otherwise process proprietary, confidential, and sensitive data, including intellectual property, trade secrets, proprietary technology and information about our business customers, suppliers and partners, and proprietary technology and information owned by our customers (collectively, sensitive information). We rely upon third party service providers and technologies to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, third party providers of cloud-based infrastructure, encryption and authentication technology, employee email, content delivery to customers, and other functions. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place.
Any of the previously identified or similar threats could cause a cybersecurity incident or other interruption, which could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or our information systems, or those of the third parties with whom we work. Further, a cybersecurity incident or other interruption could disrupt our ability (and that of third parties with whom we work) to provide our solutions.
We, and the third parties with whom we work, are subject to a variety of evolving cybersecurity-related threats. While we have implemented various controls and defenses designed to prevent cybersecurity incidents, cybersecurity attacks and threats have continued to become more prevalent and sophisticated. These threats are constantly evolving, making it increasingly difficult to successfully defend against or implement adequate preventive measures. Geopolitical tensions or conflicts have in the past led to, and may in the future lead to, increased risk of cybersecurity attacks. Notwithstanding defensive measures, experienced programmers, hackers, state actors, or others may be able to penetrate our security controls, or those of our vendors, suppliers, or customers, through attacks such as, but not limited to, social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, access attacks, credential stuffing, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, floods, attacks enhanced or facilitated by AI, and other similar threats.
Ransomware attacks, including those launched by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, ability to provide our solutions, loss of sensitive data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Similarly, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain or our third party partners’ supply chains have not been compromised or that they do not contain exploitable flaws or bugs that could result in a breach of or disruption to our information technology systems (including our solutions or the third party information technology systems that support us and our solutions). We are incorporated into the supply chain of a large number of companies worldwide and, as a result, if our products are compromised, a significant number of such companies and their data could be simultaneously affected. The potential liability and associated consequences we could suffer as a result of such a large-scale event could be catastrophic and result in irreparable harm. The growth of our remote workforce, and the increase in remote working arrangement by our vendors and other third parties, poses increased risks to our information technology systems and data privacy, as more of our employees, and those of our vendors and other third parties, utilize network connections, computers and devices outside our premises or network, including working at home, while in transit and in public locations.
Future or past business transactions (such as acquisitions or integrations) could also expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. Furthermore, we may discover cybersecurity issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and cybersecurity program.
22