Risks Related to Our Technology and Intellectual Property
Real or perceived errors, failures or bugs in our software could adversely affect our business, results of operations, financial condition and growth prospects.
Our software is complex, and therefore, undetected errors, failures or bugs have occurred in the past and may occur in the future. Our software is used in IT environments with different operating systems, system management software, applications, devices, databases, servers, storage, middleware, custom and third-party applications and equipment and networking configurations, which may cause errors or failures in the IT environment into which our software is deployed. This diversity increases the likelihood of errors or failures in those IT environments. Despite testing by us, real or perceived errors, failures or bugs may not be found until our customers use our software. Real or perceived errors, failures or bugs in our products could result in negative publicity, loss of or delay in market acceptance of our software and harm our brand, weakening of our competitive position, claims by customers for losses sustained by them or failure to meet the stated service-level commitments in our customer agreements. In such an event, we may be required, or may choose, for customer relations or other reasons, to expend significant additional resources in order to help correct the problem. Any errors, failures or bugs in our software could impair our ability to attract new customers, retain existing customers or expand their use of our software, which would adversely affect our business, results of operations and financial condition.
If our security measures, or those of our service providers or customers, are breached or unauthorized parties otherwise obtain access to our or our customers’ data or software, our products and services may be perceived as not being secure, customers may reduce or terminate their use of our products and services and we may face claims, litigation, regulatory investigations, significant liability and reputational damage.
We collect, use, store, transmit and process data as part of our business operations, including personal data for our customers in and across multiple jurisdictions. We also use third-party service providers to collect, use, store, transmit, maintain and otherwise process such information. Increasingly, a variety of cyber threats have become more prevalent in our industry and our customers’ industries. With our employees and many employees of third-party service providers working remotely due to, among other things, the COVID-19 pandemic, these threats have grown. Security incidents could result in unauthorized access to, damage to, misuse of, disclosure of, modification of, destruction of or loss of our data or customer data (including personal data), software or systems, or disrupt our ability to provide our products and services. Any actual or perceived security incident could interrupt our operations, harm our reputation and brand, result in significant remediation and cybersecurity protection costs, result in lost revenue, lead to regulatory investigations and orders, litigation, disputes, indemnity obligations, damages for breach of contract, penalties for violation of applicable laws and regulations and other legal risks, increase our insurance premiums, and result in any other financial exposure.
We have taken steps to protect the data on our systems and IT infrastructure, but no security measures can protect against all anticipated risks with certainty, and our security measures or those of our customers or third-party service providers could be breached as a result of third-party action, employee or user errors, technological limitations, defects or vulnerabilities in our systems or offerings or those of our third-party service providers, malfeasance, fraud, computer malware, viruses, cyber incidents, or from accidental technological failure or otherwise. We have experienced and may continue to experience security incidents and attacks of varying degrees from time to time.
We may need to enhance the security of our products and services, our data, our systems and our internal IT infrastructure, which may require additional resources and substantial costs and may not be successful. We have developed systems and processes to protect the integrity, confidentiality, availability and security of our data and software, but our security measures or those of our customers or third-party service providers may not mitigate against current or future security threats and could result in unauthorized access to, damage to, disablement or encryption of, use or misuse of, disclosure of, modification of, destruction of or loss of such data and software. Through contractual provisions and third-party risk management processes, we take steps to require that our third-party providers and their subcontractors protect our data, but because we do not control our third-party service providers and our ability to monitor their data security is limited, we cannot ensure the security measures they take will be sufficient to protect our data. A vulnerability in a third-party provider’s or a customer’s software or systems, a failure of our customers’ or third-party providers’ safeguards, policies or procedures or a breach of a customer’s or third-party provider’s software or systems could result in the compromise of the confidentiality, integrity or availability of our systems or the data housed in our third-party solutions. Further, because there are many different security breach techniques, which can originate from a wide variety of sources, including outside groups (such as external service providers, organized crime affiliates, terrorist organizations, or hostile foreign governments or agencies), and such techniques continue to evolve and are generally not detected until after an incident has occurred, we may be unable to implement adequate preventative measures, anticipate or prevent attempted security breaches or other security incidents or