in the past and could again, since the platform cannot operate without them.
“We depend on third-party public cloud service providers and third-party Internet service providers, and any disruption in the operation of these services or access to the Internet have in the past and could in the future adversely affect our business.”
SEC filing →As of 2026
Cybersecurity
- Cyber-attack exposure on bank-facing SaaS platformmedium
As a SaaS provider whose digital banking platform processed over $4 trillion in financial transactions in 2025 for banks and credit unions, Q2 is a high-value cyberattack and cyber-fraud target; security incidents have occurred and could materially harm its business and its customers.
“As a provider of SaaS solutions and an extensive user of a variety of technology services, we are subject to numerous risks from cybersecurity threats”
SEC filing →As of 2026
In the MyPRIA app, this is checked against the companies you actually own.
← World Watch