Cyberthreats are constantly evolving and becoming increasingly sophisticated and complex, making it increasingly difficult to detect and successfully defend against them. In addition, cyber-attackers (which may include individuals or groups, as well as sophisticated groups such as nation-state and state-sponsored attackers, which can deploy significant resources to plan and carry out exploits) also develop and deploy viruses, worms, credential stuffing attack tools and other malicious software programs, some of which may be specifically designed to attack our products, information systems or networks. Outside parties have in the past and may in the future attempt to fraudulently induce our employees or users of our products or services to disclose sensitive, personal or confidential information via illegal electronic spamming, phishing or other tactics.
While we have implemented security measures and employee training designed to protect against breaches of security and other interference with our systems and networks, our systems and networks may be, and at times are, subject to breaches or interference. Any such event may result in operational disruptions as well as unauthorized access to or the disclosure or loss of our proprietary information or our customers’ data and information, which in turn may result in legal claims, regulatory scrutiny and liability, reputational damage, the incurrence of costs to eliminate or mitigate further exposure, the loss of customers or affiliated advisors, reputational harm or other damage to our business. While we maintain insurance coverage that may, subject to policy terms and conditions, cover certain aspects of cyber risks, such insurance coverage may be insufficient to cover all losses.
In addition, the trend toward general public notification of such incidents could exacerbate the harm to our business, financial condition and results of operations. Even if we successfully protect our technology infrastructure and the confidentiality of sensitive data, we could suffer harm to our business and reputation if attempted security breaches are publicized. We cannot be certain that advances in criminal capabilities, discovery of new vulnerabilities, attempts to exploit vulnerabilities in our systems, data thefts, physical system or network break-ins or inappropriate access, or other developments will not compromise or breach the technology or other security measures protecting the networks and systems used in connection with our business.
Any cloud provider service failure or control weakness could adversely affect our business.
We employ cloud-based services to host our applications and intend to expand our use. As we expand our use of cloud-based services, we will increasingly rely on third-party cloud providers to maintain appropriate controls and safeguards to protect confidential information we receive, including personal, personally identifiable, sensitive, confidential or proprietary data, and the integrity and continuous operation of our proprietary technology platform. While we conduct due diligence on these cloud providers with respect to their security and business controls, we may not have the visibility to effectively monitor the implementation and efficacy of these controls. Outside parties may be able to circumvent controls or exploit vulnerabilities, resulting in operational disruption, data loss, defects or a security event. Migrating to the cloud increases the risk of operational disruption should internet service be interrupted. While we have implemented business contingency and other plans to facilitate continuous internet access, sustained or concurrent service denials or similar failures could limit our ability to write and process new and renewal business, provide customer service, pay claims in a timely manner or otherwise operate our business. Any such event or failure could have a material adverse effect on our business, financial condition and results of operations.
Risks Related to Laws and Regulations
We are subject to extensive regulation, which may adversely affect our ability to achieve our business objectives. In addition, if we fail to comply with these regulations, we may be subject to penalties, including fines and suspensions, which may adversely affect our financial condition and results of operations.
PSIC is subject to extensive regulation in Oregon, its state of domicile, California, where it is commercially domiciled, and to a lesser degree, the other states in which it operates. PESIC is subject to extensive regulation in Arizona, its state of domicile, and to a lesser degree, the other states in which it writes business. Our Bermuda based reinsurance subsidiary, Palomar Specialty Reinsurance Company Bermuda Ltd. (“PSRE”), is subject to regulation in Bermuda.