Snowflake Inc.

01. Findings

Snowflake maintains a comprehensive security and compliance program, holding SOC 1 and SOC 2 Type 2 certifications, and adhering to NIST 800-53 standards ^[4]. The vendor operates a Trust Center for monitoring security configurations and offers AI-guided remediation for violations through Cortex Code ^[9]. In 2024, a large-scale credential theft campaign compromised numerous customer accounts lacking multi-factor authentication, though Snowflake's underlying infrastructure was not breached ^[5]. The company partners with Mandiant and CrowdStrike for incident response and runs a private vulnerability disclosure program via HackerOne ^[8].

02. Events

• [legal] Data Security Breach Class Action Settlement

  A class action lawsuit regarding the 2024 credential theft campaign reached a preliminary settlement approval in May 2025, administered pending final court approval.

  May 22, 2025, 12:00 AM · Source

• [breach] Snowflake Customer Credential Theft Campaign

  In mid-2024, threat actors used stolen credentials to access over 160 customer environments lacking multi-factor authentication. Snowflake's infrastructure was not compromised, but significant customer data was exfiltrated.

  May 30, 2024, 12:00 AM · Source

03. AI Risk

How this vendor uses AI/ML with customer data - model providers, training stance, subprocessors, and relevant DPA language when publicly documented.

AI exposure tier: Moderate AI Exposure

Snowflake has transitioned to an AI-first product strategy, integrating artificial intelligence capabilities directly into its Data Cloud platform. The vendor provides Cortex Code to deliver AI-guided remediation for security violations identified in the Trust Center. While the platform supports customer AI workloads and machine learning pipelines, public disclosures regarding specific third-party large language model providers, customer data training practices, or opt-out mechanisms remain limited. The vendor emphasizes secure AI workload management and posture management through its centralized Trust Center and compliance frameworks.

Training on customer data

Training stance unknown

04. Company

Snowflake Inc. is a publicly traded cloud data platform company founded in 2012 and headquartered in Menlo Park, California ^[1]. The company trades on the NYSE under the ticker SNOW and reported revenues of approximately $4.68 billion in 2026 ^[1]. It employs roughly 9,060 people and operates a Data Cloud strategy that enables organizations to consolidate, secure, and analyze data across multiple cloud environments ^[1]. The executive team is led by CEO Sridhar Ramaswamy, who took over in February 2024, and Chairman Frank Slootman ^[2]. Brian Robins joined as Chief Financial Officer in September 2025 ^[3].

05. Product

Snowflake offers a cloud-native data platform that functions as a data warehouse, data lake, and data sharing service ^[1]. It supports SQL, Python, and Snowpark for data manipulation and analytics ^[1]. The platform is fully managed and runs on Amazon Web Services, Microsoft Azure, and Google Cloud Platform ^[1]. It provides features for data engineering, analytics, AI workloads, and secure data exchange ^[1]. Competitors in the cloud data warehouse space include Databricks, Google BigQuery, Amazon Redshift, and Microsoft Azure Synapse Analytics ^[10].

06. Recent News

In mid-2024, Snowflake disclosed a widespread attack campaign where threat actors used stolen credentials to access customer environments that lacked multi-factor authentication ^[5]. The incident impacted over 160 organizations, including major retailers and financial institutions, and resulted in significant data theft ^[11]. Investigations by Mandiant and CrowdStrike confirmed the vendor's infrastructure was not compromised ^[6]. The campaign led to federal indictments of the attackers and a class action lawsuit, which reached a preliminary settlement approval in May 2025 ^[7]. The vendor has since emphasized multi-factor authentication enforcement and enhanced security monitoring tools ^[11].

07. Dependencies

Fourth parties this vendor relies on - subprocessors, infrastructure, and integrations surfaced from public sources.

• Amazon Web Services

  aws.amazon.com

  InfrastructureSource →

• Microsoft Azure

  azure.microsoft.com

  InfrastructureSource →

• Google Cloud Platform

  cloud.google.com

  InfrastructureSource →

08. Competitors

Vendors offering a similar product or service - for side-by-side comparison, not a ranking.

• Databricks

  databricks.com

  Lakehouse platform with strong ML and data science support

  Vet this vendor →

10. Vendor response

Content in this section is vendor-supplied and does not alter Vendorisk.ai's risk tier or evaluation.

11. Assessment history

1. 8/19/2026, 1:27:34 PM · Elevated · 75

Risk delta is hidden until two stored snapshots can be compared.

12. Targeted questions

13. Sources

1. [1] Snowflake Inc. is a publicly traded cloud data platform company founded in 2012 and headquartered in Menlo Park, California. Snowflake Inc. - Wikipedia
2. [2] The executive team is led by CEO Sridhar Ramaswamy, who took over in February 2024, and Chairman Frank Slootman. A brief history of Snowflake | Bigeye
3. [3] Brian Robins joined as Chief Financial Officer in September 2025. Snowflake Appoints Brian Robins as Chief Financial Officer
4. [4] Snowflake maintains a comprehensive security and compliance program, holding SOC 1 and SOC 2 Type 2 certifications, and adhering to NIST 800-53 standards. Trust Center - Snowflake Inc
5. [5] In mid-2024, a large-scale credential theft campaign compromised numerous customer accounts lacking multi-factor authentication, though Snowflake's underlying infrastructure was not breached. Snowflake data breach
6. [6] Investigations by Mandiant and CrowdStrike confirmed the vendor's infrastructure was not compromised. Snowflake Data Breach: What Happened, Impact, and ...
7. [7] The campaign led to federal indictments of the attackers and a class action lawsuit, which reached a preliminary settlement approval in May 2025.