Cybersecurity (products and services)

“The impact of our cyber risk remains high, driven by higher levels of technology availability and end-to-end supply chain security as we complete our technology transformation. In addition, the rapid global adoption of AI enables greater sophistication and scale of cyber attacks.”

Annual report 2025A · The company itself

“Direct or indirect attacks on Maersk or its partners’ networks, enabled by broader digital interfaces, evolving threat sophistication and vulnerabilities in critical environments, could cause severe disruption, financial loss and reputational damage.”

Annual report 2025A · The company itself

“Maersk continues to execute its cyber security strategy, strengthen AI governance, test business continuity plans and enhance its cyber threat resilience. Maersk also continues to enhance capabilities to control impact through appropriate preparedness and response procedures.”

Annual report 2025A · The company itself

“AbbVie relies on sophisticated software applications and complex information technology systems (including cloud services) to operate its business, which are inherently vulnerable to malicious intrusion, random attack, loss of data privacy, disruption, degradation or breakdown. Certain of these applications and systems are managed, hosted, provided or used by third parties. Data privacy or security breaches of our internal systems or those of our information technology vendors may in the future result in the failure of critical business operations.”

Annual report 2025A · The company itself

“The healthcare and biopharmaceutical industries remain targets of cybersecurity threats due to the value and sensitivity of the data they hold. Cybersecurity attacks and incidents are increasing in their frequency, sophistication and intensity and, due to the nature of some of these attacks, there is a risk that they may remain undetected for a period of time.”

Annual report 2025A · The company itself

“We face legal, reputational and financial risks from any failure to protect client and/or Accenture data from security incidents or cyberattacks. We are dependent on information technology networks and systems to securely process, transmit and store electronic information and to communicate among our locations around the world and with our people, clients, ecosystem partners and vendors. As the breadth and complexity of this infrastructure continues to grow, including as a result of the increasing reliance on, and use of, mobile technologies, social media and cloud-based services, as more of our employees continue to work remotely, and as cyberattacks become increasingly sophisticated (e.g. deepfakes and AI generated social engineering), the risk of security incidents and cyberattacks has increased.”

Annual report 2025A · The company itself

“Threat actors are leveraging AI technologies to develop new hacking tools and attack vectors, exploit vulnerabilities, obscure their activities, and increase the difficulty of threat attribution.”

Annual report 2025A · The company itself

“In providing solutions and services to clients, we often manage, utilize and store sensitive or confidential client, Accenture or other third-party data, including customer and other personal data and proprietary information, and we expect these activities to increase. Unauthorized disclosure or use of, denial of access to, or other incidents involving sensitive or confidential client, vendor, ecosystem partner or Accenture data, whether through systems failure, employee negligence, fraud, misappropriation, or cybersecurity, ransomware or malware attacks, or other intentional or unintentional acts, could damage our reputation and our competitive positioning in the marketplace, disrupt our or our clients’ business, cause us to lose clients and result in significant financial exposure and legal liability.”

Annual report 2025A · The company itself

“We believe the Accenture brand name and our reputation are important corporate assets that help distinguish our solutions and services from those of competitors and also contribute to our efforts to recruit and retain talented employees. However, our corporate reputation is susceptible to material damage by events such as disputes with clients or competitors, cybersecurity incidents or service outages, internal control deficiencies, delivery or solution failures, compliance violations, government investigations or legal proceedings.”

Annual report 2025A · The company itself

“The size and scope of our operations increase the possibility that we will have employees who engage in unlawful or fraudulent activity, or otherwise expose us to unacceptable business risks, despite our efforts to train them and maintain internal controls to prevent such instances. For example, employee misconduct could involve the improper use of sensitive or confidential information entrusted to us, or obtained inappropriately, or the failure to comply with legislation or regulations regarding the protection of sensitive or confidential information, including personal data and proprietary information. Furthermore, the inappropriate use of social networking sites and unapproved technologies, such as public-facing, free AI tools, by our employees could result in breaches of confidentiality, unauthorized disclosure of non-public company information or damage to our reputation.”

Annual report 2025A · The company itself

“For example, by taking over the operation of certain portions of our clients’ businesses, including functions and systems that are critical to the core businesses of our clients, by contributing to the design, development, manufacturing and/or engineering of client products, or by providing various operational technology, digital manufacturing and robotics or other industrial automation equipment solutions, and advisory, management and engineering services for infrastructure projects, we may be exposed to additional and evolving operational, regulatory, reputational or other risks specific to these areas, including risks related to data security, product liability, health and safety, hazardous materials and other environmental risks.”

Annual report 2025A · The company itself

“Our solutions collect, store, manage and otherwise process third-party data, including our customers’ data and our own data.”

Annual report 2025A · The company itself

“Our solutions are incorporated into the supply chain of a large number of companies worldwide and, as a result, if our solutions experience a compromise, a large portion or, in some instances, all of our customers and their data for a given solution could be simultaneously affected.”

Annual report 2025A · The company itself

“Maintaining the security of our solutions is a critical issue for us and our customers. We devote significant resources to address security vulnerabilities through various methods, including, but not limited to, engineering more secure products, enhancing security and reliability features in our products and systems, regularly reviewing our service providers’ security controls, and continually assessing and improving, as appropriate, our incident response process. However, it is impossible to accurately predict the extent, frequency or impact cybersecurity issues may have on us, and our security measures do not provide full effective protection from all such events.”

Annual report 2025A · The company itself

“The costs to prevent, eliminate, mitigate or remediate cybersecurity or other security problems and vulnerabilities are significant and may reduce our margins.”

Annual report 2025A · The company itself

“Moreover, delayed sales, lower margins or lost customers resulting from disruptions caused by cyberattacks, data breaches, overly burdensome preventive security measures or failure to fully meet information security control certification requirements could materially and adversely affect our financial results, stock price and reputation.”

Annual report 2025A · The company itself

“For instance, we actively combat software piracy, but we continue to lose revenue due to illegal use of our software. Third parties may illegally copy and sell counterfeit versions of our products.”

Annual report 2025A · The company itself

“Moreover, due to challenges in detecting patent infringement pertaining to generative AI technologies, it may be more difficult to protect our generative AI and related innovations with patents. Additionally, if we use generative AI in the creation of our source code or other materials or inventions, we may not be able to rely on copyrights or patents to protect such intellectual property.”

Annual report 2025A · The company itself

“As AI continues to change content creation, our customers, particularly creators and enterprises, increasingly require responsible, secure and human-centered AI solutions. In developing our Firefly foundation models, we responsibly harness our unique data assets and help our customers amplify the value of their first-party data.”

Annual report 2025A · The company itself

“Cyber-attacks and data security breaches could harm our business. Our business relies on electronic systems and network technologies to operate our generation, transmission and distribution infrastructure.”

Annual report 2025A · The company itself

“The NYSDFS Cybersecurity Requirements for Financial Services Companies applies to Aflac New York. This regulation requires, among other things, risk assessments, administrative and technical controls, incident reporting procedures, business continuity plans, and certain cybersecurity governance, such as the designation of a Chief Information Security Officer and senior governing body oversight.”

Annual report 2025A · The company itself

“The Company will continue to incur expenses related to, among other things, investments in digital capabilities and product innovation including the development and use of artificial intelligence (AI). The Company’s development of new technology, including the use of AI by the Company and third-party vendors, could lead to an increased risk of a business interruption or a cybersecurity breach.”

Annual report 2025A · The company itself

“The Company stores confidential policyholder, employee, agent, broker, and other proprietary information on its information technology systems. The Company also depends heavily on its telecommunication, information technology and other operational systems and on the integrity and timeliness of data it uses to run its businesses and service its customers. The Company’s information technology and other systems, as well as those of third-party providers and participants in the Company’s distribution channels, have been and will likely continue to be subject to physical or electronic break-ins, unauthorized tampering, security breaches, social engineering, phishing, web application attacks, computer viruses or other malicious codes, or other cyber-related attacks, that may result in the failure to adequately maintain the security, confidentiality, integrity, or privacy of sensitive data, including personal information relating to customers and prospective customers, or in the misappropriation of the Company's intellectual property or proprietary information.”

Annual report 2025A · The company itself

“The rapid evolution and increased adoption of artificial intelligence technologies may also heighten the Company's cybersecurity risks by making cyber-attacks more difficult to detect, contain, and mitigate.”

Annual report 2025A · The company itself

“As a result, events such as these, including the June 2025 cyber incident where the Company became aware of the exfiltration of certain personal information relating to a substantial number of customers, beneficiaries, employees, agents, and other individuals in the Company’s U.S. business, could adversely affect the Company's financial condition or results of operations due to incurred costs and remediation.”

Annual report 2025A · The company itself

“We have adopted a Live and Work Anywhere policy. The increase in remote working subjects us to certain operational challenges and could have adverse tax implications, which could materially adversely affect our business, results of operations, and financial condition. Table of Contents In 2022, we adopted our Live and Work Anywhere policy, which permits the majority of our employees to work remotely. Remote working subjects us to operational challenges and risks.”

Annual report 2025A · The company itself

“Technology, Data and Cybersecurity Risks Technology, Data Privacy and Cybersecurity Compliance with federal, state, and foreign laws relating to data privacy, data security, marketing, and consumer protection involves significant expenditure and resources, and any actual or perceived failure by us or our vendors to comply may result in significant liability, litigation or other legal action against us, negative publicity, an erosion of trust, and/or result in regulatory scrutiny, fines, and penalties and could materially adversely affect our business, results of operations, and financial condition. There are numerous federal, state, and foreign data privacy, data security, marketing, and consumer protection laws, rules, and regulations that relate to the collection, maintenance, disclosure, and processing of personal data, data breach notification laws, electronic communications laws, and marketing and consumer protection laws, rules, and regulations.”

Annual report 2025A · The company itself

“Specifically, cross-border transfers outside of the EEA and the United Kingdom, including those to the United States and other jurisdictions, will likely continue to face enhanced scrutiny from regulators. Consequently, we cannot guarantee the ongoing effectiveness of our current data transfer mechanisms. It is also possible that transfers of personal data outside the United States could be restricted or impacted by developments at the federal level.”

Annual report 2025A · The company itself

“For example, the California Consumer Privacy Act (“CCPA”) provides enhanced data privacy rights to California residents, allows for statutory damages, and provides a private right of action for certain data breaches, increasing the risk of litigation.”

Annual report 2025A · The company itself

“Such verification procedures may include utilizing public information on the Internet, accessing public databases such as court records, utilizing third-party vendors to analyze host or guest data, or physical inspection. These types of activities expose us to requirements of other laws and regulations, and to the risk of regulatory engagement and/or enforcement from privacy regulators, consumer protection agencies, consumer credit reporting agencies, and civil litigation.”

Annual report 2025A · The company itself

“In addition, any failure or perceived failure to comply with consumer protection, marketing, data privacy, breach notification, or data security laws, rules, and regulations; policies; industry standards; or enforcement notices and/or assessment notices (for a compulsory audit) could lead to legal actions by individuals, consumer rights groups, government agencies, or others. We may also face civil claims including representative actions and other class action type litigation (where individuals have suffered harm), potentially amounting to significant compensation, injunctive relief, or damages liabilities, as well as associated costs, and diversion of internal resources or other regulatory orders adversely impacting the ways our business can use personal data.”

Annual report 2025A · The company itself

“While these initiatives are crucial for community trust, they can increase platform friction, potentially reducing host and guest activity and materially adversely affecting our business. These trust and safety efforts, including limited verification of hosts and listings and restrictions on certain types of bookings, our neighborhood support hotline, or other initiatives, cause us to incur significant costs and may lead to fewer listings and bookings.”

Annual report 2025A · The company itself

“Despite our investments, we cannot guarantee these measures will be successful, significantly reduce criminal or fraudulent activity on or off our platform, host or guest violations of policies, or be sufficient to protect our reputation in the event of such activity.”

Annual report 2025A · The company itself

“Despite measures to detect and reduce fraud, these efforts require continuous improvement to address evolving threats, especially with new payment methods and technology platforms.”

Annual report 2025A · The company itself

“Our payments platform is vulnerable to illegal uses, such as money laundering and fraudulent listings, which can lead to legal claims, regulatory investigations, and reputational harm. While we strive to combat these activities, our measures may not always be effective, and failure to reduce fraud could result in fines, higher fees, or loss of payment card network access, which could materially adversely affect our business, results of operations, and financial condition.”

Annual report 2025A · The company itself

“If we or our third-party providers fail to protect confidential information and/or experience material security incidents, there may be damage to our brand and reputation, material financial penalties, and legal liability, along with a decline in use of our platform, which would materially adversely affect our business, results of operations, and financial condition.”

Annual report 2025A · The company itself

“We face evolving cybersecurity risks that could impact the confidentiality, integrity, and availability of our and our third-party providers’ IT Systems and confidential information, including personal data and proprietary information if exposed. As we expand our technology use, enhance our AI and ML capabilities, and collaborate with third parties, managing these threats becomes more challenging.”

Annual report 2025A · The company itself

“These risks come from diverse threat actors, such as state-sponsored organizations, opportunistic hackers and hacktivists, as well as through diverse attack vectors, such as social engineering/phishing, malware (including ransomware), malfeasance by company insiders, suppliers or providers, and human or technological error, and as a result of malicious code embedded in open source software, or misconfigurations, bugs, or other vulnerabilities in software and hardware that is integrated into our or our providers’ IT Systems, products, or services.”

Annual report 2025A · The company itself

“We and a subset of our third-party service providers have experienced cyberattacks and other security incidents in the past, including distributed denial-of-service type attacks on our IT Systems that have made portions of our platform slow or unavailable for periods of time. Cyberattacks are expected to accelerate on a global basis in both frequency and magnitude as threat actors are becoming increasingly sophisticated in using techniques—including AI—that circumvent controls, evade detection, and remove forensic evidence, which means that we and our third-party providers may be unable to detect, investigate, contain or recover from future attacks or incidents in a timely or effective manner.”

Annual report 2025A · The company itself

“Despite significant investments in security, we cannot fully mitigate these risks, and such security incidents could disrupt operations and lead to negative publicity, reputational damage, loss of users, increased support costs, regulatory fines, legal claims 26 Table of Contents (including class actions), and significant financial losses, especially under laws which impose statutory damages per breached record, all of which could materially impact our business, results of operations, and financial condition.”

Annual report 2025A · The company itself

“Some of our third-party providers, including our cloud computing providers and our payment processing partners, have been and may be subject to further intrusions, computer viruses, malicious software (such as ransomware), denial-of-service attacks, phishing attacks, sabotage, acts of vandalism, terrorism, or other misconduct, and incidents due to inadvertent error or malfeasance by employees, contractors, or other parties. There can be no assurance that our service providers will anticipate or prevent all types of attacks or that any security measures will be effective against all types of cybersecurity threats and risks.”

Annual report 2025A · The company itself

“Together, these existing and proposed laws add additional complexity, variation in requirements, restrictions, and potential legal risk, and require additional investment in resources to compliance programs and cybersecurity, which could impact strategies, and could result in increased compliance costs and/or changes in business practices and policies.”

Annual report 2025A · The company itself

“Measures that we are taking to improve the trust and safety of our platform may cause us to incur significant expenditures and may not be successful. We have taken and continue to take measures to help improve the trust and safety on our platform, combat fraudulent activities and other misconduct, and help improve community trust, such as requiring identity and other information from hosts and guests, attempting to confirm the location of listings, removing suspected fraudulent listings or listings repeatedly reported by guests to be significantly not as described, and removing hosts and guests who fail to comply with our policies.”

Annual report 2025A · The company itself

“Our ability to generate security revenue depends on our ability to increase our industry recognition as a provider of security solutions, navigate a highly competitive market, develop or acquire new solutions in a rapidly-changing environment where security threats are constantly evolving and ensure that our solutions operate effectively and are competitive with products offered by others, particularly as larger providers increasingly offer broader platforms of security services. Further, competition and pricing pressure has, and may continue to impact, revenue of certain of our security solutions, including during contract renewals.”

Annual report 2025A · The company itself

“As our solutions are adopted by an increasing number of enterprises and governments, it is possible that the adversaries behind advanced malicious actions will specifically focus on finding ways to defeat our products and services. If they are successful, we could experience a serious impact on our reputation and financial condition as a provider of security solutions.”

Annual report 2025A · The company itself

“Cybersecurity breaches and attacks on us, our contractors or our third-party vendors, as well as steps we need to take in an effort to prevent them, can lead to significant costs and disruptions that would harm our business, financial results and reputation. We and the third-parties upon which we rely face a variety of evolving threats, which could cause cybersecurity incidents and/or data breaches, such as cyber-attacks, malicious internet-based activity, online and offline fraud and other similar activities.”

Annual report 2025A · The company itself

“Such threats are prevalent and continue to rise, are increasingly difficult to detect and come from a variety of sources and may be enhanced or facilitated by AI.”

Annual report 2025A · The company itself

“We regularly face attempts to gain unauthorized access or deliver malicious software to Akamai's platforms, products and services and our internal IT systems, with the goal of stealing proprietary information related to our business, products, employees and customers; disrupting our systems and services or those of our customers or others; or demanding ransom to return control of such systems and services. These attempts take a variety of forms, including DDoS attacks, infrastructure attacks, botnets, malicious file uploads, computer malware, application abuse, credential abuse, social engineering (including phishing attacks), ransomware, bugs, viruses, worms malicious software programs, business email compromises, misuse of employee credentials and wrongful conduct by insider employees or vendors, all of which may be enhanced or facilitated by AI.”

Annual report 2025A · The company itself

“Further, attempts to disrupt or gain unauthorized access to our and our third-party vendors’ information systems from malicious third parties or insider threats may incorporate widely varying and frequently changing tactics, which may be enhanced or facilitated by AI.”

Annual report 2025A · The company itself

“Furthermore, nation state and hacktivist attacks against us or our customers have in the past and may in the future intensify during periods of heightened geopolitical tensions or armed conflict, such as the ongoing war in Ukraine, the Israel-Hamas war and the escalation of military conflict between Israel and Iran, as well as broader military confrontations involving the United States.”

Annual report 2025A · The company itself

“For example, we have discovered vulnerabilities in software and hardware used in our technology, such as the AMD "Inception" vulnerability identified in mid-2023 that potentially impacted a large portion of the internet ecosystem, and may have other undiscovered vulnerabilities. Vulnerabilities, resident in software, hardware or configurations, have in the past and may in the future require significant operational efforts to mitigate and may persist for extended periods of time and the effects of any such vulnerability could be exacerbated.”

Annual report 2025A · The company itself

“For example, with the acquisition of Linode Limited Liability Company ("Linode"), we continue to adapt procedures for mitigating risks that have in the past or may in the future materialize, including any harms that may arise from abuse of our cloud computing products. If we fail to mitigate these harms or if there is a significant cybersecurity event using our cloud computing products or our cloud computing products are perceived to be less reliable than our competitors, it could result in loss of customers and reputational damage.”

Annual report 2025A · The company itself

“As a result of the diversification of our business, personnel growth, the deployment of our FlexBase program, acquisitions and international expansion in recent years, most of our employees are now based outside of our Cambridge, Massachusetts headquarters. Because most of our employees work remotely, we are subject to additional risks. For example, certain security systems in homes or other remote workplaces may be less secure than those used in our offices, which may subject us to increased security risks, including cybersecurity-related events, and expose us to risks of data or financial loss and associated disruptions to our business operations.”

Annual report 2025A · The company itself

“Table of Contents We may need to defend against patent or copyright infringement claims, which would cause us to incur substantial costs or limit our ability to use certain technologies in the future. As we expand our business and develop new technologies, products and services, we have become increasingly subject to intellectual property infringement and other claims and related litigation. We have also agreed to indemnify our customers and channel and strategic partners if our solutions infringe or misappropriate specified intellectual property rights.”

Annual report 2025A · The company itself

“Business Overview Akamai's mission is to power and protect life online. Since 1998, Akamai has developed and provided solutions for global enterprises to build, secure and accelerate their applications and digital experiences.”

Annual report 2025A · The company itself

“In May 2023, Akamai acquired Neosec, Inc. ("Neosec"), which enabled us to offer a solution we refer to as API Security that works to discover and audit APIs and monitor API activity.”

Annual report 2025A · The company itself

“In June 2024, Akamai acquired Noname Security Ltd. ("Noname Security"), one of the top API security vendors in the market.”

Annual report 2025A · The company itself

“We have observed the following trends related to our revenue in recent years: •Increased sales of our security solutions, led by application security solutions and our microsegmentation solutions, and increased sales of our cloud computing solutions, attributable to enhanced services on our compute platform, and growth in our Cloud Infrastructure Services, have made a significant contribution to revenue growth. Our security and cloud computing solutions continue to contribute to a large portion of revenue. We plan to continue to invest in these areas with a focus on higher growth security products and Cloud Infrastructure Services to further advance our product portfolios and sales capabilities. •Traffic growth on our network has improved, but remains moderated as compared to prior years.”

Annual report 2025A · The company itself

“We have been able to mitigate some of the negative impacts to our revenue growth rates by upselling incremental solutions to our existing customers.”

Annual report 2025A · The company itself

“We also acquired Noname Security in June 2024. Noname Security is intended to expand our existing API Security offering by providing more flexible deployment options, extensive vendor integrations and enhanced attack analysis.”

Annual report 2025A · The company itself

“Noname Security In June 2024, the Company acquired all the outstanding equity interests of Noname Gate Ltd. ("Noname Security") for $451.5 million in cash. Noname Security is intended to expand the Company’s existing application programming interface ("API") security offering by providing more flexible deployment options, extensive vendor integrations and enhanced attack analysis.”

Annual report 2025A · The company itself

“Neosec In May 2023, the Company acquired all the outstanding equity interests of Neosec for $91.4 million in cash. Neosec is an API detection and response platform based on data and behavioral analytics. The acquisition is intended to complement the Company's application and API security portfolio by extending its visibility into the rapidly growing API threat landscape.”

Annual report 2025A · The company itself

“Security Our security solutions, threat intelligence and global operations team work to provide defense in depth to safeguard enterprise data and applications across hybrid cloud environments. Akamai operates two security platforms – Application 3 Table of Contents Protection and Zero Trust Network Security – designed to address the expanding and evolving threat landscape facing modern enterprises.”

Annual report 2025A · The company itself

“Our portfolio encompasses mature, market-leading security products including web application firewall ("WAF"), bot management, distributed denial-of-service ("DDoS") protection and domain name system ("DNS") security, complemented by fast-growing solutions in application programming interface ("API") security and network segmentation.”

Annual report 2025A · The company itself

“Customers trust Akamai to help keep infrastructure, websites, applications, APIs, networks and users safe from a multitude of cyberattacks and online threats while improving performance.”

Annual report 2025A · The company itself

“This is part of a growing set of solutions designed to help businesses implement a Zero Trust security architecture. The Akamai Guardicore Platform simplifies enterprise security with broad visibility and granular controls through one console.”

Annual report 2025A · The company itself

“Our security solutions currently generate the largest portion of our revenue.”

Annual report 2025A · The company itself

“Revenue We primarily derive revenue from the sale of services to customers pursuant to contracts having terms of one year or longer, which allows us to have a consistent and predictable base level of revenue. Services included in our contracts consist of security solutions, the delivery of content, applications and software over the internet, cloud computing solutions and professional services.”

Annual report 2025A · The company itself

“Services included in our contracts consist of security solutions, the delivery of content, applications and software over the internet, cloud computing solutions and professional services. In addition to a base level of revenue, we are also dependent on our ability to increase our product offerings and to cross-sell additional services to our new and existing customers, particularly for our security and cloud 28 Table of Contents computing solutions portfolios.”

Annual report 2025A · The company itself

“The increases in security solutions revenue for 2025 as compared to 2024, and 2024 as compared to 2023, were due to growth of sales in key products in our security solutions portfolio, including our API security, web application and Guardicore segmentation solutions.”

Annual report 2025A · The company itself

“Revenue Revenue by solution category during the periods presented was as follows (in thousands): For the Years Ended December 31, For the Years Ended December 31, 2025 2024 % Change % Change at Constant Currency 2024 2023 % Change % Change at Constant Currency Security $ 2,243,404 $ 2,042,661 10 % 9 % $ 2,042,661 $ 1,765,267 16 % 16 % Delivery 1,256,721 1,318,131 (5) (5) 1,318,131 1,542,434 (15) (14) Cloud computing 708,050 630,376 12 12 630,376 504,219 25 25 Total revenue The increases in our revenue in 2025 as compared to 2024, and 2024 as compared to 2023, were primarily the result of continued growth in sales of our security and cloud computing solutions, partially offset by a decline in revenue from our delivery solutions due to downward pricing of renewals.”

Annual report 2025A · The company itself

“Cyber attacks The threat of malicious attacks on IT systems has risen significantly in recent years. Daily attack attempts continue with both rising frequency and impact.”

Annual report 2025A · The company itself

“The IT systems used by the portfolio businesses are completely independent from each other, which limits the impact. Across the portfolio, there is a strong focus on IT security, awareness training, and ongoing investments to prevent, detect and respond to cyber attacks.”

Annual report 2025A · The company itself

“Our business and operations could suffer in the event of cybersecurity breaches, information technology system failures, or network disruptions. We and our third-party service providers have been and will continue to be subject to advanced and persistent threats in the areas of information and operational technology security and fraud. Cybersecurity attacks, especially in light of the advancement and proliferation of artificial intelligence (“AI”) and machine learning technologies, may become more sophisticated over time.”

Annual report 2025A · The company itself

“In addition, we must comply with numerous laws and regulations addressing privacy, data protection, artificial intelligence, data governance and cybersecurity. We are subject to the European Union General Data Protection Regulation 2016/679 and any applicable national implementing laws (together, the “EU GDPR”), as well as the United Kingdom General Data Protection Regulation and the Data Protection Act 2018 (together, the “UK GDPR”).”

Annual report 2025A · The company itself

“Security breaches, data breaches, cybersecurity attacks, or other cybersecurity incidents could materially adversely impact our operations and patient care, and our reputation, business, financial condition and results of operations could be harmed. Our IT systems, policies and contracts and the policies of our third-party vendors, and their IT systems safeguard employee, applicant and customer personal, health and financial, and our own proprietary information and data essential to our operations.”

Annual report 2025A · The company itself

“We and our service providers, third-party vendors and other third parties could be targeted by or subject to physical break-ins, computer viruses and other malicious code, unauthorized or fraudulent access, programming errors or other technical malfunctions, hacking attacks, phishing, vishing, deepfakes, and other social engineering attacks, malware, ransomware, employee noncompliance, error or malfeasance, cybersecurity attacks, malicious code, and other breaches of, or incidents impacting, IT systems or similar malicious or otherwise disruptive actions, including by organized groups and nation-state actors, which may disrupt or limit the availability of, or result in damage to, our IT systems and result in loss or unavailability of, damage to, or the unauthorized acquisition, use, disclosure, or other processing of confidential information. We have experienced, and may again experience in the future, cybersecurity incidents, data incidents, and unauthorized internal employee exfiltration of information.”

Annual report 2025A · The company itself

“Further, the frequency and sophistication of third-party cybersecurity attacks are increasing, particularly with the advancement of AI technologies.”

Annual report 2025A · The company itself

“Additionally, our iTero intraoral scanners may be independently or collectively the target of cybersecurity incidents or attacks or subject to security vulnerabilities, bugs, errors, defects, or viruses or other malicious code. Due to the large and growing number of these decentralized devices, we may be unable, or not have the capacity, knowledge or infrastructure, to respond to or remedy a cybersecurity incident in a timely manner.”

Annual report 2025A · The company itself

“The costs to eliminate, mitigate, or recover from security problems and cybersecurity attacks and incidents could be material and require us to implement additional or different security controls or other measures and, depending on the nature and extent of the problem and the products, services or IT systems impacted, such security problems and cybersecurity attacks and incidents may result in network, IT system interruptions or other disruptions, decreased product sales, data loss, damage, unavailability, or other liabilities, any of which may have a material impact on our operations, net revenues and operating results. The costs associated with cybersecurity tools and infrastructure and competition for scarce cybersecurity and IT resources could limit our ability to identify, eliminate or remediate cybersecurity or other security vulnerabilities or problems or enact changes to minimize the attack surface of our network.”

Annual report 2025A · The company itself

“FERC designated North American Electric Reliability Corporation, which also provides oversight of cybersecurity standards, as the overarching Electric Reliability Organization. The Midwest Reliability Organization, which is a regional member of North American Electric Reliability Corporation, has direct responsibility for mandatory electric reliability standards for IPL and WPL.”

Annual report 2025A · The company itself

“Department of Homeland Security Transportation Security Administration - Alliant Energy, IPL and WPL are subject to regulation for physical and cybersecurity of their natural gas pipeline systems.”

Annual report 2025A · The company itself

“A cyber attack may disrupt our operations or lead to a loss or misuse of confidential and proprietary information or potential liability - We operate in an industry that requires the continuous use and operation of information and telecommunications systems. We face threats from use of malicious code (such as malware, viruses and ransomware), employee theft or misuse, vulnerabilities (such as the log4j and MOVEit vulnerabilities), fraud attempts, phishing attacks and advanced persistent threats. This includes threats from nation-state actors (such as VOLT TYPHOON and SALT TYPHOON), which have demonstrated an increased focus on targeting critical industries, including telecommunications and energy.”

Annual report 2025A · The company itself

“Cyber attacks targeting electronic control systems used at our generating facilities and for electric and gas distribution systems could result in a full or partial disruption of our electric and/or gas operations.”

Annual report 2025A · The company itself

“Riski Riskin määritelmä Riskiä vähentävät toimet Operatiiviset riskit Kyberturvallisuus ja tietoturvaan liittyvät riskit Virukset, madot, kiristysohjelmat ja muut haittaohjelmat voivat vaarantaa järjestelmien käytön ja tiedot. Yhtiön järjestelmien luvaton käyttö tai arkaluonteisen tiedon varastaminen, mukaan lukien asiakastietojen tietomurrot, sekä palvelujen keskeytyminen vihamielisten toimien, kuten palvelunestohyökkäysten, vuoksi voivat aiheuttaa merkittäviä häiriöitä.”

Annual report 2025A · The company itself

“Tietoturvauhkia voivat vahvistaa myös tekoälyn yleistyminen, esimerkiksi automatisoitu tietojenkalastelu ja sosiaalinen manipulointi sekä hyväksymättömien työkalujen (”shadow IT/AI”) käyttö, mikä voi lisätä tietovuotoriskiä ja vaikeuttaa valvontaa.”

Annual report 2025A · The company itself

“Lisäksi tekoälyä hyödyntäviin toiminnallisuuksiin voi liittyä erityisriskejä, kuten heikkolaatuisen datan vaikutukset sekä hyökkäykset, jotka voivat johtaa virheellisiin tuloksiin tai ei-toivottuihin toimiin.”

Annual report 2025A · The company itself

“Tekijänoikeudet Liiketoimintakriittisen tiedon ja liikesalaisuuksien vuotaminen sekä julkaistujen sisältöjen tai datan oikeudeton käyttö ja ongelmat avoimen lähdekoodin hyödyntämisessä.”

Annual report 2025A · The company itself

“Keskeisiä operatiivisia riskejä ovat tietotekniikan ja viestinnän häiriöt, kyberriskit sekä AI-järjestelmien toimintahäiriöt.”

Annual report 2025A · The company itself

“Myös arvoketjussa tapahtuva tietosuoja- tai tietoturvaloukkaus voi aiheuttaa yhtiölle taloudellisia menetyksiä. Kielteinen vaikutus: käyttäjän tai asiakkaan yksityisyyden loukkaus, voi tarkoittaa henkilötiedon (esim. nimi, yhteystiedot, tunnisteet, osto- ja selaushistoria, mahdolliset maksutiedot) päätymistä luvattomasti kolmansille osapuolille, altistaen esimerkiksi identiteettivarkauksille, mistä voi seurata taloudellisia menetyksiä ja aikaa vievää vahinkojen selvittelyä.”

Annual report 2025A · The company itself

“Lisäksi sidosryhmäpalaute ei painottanut kolmansien osapuolten yhtiölle muodostamia riskejä, mutta johdon arvoketjuarvioinnin mukaan kumppaneiden tietoturva- ja tietosuojaloukkaukset ja vastuullisuuteen liittyvät väärinkäytökset voivat aiheuttaa Alma Medialle merkittävän maineriskin.”

Annual report 2025A · The company itself

“Samanaikaisesti digitaalisten palveluiden ja datavetoisen liiketoiminnan kasvu on lisännyt kuluttajien ja loppukäyttäjien tietosuojaan ja tietoturvaan liittyvien riskien merkitystä. Tietosuojaan liittyviä IROja on tarkennettu kattamaan entistä selkeämmin sekä oman toiminnan että arvoketjun alku- ja loppupään vaikutukset, mukaan lukien mahdolliset taloudelliset ja maineeseen kohdistuvat riskit.”

Annual report 2025A · The company itself

“In 2025, we recorded impairments of the values of the goodwill and other intangible assets within our e-vapor reporting unit as a result of the ITC exclusion order and cease-and-desist orders prohibiting the importation and sale of NJOY ACE into the United States and our expectation that effective enforcement against illicit flavored disposable e-vapor products would occur more gradually than initially anticipated.”

Annual report 2025A · The company itself

“We Could Be Harmed by Data Loss or Other Security Incidents Because we collect, process, store, and transmit large amounts of data, including confidential, classified, sensitive, proprietary, and business and personal information, failure to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting our or our vendors’ or customers’ technology, products, and systems, could: expose us or our customers to a risk of loss, disclosure, or misuse of such information; adversely affect our operating results; result in litigation, liability, or regulatory action (including under laws related to privacy, data use, data protection, data security, network security, and consumer protection); deter customers or sellers from using our stores, products, and services; and otherwise harm our business and reputation.”

Annual report 2025A · The company itself

“Although we have developed systems and processes that are designed to protect customer data and prevent, detect, or mitigate such incidents, including systems and processes designed to reduce the impact of a security incident at a third-party vendor or customer, such measures cannot provide absolute security and may fail to operate as intended or be circumvented, including by use of developing technologies such as artificial intelligence.”

Annual report 2025A · The company itself

“We are also subject to or voluntarily comply with a number of other laws and regulations relating to payments, money laundering, international money transfers, privacy, data use, data protection, data security, data localization, network security, consumer protection, and electronic fund transfers. If we were found to be in violation of applicable laws or regulations, we could be subject to additional requirements and civil and criminal penalties, or forced to cease providing certain services.”

Annual report 2025A · The company itself

“Physical attacks or hostile cyber intrusions could severely impair operations, lead to the disclosure of confidential information and damage AEP’s reputation. (Applies to all Registrants) Risks from cybersecurity and physical threats to energy infrastructure are increasing.”

Annual report 2025A · The company itself

“In addition, the rapid evolution and increased adoption of AI technologies may intensify AEP’s cybersecurity risks.”

Annual report 2025A · The company itself

“If a material physical or cybersecurity breach or disruption were to occur, AEP’s reputation could be negatively affected, customer confidence in AEP could be diminished and AEP could be subject to legal claims, regulatory exposure, loss of revenues, and increased costs, including infrastructure repairs or operations shutdown, all of which could materially affect AEP’s financial condition and materially damage its business reputation.”

Annual report 2025A · The company itself

“Our privacy and data protection programs have become the subject of heightened scrutiny and review in certain jurisdictions, including in the EU, and we continue to enhance our privacy program to comply with applicable requirements and regulatory expectations. Our compliance with the various and often diverging legal frameworks around privacy, data protection, AI, resiliency, information security and cybersecurity, as well as increased regulatory and legislative activity in these areas, may result in higher technology, administrative and other operational costs and hinder our ability to deploy and scale technology, innovate quickly and effectively utilize data.”

Annual report 2025A · The company itself

“There are a number of motivations for cyber threat actors, including criminal activities such as fraud, identity theft and ransom, corporate or nation-state espionage, political agendas, public embarrassment with the intent to cause financial or reputational harm, intent to disrupt information technology systems and supply chains, and to expose and exploit potential security and privacy vulnerabilities in corporate systems and websites. Cyber threat actors have rapidly evolved their techniques and increasingly utilize advanced capabilities, including the exploitation of unknown security flaws in software and hardware and the integration of advanced forms of AI and other new technology, which can increase the efficacy, severity, frequency and ease of execution of cyberattacks. In addition, new computing technologies, such as quantum computing, may enable threat actors to compromise data encryption and other protective measures.”

Annual report 2025A · The company itself

“Our and our partners’ networks and systems are subject to constant attempts to disrupt business operations and capture, destroy, manipulate or expose various types of information relating to corporate trade secrets, customer information (including Card Member, travel, dining and loyalty program data), colleague information and other sensitive business information (including acquisition activity, non-public financial results and intellectual property). For example, we and other U.S. financial services providers have been the target of attacks, such as denial-of-service attacks, social engineering and the impersonation of current or prospective employees and contractors, in some cases conducted by nation state-affiliated actors.”

Annual report 2025A · The company itself

“Risks associated with such incidents and activities include theft of funds and other monetary loss, disruption of our operations and the unauthorized disclosure, release, gathering, monitoring, misuse, modification, loss or destruction of confidential, proprietary, trade secret or other information (including account data information). An incident may not be detected until well after it occurs and the severity and potential impact may not be fully known for a substantial period of time after it has been discovered. We are subject to varied cybersecurity regulations and incident reporting requirements, which could require us to disclose incidents that may not have been resolved or fully investigated at the time of disclosure, leading to customer confusion, regulatory scrutiny and negative publicity and exacerbating risks related to the incident itself.”

Annual report 2025A · The company itself

“Information, operational or cybersecurity incidents and other actual or perceived failures to maintain confidentiality, integrity, availability of services and data, privacy and/or security has led to regulatory investigations and increased regulatory scrutiny and may lead to regulatory intervention (such as mandatory card reissuance), consent decrees, increased litigation (including class action litigation), response costs (including notification and remediation costs), fines, negative assessments of us and our subsidiaries by banking regulators and rating agencies, reputational and financial damage to our brand, negative impacts to our partner relationships, and reduced usage of our products and services, all of which could have a material adverse impact on our business.”

Annual report 2025A · The company itself

“Fraudulent activity associated with our products and services could have a material adverse effect on our business and results of operations. We face risks from fraudulent activity associated with Card Members, merchants and others, including through bad actors obtaining access to our customer accounts and information and frauds committed by our customers against us. Large financial services firms such as American Express and our customers are regularly targeted by a range of fraudulent activity, including fraud on our card and banking products, false disputes, account takeovers, identity theft and electronic-transaction related crimes, with sophisticated perpetrators increasingly utilizing a range of advanced techniques and multiple parties acting in concert.”

Annual report 2025A · The company itself

“New or emerging technologies, such as generative AI capabilities, have increased these fraud risks. For example, we have seen our customers targeted by elaborate and voluminous social engineering attacks, which may utilize advanced methods of deception, such as synthetic voice and conversation generation.”

Annual report 2025A · The company itself

“Globally and regionally, we continue to see enhanced legislative and regulatory interest regarding retirement investing and fiduciary initiatives, cybersecurity, technology, and operational resilience; the use of artificial intelligence (“AI”); responsible information and data collection, storage and use; financial crime prevention; and privacy matters, and we will continue to closely review and monitor any legislative or regulatory proposals and changes.”

Annual report 2025A · The company itself

“Key U.K. regulatory developments and trends include the following: •Operational Resilience: Under this U.K. regulatory requirement, in scope firms must identify their important business services, which, if unavailable, could cause intolerable harm to clients, which they could not reasonably recover, or market disruption. The regulations introduce a new concept of impact tolerance and firms are also required to stress test their important business services and appoint a senior manager accountable for the regime.”

Annual report 2025A · The company itself

“Reputational damage may arise from numerous sources, including litigation or regulatory actions, failing to deliver minimum standards of service and quality, compliance failures, any perceived or actual weakness in our financial strength or liquidity, clients’ or potential clients’ perceived failure of how we address certain political, environmental, social or governance topics, technological breakdowns, cybersecurity attacks, or other security breaches (including attempted breaches, breaches impacting our vendors or their subcontractors or inadvertent disclosures) resulting in system unavailability, improper disclosure or loss of data integrity relating to client or employee personal information, unethical or improper behavior and the misconduct or error of our employees, advisors and counterparties.”

Annual report 2025A · The company itself

“The number of threats and events has increased substantially every year, which is expected to continue, particularly as the use of AI makes these attempts look more legitimate and is leveraged to improve their effectiveness.”

Annual report 2025A · The company itself

“In addition, the ever-increasing reliance on technology systems and networks and the occurrence and potential adverse impact of attacks on such systems and networks, both generally and in the financial services industry, have enhanced government and regulatory scrutiny of the measures taken by companies to protect against cybersecurity threats and report incidents they suffer. As these threats, and government and regulatory oversight of associated risks, continue to evolve, we may be required to expend significant additional resources (both direct financial resources and indirect costs like people) to enhance or expand upon the technical and operational security and response measures we currently maintain or that we allow franchise advisors to maintain and control locally.”

Annual report 2025A · The company itself

“Risks Related to Economic Conditions and Operating a Global Business •Our efforts to collaborate with or acquire other companies, products, or technology, and to integrate the operations of companies or to support the products or technology we have acquired, may not be successful, and may result in unanticipated costs, delays or failures to realize the benefits of the transactions. •A breakdown of our information technology systems, cyberattack or information security breach could significantly compromise the confidentiality, integrity and availability of our information technology systems, network-connected control systems and/or our data, interrupt the operation of our business and/or affect our reputation. •Our sales and operations are subject to the risks of doing business internationally, including in new or emerging markets. •We may not be able to access the capital and credit markets on terms that are favorable to us, or at all.”

Annual report 2025A · The company itself

“Remote and hybrid working arrangements, including those of many third-party providers, can increase cybersecurity risks due to the challenges associated with managing remote computing assets and security vulnerabilities that are 36 present in many non-corporate and home networks.”

Annual report 2025A · The company itself

“Attacks such as those experienced by government entities (including those that approve and/or regulate our products, such as the EMA) and other multi-national companies, including some of our peers, could leave us unable to utilize key business systems or access or protect important data, and could have a material adverse effect on our ability to operate our business, including developing, gaining regulatory approval for, manufacturing, selling and/or distributing our products.”

Annual report 2025A · The company itself

“In some cases, we use third-party service providers to collect, process, store, manage or transmit such data, which has increased our risk. Intentional or inadvertent data privacy or security breaches (including cyberattacks) resulting from attacks or lapses by employees, service providers (including providers of information technology-specific services), business partners, nation states (including groups associated with or supported by foreign intelligence agencies), organized crime organizations, “hacktivists” or others, create risks that our sensitive data may be exposed to unauthorized persons, our competitors or the public.”

Annual report 2025A · The company itself

“System vulnerabilities and/or cybersecurity breaches experienced by our third-party service providers have constituted a substantial share of the information security risks that have affected us. For example, in the past we have experienced cybersecurity incidents involving third-party service providers, including incidents in which unauthorized third parties accessed or exfiltrated certain information, including non-significant Amgen data and personally identifiable patient information, and we 37 have made required regulatory notifications in connection with certain such incidents.”

Annual report 2025A · The company itself

“For example, we have experienced cybersecurity incidents at third-party vendors that provide testing, analytical, information technology and clinical data services, which required us to temporarily disconnect our systems from those vendors. Although these incidents did not result in breaches of our systems or significantly affect product availability, a prolonged or more widespread service outage affecting these or other vendors, particularly where a vendor is a single source for critical services, could have a material adverse effect on our business or results of operations.”

Annual report 2025A · The company itself

“In addition, we distribute our products in the United States primarily through three pharmaceutical wholesalers, and a security breach that impairs the distribution operations of our wholesalers could significantly impair our ability to deliver our products to healthcare providers and patients.”

Annual report 2025A · The company itself

“We will continue to experience varying degrees of cyberattacks and other incidents in the future. Even though we continue to invest in the monitoring, protection and resilience of our critical and/or sensitive data and systems, there can be no assurance that our efforts will detect, prevent or fully recover systems or data from all breakdowns, service interruptions, attacks and/or breaches of our systems that could adversely affect our business and operations and/or result in the loss or exposure of critical, proprietary, private, confidential or otherwise sensitive data, which could result in material financial, legal business or reputational harm to us or negatively affect our stock price.”

Annual report 2025A · The company itself

“We rely on both our own information technology systems and those provided by third-party vendors to support critical business operations. These systems are subject to numerous and evolving cybersecurity threats that are designed to disrupt operations or gain unauthorized access and threaten the confidentiality, integrity and availability of our information technology systems and confidential information. These threats may arise from diverse threat actors such as state-sponsored organizations and opportunistic hackers and hacktivists, as well as through diverse attack vectors, including, but not limited to, malware, social engineering/phishing, credential harvesting, ransomware, malfeasance by insiders, human or technological error and other increasingly sophisticated attacks.”

Annual report 2025A · The company itself

“Risks Related to Cyber, Artificial Intelligence, Intellectual Property, Legal and Regulatory Our computer systems and networks are subject to attempted security breaches and other cyber incidents and a significant disruption in, or breach in security of, our information technology systems or certain products could materially and adversely affect our business or reputation. We rely on information technology systems throughout our company to keep financial records and customer data, process orders, manage inventory, coordinate shipments to customers, maintain confidential and proprietary information, assist in semiconductor engineering and other technical activities and operate other critical functions such as internet connectivity, network communications and email.”

Annual report 2025A · The company itself

“In addition, the use of AI in the development of our products and services, in our business operations or by our customers in end products that incorporate our products, could cause loss of intellectual property, or subject us to risks related to intellectual property infringement or misappropriation, data privacy or cybersecurity.”

Annual report 2025A · The company itself

“If we fail to comply with U.S. and foreign laws related to privacy, data security and data protection, it could adversely affect our operating results and financial condition. We are or may become subject to a variety of laws and regulations such as the European Union’s General Data Protection Regulation (GDPR), China’s Personal Information Protection Law (PIPL), or California’s Consumer Privacy Act (CCPA) regarding privacy, data protection and data security.”

Annual report 2025A · The company itself

“In connection with our United States government business, we are subject to evolving procurement rules and regulations, as well as government audits and to review and approval of our policies, procedures, and internal controls for compliance with procurement regulations and applicable laws, such as the Cybersecurity Maturity Model Certification.”

Annual report 2025A · The company itself

“Risks Related to Technology, Cybersecurity, and Data Protection •We rely on complex information technology systems and networks to operate our business. Any significant system or network disruption due to a breach in the security of our information technology systems could have a negative impact on our reputation, operations, sales, and operating results. •Improper disclosure of confidential, personal, or proprietary data could result in regulatory scrutiny, legal liability, or harm to our reputation. •Regulation in the areas of data privacy, data protection, data management, data transfer, data localization, artificial intelligence, and cybersecurity could increase our costs and affect or limit our business opportunities.”

Annual report 2025A · The company itself

“Although we are not currently aware of any security incidents or cyberattacks that, individually or in the aggregate, have materially affected, or would reasonably be expected to materially affect, our operations or financial condition, there can be no assurance that the various procedures and controls we utilize to mitigate these threats will be sufficient to prevent disruptions to our systems, especially because the cyberattack techniques used change frequently and are not recognized until launched, the full scope of a cyberattack may not be realized until an investigation has been performed and cyberattacks can originate from a wide variety of sources.”

Annual report 2025A · The company itself

“As new technologies, including tools that harness generative artificial intelligence and other machine learning techniques, rapidly develop and become even more accessible, the use of such new technologies by us, our affiliates and our third-party service providers will present additional known and unknown risks, including, among others, the risk that confidential information may be stolen, misappropriated or disclosed and the risk that we and/or third-party service providers may rely on incorrect, unclear or biased outputs generated by such technologies, any of which could have an adverse impact on us, our reputation and our business.”

Annual report 2025A · The company itself

“The misuse or misappropriation of our data, including material non-public information, unavoidable deficiencies in the practices associated with data collection, training AI technology on large data sets and big data analytics and difficulties in validating data could have an adverse impact on our reputation, subject us to legal and regulatory investigations and/or actions and create competitive risk.”

Annual report 2025A · The company itself

“We are also dependent on an increasingly concentrated group of third-party vendors that we do not control for hosting the information systems and hardware systems that are critical to our businesses. We rely on third-party service providers for certain aspects of our businesses, including for certain information systems, technology and administration of the funds we manage and compliance matters. While we require our critical third-party suppliers to implement and maintain what we believe to be effective cybersecurity and data protection measures, we cannot guarantee that third parties and infrastructure in our supply chain or our partners’ supply chains have not been compromised or that they do not contain exploitable defects or bugs 39 Table of Contents that could result in a breach of or disruption to our information technology systems or the third-party information technology systems that support our services.”

Annual report 2025A · The company itself

“Cyberattacks are continually increasing in their frequency, sophistication and intensity. Additionally, some actors are using artificial intelligence technology to launch more automated, targeted and coordinated attacks which further heightens these risks.”

Annual report 2025A · The company itself

“Further, engineering and maintaining security for our systems and products may require significant costs. However, failing to properly respond to and invest in information technology and cybersecurity advancements may limit our ability to 25 Table of Contents attract and retain customers, prevent us from offering similar products and services as those offered by our competitors or inhibit our ability to meet regulatory, industry or other compliance requirements.”

Annual report 2025A · The company itself

“Some of our products, including but not limited to safety-critical products, contain complex digital technologies designed to support today’s increasingly connected vehicles.”

Annual report 2025A · The company itself

“The NAIC adopted an Insurance Data Security Model Law in 2017 that requires insurers, insurance producers and other entities required to be licensed under state insurance laws to comply with certain requirements under state insurance laws, such as developing and maintaining a written information security program, conducting risk assessments overseeing the data security practices of third party service providers and meeting expanded breach notification requirements.”

Annual report 2025A · The company itself

“The California Consumer Privacy Act of 2018 (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”) that took effect in 2023, grants California consumers certain rights to, among other things, access, correct and delete data about them subject to certain exceptions, as well as a private right of action related to cybersecurity breaches with statutory penalties.”

Annual report 2025A · The company itself

“In September 2025, the CPPA finalized rules which impose requirements for annual cybersecurity audits and privacy risk assessments.”

Annual report 2025A · The company itself

“The NYDFS also issued guidance regarding cybersecurity risks arising from AI requiring us to continuously assess these risks and implement appropriate cybersecurity measures to mitigate these threats.”

Annual report 2025A · The company itself

“The EU GDPR came into effect on May 25, 2018. The EU GDPR governs the collection, use, disclosure, transfer or other processing of personal data. Its scope extends to certain entities not established in the EEA if they offer goods or services to, or monitor the behavior of, EEA data subjects. The EU GDPR contains a number of requirements regarding the processing of personal data about individuals, including mandatory security breach reporting, new and strengthened individual rights, evidenced data controller accountability for compliance with the GDPR principles (including fairness and transparency), maintenance of data processing activity records and the implementation of “privacy by design,” including through the completion of mandatory Data Protection Impact Assessments in connection with higher risk data processing activities.”

Annual report 2025A · The company itself

“In addition, the EU GDPR increases scrutiny of transfers of personal data to jurisdictions which the European Commission does not recognize as having “adequate” data protection laws. In particular in 2020, the Court of Justice of the EU (Court of Justice) in Schrems II invalidated the European Union-United States (EU-U.S.) Privacy Shield on the grounds that the EU-U.S. Privacy Shield failed to offer adequate protections to EU personal information transferred to the U.S.”

Annual report 2025A · The company itself

“On July 10, 2023, the European Commission adopted an adequacy decision relating to the transfer of personal data from the EU to the U.S. which takes place under the DPF. The DPF is the successor to the EU-U.S. Privacy Shield and allows companies that are subject to the GDPR to transfer personal data to U.S. entities that participate in the DPF without the need for alternative data protection transfer mechanisms (such as SCCs or binding corporate rules).”

Annual report 2025A · The company itself

“The EU GDPR imposes substantial fines for breaches and violations (up to the greater of €20 million or 4% of global turnover).”

Annual report 2025A · The company itself

“The SEC maintains cybersecurity disclosure rules (“SEC Cybersecurity Rules”) mandating cybersecurity incident and risk management disclosure for public companies such as Arch. The SEC Cybersecurity Rules became effective in 2023 and mandate that public companies report a cybersecurity incident on a Form 8-K within four days after they determine that the incident is material.”

Annual report 2025A · The company itself

“The Digital Operational Resilience Act (“DORA”) entered into force in January 2023. The core aim of DORA is to prevent and mitigate cyber threats and sets uniform requirements for the security of network and information systems of financial sector entities (including (re)insurers) as well as critical third parties which provide ICT (information and communication technology)-related services, such as cloud platforms or data analytics services. Certain of our in-scope Irish entities are required to comply with the obligations set out under DORA since January 17, 2025.”

Annual report 2025A · The company itself

“Risks Related to Cybersecurity and Data Privacy Our products, services, and external facing or internal network systems, or those of third parties on which we rely, could experience cybersecurity incidents, and defects, errors, or vulnerabilities in our products, or the misuse of our products, could lead to cybersecurity incidents or a failure to detect cybersecurity incidents, create product liability risks, damage our reputation, adversely impact our operating results, or otherwise negatively impact our business. Our products, services, and external facing or internal network systems could experience cybersecurity incidents or become a target for security attacks, including attacks specifically designed to disrupt our business and our customers and introduce malicious software and attacks by state sponsors.”

Annual report 2025A · The company itself

“In addition defects, errors, or vulnerabilities in our security platform or in the hardware upon which it is deployed, including as a result of misuse or a failure to implement updates to such platform, could temporarily or permanently limit our detection capabilities and expose our end-customers’ networks, leaving their networks unprotected against the latest security threats, or otherwise lead to cybersecurity incidents. If customers of our security platform do suffer a cybersecurity incident, even if it is not attributable to a failure of our platform, customers may believe that our platform failed to detect a threat or vulnerability, which could harm our reputation or negatively affect our financial results.”

Annual report 2025A · The company itself

“Negative perceptions or publicity, including our association with clients or business partners with damaged reputations, as a result of actions taken by companies we acquire before the acquisition, as a result of marketing partnerships (for example, with a sports team or league), or from actual or alleged conduct by us or our employees, including corruption or bribery allegations or cybersecurity incidents, could damage our reputation.”

Annual report 2025A · The company itself

“These risks include, among others, the input of confidential information, including material non-public information, in contravention of our policies or contractual restrictions to which any of the foregoing are subject, or in violation of applicable laws or regulations, including those relating to data protection and AI. This could result in such information becoming part of a data set that is accessible by other third-party AI applications and users.”

Annual report 2025A · The company itself

“The increasing adoption of AI technologies by cyber threat actors presents a significant and evolving risk to our company. These actors may leverage AI to develop more sophisticated and targeted cyberattacks, including advanced phishing schemes, malware, and data exfiltration techniques, which could compromise our controls and systems, client data, and proprietary information.”

Annual report 2025A · The company itself

“Business disruptions could have a material adverse effect on our operations, damage our reputation and impact client relationships. Our ability to conduct business may be adversely affected by a disruption in the infrastructure that supports our business. This includes infrastructure controlled by third-party vendors and suppliers. Such disruptions could be caused by various factors, such as cybersecurity incidents, security breaches, human error, capacity constraints, hardware failures or defects, natural or man-made disasters, climate and weather events, pandemics, fires, power outages, telecommunication failures, break-ins, sabotage, intentional acts of vandalism, acts of terrorism, civil disruption, political violence and unrest, military actions or war.”

Annual report 2025A · The company itself

“These third parties face their own technology, operating, business and economic risks, and any significant failures by them, including the improper use or disclosure of our confidential client, employee or company information, could cause harm to our business and reputation. An interruption in or the cessation of service by any service provider as a result of systems failures, cybersecurity incidents, capacity constraints, financial difficulties, or for any other reason could disrupt our operations, impact our ability to offer certain products and services, and result in contractual or regulatory penalties, liability claims from clients or employees, damage to our reputation, and harm to our business.”

Annual report 2025A · The company itself

“Regulatory, Legal and Accounting Risks Improper disclosure of confidential, personal or proprietary information and cybersecurity attacks or other security breach of our information systems, or those of third-party vendors we rely on, could result in regulatory scrutiny, legal liability or reputational harm, and could adversely affect our business, financial condition and reputation. We collect, use, store, transmit and otherwise process, confidential, personal and proprietary information relating to our company, acquisition targets, our employees and our clients. This information includes personally identifiable information, protected health information, financial information, mergers and acquisitions information and intellectual property.”

Annual report 2025A · The company itself

“In addition, our increased reliance on technologies that support remote and hybrid work and our employees’ more frequent use of personal devices and non-standard business processing as well as the increasing prevalence of sophisticated cyber-attacks using AI, such as “deep fakes,” may increase the risk of cybersecurity or data breaches from circumvention of security systems, denial-of-service attacks or other cyber-attacks, hacking, “phishing” 22 Table of Contents attacks (including digital or telephonic impersonation), computer viruses, ransomware, malware, malicious or destructive code, employee or insider error, malfeasance, social engineering, physical breaches or other actions.”

Annual report 2025A · The company itself

“If we are unable to effectively maintain and enhance our system safeguards in line with evolving cyber threats, including in connection with the integration of acquisitions, we may incur unexpected costs, including litigation costs, regulatory enforcement action, loss of clients, reputational damage, and certain of our systems may become more vulnerable to unauthorized access.”

Annual report 2025A · The company itself

“Our reputation and brand image could be negatively affected by a number of factors, including the safety, quality or reliability of our services, products and operations; cybersecurity incidents and data breaches, including our actual or perceived responses thereto; regulatory compliance; governance issues; our actual or perceived position or lack of position on social and other sensitive matters; and the conduct of our employees and former employees.”

Annual report 2025A · The company itself

“Cyberattacks impacting our networks, systems or data or those of our suppliers or vendors may have a material adverse effect on our operations or results of operations. Cyberattacks – including through the use of malware, computer viruses, distributed denial of services attacks, ransomware attacks, credential harvesting, social engineering and other means for obtaining unauthorized access to or disrupting the operation of our networks and systems or accessing our data and those of our suppliers, vendors and other service providers – could have a material adverse effect on our operations or results of operations.”

Annual report 2025A · The company itself

“AT&T processes and handles personal data of its customers and subscribers, employees of its enterprise customers and its employees.”

Annual report 2025A · The company itself

“An additional driver of IT security investment is the EU Network and Information Systems 2 (NIS 2) Directive, which was adopted into local law by EU countries in 2024. The NIS 2 directive sets a new regulatory baseline of cybersecurity requirements to be implemented in public and private sector organizations which provide vital functions for society. A large percentage of Atea’s customers fall within the scope of the NIS 2 regulation and are required to register and confirm that they have implemented the cybersecurity measures of NIS 2.”

Annual report 2024A · The company itself

“Maintaining strict standards of information security and data protection are essential to our business. We are committed to protecting personal data to ensure we respect the fundamental rights and freedoms of individuals.”

Annual report 2024A · The company itself

“Our Information Security Management System and operations comply with all applicable laws, including the GDPR and adhere to the ISO 27001 standard.”

Annual report 2024A · The company itself

“Our adherence to GDPR, along with our ISO/IEC 27001 certification, ensures we consider the perspective of consumers and end-users in our operations across the Nordic and Baltic regions. This compliance and certification demonstrates our dedication to maintaining the highest standards of information security and data protection.”

Annual report 2024A · The company itself

“These actions were determined through a comprehensive risk assessment process, ensuring alignment with legislative requirements such as GDPR and best practices outlined in ISO 27001.”

Annual report 2024A · The company itself

“Critical services exposed on the internet are penetration tested annually by external party. These services are also vulnerability scanned internally every month.”

Annual report 2024A · The company itself

“Cyber security risks are increasing in importance and can have a major impact on the Group’s operations.”

Annual report 2024A · The company itself

“Cyber-attacks or acts of cyber-terrorism could disrupt our business operations and information technology systems or result in the loss or exposure of confidential or sensitive customer, employee or Company information. Our business operations and information technology systems may be vulnerable to an attack by individuals or organizations intending to disrupt our business operations and information technology systems. Disruption of those systems could adversely impact our ability to safely deliver natural gas to our customers, operate our pipeline and storage systems, or serve our customers timely.”

Annual report 2025A · The company itself

“The use of AI applications has resulted in, and may in the future result in, cybersecurity incidents that implicate the personal data of end users of such applications.”

Annual report 2026A · The company itself

“As we digitize Autodesk and use cloud- and web-based technologies to leverage customer data to deliver the total customer experience, we are exposed to increased security risks and the potential for unauthorized access to, or improper use, disclosure, or other processing of, our and our customers’ information.”

Annual report 2026A · The company itself

“The risk of a security incident, particularly through cyber-attack or cyber intrusion, including by computer hackers, foreign governments, and cyber terrorists, has increased as the number, intensity, and sophistication of attempted attacks and intrusions from around the world have increased. These threats include, among others, identity theft, unauthorized access, DNS attacks, wireless network attacks, viruses and worms, malware, bugs, vulnerabilities, advanced persistent threats, application-centric attacks, peer-to-peer attacks, social engineering, phishing, credential stuffing, malicious file uploads, backdoor trojans, supply chain attacks, ransomware attacks, and distributed denial of service attacks.”

Annual report 2026A · The company itself

“Additionally, these threats continue to evolve in sophistication and volume and are difficult to detect and predict due to advances in electronic warfare techniques, advances in cryptography and other technologies, including AI and machine learning.”

Annual report 2026A · The company itself

“Use of open source software may also present additional security risks because the public availability of such software may make it easier for hackers and other third parties to determine how to compromise our platform.”

Annual report 2026A · The company itself

“There have been and may continue to be significant supply chain attacks, and we cannot guarantee that our or our such third parties’ systems have not been breached or otherwise compromised or that they do not contain exploitable defects, bugs, or vulnerabilities that could result in an incident, breach, or other disruption to, our or these third parties’ systems. Any security breach or incident involving such third parties could compromise the integrity or availability of, or result in the theft or unauthorized use, modification, or other processing of, our and our customers’ data.”

Annual report 2026A · The company itself

“We have been, and expect we will continue to be, the subject of cybersecurity attacks, including unauthorized intrusion, malicious software infiltration, network disruption, denial of service, corruption of data, ransomware attack, insider threats, and theft of sensitive information (including our intellectual property). Although none of the cybersecurity incidents that we have identified to date have materially affected us, including our business strategy, operations, results of operations, or financial condition, we continue to face significant known and unknown cybersecurity threats.”

Annual report 2026A · The company itself

“Our systems and the third-party systems with which we interact are subject to damage, failure or interruption due to various reasons such as: power or other 19 Table of Contents critical infrastructure outages, facility damage, physical theft, telecommunications failures, malware, security incidents, malicious cyber-attacks, including the use of malicious codes, worms, phishing, spyware, denial of service attacks and ransomware, natural disasters and catastrophic events, inadequate or ineffective redundancy measures; and design or usage errors by AutoZoners, contractors or third-party service providers.”

Annual report 2025A · The company itself

“While addressing vulnerabilities is a priority for us, the methods used to obtain unauthorized access are constantly evolving and increasing in frequency and sophistication, including through the use of evolving artificial intelligence tools to identify and exploit vulnerabilities.”

Annual report 2025A · The company itself

“While we have not experienced a material breach of our information systems or data to date, unauthorized parties have in the past gained access and exfiltrated data, and will continue to attempt to do so as the result of a cyber-attack, misconduct or error by an AutoZoner, job applicant, customer, vendor or third party, system vulnerabilities or compromises, fraud, hacking, phishing attempts, malware, ransomware, other malicious codes or other intentional or unintentional acts.”

Annual report 2025A · The company itself

“We rely extensively on information technology systems, some of which are managed or provided by third-party service providers, to collect, analyze, process, store, manage, transmit and protect key business processes, transactions and data, such as sales data, customer data, employee data, demand forecasting, merchandise ordering, inventory replenishment, supply chain management, payment processing, order fulfillment and more.”

Annual report 2025A · The company itself

“Att vara verksam på den finansiella marknaden innebär en risk för att produkter och tjänster utnyttjas av kriminella för penningtvätt eller finansiering av terrorism, bedrägerier, otillbörlig marknadspåverkan eller insiderhandel. Finansiell brottslighet utgör ett allvarligt hot mot det finansiella systemet och därmed mot samhället i stort.”

Annual report 2024A · The company itself

“Finansiell brottslighet är ett hot mot hela samhället.”

Annual report 2024A · The company itself

“Med våra viktigaste leverantörer och motparter förs en kontinuerlig dialog, där framför allt frågor kring säkerhet och datahantering är en central aspekt. Det finns även en uppförandekod för leverantörer för att tydliggöra att hållbarhet är en central aspekt för Avanza och vilken förväntan vi har på våra motparter.”

Annual report 2024A · The company itself

“Avanzas verksamhet bedrivs digitalt, med krav på hög säkerhet, stabilitet och tillgänglighet.”

Annual report 2024A · The company itself

“Key competitive factors in these product categories include product performance and reliability; product features (including live-streaming, GPS tracking, pre-event buffering, real-time alerting and license plate recognition accuracy); battery life and power options; ease of deployment and integration with existing infrastructure; product quality and warranty; total cost of ownership; data security, privacy and information workflows; interoperability with other public safety systems; company reputation and financial strength; and customer satisfaction and relationships.”

Annual report 2025A · The company itself

“Governmental Regulation U.S. and foreign laws and regulations govern matters central to our business, including privacy and data protection; regulation of certain of our conducted energy devices (“CEDs”) as firearms; telecommunications and spectrum use; export controls; government procurement; environmental and sustainability requirements; economic and trade restrictions; and other regulatory regimes applicable to our products and operations.”

Annual report 2025A · The company itself

“We could experience negative publicity (which may be raised by consumer advocacy groups, third party interest groups, investors, employees or other stakeholders) for a variety of reasons, including product safety issues, threatened or pending legal or regulatory proceedings, product claims, advertising and promotional practices, sustainability or policy issues, materials sourcing or cybersecurity incidents.”

Annual report 2025A · The company itself

“If our security measures or those of our third party providers, including cloud storage providers, are breached, resulting in unauthorized access to our or our customers’ data, it could undermine confidence in our network, data centers, and services leading to reduced customer use of our products and services and significant legal and financial exposure and liabilities. Security breaches of our products and services could result in the unauthorized release, gathering, monitoring, misuse, loss or destruction of our customers’ data.”

Annual report 2025A · The company itself

“Delayed detection of sophisticated threats could allow attackers to remain undetected for extended periods, increasing potential damage to our operations, intellectual property, and customer data. Moreover, our security measures and those of our third party service providers or customers may not immediately detect such security breaches. Although we have developed systems and processes that are designed to protect our data and user data, and to prevent or detect data loss and security breaches, we have been in the past and are likely to remain a frequent target of cybersecurity intrusion attempts and we cannot assure that such measures will provide absolute security.”

Annual report 2025A · The company itself

“Recent developments in the threat landscape include the use of AI and machine learning by attackers to automate, enhance, and evade detection during cyber attacks, along with an increased number of cyber extortion and ransomware incidents. These attacks may involve higher financial ransom demands and demonstrate increasing sophistication, including novel ransomware techniques, diverse methodologies, and advance capabilities such as adaptive malware and deepfake-enabled phishing schemes.”

Annual report 2025A · The company itself

“A security breach could expose us to a risk of loss or inappropriate use of proprietary and sensitive data, or the denial of access to such data. A real or perceived security breach could also result in reduced confidence in the security of our products and services, damage our reputation, disrupt our business, subject us to third party lawsuits, regulatory fines or investigations or otherwise subject us to legal liability, significantly harm our business prospects, operating results and financial condition.”

Annual report 2025A · The company itself

“We may also face increased scrutiny regarding data privacy and security risks related to the data we use to train and evaluate AI models, as breaches or misuse of this data and associated terms and conditions could expose us to significant liabilities.”

Annual report 2025A · The company itself

“Our trusted network seamlessly integrates software and hardware with a range of connected devices, including TASER energy devices, cameras and sensors, drones and robotics, cloud-based evidence management, records management, real-time operations software, critical incident and emergency response systems, immersive training, and productivity tools – all enhanced by artificial intelligence (“AI”).”

Annual report 2025A · The company itself

“Our IT systems and Technology are vulnerable to breakdown, interruption, cyber and other security attacks, system malfunction, unauthorized access, inadvertent exposure or disclosure of information, theft, and other events and, at times, requires the manual application of security upgrades or patches on each machine or device that utilizes the Technology. Third-party systems and solutions that we rely on are also vulnerable to the same risks and may contain defects in design or manufacture or other problems that could result in system disruption or compromise the information security of our own systems, products, and services.”

Annual report 2025A · The company itself

“Security threats, including cyber and other attacks, have become very sophisticated, frequent, and adaptive. The adversarial use of AI also poses unique challenges and may impact real-time detection capabilities and containment efforts.”

Annual report 2025A · The company itself

“Further, we expect that the breadth and complexity of our information and technology systems and infrastructure will increase as we work to expand our product offerings to utilize and generate data analytics and potentially AI (which create emerging enterprise risks, including cybersecurity, monitoring, and oversight). See “Risks Relating to Our Operations – We are exposed to risks associated with incorporating AI, machine learning and other emerging technologies into our products, services and operations”.”

Annual report 2025A · The company itself

“The continuing evolution of technology we use, including cloud-based computing, open-source software, data hosting, AI, and reliance on third parties and Software as a Service (Saas) solutions, whom may also use open-source software, cloud-based computing, data hosting, or AI tools, create additional opportunities for the unintentional, intentional, unauthorized or unlawful disclosure, exposure, dissemination, loss, alteration, access or destruction of Protected Information stored or processed in our devices, systems, servers, infrastructure, and products (collectively, Technology), and those of our Saas providers and third party service providers.”

Annual report 2025A · The company itself

“Additionally, certain of our products and systems collect Protected Information regarding customers, partners, patients and their therapies, and are internet enabled and connect to our systems, hospital networks, electronic medical record systems, or electronic health record systems, and are subject to the same risks, and could impact patient safety and lead to field actions or product recalls.”

Annual report 2025A · The company itself

“We, like other global companies, have experienced cyber incidents in the past (including ones related to the unauthorized access to or disclosure of data and to certain of our third-party service providers), and may experience them in the future. These events have exposed and may continue to expose vulnerabilities in our information technology systems, and could expose Protected Information to unauthorized third parties and/or cause temporary or loss or unavailability of such information.”

Annual report 2025A · The company itself

“We could also suffer strained relationships with customers, business partners, physicians and other healthcare professionals, increased costs, litigation or other negative consequences as a result of such cyber incidents.”

Annual report 2025A · The company itself

“Additionally, our ongoing integration of Hillrom and the sale of our Kidney Care business, as well as a number of our employees having fully remote or hybrid work arrangements expose us to, among other things, heightened risks related to our information technology systems and networks, including cyber attacks, computer viruses, malicious software, security breaches and telecommunication failures, both for systems and networks we control directly and for those that employees and third-party developers rely on to work remotely.”

Annual report 2025A · The company itself

“However, we face risks and uncertainties related to the development, adoption and use of AI, ML and other emerging technologies. Additionally, our internal AI-related policies may not be effective in managing AI use and reducing inherent risks associated with the use of AI, including but not limited to AI-specific cybersecurity risks.”

Annual report 2025A · The company itself

“We also may have more difficulty protecting or enforcing our regulated personal data, confidential data, and intellectual property rights as a result of these technologies, and there may be a risk of data leakage or infringing on the intellectual property or data rights of others which could lead to regulatory action, or litigation, arbitration or other disputes over the ownership, validity, scope or enforcement of our or others’ patents, trademarks, copyrights, trade secrets or other proprietary rights.”

Annual report 2025A · The company itself

“Governmental authorities are also increasingly imposing cyber incident disclosure regulations with differing criteria for what incidents must be reported as well as the timelines in which to report them.”

Annual report 2025A · The company itself

“Operational Risks Cybersecurity incidents and breaches or breakdowns of our information and technology systems or infrastructure could have a material adverse effect on our operations. We rely on a large number of information and technology (“IT”) systems and related infrastructure, including services provided to us by third-party vendors to operate our business.”

Annual report 2025A · The company itself

“Table of Contents We are also subject to complex and rapidly evolving privacy and data protection laws, regulations and standards which govern the collection, use, storage, transfer, sharing and processing of personal data (particularly sensitive health information) across the U.S. and a significant number of other countries where we operate. The nature of our technologies and data-driven solutions amplifies privacy and data protection risks, especially as we employ could-based infrastructures, AI and other emerging digital capabilities.”

Annual report 2025A · The company itself

“These laws, rules and regulations require, among other things, proactive implementation of comprehensive compliance programs, continuous enhancement of internal policies, business practices, processes, and integration of technical and organizational safeguards across all assets and activities that process personal data. These requirements often entail operational constraints and higher compliance costs and may require us to modify existing or future products, potentially impacting innovation timelines and financial performance.”

Annual report 2025A · The company itself

“Non-compliance by third-party vendors, manufacturers, or service providers (especially those involved in data processing) can expose us to liability indirectly. Cybersecurity incidents, system failures, or breaches involving our own infrastructure or that of our partners may trigger regulatory scrutiny, financial penalties, business interruption, reputational harm, loss of competitive advantage and customer trust, as well as privacy litigation and civil lawsuits with damages.”

Annual report 2025A · The company itself

“Cybersecurity risks could result in economic losses to our businesses and reputational damage.”

Annual report unknown yearA · The company itself

“Lubrizol expends significant capital to ensure the safety of its employees and the communities where it operates, as well as delivering on its commitments to operational excellence and cybersecurity.”

Annual report unknown yearA · The company itself

“If we fail to secure these systems against attacks, or fail to effectively configure, upgrade and maintain our hardware, software, network, and system infrastructure and improve the efficiency, resiliency and capacity of our systems, it could cause system interruptions and delays and hinder our ability to accept and fulfill customer orders, provide customer service and/or perform other necessary business functions. Any interruption could have a material adverse impact on our revenue and operations, cause us to incur material costs and/or adversely affect our reputation.”

Annual report 2026A · The company itself

“Our business involves the collection, use, sharing and retention of personal information (including payment card information and protected health information) and confidential business information. We share personal and confidential information with suppliers and other third parties and use third-party technology and systems that process and transmit information for a variety of activities. We have been the target of attempted cyber-attacks and other security threats, and we may be subject to breaches of our information technology systems. While we engage in significant cybersecurity and data-protection efforts, criminal activity (such as cyberattacks), lapses in our controls, impersonation of individuals with proper access controls, or the intentional or negligent actions of employees, business associates or third parties may undermine our cybersecurity and privacy measures.”

Annual report 2026A · The company itself

“The integration of AI into our operations introduces cybersecurity and privacy risks (including unauthorized or misuse of AI tools) and could lead to potential unauthorized access, use, acquisition, release, disclosure, alteration or destruction of personal or confidential information or challenge the stability of our platforms. Further, evolving consumer behaviors, such as shopping through AI-driven services, introduces growing complexity and heightened cybersecurity and privacy risks. These trends increase the complexity of bot mitigation strategies, requiring organizations to maintain robust cybersecurity controls while ensuring discoverability within agentic services and AI-powered search environments.”

Annual report 2026A · The company itself

“Increasing costs associated with information security and privacy, such as increased investment in technology and qualified staff, costs of compliance, costs resulting from fraud or criminal activity and costs of cyber and privacy insurance, could cause our business and results of operations to suffer materially. In addition, any compromise of our data security may materially increase the costs we incur to protect against such breaches and could subject us to additional legal risk. Any compromise of our customer information or other confidential information could have a material adverse impact on our reputation and/or our relationships with our customers and partners, which may in turn have a negative impact on our revenue and may expose us to material costs, penalties and claims.”

Annual report 2026A · The company itself

“Technological dependencies remain significant, including areas such as data analytics, cybersecurity, and cloud infrastructure. Our investments in AI, automation, and AdTech - including our Playbook and AdVantage platforms - further highlight the strategic importance of innovation for maintaining competitive advantage and operational resilience.”

Annual report 2025A · The company itself

“To provide users with tailored and educational experiences, we process various categories of user-related and personal data. This processing is governed by our Data Ethics Policy - developed in accordance with section 99d of the Danish Financial Statements Act - and supported by our GDPR compliance framework.”

Annual report 2025A · The company itself

“Cyber- och informationssäkerhetsrisker Cyber- och informationssäkerhetsrisker är en betydande utmaning för koncernen, särskilt med tanke på användningen av olika IT-plattformar både internt och för att skapa en attraktiv online shoppingmiljö för kunderna. Eventuella störningar i dessa plattformar, till följd av exempelvis ransomware-, dataintrång- eller DDoS-angrepp, kan allvarligt påverka interna processer och leda till driftstopp i externa system. Dessa risker, inklusive de som härrör från betalningsbedrägerier, insiderhot eller phishing, har potential att negativt påverka koncernens verksamhet, finansiella ställning och resultat.”

Annual report 2024A · The company itself

“DATASÄKERHET OCH HANTERING AV PERSONUPPGIFTER Vi lägger stor vikt vid att värna om datasäkerhet samt våra kunders och anställdas integritet och personuppgifter. Vi behandlar inte kreditkortsuppgifter utan detta hanteras av tredjepartslösningar.”

Annual report 2024A · The company itself

“Inom labautomation måste man följa 21 CFR Part 11, EU GMP Annex 11 samt den nyligen utfärdade EU Cyber Resilience Act. Den sistnämnda säkerställer att automatiserade system för datainsamling, analys och rapportering upprätthåller dataintegritet, säkerhet och spårbarhet för att kunna uppfylla kundernas behov.”

Annual report 2024A · The company itself

“IT och IT-säkerhet Riskbeskrivning En informationssäkerhetsrisk handlar om hur sannolikt det är att ett informationssäkerhethot inträffar och vilken affärsmässig effekt ett sådant hot kan få. På så vis fastställs den informationssäkerhetsrisknivå som är förknippad med ett hot och den sårbarhet som gör det möjligt för hotet att realiseras.”

Annual report 2024A · The company itself

“In particular, a broad privacy law in California, the California Consumer Privacy Act (“CCPA”), came into effect in January 2020. The CCPA has some of the same features as the GDPR (discussed below) and has already prompted several other states to follow with similar laws.”

Annual report unknown yearA · The company itself

“The EU General Data Protection Regulation that became effective in May 2018 (“GDPR”) has imposed significantly stricter requirements in how we collect, transmit, process, and retain personal data, including, among other things, in certain circumstances a requirement for almost immediate notice of data breaches to supervisory authorities and prompt notice to data subjects with significant fines for non-compliance.”

Annual report unknown yearA · The company itself

“Several other countries in which we do business have passed, and other countries are considering passing, laws that require personal data relating to their citizens to be maintained on local servers and impose additional data transfer restrictions.”

Annual report unknown yearA · The company itself

“A significant disruption in, or breach of security of, our information technology systems or data, or violation of data privacy laws, could result in damage to our reputation, data integrity and/or subject us to costs, fines, or lawsuits under data privacy or other laws or contractual requirements.”

Annual report unknown yearA · The company itself

“Cybersecurity threats and incidents are increasing in their frequency, sophistication and intensity, and are becoming increasingly difficult to detect, particularly when they impact vendors, customers or suppliers, and other companies in our supply chain. Cybersecurity threats and incidents are often carried out by motivated, well-resourced, skilled and persistent threat actors, including nation states, organized crime groups, “hacktivists” and may include or target employees or contractors acting with careless or malicious intent. Recent developments in the threat landscape include use of adversarial AI techniques and machine learning, as well as an increased number of cyber extortion attacks, with higher financial ransom demand amounts and increasing sophistication and variety of ransomware techniques and methodology.”

Annual report 2025A · The company itself

“While we continue to build and improve our systems and infrastructure, including our business continuity plans, there can be no assurance that our efforts will detect and prevent cybersecurity threats or incidents in our systems and any such incidents could materially adversely affect our business and operations and/or result in the loss of critical or sensitive information, which could result in material financial, legal, operational or reputational harm to us, loss of competitive advantage or loss of consumer confidence.”

Annual report 2025A · The company itself

“Cybersecurity and data protection risks could result in the loss of data, interruptions in our business, and damage to our reputation, and subject us to regulatory actions, increased costs and financial losses, each of which could have a material adverse effect on our business and results of operations. Our operations are highly dependent on our technology platforms and we rely heavily on our analytical, financial, accounting, communications and other data processing systems. Our systems face ongoing cybersecurity threats and attacks, which could result in the loss of confidentiality, integrity or availability of such systems and the data held by such systems.”

Annual report 2025A · The company itself

“In addition, the risk of cyber and data security threats to us is exacerbated with the advancement of artificial intelligence, which malicious third parties are using to create new, sophisticated and more frequent attacks.”

Annual report 2025A · The company itself

“These third-party service providers also face ongoing cybersecurity threats and compromises of their systems. These cybersecurity threats and compromises could occur as a result of threat actors impersonating Blackstone or its employees, including through the use of artificial intelligence technologies. Such technologies could make such impersonation more likely to occur or appear more credible.”

Annual report 2025A · The company itself

“Our funds’ portfolio companies also rely on data processing systems and the secure processing, storage and transmission of information, including payment and health information, which in some instances are provided by third parties. A disruption or compromise of these systems could have a material adverse effect on the value of these businesses.”

Annual report 2025A · The company itself

“Table of Contents Our and our funds’ portfolio companies’ technology platforms, data and intellectual property are also subject to a heightened risk of theft or compromise as a result of operations outside the United States, in particular in those jurisdictions that do not have comparable levels of protection of proprietary information and assets such as intellectual property, trademarks, trade secrets, know-how and customer information and records. In addition, we and our funds’ portfolio companies may be required to compromise protections or forego rights to technology, data and intellectual property in order to operate in or access markets in a foreign jurisdiction. Any such direct or indirect compromise of these assets could have a material adverse impact on us and our funds’ portfolio companies.”

Annual report 2025A · The company itself

“Data security and privacy compliance obligations to which we are subject impose compliance costs on us, which could increase significantly as laws and regulations evolve globally. Our compliance obligations include those relating to U.S. laws and regulations, including, without limitation, state regulations such as the CPRA, which provides for enhanced consumer protections for California residents, a private right of action for data breaches and statutory fines and damages for data breaches or other California Consumer Privacy Act (“CCPA”) violations, as well as a requirement of “reasonable” cybersecurity.”

Annual report 2025A · The company itself

“Table of Contents Any inability, or perceived inability, by us or our funds’ portfolio companies to adequately address data protection or privacy concerns, or comply with applicable laws, regulations, policies, industry standards and guidance, contractual obligations, or other legal obligations, even if unfounded, could result in significant legal, regulatory and third-party liability, increased costs, disruption of our and our funds’ portfolio companies’ business and operations, and a loss of client (including investor) confidence and other reputational damage. Many regulators have indicated an intention to take more aggressive enforcement actions regarding data security and privacy matters, and private litigation resulting from such matters is increasing and resulting in progressively larger judgments and settlements. Specifically, the SEC’s stated 2026 examination priorities include an intended focus on adviser’s policies and practices as it relates to the prevention of interruptions to mission-critical services and protection of investor information, records and assets.”

Annual report 2025A · The company itself

“The volume and reliance on data and algorithms also make AI Technologies, and in turn us and our portfolio companies and investments, more susceptible to cybersecurity threats, including the compromise of underlying models, training data, or other intellectual property.”

Annual report 2025A · The company itself

“For example, a user may input confidential information, including material non-public information or personal identifiable information, into AI Technology applications, resulting in such information becoming part of a dataset that is accessible by third-party AI Technology applications and users, including our competitors. Such actions could subject us to legal and regulatory 36 Table of Contents investigations and/or actions.”

Annual report 2025A · The company itself

“•real or perceived improper or unauthorized use of, disclosure of, or access to data; •real or perceived security breaches or incidents or human error in administering our software, hardware, and systems; •systems failures, interruptions, delays in service, catastrophic events, and resulting interruptions in the availability of our products or services or those of our sellers; •any failure to safeguard the bitcoin we hold on behalf of ourselves and other parties; •our risk management efforts; •our dependence on payment card networks and acquiring processors; •our reliance on third parties and their systems for a variety of services, including the processing of transaction data and settlement of funds; •our dependence on key management and any failure to attract, motivate, and retain our employees; •our operational, financial, and other internal controls and systems; •any shortage, price increases, tariffs, changes, delay or discontinuation of our key components; and •the integration of our services and our products with a variety of operating systems.”

Annual report 2025A · The company itself

“Operational Risks We, our sellers, our partners, and others who use our services obtain and process a large amount of data. Any real or perceived improper or unauthorized use of, disclosure of, or access to such data could harm our reputation as a trusted brand, as well as have a material and adverse effect on our business.”

Annual report 2025A · The company itself

“Our products and services operate in conjunction with, and we are dependent upon, third-party products and components across a broad ecosystem. There have been and may continue to be significant attacks on third-party providers, and we cannot guarantee that our or our third-party developers or vendors’ systems and networks have not been breached or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our systems and networks or the systems and networks of third parties that support us and our products and services.”

Annual report 2025A · The company itself

“Regulations promulgated under the CCPA in September 2025 impose restrictive new obligations regarding, among other things, automated decision-making technology and cybersecurity programs.”

Annual report 2025A · The company itself

“Bitcoin Ecosystem •Bitkey: Bitkey is a self-custody bitcoin wallet that gives individuals secure control over their bitcoin without relying on third-party custodians.”

Annual report 2025A · The company itself

“Risken för intrång i IT-miljön med utpressning eller liknande, som kan få IT-system att stanna upp och därmed stoppa produktion eller annan verksamhet. Sedan 2021 driver Boliden ett program för att systematiskt höja sin säkerhetsnivå.”

Annual report 2024A · The company itself

“If threat actors are able to circumvent, interrupt, or adversely affect our security measures, including as a result of our own acts or omissions, it could result in a compromise or breach of consumer, partner, or employee data. Data security is essential to maintaining consumer and partner confidence in our services and the uninterrupted availability of our web and mobile platforms is essential for our business.”

Annual report 2025A · The company itself

“Vulnerabilities in our consumer and partner systems could and have resulted in unauthorized access to personal and confidential data.”

Annual report 2025A · The company itself

“These risks are likely to increase as we expand our offerings, integrate our products and services, continue to incorporate AI, and store and process more data.”

Annual report 2025A · The company itself

“Cyberattacks, system vulnerabilities, or inadequate system capacity could lead to sustained service outages, data loss, reduced revenue, increased costs, liability claims, or harm to our competitive position.”

Annual report 2025A · The company itself

“Any publicized privacy and security problems could negatively affect consumers' or partners' willingness to use our services.”

Annual report 2025A · The company itself

“Dataskydd och informationssäkerhet: Intrång i kunduppgifter Att skydda kunduppgifter är avgörande för förtroendet för Boozts varumärke och affärsmodell, och detta har en direkt påverkan på kundernas lojalitet och bolagets finansiella resultat. Vår strategi fokuserar på starka säkerhetsåtgärder och hög transparens för att begränsa de väsentliga finansiella risker och ryktesrisker som dataintrång medför, till exempel vid cyberattacker.”

Annual report 2024A · The company itself

“We rely on the proper function, availability and security of information technology systems to operate our business and a cyber-attack or other breach of these systems could have a material adverse effect on our business, financial condition or results of operations. We rely on information technology (IT) and operational technology (OT) systems, including technology from third party vendors, to manufacture and ship our products, as well as to process, transmit and store electronic information in our day-to-day operations.”

Annual report 2025A · The company itself

“Sikkerhet Sikkerhetslandskapet i 2024 var preget av økende kompleksitet. Cyberangrepene blir mer sofistikerte, og trusselaktørene utnytter nye teknologier og metoder for å nå sine mål. Angrepene blir også stadig mer målrettet og tilpasset.”

Annual report 2024A · The company itself

“IT-sikkerhetsrisiko Urolighet globalt gjør at trusselnivået med hensyn til IT-sikkerhet er høyt nasjonalt og globalt. Dette innebærer økende informasjonssikkerhetsrisiko i våre kundeleveranser og med hensyn til konsernets interne infrastruktur og egne systemer.”

Annual report 2024A · The company itself

“Leverandørkjedeangrep er vurdert som å være en stor trussel av både Nasjonal Sikkerhetsmyndighet (NSM), og av Bouvets kunder.”

Annual report 2024A · The company itself

“Økte krav til sikkerhet og bærekraft samt en aldrende befolkning er også viktige drivere.”

Annual report 2024A · The company itself

“Oppdragene kan blant annet omfatte håndtering av regulatoriske krav på miljøog klimafeltet, digitalt samfunnsansvar og krav til informasjonssikkerhet.”

Annual report 2024A · The company itself

“Målet er å sikre kundenes og egne data mot sikkerhetsbrudd. Konsernet jobber aktivt for å motvirke sikkerhetsbrudd på interne systemer gjennom kontinuerlig oppdatering av tekniske sikkerhetsløsninger, prosedyrer og rutiner, i tillegg til evaluering av leverandører og samarbeidspartnere.”

Annual report 2024A · The company itself

“Som samfunnsaktør og leverandør for kunder med viktige samfunnsoppdrag har Bouvet en viktig rolle i å hjelpe kundene med å møte disse utfordringene. Gjennom sikkerhetsrådgivning, implementering av sikkerhetsløsninger og bistand ved hendelser kan Bouvet bidra til å øke sikkerhetsnivået hos sine kunder.”

Annual report 2024A · The company itself

“Tjenester For mange kunder er Bouvet en langsiktig, strategisk partner med et bredt tjenestespekter innen informasjonsteknologi, design, kommunikasjon og virksomhetsstyring.”

Annual report 2024A · The company itself

“We have faced, and will continue to face, risks of incidents, whether through cyber attacks or cyber intrusions through the Cloud, the Internet, phishing attempts, ransomware and other forms of malware, computer viruses, email attachments, extortion, exfiltration and other scams. Although we make efforts to maintain the security and integrity of our information technology systems and data, these systems and the proprietary, confidential and personal information that resides on or is transmitted through them, are subject to the risk of a cybersecurity incident or disruption, and there can be no assurance that our security efforts and measures, and those of our third-party vendors, will prevent breakdowns or incidents to our or our third-party vendors’ systems, which could adversely affect our business strategy, results of operations, or financial condition.”

Annual report 2025A · The company itself

“Cybersecurity risks continue to develop, including as a result of threat actors increasingly targeting employees and supply chains and geopolitical tensions leading to an increase in sabotage, espionage and cyber attacks. As the cyber-threat landscape evolves, these attacks are growing in frequency, sophistication and intensity, and due to the nature of some of these attacks, there is also a risk that they may remain undetected for a period of time.”

Annual report 2025A · The company itself

“Cybersecurity threats or other security breaches, or any other impairment of the confidentiality, integrity or availability of our IT systems, or those of one or more of our corporate infrastructure vendors, could have a material adverse effect on our business.”

Annual report 2025A · The company itself

“Failure of our software portfolio to manage and secure IT infrastructures and environments could have a material adverse effect on our business. Certain aspects of our software portfolio are intended to manage and secure IT infrastructures and environments, and as a result, we expect these products to be ongoing targets of cyber-attacks.”

Annual report 2025A · The company itself

“Certain aspects of our software portfolio are intended to manage and secure IT infrastructures and environments, and as a result, we expect these products to be ongoing targets of cyber-attacks. Open source code or other third-party software used in these products could also be targeted and may make our software vulnerable to additional security risks not posed by purely proprietary software.”

Annual report 2025A · The company itself

“In the past, elements of our proprietary source code have been exposed in an unauthorized manner. It is possible that such exposure of source code could reveal unknown security vulnerabilities in our software that could be exploited by malicious actors.”

Annual report 2025A · The company itself

“A successful cyber-attack, or false reports thereof, involving our software could cause customers and potential customers to believe our software is ineffective or unreliable and result in, among other things, the loss of customers, unfavorable publicity, damage to our reputation, difficulty in marketing our software, and allegations by our customers that we have not performed our contractual obligations, and could give rise to significant costs, including costs related to developing solutions or indemnification obligations under our agreements. Any such event could adversely impact our revenue and results of operations.”

Annual report 2025A · The company itself

“Additionally, concerns about government interference and digital sovereignty, as well as expanding privacy, cybersecurity and data governance legislation, particularly in cloud computing and AI, could adversely affect our customers, our products and services and our own data management practices. The theft, loss or misuse of personal data collected, used, stored or transferred by us to run our business could result in significantly increased business and security costs or costs related to defending legal claims.”

Annual report 2025A · The company itself

“We conduct annual reviews with many of our clients of our cybersecurity and data security policies, practices and controls, which, together with our ongoing engagement with regulators across the world, helps us keep pace with cybersecurity and data security standards and support our product development and technology decisions.”

Annual report 2026A · The company itself

“As a provider of technology services to financial institutions, certain aspects of our U.S. operations are subject to regulatory examination by the Federal Financial Institutions Examination Council (“FFIEC”), an interagency body of the Federal Deposit Insurance Corporation, the Office of the Comptroller of the Currency, the Board of Governors of the Federal Reserve System, the National Credit Union Administration, and the Consumer Financial Protection Bureau. Periodic examinations by the FFIEC generally include areas such as internal audit, risk management, business continuity planning, information security, systems development, operational resiliency, and third-party vendor management to identify potential risks related to our services that could adversely affect our banking and financial services clients.”

Annual report 2026A · The company itself

“Security breaches or cybersecurity incidents could adversely affect our financial results and ability to operate, could result in personal, confidential or proprietary information being misappropriated, and may cause us to be held liable or suffer harm to our reputation. We process and transfer sensitive data, including personal information, valuable intellectual property and other proprietary or confidential data provided to us by our clients, which include financial institutions, public companies, mutual funds, and healthcare companies. We also handle personal information of our employees in connection with their employment.”

Annual report 2026A · The company itself

“Information security threats continue to evolve, such as the increasing availability and adoption of AI technologies by malicious actors, resulting in increased risk and exposure and increased costs to protect against the threat of information security breaches or to respond to or alleviate problems caused by such breaches. These AI-enabled capabilities have accelerated the sophistication and frequency of cybersecurity threats and may make it more difficult to detect, prevent, and respond to attacks.”

Annual report 2026A · The company itself

“Due to the nature of our products and services, we are subject to the risk of information security incidents, including those impacting our clients and third-party vendors. Some of our clients and third-party vendors have experienced cybersecurity incidents. Failure by our clients or third-party vendors to notify us in a timely manner of cybersecurity incidents impacting their operations could result in unauthorized access to our systems and data and materially affect our business, operations and financial results.”

Annual report 2026A · The company itself

“We face ongoing cybersecurity threats to our information technology infrastructure including data loss, data exfiltration, denial of service, and ransomware, among others. We have experienced non-material cybersecurity incidents, attempts to breach our systems and other similar attacks, including incidents affecting our clients and third-party vendors, which if such attacks or attempts are successful in the future could cause harm to our business and our reputation and challenge our ability to provide reliable services, as well as negatively impact our results of operations and financial condition.”

Annual report 2026A · The company itself

“If we fail to maintain an adequate information security program or implement sufficient security standards, technology or controls to protect against information security incidents or privacy breaches or fail to identify and adapt to emerging security threats and risks, it could cause us to lose revenues, lose clients and/or damage to our reputation. In addition, any unauthorized access to our information technology systems could result in the use, theft, or disclosure of confidential, sensitive, or personal data, destruction or modification of records, interruptions to our operations and delivery of our services and products, installation of malware, and the potential need to pay ransom. As a result, we may incur significant costs to investigate and remediate such incidents, and to protect against future threats to our information security and information technology systems.”

Annual report 2026A · The company itself

“As a provider of data and business processing solutions, our systems contain a significant amount of sensitive data, including personal information, related to our clients, customers of our clients, our employees, among others. We are, therefore, subject to compliance obligations under federal, state and foreign privacy and information security laws, including in the U.S., the GLBA, HIPAA, CPRA, the PIPEDA in Canada, the GDPR in the European Union and its UK equivalent, and we are subject to compliance with various client industry standards such as PCI DSS as well as Medicare and Medicaid programs related to our clients.”

Annual report 2026A · The company itself

“We have internal policies and controls governing the development, procurement, deployment, and use of AI and RPA by our employees designed to align with globally recognized AI principles, maintain trust with customers and protect us from cybersecurity threats, breaches of data privacy and intellectual property, errors and omissions liability and regulatory enforcement risk; however, our employees could violate these policies and they or external threat actors could circumvent our controls and expose us to such risks.”

Annual report 2025A · The company itself

“A failure by the third parties to: (i) comply with service level agreements in a high quality and timely manner, particularly during periods of our peak demand for their services, (ii) maintain adequate internal controls that may impact our own financial reporting, or (iii) adequately maintain the confidentiality of any of our data or trade secrets or adequately protect or properly use other intellectual property to which they may have access, could result in economic, financial and/or reputational harm to us.”

Annual report 2025A · The company itself

“We are responsible for maintaining the security and privacy of our customers’ confidential and proprietary information and the personal data of their employees. We have put in place administrative, physical, procedures and technological safeguards designed to protect the security and privacy of this information; however, we cannot guarantee that this information will not be improperly disclosed or accessed, or that the administrative, physical, procedures and technological safeguards are adequate to ensure that this information is timely disposed of or deleted in a manner compliant with such policies and applicable law or regulation.”

Annual report 2025A · The company itself

“We are subject to cybersecurity risks and expect to incur increasing costs in an effort to minimize those risks.”

Annual report 2025A · The company itself

“We are committed to implementing safeguards designed to protect our customers’ information, as well as our own information and technology. For additional information on our risks associated with cybersecurity and our use of technology systems and our management of these risks, please see “Item 1A.”

Annual report 2025A · The company itself

“•We face risks related to our operational, technological and organizational infrastructure. •A cyber-attack or other security incident on us or third parties (including their supply chains) with which we conduct business, including an incident that results in the theft, loss, manipulation or misuse of information (including personal information), or the disabling of systems and access to information critical to business operations, may result in increased costs, reductions in revenue, reputational damage, legal exposure and business disruptions. •We face risks resulting from the extensive use of models and data, as well as from our evolving use of AI. •Risks of external fraud exceeding our expectations due to larger, more sophisticated, or more frequent fraud attacks, failure to detect and respond to such attacks and/or the reduced capability to recover losses from those incidents.”

Annual report 2025A · The company itself

“•Compliance with new and existing domestic and foreign laws, regulations and regulatory expectations is costly and complex, and any significant changes may adversely affect our business. •Our required compliance with applicable laws and regulations related to privacy, data protection and data security, in addition to compliance with our own privacy policies and contractual obligations to third parties, may increase our costs, reduce our revenue, increase our legal exposure and limit our ability to pursue business opportunities. •Our businesses are subject to the risk of increased litigation, government investigations and regulatory enforcement. •We face intense competition in all of our markets, which could have a material adverse effect on our business and results of operations. •A change in market preference towards other operators of payment networks and alternative payment providers could result in reduced transaction volume, limited merchant acceptance of our cards and limited issuance of cards on our networks by third parties, and in turn may impact our revenue margins.”

Annual report 2025A · The company itself

“Similar to other large corporations in our industry, we are exposed to operational risk that can manifest itself in many ways, such as errors in execution, inadequate processes, inaccurate models, faulty or disabled technological infrastructure, malicious disruption and fraud by employees or persons outside of our company, whether through attacks on Capital One directly, or on our third-party service providers or customers. In addition, the increased use of near real-time money movement solutions and the use of AI, as well as other emerging technologies, increases the complexity of preventing, detecting and recovering fraudulent transactions.”

Annual report 2025A · The company itself

“In particular, negative public perceptions regarding our reputation, including negative perceptions regarding our ability to maintain the security of our technology systems and protect customer data, could lead to decreases in the levels of deposits that current and potential consumer and commercial customers choose to maintain with us.”

Annual report 2025A · The company itself

“Negative public opinion or damage to our brand could also result from actual or alleged conduct in any number of activities or circumstances, including lending and payment network practices, regulatory compliance, cyber-attacks or other security incidents, accounting issues, corporate governance and sales and marketing, and from actions taken by regulators or other persons in response to such conduct.”

Annual report 2025A · The company itself

“We are also heavily dependent on the security, capability, integrity and continuous availability of the technology systems and networks that we use to manage our internal financial and other systems, monitor risk and compliance with regulatory requirements, provide services to our customers, develop and offer new products and communicate with stakeholders.”

Annual report 2025A · The company itself

“De tre största identifierade riskerna är: Integritetsrisker och GDPR-efterlevnad: Som mjukvaruföretag inom sjukvårdssektorn hanterar Carasent stora mängder känsliga personuppgifter. Bristande efterlevnad av GDPR kan leda till juridiska konsekvenser och skada förtroendet hos kunder och patienter.”

Annual report 2024A · The company itself

“Our business has been and may again in the future be impacted by disruptions to our or third-party providers’ Technology infrastructure, which have resulted and could in the future result from (among other causes) cyber-attacks, infrastructure failures or compromises to our physical security. Cyber-based risks are evolving and include attacks: (i) on our Technology infrastructure; (ii) targeting the security, integrity and/or availability of hardware and software; (iii) exploiting weaknesses or vulnerabilities in our products, or capturing information installed, stored or transmitted in our products (including after the purchase of those products and when they are installed into, or into environments using, third-party products); and (iv) on facilities or similar infrastructure.”

Annual report 2025A · The company itself

“These risks are heightened by the increasingly connected nature of our products and services as we continue to focus on providing digitally-enabled lifecycle solutions to our customers, including due to the use of third-party products to connect these products and services to the internet, which may be subject to additional vulnerabilities beyond our control.”

Annual report 2025A · The company itself

“Our actual or perceived failure to protect such information and data, comply with privacy and security-related requirements, mitigate data loss, and/or prevent a cybersecurity or other incident could damage our reputation and harm our business and operating results. We collect, process, store, share, transmit, disclose, and use sensitive information and other data provided by consumers, employees, and business partners, including personally identifiable information (“PII”) and sensitive personal information ("SPI"), to support our business operations. This information may include social security numbers, credit scores, and financial information.”

Annual report 2025A · The company itself

“Our business involves the handling, storage, and transmission of proprietary information and sensitive or confidential data, including personal information of coworkers, customers, partners, and others, which we must do in compliance with applicable law. In connection with our services business, some of our coworkers have access to our customers’ confidential data and other information.”

Annual report 2025A · The company itself

“Additionally, third parties, such as data center colocation and hosted solution partners, provide services to us and also provide services as a component of our services delivery to customers and to customer systems. These third parties may also utilize or embed AI capabilities in providing their services to us and our customers. These third parties or others that are a part of our supply chain, and their use of AI capabilities, could also be a source of security risk in the event of a failure to protect their own products, security systems and infrastructure and we may not be able to control the manner in which these third parties respond to any security breach.”

Annual report 2025A · The company itself

“Security breaches could result in legal claims or proceedings, liability, or regulatory penalties under laws protecting the privacy of personal information (including those under the European Union’s General Data Protection Regulation and the California Privacy Rights Act), significant remediation costs as well as the loss of partners and existing or potential customers and, ultimately, damage to our brand and reputation and adversely impact our business.”

Annual report 2025A · The company itself

“The success of our business depends on the continuing development, maintenance, and operation of our information technology systems. Our success is dependent on the accuracy, proper utilization, and continuing operation, maintenance, and development of our information technology systems, including our business systems, such as our sales, customer management, financial and accounting, marketing, purchasing, warehouse management, and e-commerce and mobile systems, as well as our operational platforms, including voice and data networks and power systems, which may include third-party hosted systems or systems that may utilize cloud technologies outside of our control.”

Annual report 2025A · The company itself

“Our broad array of offerings ranges from discrete hardware and software products to integrated IT solutions and services that include on-premise and cloud capabilities across hybrid infrastructure, digital experience, and security.”

Annual report 2025A · The company itself

“To help our customers accomplish this, we have built a robust portfolio of integrated IT solutions across hybrid infrastructure, digital experience, security, digital velocity, and services that we provide in on-premise, hybrid, or cloud-based environments.”

Annual report 2025A · The company itself

“•Security: We assess our customers’ security needs and provide them with tools and services to help effectively manage risk, increase business continuity and operational efficiency, and improve their end user experience. We are a security solutions integrator that combines our expertise in advisory, design, solution architecture, and implementation services. Our customer solutions can take the form of hardware, software, or Software as a Service across a multitude of categories such as: endpoint security, email security, web security, intrusion prevention, identity and access management, next-generation firewall, security service edge, security information and event management, exposure and threat management, governance, risk and compliance, data security and governance, cloud infrastructure entitlement management, virtual private network services, network access control, and physical security.”

Annual report 2025A · The company itself

“IT system Risker kopplade till IT-system uppstår framför allt till följd av CellaVisions ökande digitalisering av affärsprocesser, allt strängare krav på informationssäkerhet och ett växande hot från cyberattacker. CellaVision har identifierat tre huvudsakliga riskområden: • Driftsäkerhet – tillgänglighet till IT system och data • Datasäkerhet – risk för förlust av data • Skydd mot intrång – från medarbetare och externa parter CellaVision arbetar proaktivt med IT-säkerhet för att uppfylla de krav som ställs av partners och myndigheter, både nu och i framtiden.”

Annual report 2024A · The company itself

“För att stärka IT-säkerheten gör CellaVision väsentliga investeringar, som att förstärka ITavdelningen och implementera National Institute of Standards Technology (NIST-regelverket).”

Annual report 2024A · The company itself

“Any failure or perceived failure by us to comply with our privacy policies, or applicable data privacy and security laws, regulations, rules, standards or contractual obligations, or any compromise of security that results in unauthorized access to, or unauthorized loss, destruction, use, modification, acquisition, disclosure, release or transfer of personal information, may result in requirements to modify or cease certain operations or practices, the expenditure of substantial costs, time and other resources, proceedings or actions against us, legal liability, governmental investigations, enforcement actions, claims, fines, judgments, awards, penalties, sanctions and costly litigation (including class actions). Any of the foregoing could harm our reputation, distract our management and technical personnel, increase our costs of doing business, adversely affect the demand for our products and services, and ultimately result in the imposition of liability, any of which could have a material adverse effect on our business, financial condition and results of operations.”

Annual report 2025A · The company itself

“Any failure of these third-party vendors' prevention, detection or control systems related to regulatory compliance, compliance with our internal policies, data security and/or cybersecurity or any incident involving the theft, misappropriation, loss or other unauthorized disclosure of, or access to, members' or other constituents' sensitive information could require us to expend significant resources to remediate any damage, interrupt our operations and adversely affect our brand and reputation and also expose us to whistleblower, class action and other litigation, other proceedings, prohibitions on marketing or active or passive enrollment of members, corrective actions, fines, sanctions and/or penalties, any of which could adversely affect our business results of operations, financial condition or cash flows.”

Annual report 2025A · The company itself

“Risk Factors Affecting Safety and Security Risks •The Registrants’ businesses have safety risks. •Cyberattacks, physical security breaches, acts of terrorism or other disruptions could adversely impact our business, financial condition, results of operations and cash flows. •We may not be successful in our adoption, development and deployment of AI, which could adversely affect our business, reputation or financial results. iii General and Other Risks •Our revenues and results of operations are seasonal. •Severe weather events, natural disasters and other climate-related impacts could adversely impact our businesses, financial condition, results of operations and cash flows. •We are exposed to risks related to changes in demand and energy consumption that could adversely impact our business, financial condition, results of operations and cash flows.”

Annual report 2025A · The company itself

“Our actual or perceived ability to prevent, mitigate, prepare for and timely respond to electric outages, natural gas leaks or events and related accidents and similar interruptions caused by severe weather, physical or cybersecurity incidents or other unanticipated events, as well as our own or third parties’ actions or failure to act, can affect customer, regulator and legislator satisfaction or potentially subject us to regulatory action and litigation. For example, CenterPoint Energy, CenterPoint Energy Service Company, LLC and Houston Electric are subject to litigation and claims arising out of Hurricane Beryl and various federal, state and local governmental and regulatory agencies and other entities called for or conducted inquiries and investigations into Hurricane Beryl and the efforts made by Houston Electric to prepare for, and respond to, this event, including the associated electric service outage issues.”

Annual report 2025A · The company itself

“Computer viruses, threat actors, employee or vendor incidents and other external hazards could expose our information systems, and those of third parties who process our data, provide access to systems or that have access to our systems, to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our business, reputation, results of operations and financial condition, and subject us to possible legal claims and liability.”

Annual report 2025A · The company itself

“The sophistication of cybersecurity threats, including those leveraging AI, continues to increase, and the controls and preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems, including the regular testing of our cybersecurity incident response plan, may be insufficient. In addition, new technology that could result in greater operational efficiency, such as AI and cloud-based infrastructure, may further expose our computer systems to the risk of cybersecurity incidents.”

Annual report 2025A · The company itself

“Our contracts with our clients typically contain provisions that require us to keep confidential the information generated from the studies we conduct. In the event the confidentiality of such information is compromised, whether by unauthorized access or other breaches, we could be exposed to significant harm, including termination of customer contracts, damage to our customer relationships, damage to our reputation and potential legal claims from customers, employees and other parties.”

Annual report 2025A · The company itself

“We are required to comply with stringent, complex and evolving laws, rules, regulations and standards in many jurisdictions, as well as contractual obligations, relating to data privacy and security. Any actual or perceived failure to comply with these requirements could have a material adverse effect on our business.”

Annual report 2025A · The company itself

“Information security risks for financial institutions are increasing, in part because of the use of the internet and mobile and cloud technologies to conduct financial transactions, and the increased sophistication and activities, including the use of artificial intelligence technologies, of organized crime, activists, hackers and other external parties, including foreign state actors. Our systems and those of other financial institutions, as well as those of our third-party service providers, have been and will continue to be the frequent target of cyber attacks, malicious code, computer viruses, ransomware, and denial of service attacks that could result in unauthorized access, misuse, loss or destruction of data (including confidential client information), account takeovers, unavailability of service or other events.”

Annual report 2025A · The company itself

“Our systems are vulnerable to disruptions from human error, execution errors, errors in models such as those used for asset management, capital planning and management, risk management, stress testing and compliance, employee misconduct, unauthorized trading, external fraud, computer viruses, distributed denial of service attacks, cyber attacks, terrorist attacks, natural disaster, extreme weather, power outage, capacity constraints, software flaws, events impacting key business partners and vendors, and similar events. For example, we and other financial institutions have been the target of various denial of service attacks that have, in certain circumstances, made websites, mobile applications and email unavailable for periods of time.”

Annual report 2025A · The company itself

“To the extent Schwab experiences business or system interruptions, errors or downtime (which could result from a variety of causes, including natural disasters, terrorist attacks, technological failure, cyber attacks, changes to systems, linkages with third-party systems, extreme weather, and power failures), our business and operations could be negatively impacted.”

Annual report 2025A · The company itself

“Privacy risk is the risk of unauthorized collection, use, storage, or sharing of personal information, including data incidents and other mismanagement of personal information.”

Annual report 2025A · The company itself

“Cyberattacks and events affecting Chevron’s operational technology networks or other digital infrastructure could have a material adverse impact on the company’s business and results of operations There are numerous and evolving risks to Chevron’s cybersecurity and privacy from cyber threat actors, including criminal hackers, state-sponsored intrusions, industrial espionage and employee malfeasance. These cyber threat actors, whether internal or external to Chevron, are becoming more sophisticated and coordinated in their attempts to access the company’s information technology (IT) systems and data, including the IT systems of cloud providers and other third parties with whom the company conducts business through, without limitation, malicious software; data breaches by employees, insiders or others with authorized access; cyber or phishing-attacks; ransomware; attempts to gain unauthorized access to our data and systems; and other electronic security breaches.”

Annual report 2025A · The company itself

“We are heavily dependent on information technology systems, including for point-of-sale and payment processing in our restaurants, digital ordering and order delivery, tracing ingredients back to suppliers and growers, digital Hazard Analysis and Critical Control Points monitoring, monitoring and managing our supply chain, our guest rewards program, payroll processing, sales forecasting, marketing initiatives, business analytics and various other processes and transactions. Our ability to effectively manage our business and coordinate the procurement, production, distribution, safety and sale of our products depends significantly on the consistent availability, reliability and security of these systems. Many of these critical systems are provided and managed by third parties, and we are reliant on these third-party providers to implement protective measures that ensure the security and availability of their systems.”

Annual report 2025A · The company itself

“To the extent we, a third party or any such individual were to experience a breach of our or their information technology systems that results in the unauthorized access, theft, use, destruction or other compromises of guests’ or employees’ data or confidential information of Chipotle, including through cyber-attacks or other external or internal methods, it could have an adverse impact on our reputation and brand and we could experience a material loss of revenues, a decrease in our ability to retain guests or attract new ones, the imposition of potentially significant costs (including loss of data or payment for recovery of data) and liabilities, loss of business partners and the disruption to our supply chain and business plans.”

Annual report 2025A · The company itself

“We may be required to make significant capital investments and other expenditures to investigate security incidents, remedy cybersecurity problems, recuperate lost data, prevent future compromises and adapt systems and practices to react to the changing threat environment. These include costs associated with notifying affected individuals and other agencies, additional security technologies and training, hiring additional employees, retention of experts and providing credit monitoring services for individuals whose data has been breached. These costs could be material and could adversely impact our results of operations in the period in which they are incurred, including by causing us to delay the pursuit of other important business strategies and initiatives, and may not meaningfully limit the success of future attempts to breach our information technology systems.”

Annual report 2025A · The company itself

“We collect, use and store personal data of our employees, customers and other third parties in the ordinary course of business, and we are required to comply with increasingly complex and changing data privacy and security laws and regulations, as well as self-regulatory regimes, that apply to the collection, storage, use, transmission and protection of personal information and other consumer and employee data, including particularly the transfer of personal data between or among countries.”

Annual report 2025A · The company itself

“As of January 1, 2026, comprehensive privacy laws are in effect in 20 states, complicating our privacy compliance obligations through the introduction of increasingly disparate requirements across the various U.S. jurisdictions in which we operate.”

Annual report 2025A · The company itself

“Failure to comply with applicable privacy, cybersecurity, or data protection requirements, or failure to prevent or promptly detect and remediate a security incident, could materially and adversely affect our business, financial condition, and results of operations.”

Annual report 2025A · The company itself

“Any inadequacy, interruption, theft or loss of data, malicious attack, integration failure, failure to maintain the security, confidentiality or privacy of sensitive data residing on our systems or other security failure of that technology could harm our ability to effectively operate our business and damage the reputation of our brands.”

Annual report 2025A · The company itself

“Increased information technology security threats and more sophisticated computer crime, including viruses and malware, ransomware attacks, misuse of artificial intelligence and machine learning technologies, denial of service and phishing attacks and advanced persistent threats, pose a potential risk to the security of our information technology systems, networks, and services, and those of our customers and other business partners, as well as the confidentiality, availability, and integrity of our data, and the data of our customers and other business partners.”

Annual report 2025A · The company itself

“Our information technology systems and our third-party providers’ systems, have been, and will likely continue to be, subject to advanced computer viruses or other malicious codes, ransomware, unauthorized access attempts, denial of service attacks, phishing, social engineering, hacking and other cyberattacks.”

Annual report 2025A · The company itself

“Due to the conflicts in Ukraine and the Middle East, as well as other evolving geo-political tensions, there is a possibility that the escalation of tensions could result in cyberattacks that could either directly or indirectly affect our operations.”

Annual report 2025A · The company itself

“Communications technologies, given their capability to transmit sensitive information, have frequently been the target of threat actors, including nation states and other malicious parties, and we expect these threats to increase with the growing prevalence of AI.”

Annual report 2025A · The company itself

“The frequency and sophistication of cybersecurity events globally continues to increase, including through the use of AI, with companies in our industry particularly targeted given the nature of the products that we sell.”

Annual report 2025A · The company itself

“Increased regulation of product security, cybersecurity and data practices could adversely affect our business and results of operations We operate in a regulatory environment that is rapidly evolving with respect to product security, cybersecurity, and the collection, use, and retention of data. Governments around the world continue to adopt new, and expand existing, laws and regulations imposing heightened requirements on companies related to these topics.”

Annual report 2025A · The company itself

“Cybersecurity With the rapid growth in AI, modern applications, hyper-distributed architecture and increasingly sophisticated cyberattacks, cybersecurity is a top priority for customers.”

Annual report 2026A · The company itself

“Government Regulation We are subject to numerous regulations and laws in the United States and abroad that involve matters central to our business. Many of these regulations and laws are evolving and their applicability and scope, as interpreted by courts and regulators, remain uncertain. These regulations and laws involve a variety of matters including privacy, data protection and personal information, cybersecurity, operational resilience, AI, tax, trade, encryption technology, environmental sustainability (including climate change), human rights, product certification, and national security.”

Annual report 2026A · The company itself

“We have experienced, and may in the future experience, interruptions in service, storage failures, and other performance-related problems due to a variety of factors, such as infrastructure and software changes, human or software errors, capacity constraints, unauthorized access, denial of service or other cyber attacks, and our exposure to these risks is growing as increasingly powerful AI capabilities emerge and are widely disseminated among threat actors.”

Annual report 2026A · The company itself

“Entrance into new or developing markets exposes us to additional competition and will likely increase demands on our service and support operations. As we pursue new market opportunities and key priority areas, including AI, cloud, and cybersecurity, we compete with companies of all sizes, some of which may have greater resources than we do.”

Annual report 2026A · The company itself

“Rapidly accelerating advances in AI technology are enabling threat actors, or autonomous systems, to identify and exploit vulnerabilities across both software and hardware with little or no delay between discovery and exploitation, including so-called “zero-minute” vulnerabilities, increasing the likelihood and speed of successful cyber attacks. These advances also show AI technology can rapidly chain otherwise low-severity, unrelated vulnerabilities into more severe combined exploits, complicating prioritization of security updates.”

Annual report 2026A · The company itself

“Additional areas of uncertainty that could impact sales of our products and services include laws, regulations, or customer procurement requirements related to encryption technology, data, AI, privacy, cybersecurity, sovereignty, localization, operational resilience, environmental sustainability (including climate change), human rights, product certification, product and digital accessibility, country of origin, sourcing, national security, and other security controls applicable to our offerings and supply chain.”

Annual report 2026A · The company itself

“While we intend to focus on managing our costs and expenses, over the long term, we also intend to invest in personnel and other resources related to our engineering, sales, service and marketing functions as we realign and dedicate resources on key priority areas, such as AI, cloud, and cybersecurity.”

Annual report 2026A · The company itself

“Security Security is at the core of our business strategy, reflecting our commitment to address the evolving needs of organizations of every size across every industry. Our security portfolio spans Network Security, Identity and Access Management, Secure Access Service Edge (SASE), and Identity and Agentic Security solutions.”

Annual report 2026A · The company itself

“We experience cyber attacks and other attempts to gain unauthorized access on a regular basis to (i) our products and services (together, our “solutions”) and (ii) the servers, data centers, networks, systems, and cloud-based services operated or enabled by us, or by third parties upon which we rely, on or through which our and third-party data are stored, processed, or can be accessed (collectively, our “IT environment”).”

Annual report 2026A · The company itself

“We are subject to a variety of cybersecurity risks that, if realized, could adversely affect how we conduct our business. Evolving technologies, including the introduction of Generative Artificial Intelligence and Large Language Models, and the increased sophistication and activities of organized crime, hackers, terrorists, nation-states, activists, and other external parties present a significant information security risk to large financial institutions such as us.”

Annual report 2025A · The company itself

“Third parties with whom we or our customers do business also present operational and information security risks to us, including security breaches or failures of their own systems. Risks related to cyberattacks on our vendors and other third parties, including supply chain attacks affecting our software and information technology service providers, are on the rise as such attacks become more frequent and severe.”

Annual report 2025A · The company itself

“Our operations rely on the secure processing, transmission, and storage of confidential information in our computer systems and networks as well as in the third-party computer systems and networks used to provide products and services on our behalf. Although we believe that we have appropriate information security procedures and controls based on our adherence to applicable laws and regulations and industry standards, our technologies, systems, and networks may be the target of cyberattacks or information security breaches that could result in the unauthorized release, gathering, monitoring, misuse, theft, sale, or loss or destruction of the confidential and/or proprietary information of CFG, and our customers, vendors, counterparties, or employees.”

Annual report 2025A · The company itself

“We and our third-party vendors are under continuous threat of loss or network degradation due to cyberattacks, such as computer viruses, malicious or destructive code, phishing attacks, ransomware, and Distributed Denial of Service attacks (collectively, “fraudulent schemes”). Also, our customers are routinely the target of fraudulent schemes as we continue to expand customer capabilities to utilize the Internet and other remote channels to transact business. Two of the most significant cyberattack risks that we face as a result of these fraudulent schemes are potential loss of funds resulting from customers falling victim to cybercriminal communications directed to them or unauthorized access to sensitive customer data.”

Annual report 2025A · The company itself

“As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our layers of defense, to investigate and remediate any information security vulnerabilities internally, to assess and mitigate issues associated with customers that have fallen victim to fraudulent schemes, and perform additional due diligence with respect to our third-party vendors.”

Annual report 2025A · The company itself

“We are also subject to laws and regulations relating to the privacy of the information of our customers, employees, counterparties, and others, and any failure to comply with these laws and regulations could expose us to liability and/or reputational damage. As new privacy-related laws and regulations are implemented, the time and resources needed for us to comply with those laws and regulations, as well as our potential liability for non-compliance and our reporting obligations in the case of data breaches, may significantly increase.”

Annual report 2025A · The company itself

“We face legal, reputational and financial risks if we fail to protect client and/or Cognizant data from cybersecurity incidents. In order to provide our services and solutions, we depend on global information technology networks and systems, to process, transmit, host and securely store electronic information (including our confidential information and the confidential information of our clients) and to communicate among our locations around the world and with our clients, suppliers, vendors and alliance partners (including numerous cloud service providers). Security breaches, employee malfeasance, or human or technological error have in the past and could in the future cause shutdowns or disruptions of our, our vendors' or our clients' operations and potential unauthorized access and/or disclosure of our or our clients’ sensitive data, which in turn could jeopardize projects that are critical to our operations or the operations of our clients’ businesses and have other adverse impacts on our business or the business of our clients.”

Annual report 2025A · The company itself

“In addition, the products, services and software that we provide to our clients, or the third-party components we use to provide such products, services and software, have in the past and may in the future unintentionally contain or introduce cybersecurity threats or vulnerabilities to our clients’ information technology networks. Furthermore, the security measures we implement for our cybersecurity solutions clients may not function as expected or be sufficient to identify or protect against certain cybersecurity attacks.”

Annual report 2025A · The company itself

“The emergence and maturation of AI capabilities is already being used by malicious actors to amplify cybersecurity attacks. This development may also lead to new or more sophisticated methods of attack and/or a more significant impact on affected parties.”

Annual report 2025A · The company itself

“Although our cybersecurity risk management program utilizes various procedures and controls to mitigate our exposure to the risks described above, the cybersecurity threat landscape is rapidly evolving and increasingly sophisticated. There can be no assurance that the procedures and controls that we implement, or that our clients, suppliers, subcontractors and other third parties with whom we do business implement, will be sufficient to protect from cybersecurity threats.”

Annual report 2025A · The company itself

“Security Established in 2026, our Security practice helps clients protect their digital environments and maintain regulatory compliance through comprehensive cybersecurity solutions. We provide governance, risk and compliance services to manage cyber risks and ensure adherence to regulatory standards, threat and vulnerability management to enable proactive detection and mitigation of sophisticated threats, data protection and privacy services including classification, encryption and leakage prevention, identity and access management solutions delivering identity-centric, zero-trust security and cloud and infrastructure security services protecting network, workload and cloud environments.”

Annual report 2025A · The company itself

“For example, as previously disclosed on a Current Report on Form 8-K filed with the SEC on May 15, 2025, a threat actor improperly obtained information about certain customer accounts and internal documentation, and used that information for social-engineering attempts. No passwords or private keys were compromised as a result of this incident. We continue to face risks related to this incident, including harm to our reputation, governmental investigations and regulatory scrutiny, and ongoing litigation.”

Annual report 2025A · The company itself

“An increasing number of organizations, including large merchants, businesses, technology companies, and financial institutions, as well as government institutions, have disclosed breaches of their information security systems, some of which have involved sophisticated and highly targeted attacks, including on their websites, mobile applications, and infrastructure. Attacks upon systems across a variety of industries, including the crypto industry, are increasing in their frequency, persistence, magnitude, and sophistication, and, in many cases, are being conducted by sophisticated, well-funded, and organized groups and individuals, including state actors.”

Annual report 2025A · The company itself

“We collect and process a large amount of sensitive customer data. Any real or perceived improper use of, disclosure of, or access to such data could harm our reputation, as well as adversely affect our business, operating results, and financial condition.”

Annual report 2025A · The company itself

“However, our security measures, those of our vendors or service providers, or the security measures of companies we acquire, may be inadequate or breached as a result 64 Table of Contents of third-party action, employee or service provider error, malfeasance, malware, phishing, hacking attacks, system error, trickery, advances in computer capabilities, new discoveries in the field of cryptography, inadequate facility security or otherwise, and, as a result, someone may be able to obtain unauthorized access to sensitive information, including personal data, on our systems. We could be the target of a cybersecurity incident, which could result in harm to our reputation and financial losses.”

Annual report 2025A · The company itself

“The increasing sophistication of AI poses a greater risk of identity fraud, as malicious actors may exploit various AI technologies to create increasingly convincing false identities, transaction records, or attempt to manipulate our verification processes. This necessitates ongoing enhancements to our verification systems and security protocols to prevent unauthorized access and protect sensitive information.”

Annual report 2025A · The company itself

“Information security Coloplast operates in a dynamic information risk environment with regulatory and legislative data compliance obligations. Business operations depend on a wide range of information technology systems, operational technology systems, people, and suppliers. Coloplast processes highly confidential information and legally protected personal health information through multiple channels and sell digitally connected devices.”

Annual report 2025A · The company itself

“In particular, unauthorized copying, distribution and piracy of programming and films over the internet, through devices, software and websites, on counterfeit DVDs/Blu-rays, through AI and through other platforms interfere with the market for copyrighted works and present challenges for our content businesses. We have actively engaged in the enforcement of our intellectual property rights and likely will continue to expend substantial resources to protect our content.”

Annual report 2025A · The company itself

“A cyber attack, information or security breach, or technology disruption or failure may negatively impact our ability to conduct our business or result in the misuse of confidential information, all of which could adversely affect our business, reputation or results of operations. Network and information systems and other technologies, including those that are related to our network management, customer service operations and programming delivery and are embedded in our products and services, are critical to our business activities.”

Annual report 2025A · The company itself

“We also obtain certain confidential, proprietary and personal information about our customers, personnel and vendors, that in many cases is provided or made available to third-party vendors who agree to protect it, which has in the past, and may in the future, become compromised through a cyber attack or data breach, misappropriation, misuse, leakage, falsification or accidental release or loss of information by us or a third party.”

Annual report 2025A · The company itself

“The occurrence of both intentional and unintentional incidents has caused, and may from time to time in the future cause, a variety of business impacts. These include degradation or disruption of our network, products and services, excessive call volume to call centers, theft or misuse of our intellectual property or other assets, disruption of the security of our internal systems, products, services or satellite transmission signals, power outages, and the compromise or exfiltration of sensitive, personal, proprietary, confidential or technical business information and customer or vendor data, and reputational impacts.”

Annual report 2025A · The company itself

“Information technology system failures, network disruptions or cybersecurity breaches could adversely affect our business. We use and rely significantly on sophisticated information technology systems and infrastructure, including computer systems, hardware, software, technology and online sites and networks (collectively, “IT Systems”), in conducting our day-to-day operations, providing services to certain customers and protecting sensitive Company information.”

Annual report 2025A · The company itself

“We face numerous and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our IT Systems and Confidential Information, including from diverse threat actors, such as state-sponsored organizations, opportunistic hackers and hacktivists, as well as through diverse attack vectors, such as social engineering/phishing, malware (including ransomware), malfeasance by insiders, human or technological error (including the misuse of artificial intelligence tools by our employees), and as a result of malicious code embedded in open-source software, or misconfigurations, bugs or other vulnerabilities in commercial software that is integrated into our (or our suppliers’ or service providers’) IT Systems, products or services.”

Annual report 2025A · The company itself

“Our technologies, systems and networks are subject to cybersecurity threats. Our business is faced with growing cybersecurity threats as we increasingly rely on digital technologies across our business.”

Annual report 2025A · The company itself

“Our increasing reliance on IT in our production, distribution and marketing systems may allow cybersecurity threats to disrupt our oil and gas operations, both domestically and abroad. If our data, IT, operational technology (OT), including industrial control and supervisory control and data acquisition (SCADA) systems were to be breached, damaged or disrupted due to a cybersecurity incident or cyber-attack (directly, indirectly through third parties or through the IT networks, servers, software, or infrastructure on which they rely), we could be subject to serious negative consequences.”

Annual report 2025A · The company itself

“We are subject to evolving physical security, cybersecurity, and third-party reliability risks. Threat actors continue to seek to exploit potential vulnerabilities in the energy sector associated with protection of sensitive and confidential information, grid infrastructure, and other energy infrastructures. These attacks and disruptions, both physical and cyber, are becoming increasingly sophisticated and dynamic.”

Annual report 2025A · The company itself

“In addition, new or updated security regulations or new vulnerabilities identified by security researchers, third-party suppliers, or threat actors could require changes in current measures taken by security or our business operations and could adversely affect our results of operations or financial condition. Our acquisition of Calpine in January 2026 introduces expanded cybersecurity and physical security risks.”

Annual report 2025A · The company itself

“•A successful cybersecurity attack which could interrupt or disrupt our information technology systems, or those of our third-party service providers, or cause the loss of confidential or protected data. •Market consolidation of large customers globally through mergers or acquisitions resulting in a larger proportion or concentration of our business being derived from fewer customers. •Disruptions in supplies of raw materials, particularly components used to manufacture our silicone hydrogel lenses. •New U.S. and foreign government laws and regulations, and changes in existing laws, regulations and enforcement guidance, which affect areas of our operations including, but not limited to, those affecting the health care industry, including the contact lens industry specifically and the medical device or pharmaceutical industries generally, including but not limited to the EU Medical Devices Regulation (MDR) and the EU In Vitro Diagnostic Medical Devices Regulation (IVDR).”

Annual report 2025A · The company itself

“As a manufacturer of connected medical devices, we are subject to evolving cybersecurity regulations and guidance issued by the FDA, including the final guidance titled Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions (September 2023, updated June 2025). Under Section 524B of the FDCA, effective March 29, 2023, all new premarket submissions and previously authorized devices undergoing new FDA review must comply with enhanced cybersecurity requirements.”

Annual report 2025A · The company itself

“We are also subject to various other laws in the United States such as Section 5(a) of the Federal Trade Commission Act, which requires a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities and the CCPA, which gives California residents certain rights to access and delete their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that has increased the likelihood of, and risks associated with data breach litigation.”

Annual report 2025A · The company itself

“For example, with the recent addition of cord blood and cord tissue storage (and other cryostorage) businesses, we interact directly with our customers and collect and maintain personal information regarding our customers and donors. Acquisitions like this could subject us to additional regulatory and consumer liability risk and the cost of analyzing and integrating new privacy compliance programs.”

Annual report 2025A · The company itself

“Our business is exposed to risks associated with online commerce security and credit card fraud. Consumer concerns over the security of transactions conducted on the internet or the privacy of users may inhibit the growth of the internet and online commerce.”

Annual report 2025A · The company itself

“We are required to maintain the privacy and security of personal and business information amidst multiplying threat landscapes and in compliance with increasing privacy and data protection regulations globally. Failure to do so could damage our business, including our reputation with members, suppliers and employees, cause us to incur substantial additional costs, and become subject to litigation and regulatory action.”

Annual report 2025A · The company itself

“We must comply with evolving payment card association and network operating rules, including data security rules, certification requirements and rules governing electronic funds transfers. For example, we are subject to Payment Card Industry Data Security Standards, which contain compliance guidelines and standards with regard to our security surrounding the physical and electronic storage, processing and transmission of individual cardholder data. If our internal systems are breached or compromised, we may be liable for card re-issuance costs, subject to fines and higher transaction fees and lose our ability to accept card payments from our members, and our business and operating results could be adversely affected.”

Annual report 2025A · The company itself

“CRH FORM 10-K Cybersecurity CRH depends on multiple information and operational technology systems, including certain systems for which third-parties are in whole or in part responsible. We may be unable to protect our assets and data against increasingly sophisticated cybersecurity attacks. Security breaches, IT interruptions or data loss could result in significant business disruption, loss of production, reputational damage and/or regulatory penalties.”

Annual report 2025A · The company itself

“Additionally, if the incidence of cyberattacks were to decline, or be perceived to decline, or if organizations adopt endpoints that use operating systems we do not adequately support, our ability to attract new customers and expand sales of our solutions to existing customers could be adversely affected.”

Annual report 2026A · The company itself

“Real or perceived defects, errors or vulnerabilities in our Falcon platform and cloud modules, the failure of our platform to detect or prevent incidents, including advanced and newly developed attacks, misconfiguration of our solutions, or the failure of customers to take action on attacks identified by our platform could harm our reputation and adversely affect our business, financial position and results of operations. Because our cloud native security platform is complex, it has contained, and may in the future contain defects, errors or vulnerabilities that are not detected until after deployment.”

Annual report 2026A · The company itself

“Moreover, as our cloud native security platform is adopted by an increasing number of enterprises and governments, individuals and organizations behind advanced cyberattacks may intensify their efforts to defeat our security platform. If this happens, our systems and subscription customers could be specifically targeted by attackers and could result in vulnerabilities in our platform or undermine the market acceptance of our Falcon platform and could adversely affect our reputation as a provider of security solutions.”

Annual report 2026A · The company itself

“Organizations are increasingly subject to a wide variety of attacks on their networks, systems, and endpoints. No security solution, including our Falcon platform, can address all possible security threats or block all methods of penetrating a network or otherwise perpetrating a security incident.”

Annual report 2026A · The company itself

“We are required to comply with stringent, complex and evolving laws, rules, regulations and standards in many jurisdictions, as well as contractual obligations, relating to data privacy and security. Ensuring compliance with such requirements may increase operating costs, impact our data processing practices and policies and the development of new products or services, and reduce operational efficiency, any of which could adversely affect our business and operations.”

Annual report 2026A · The company itself

“The CrowdStrike Store is an open cloud-based application PaaS for cybersecurity and the industry’s first unified security cloud ecosystem of trusted third-party applications.”

Annual report 2026A · The company itself

“Our internal team of security experts, researchers, intelligence analysts, and threat hunters continuously analyzes the evolving global threat landscape to develop products that defend against today’s most sophisticated and stealthy attacks and report on emerging security issues.”

Annual report 2026A · The company itself

“If we are unable to successfully enhance our existing products and services and introduce new products and services in response to rapid technological changes and market developments as well as evolving security threats, our competitive position and prospects will be harmed. Our ability to increase revenue from existing customers and attract new customers will depend in significant part on our ability to anticipate and respond effectively to rapid technological changes and market developments as well as evolving security threats. The success of our Falcon platform depends on our ability to take such changes into account and invest effectively in our research and development organization to increase the reliability, availability and scalability of our existing solutions and introduce new solutions.”

Annual report 2026A · The company itself

“Success in delivering enhancements and new solutions depends on several factors, including the timely completion, introduction and market acceptance of the enhancement or new solution, the risk that such enhancement or new solution may have quality or other defects or deficiencies (such as those experienced in connection with the July 19 Incident), especially in the early stages of introduction, as well as our ability to seamlessly integrate all of our product and service offerings and develop adequate sales capabilities in new markets. Failure to effectively deliver, integrate, and manage perceptions with respect to enhancements and new solutions could erode our competitive position, significantly impair our revenue growth, and negatively impact our operating results.”

Annual report 2026A · The company itself

“Table of Contents If we are not able to maintain and enhance our CrowdStrike and Falcon brands and our reputation as a provider of high-efficacy security solutions, our business and results of operations may be adversely affected. We believe that maintaining and enhancing our CrowdStrike and Falcon brands and our reputation as a provider of high-efficacy security solutions is critical to our relationship with our existing customers, channel partners, and technology alliance partners and our ability to attract new customers and partners.”

Annual report 2026A · The company itself

“Additionally, we have entered, and intend to continue to enter, into technology alliance partnerships with third parties to support our future growth plans.”

Annual report 2026A · The company itself

“We incorporate novel uses of AI technologies, including generative AI, into our products and operations, such as our Falcon platform. AI is complex and rapidly evolving, and we face significant competition from other companies who may incorporate AI into their products more quickly or more successfully than us, as well as an evolving regulatory landscape.”

Annual report 2026A · The company itself

“BUSINESS Overview Founded in 2011, CrowdStrike reinvented cybersecurity for the cloud and artificial intelligence (“AI”) era and transformed the way cybersecurity is delivered and experienced by customers.”

Annual report 2026A · The company itself

“Today, we offer 33 cloud modules on our Falcon platform via a SaaS subscription-based model that spans multiple large markets, including corporate endpoint and cloud workload security, managed security services, security and vulnerability management, IT operations management, identity protection, next-generation security information and event management (“SIEM”) and log management, threat intelligence services, data protection, SaaS security posture management, Security Orchestration, Automation and Response (“SOAR”) and AI powered workflow automation, and security for generative AI and AI-driven systems through AI detection and response.”

Annual report 2026A · The company itself

“Threat Graph also provides query and hunting capability over the full set of high-fidelity events collected in the graph. This correlated data, natively represented in a graph structure, enables new products and cloud modules to be created rapidly since the platform provides the visibility, collection, correlation, and actions over data as reusable building blocks. This collect-once, use repeatedly approach is the reason why we have been able to deliver new cloud modules covering IT hygiene and vulnerability management quickly and enables us to continue expanding the Falcon platform rapidly in the future.”

Annual report 2026A · The company itself

“Asset Graph. Asset Graph dynamically monitors and tracks the complex interactions among enterprise entities, providing a single holistic view of the risks those assets pose. Asset Graph provides graph visualizations of the relationships among entities and assets such as devices, users, accounts, cloud workloads, along with the rich context necessary for proper security hygiene and proactive security posture management to reduce risk in their organizations.”

Annual report 2026A · The company itself

“The Falcon platform management interface gives customers an intuitive and informative view of their complete environment, with timely alerts and detailed search capabilities. We provide real-time endpoint and cloud workload visibility to allow customers to review details and respond to threats instantly and effectively, from anywhere, and maintain an index of these events for future use.”

Annual report 2026A · The company itself

“APIs and Integrations. Our Falcon platform and architecture is built around a rich set of APIs that efficiently and effectively complement and expand a customer’s existing security infrastructure, such as security information event management, or SIEMs, intrusion prevention systems and intrusion detection systems. The platform includes streaming, query and batch APIs allowing customers and partners to integrate a variety of solutions seamlessly.”

Annual report 2026A · The company itself

“Our proactive consulting security services include technical assessment and strategic advisory services designed to help organizations understand their cyber maturity levels. These services include endpoint, identity, and cloud workload compromise assessments, cybersecurity maturity assessments, security program in-depth assessments, service organization control assessments, IT hygiene assessments, and active directory security assessments.”

Annual report 2026A · The company itself

“We also offer AI red-teaming and other AI security services to help organizations understand where these emerging models introduce cyber risk, where they can be exploited, and where to take corrective security actions.”

Annual report 2026A · The company itself

“Our platform deployment and operational services are designed to help customers maximize the value of their investment in the CrowdStrike Falcon platform and transform their Security Operations Centers. These services provide seamless deployment of Falcon modules across endpoint, cloud, identity, Next-Gen SIEM and virtually every other module ensuring rapid time-to-value and alignment to CrowdStrike’s recommended security configurations to prevent breaches.”

Annual report 2026A · The company itself

“•Our services business has historically experienced significant volatility in demand, which reduces the predictability of our results. •As a result of competition in our industry, we may find it more difficult to negotiate favorable rates on our new or renewing tenant contracts. •New wireless technologies may not deploy or be adopted by tenants as rapidly or in the manner projected. •If radio frequency emissions from wireless handsets or equipment on our communications infrastructure are demonstrated to cause negative health effects, potential future claims could adversely affect our operations, costs or revenues. •Cybersecurity breaches or other information technology disruptions could adversely affect our operations, business, and reputation. •If we do not continue to make appropriate investments in, and effectively implement and maintain, our information technology systems and digital capabilities, our business and operating results could be adversely affected.”

Annual report 2025A · The company itself

“Cybersecurity breaches or other information technology disruptions could adversely affect our operations, business, and reputation. Despite existing security measures, certain of our information technology and communications infrastructure may be subject to damage, disruptions, or shutdowns due to unauthorized access, computer viruses, ransomware or other malicious software, cyber-attacks and other security breaches.”

Annual report 2025A · The company itself

“In addition, integration and adoption of artificial intelligence and machine learning ("AI") into our business may pose new information security risks and challenges. The increased prevalence of AI may 19 also heighten cybersecurity and data protection risks. AI-enabled systems, as well as AI-driven techniques used by threat actors, may increase the sophistication, scale, frequency, and speed of cyberattacks targeting our information technology systems, operational technology, or sensitive data.”

Annual report 2025A · The company itself

“Further, our reliance on cloud- or internet-based services and on remote access to information systems increases our exposure to potential cybersecurity incidents. An attack attempt or security breach, such as a distributed denial of service attack, could potentially result in (1) interruption or cessation of certain of our services to our tenants or access by our tenants to certain of our information technology systems, (2) our inability to meet expected levels of service to our tenants, (3) data transmitted over our tenants' networks being compromised or misappropriated, or (4) business or other sensitive data being compromised, misappropriated or lost.”

Annual report 2025A · The company itself

“Additionally, security incidents impacting our tenants, vendors and business partners could result in a material adverse effect on our business. We may be required to expend significant resources to protect against or recover from such threats.”

Annual report 2025A · The company itself

“The Company relies on information technology in all aspects of its business. The security, stability and availability of the Company’s and its key third-party vendors’ information technology systems are critical to its ability to operate safely and effectively and to compete within the transportation industry. A successful data breach, cyber-attack, or the occurrence of any similar incident that impacts the Company’s or its key third-party vendors’ information technology systems could result in a service interruption, train accident, misappropriation of confidential or proprietary information (including personal information), process failure, or other operational difficulties.”

Annual report 2025A · The company itself

“The Company, its third-party vendors and other companies in the rail and transportation industries have been subject to, and are likely to continue to be the target of, data breaches, cyber-attacks and other similar incidents. These incidents may include, among other things, malware, ransomware, distributed denial of service attacks, social engineering, phishing, theft, malfeasance or improper access by employees or third-party vendors, software bugs, server malfunctions, software or hardware failures, human error, fraud, or other modes of attack or disruption. Attacks of these nature are increasing in frequency, levels of persistence, intensity and sophistication, including by nation-state threat actors or those associated with nation-states.”

Annual report 2025A · The company itself

“Risks Related to Our Operations •Data governance failures, the failure or disruption of our information technology or infrastructure, a cyberattack or other information security incident can adversely affect our reputation, businesses and prospects.”

Annual report 2025A · The company itself

“Operational Risks •Significant disruptions in, or breaches in security of, our information technology (“IT”) systems or data; data privacy violations; other losses or disruptions to facilities, supply chains, distribution systems or IT systems due to catastrophe; and labor disputes can all adversely affect our business and financial statements. •Defects, manufacturing problems and unanticipated use or inadequate disclosure with respect to our products or services, or allegations thereof, can adversely affect our business and financial statements. •Climate change, legal or regulatory measures to address climate change and other sustainability topics and any inability to address regulatory requirements or stakeholder expectations with respect to climate change and other sustainability topics, may negatively affect our business and financial statements. •Our financial results are subject to fluctuations in the cost and availability of the supplies we use in, and the labor we need for, our operations, as well as adverse changes with respect to key distributors and channel partners.”

Annual report 2025A · The company itself

“As a global organization, we are subject to data privacy and security laws, regulations and customer-imposed controls in numerous jurisdictions as a result of having access to and processing confidential, personal and/or sensitive data in the course of our business.”

Annual report 2025A · The company itself

“We periodically engage third parties to perform cybersecurity audits utilizing the National Institute of Standards and Technology (“NIST”) Cybersecurity and Privacy Frameworks. We also engage third parties to conduct security reviews of our network, processes, and systems on a regular basis.”

Annual report 2026A · The company itself

“From time to time, we and our third party service providers and suppliers experience unauthorized attempts to infiltrate and interrupt information systems. To date, interruptions of these information systems, as a result of unauthorized infiltration attempts, have not had a material impact on our operations.”

Annual report 2026A · The company itself

“Unauthorized access, theft, use, destruction, or other compromises are becoming increasingly sophisticated, more difficult to detect, contain, and mitigate, and may occur through a variety of methods, including attacks using malicious code, vulnerabilities in software, hardware, or other infrastructure (including systems used by our supply chain), system misconfigurations, phishing, or social engineering. Failure of our or our service providers’ information systems to function as intended, or cyber-attacks or security breaches, could result in loss of revenue, assets, personal data, intellectual property, trade secrets, or other sensitive and confidential data, violation of applicable privacy and data security laws, reputational harm to the companies and their brands, operational disruptions, legal challenges, and significant remediation and other costs, all of which could have a material adverse effect on our business.”

Annual report 2026A · The company itself

“We may incur increased costs to comply with privacy and data protection laws, and, if we fail to comply or our systems are compromised, we could be subject to government enforcement actions, private litigation, and adverse publicity. We receive and maintain certain personal, financial, and other information about our customers, employees, vendors, and suppliers. In addition, certain of our vendors receive and maintain certain personal, financial, and other information about our employees and customers.”

Annual report 2026A · The company itself

“In addition, the use of social media for business purposes presents various risks, including the improper disclosure of proprietary information, exposure of personally identifiable information, fraud, and the dissemination of inaccurate information.”

Annual report 2026A · The company itself

“If we or the third-parties with whom we work experience, or are unable to protect against cyber-attacks, ransomware, security incidents, or security breaches, or if unauthorized parties otherwise obtain access to or otherwise compromise our customers’ data, our data, or our platform and information technology systems, then our solution may be perceived as not being secure, our reputation may be harmed, demand for our platform and products may be reduced, and we may incur significant liabilities or additional expenses.”

Annual report 2025A · The company itself

“We have previously and may in the future become the target of cyber-attacks by third parties, including without limitation nation-state actors, seeking to gain unauthorized access to and exfiltrate our or our customers’ data, including confidential and personal information, or to disrupt our ability to provide our services. Cyber-attacks, computer malware, viruses, employee mistakes or malfeasance, social engineering (including through deep fakes and spear phishing), malicious code, denial-of-service attacks, credential harvesting and general hacking have become more prevalent in our industry, particularly against cloud services, and have become enhanced or facilitated by artificial intelligence.”

Annual report 2025A · The company itself

“The Company’s revenue arrangements may include infrastructure monitoring, application performance monitoring, log management, synthetics monitoring, security monitoring, continuous profiling, serverless monitoring, network monitoring, real user monitoring and incident management as well as secondary services including custom metrics in dashboard monitoring, docker container monitoring, and indexed spans.”

Annual report 2025A · The company itself

“We store and transmit sensitive information, including personal information of customers, consumers, and employees, payment card information, and proprietary operational, financial, and strategic data. Unauthorized access to, loss, misuse, or disclosure of such information could result in reputational harm, litigation, regulatory investigations, significant remediation costs and substantial losses.”

Annual report 2026A · The company itself

“Cybersecurity threats continue to evolve in frequency and sophistication, and our reliance on interconnected systems, cloud-based platforms, and third-party service providers increases the risk that a security incident affecting us or these parties could disrupt our operations.”

Annual report 2026A · The company itself

“Ökad digitalisering innebär att Dedicare behöver hantera risker som kommer med det digitala informationssamhället. Verksamheten är beroende av tillgång till väl anpassade digitala system, en välfungerande IT-miljö och infrastruktur. Till det tillkommer förmåga att hantera cyberhot, affärskontinuitet och informationssäkerhetsrisker.”

Annual report 2024A · The company itself

“Dedicare fortsätter också att ta stora steg för att uppnå målsättningen om en skalbar miljö i form av effektiva integrationer och Cloudlösningar. Arbetet med förstärkt IT-säkerhet är fortsatt viktigt. Utgångspunkten för arbetet med IT-säkerhet har varit ISO 27001 för att anpassa driften efter bästa möjliga standard.”

Annual report 2024A · The company itself

“The use of AI technologies also could expose us to an increased risk of cybersecurity threats and incidents and claims or other adverse effects from infringements or violations of intellectual property rights, including claims related to AI technologies considered to have similarities to other AI technologies.”

Annual report 2026A · The company itself

“Hardware, software, and applications that we produce or procure from third parties may contain defects in design or manufacture or other deficiencies, including security vulnerabilities that could interfere with the operation or security of our products, services, and offerings.”

Annual report 2026A · The company itself

“Further, our use of AI technologies, including generative and agentic AI, may make us susceptible to unanticipated security threats from adversaries as we incorporate such technologies into our internal systems, customer-facing services and products, while our understanding of AI-related security risks and protection methods continue to develop.”

Annual report 2026A · The company itself

“Any actual or perceived security vulnerabilities in our products or services, or those of third-party products we sell or in the open-source software or AI models we utilize, could lead to loss of existing or potential customers, and may impede our sales, manufacturing, distribution, outsourcing services, information technology solutions, and other critical functions and offerings.”

Annual report 2026A · The company itself

“As a global enterprise, we face compliance risks under a significant and increasing number of laws and regulations in the United States, the European Union, China, and numerous other jurisdictions relating to cybersecurity, product security, software supply chain security and AI, and the collection, use, residency, transfer, and protection of data. Such laws and regulations continue to evolve, may be applied differently in different jurisdictions, and could result in increased costs in the event of a significant disruption of our operations, data or privacy breach, loss, or other compromise of proprietary or confidential information as a result of a cyber-attack or insider activity.”

Annual report 2026A · The company itself

“Cybersecurity Incidents May Adversely Impact Our Operations We rely heavily on information systems, operational technologies and other digital technologies to conduct our business, and we are expanding the use of and reliance on these systems and technologies, including through artificial intelligence, process automation and data analytics. Concurrent with the growing dependence on technology is a greater sensitivity to cyberattacks and other cyber-related incidents, which have increasingly targeted our industry. Perpetrators of cyberattacks often attempt to gain unauthorized access to digital systems for purposes of misappropriating confidential, proprietary or personal information, intellectual property or financial assets, corrupting data or causing operational disruptions, as well as preventing users from accessing systems or information for the purpose of demanding payment in order for users to regain access.”

Annual report 2025A · The company itself

“Moreover, we and other upstream companies rely on extensive oil and gas infrastructure and distribution systems to deliver our production to market, which, in turn, depend upon digital technologies; we also rely on other critical infrastructure to operate our business, such as communication networks and power grids. Any cyberattack directed at such infrastructure or systems could adversely impact our business and operations, including by limiting our ability to transport and market our production.”

Annual report 2025A · The company itself

“Many of these laws and regulations are subject to change and uncertain interpretation, and could result in claims, changes to our business practices, monetary penalties, increased cost of operations, or declines in user growth or engagement, or otherwise harm our business.”

Annual report 2025A · The company itself

“For example, medical device cybersecurity continues to be an area of focus for and evolving guidance from FDA.”

Annual report 2025A · The company itself

“These frameworks, in addition to similar laws being enacted by other states and other jurisdictions, impose stringent cybersecurity standards and potentially significant non-compliance penalties, and involve the expenditure of significant resources and time and effort to comply.”

Annual report 2025A · The company itself

“We are heavily dependent on electrical power, internet and telecommunications infrastructure and our information systems and computer-based programs, including our well operations information, seismic data, electronic data processing and accounting data. If any of such infrastructure, systems or programs were to fail or become unavailable or compromised, or create erroneous information in our hardware or software network infrastructure, our ability to safely and effectively operate our business will be limited and any such consequence could have a material adverse effect on our business.”

Annual report 2025A · The company itself

“We and our third-party providers are vulnerable to cyberattacks and security breaches that could materially disrupt or compromise our operations, data and results.”

Annual report 2025A · The company itself

“We face evolving risks that threaten the confidentiality, integrity, and availability of Information Systems and data, including from state-sponsored espionage actors, financially motivated hackers, hacktivists and insiders, as well as through diverse attack vectors, such as social engineering/phishing, malware (including ransomware), human or technological error, or due to “bugs,” misconfigurations and known and unknown vulnerabilities in hardware, software, systems and processes that support our business. Even if vulnerabilities are publicly known or identified through our security tools, we cannot guarantee that patches or mitigating measures will be implemented before a threat actor can exploit them.”

Annual report 2025A · The company itself

“Unauthorized access to our or customers’ physical assets or Information Systems, misappropriation of our or customers’ sensitive or proprietary information, or disruptions to our or customers’ operations as a result of attacks, breaches or disruptions to our, or any providers’ or customers’, Information Systems or controls could lead to material breaches of legal and regulatory (e.g., privacy laws such as GDPR) or contractual obligations, and/or other operational and business impacts. The foregoing could expose us to material lawsuits, regulatory actions, penalties or fines, monetary damages, loss of existing or potential customers, harm to our reputation and significant increases in our security and insurance costs, and other adverse effects on our business and results.”

Annual report 2025A · The company itself

“Implementation of these technologies may involve challenges such as potential shortages in required data to train internal AI models, scarcity of skilled talent to effectively deploy internal AI initiatives, or the possibility that AI tools we develop or utilize may not achieve their desired or intended benefits performance or cost-efficiency objectives. Use of third-party AI tools may introduce information security, data privacy and legal or regulatory risks. Failure to properly manage these risks could negatively impact our business, reputation and operating results.”

Annual report 2025A · The company itself

“We have been subject to cybersecurity incidents in the past and anticipate being the target of future attacks. Any actual or perceived cybersecurity incident or security or privacy breach, particularly those involving our key systems, data, or critical third-party providers, could interrupt our operations, subject us to claims, litigation, regulatory investigations and liability, and adversely affect our reputation, brand, business, financial condition, and results of operations.”

Annual report 2025A · The company itself

“Cybersecurity incidents are increasing in severity and sophistication and can originate with external actors or with our employees and contractors, whether acting maliciously or by inadvertently providing access to an external party or having their credentials compromised by an external party. For example, in October 2025, we identified and disclosed a cybersecurity incident in which an employee was the target of a social engineering scheme that enabled an unauthorized third party to gain access to certain internal systems and obtain limited contact information relating to a mix of users, including merchants, consumers, and Dashers that use our platform.”

Annual report 2025A · The company itself

“If the use of tracking technologies, such as “cookies,” is further restricted, regulated, or blocked by new laws, regulations, litigation, or other practices, the amount or accuracy of Internet user information we collect would decrease, which could harm our business, financial condition, and results of operations. U.S. and non-U.S. jurisdictions have enacted or are considering enacting legislation or regulations that significantly restrict the practice of online tracking.”

Annual report 2025A · The company itself

“Our failure, or the failure by our vendors, merchants, or Dashers on our platform, to comply with applicable laws or regulations or any other actual or asserted obligations relating to privacy, data protection, or cybersecurity, or any compromise of security that results in unauthorized access to, or use or release of personal data or other data relating to merchants, consumers, Dashers, or other individuals, or the perception of privacy concerns or that any of the foregoing types of failure or compromise has occurred, could damage our reputation and 35 Table of Contents brand, discourage new and existing merchants, consumers, and Dashers from using our platform, or result in fines, investigations, or proceedings by governmental agencies and private claims and litigation, any of which could adversely affect our business, financial condition, and results of operations.”

Annual report 2025A · The company itself

“Cyberattacks and data security breaches could adversely affect the Duke Energy Registrants' businesses. Cybersecurity risks have increased in recent years as a result of the proliferation of new technologies, and the increased sophistication, magnitude and frequency of cyberattacks and data security breaches. Duke Energy relies on the continued operation of advanced digital information and operational technology systems and network infrastructure, which are part of an interconnected regional grid. Additionally, connectivity to the internet continues to increase through grid modernization and other operational excellence initiatives.”

Annual report 2025A · The company itself

“The Company’s business, results of operations, financial condition and cash flows could be adversely affected by interruption or regulation of the Company’s information technology or network systems and storage of information and other business disruptions. DuPont relies on centralized and local information technology and physical networks and systems, some of which are managed or accessible by third parties, to process, transmit and store electronic information, and to otherwise manage or support its business.”

Annual report 2025A · The company itself

“However, the introduction of AI technologies, particularly generative AI, into internal processes and/or new and existing offerings may result in new or expanded risks and liabilities, including due to enhanced governmental or regulatory scrutiny, litigation, compliance issues, ethical concerns, confidentiality or security risks, as well as other factors that could adversely affect our business, reputation, and financial results. Furthermore, any confidential information that is disclosed to a third-party generative AI platform could be leaked or disclosed to others, which could result in loss or theft of intellectual property, as well as subject us to risks related to intellectual property infringement or misappropriation, data privacy and cybersecurity.”

Annual report 2025A · The company itself

“If we are unable to protect our information technology infrastructure against service interruptions, data corruption, cyberbased attacks or network security breaches, product or service offerings could be compromised or operations could be disrupted or data confidentiality impaired. Eaton relies on information technology networks and systems, including the Internet, to process, transmit and store electronic information, and to manage or support a variety of business processes and activities, including procurement, manufacturing, distribution, invoicing and collection.”

Annual report 2025A · The company itself

“Global cybersecurity threats range from widespread vulnerabilities, sophisticated and targeted measures known as advanced persistent threats, or uncoordinated individual attempts to gain unauthorized access to IT/OT systems. These threats may be directed at Eaton, its products, software embedded in Eaton’s products, or its third-party service providers. The risk is amplified by the increasingly connected nature of our products and systems.”

Annual report 2025A · The company itself

“Table of Contents Our customers, including governmental agencies, are increasingly requiring cybersecurity protections and mandating cybersecurity standards, which may result in additional operating or production costs.”

Annual report 2025A · The company itself

“For information regarding technology-related risks, see the information in “Item 1A: Risk Factors” under the captions “We face significant risk from cyberattacks and data security breaches,” “Systems failures and business interruptions could harm our business” and “Increasing levels of regulation in the areas of privacy, protection of user data and cybersecurity could harm our business.””

Annual report 2025A · The company itself

“The confidentiality, integrity and availability of our services and products depends on the continuing operation of our information technology and other enabling systems.”

Annual report 2025A · The company itself

“The capacity, reliability and security of our information technology hardware and software infrastructure (including, but not limited to, our billing systems) and communications systems, or those of third parties that we use in our operations, are important to the operation of our business, which has in the past and would in the future suffer in the event of system failures or cyber-attacks. Likewise, our ability to expand and update our information technology infrastructure in response to, among other things, our growth and changing needs is important to the continued implementation of our new service offering initiatives. Our inability to expand or upgrade our technology infrastructure could have adverse consequences, which could include, among other things, the delayed implementation of new service offerings, service or billing interruptions and the diversion of management and developmental resources.”

Annual report 2025A · The company itself

“In addition, although we take protective measures designed to secure our information technology systems and endeavor to modify such protective measures as circumstances warrant, our information technology hardware and software infrastructure and communications systems, or those of third parties that we use in our operations, may be vulnerable to a variety of interruptions, including, without limitation, natural disasters, terrorist attacks, telecommunications failures, cyber-attacks and other malicious activities such as unauthorized access, physical or electronic break-ins, misuse, computer viruses or other malicious code, computer denial of service attacks and other events that could disrupt or harm our business. These protective measures may not be sufficient for all eventualities and may themselves be vulnerable to hacking, malfeasance, system error or other irregularities.”

Annual report 2025A · The company itself

“We have experienced and may experience in the future cyber-attacks and other attempts to gain unauthorized access to our systems on a consistent basis.”

Annual report 2025A · The company itself

“We have discovered and remediated, and may discover new vulnerabilities due to the scale of activities on our platforms, and may not be able to mitigate or fix such vulnerabilities on acceptable timeframes or at all, due to other factors, including, but not limited to, issues outside of our control such as natural disasters/climate change such as sea level rise, drought, flooding, wildfires, increased storm severity, power loss, and we may be notified of such vulnerabilities via third parties. Any of the foregoing developments may, among other things, negatively affect user and customer trust, harm our reputation and brands and adversely affect our business and financial results.”

Annual report 2025A · The company itself

“We rely on certain third parties for developing key components of our information technology and communications systems and ongoing service, all of which affect our Pay-TV, Wireless and Broadband and Satellite Services businesses. Some of our key systems and operations, including, but not limited to, those supplied by certain third-party providers, are not fully redundant and our disaster recovery planning cannot account for all eventualities. Interruption and/or failure of any of these systems could, among other things, disrupt our operations, interrupt our services, result in significant financial expenditures and damage our reputation, thus adversely impacting our ability to provide our services, retain our current subscribers and attract new Pay-TV, Wireless, and Broadband subscribers.”

Annual report 2025A · The company itself

“In addition to risks described elsewhere herein, the different regions and countries in which we operate our businesses outside of the U.S. expose us to increased risks due to different privacy and cyber-related laws in each of these locations. The same cyber-related issue could have different consequences depending on, among other factors, the region or country of occurrence, the laws applicable in each case and the different levels of enforcement by regulatory and governmental authorities in each jurisdiction.”

Annual report 2025A · The company itself

“Any such developments may also subject us to litigation and regulatory inquiries, which could result in monetary penalties and damages, distract management’s time and attention and lead to enhanced regulatory oversight.”

Annual report 2025A · The company itself

“Problems can arise for a number of reasons, including disruption of facility utilities, equipment malfunction, failure to follow protocols and procedures, raw material problems (including cost volatility and availability), software problems, cybersecurity incidents, or human error.”

Annual report 2025A · The company itself

“The rapid advancement of these technologies entails risks, including potential deficiencies in AI-generated information and increased regulatory, cybersecurity, privacy, intellectual property and data-related risks.”

Annual report 2025A · The company itself

“Failure to protect our information technology infrastructure and our products against cybersecurity attacks, network security breaches, service interruptions, or data corruption could materially disrupt our operations and adversely affect our business and operating results. The operation of our business depends on our information technology systems and the information technology systems of certain of our service providers and suppliers. We rely on our information technology systems to, among other things, effectively manage sales and marketing data, accounting and financial functions, inventory 15 Table of Contents management, product development tasks, clinical data, customer service and technical support functions.”

Annual report 2025A · The company itself

“Cybersecurity attacks can include, but are not limited to, computer viruses, denial-of-service attacks, phishing attacks, ransomware attacks, and other introduction of malware to computers and networks; social engineering or other unauthorized access through the use of compromised credentials; exploitation of design flaws, bugs, or security vulnerabilities; intentional or unintentional acts by employees or other insiders with access privileges; and intentional acts of vandalism by third parties and sabotage. Further, cybersecurity threats and the techniques used in cybersecurity attacks change, develop, and evolve rapidly, including from emerging technologies, such as advanced forms of AI and quantum computing.”

Annual report 2025A · The company itself

“Failure to comply with data privacy and security laws could have a material adverse effect on our business. We are required to comply with increasingly complex and changing legal and regulatory requirements that govern the collection, use, storage, security, transfer, disclosure, and other processing of personal data in the United States and in other countries, which may include, but are not limited to, the Health Insurance Portability and Accountability Act (“HIPPA”), as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, the General Data Protection Regulation (“GDPR”) adopted by the EU and the California Privacy Rights Act (“CRPA”) and the California Consumer Privacy Act, as amended by the CRPA (the “CCPA”). The GDPR imposes stringent EU data protection requirements and provides for significant penalties for noncompliance.”

Annual report 2025A · The company itself

“We are increasingly dependent on sophisticated information technology systems; our business and results of operations are subject to adverse impacts due to the disruption, failure, or breaches of these systems. We and our customers and third-party providers rely on information technology systems, hardware, and software, including third-party “cloud based” systems, to run critical accounting, project management, and financial information systems. We rely upon security measures, systems redundancy, and third-party products and services to attempt to secure our information technology systems and the confidential, proprietary, and sensitive information they contain.”

Annual report 2025A · The company itself

“However, our information technology systems and data, and that of our customers and third-party providers, are subject to cybersecurity incidents, such as hacking, computer viruses or other malicious or destructive software, ransomware, denial of service attacks, malicious social engineering and other intrusions, encryption, erasure, failure, and damage by individuals (which may include our and our third-party providers’ employees), groups or nation states or state-sponsored threats. Such cybersecurity incidents could result in operational disruption and information misappropriation, such as theft of intellectual property or inappropriate disclosure of customer data or confidential, sensitive, or personal information, or in reputational harm with customers.”

Annual report 2025A · The company itself

“We anticipate that the risk of cybersecurity attacks will increase as artificial intelligence capabilities improve and are increasingly used to identify vulnerabilities and construct increasingly sophisticated cybersecurity attacks, with the possibility of additional vulnerabilities being introduced through our own use of artificial intelligence and its use by our stakeholders, including vendors and customers, among others. Should the Company be unable to prevent security breaches or other damage to our information technology systems, disruptions could have an adverse effect on our operations, as well as expose the Company to litigation, liability or penalties under privacy laws, increased cybersecurity protection costs, reputational damage and product failure.”

Annual report 2025A · The company itself

“Koncernen är också utsatt för risker relaterade till dataintrång, virus, sabotage och annan cyberbrottslighet. Vidare kan koncernen hållas ansvarig för skada och därmed leda till ökade kostnader och skadat rykte.”

Annual report 2024A · The company itself

“Ni investerar i ett fantastiskt företag som under 2024 levererade en organisk tillväxt på 10 procent både inom sin säkerhetsoch nätverksaffär.”

Annual report 2024A · The company itself

“Våra kunder gör ditt liv på nätet möjligt Mobila nätverk är ryggraden i digitaliseringen. Företag och människor förlitar sig på robusta nätverk för att få tillgång till information, leverera digitala tjänster och förbättra kundupplevelser. Nätverksprestanda och säkerhet är båda avgörande faktorer.”

Annual report 2024A · The company itself

“I allt högre grad anses telekomnät - verk vara kritisk infrastruktur för samhället och står inför ökande cybersäkerhetshot. Investeringar för att skydda mobilnät och digital kommunikation är ett prioriterat område som har fått ytterligare fokus på grund av en mer osäker global situation, där färska undersökningar tyder på att många operatörer ännu inte har investerat tillräckligt.”

Annual report 2024A · The company itself

“Bedrägeri och säkerhetshot År 2023 eskalerade cybersäkerhetshot från redan höga nivåer globalt, delvis förstärkta av AI-kapacitet, vilket påverkade kritisk infrastruktur inklusive telekomnätverk, såväl som företag och konsumenter. Bedrägliga röstsamtal, bluffmedde - landen och stora tjänsteavbrott har lett till en kraftig ökning av allmänhetens medvetenhet, och attacker på telekomnätverk anses alltmer vara ett nationellt säkerhetsproblem.”

Annual report 2024A · The company itself

“Omsättningen från produktgruppen Säkerhetslösningar ökade med 9 procent (-2) och uppgick till 392,4 Mkr (359,9).”

Annual report 2024A · The company itself

“Under 2024 återinvesterade vi 23 procent av våra intäkter i forskning och utveckling och gjorde även viktiga förbättringar i vår produktportfölj. Inom vår säkerhetsaffär lanserade vi AI-drivna säkerhetsfunktioner i vår Messaging Firewall för att i realtid kunna blockera skadliga länkar i SMS-, MMS- och RCS-meddelanden.”

Annual report 2024A · The company itself

“Transformation inom säkerhet skapar tillväxtpotential Enea har under det senaste decenniet skiftat från operativsystem (OS) och konsulttjänster till ett fokus på cybersäkerhet. Den traditionella OS-verksamheten har minskat drastiskt, från 70 procent av försäljningen 2015 till en ensiffrig procentandel av försäljningen idag.”

Annual report 2024A · The company itself

“Qosmos, ledande positioner inom IP-trafikklassificering och nätverksintelligens.”

Annual report 2024A · The company itself

“Ett tredje exempel handlar om cybersäkerhet för mobilnätverk, där ett ökat trafikutbyte mellan operatörer leder till nya säkerhetshot.”

Annual report 2024A · The company itself

“Ett fortsatt viktigt investeringsområde för oss är cybersäkerhet. Här har vi under de senaste åren väsentligt stärkt vår marknadsposition samtidigt som behovet av förbättrad säkerhet i mobilnätverk kontinuerligt ökar i hela världen.”

Annual report 2024A · The company itself

“Investeringar görs mot marknader med potential för tillväxt och framtida lönsamhet och efter noggrann analys. Investeringar prioriteras inom molnbaserade produkter riktade mot datahantering, säkerhet, mobil videotrafik samt 5G.”

Annual report 2024A · The company itself

“En värdeskapande verksamhet .........11 RAPPORTER Nyckeltal 2024 Fakta 2024 Mkr Omsättning 34% Justerad EBITDA marginal 23% Forskning & Utveckling Om Enea Enea är en världsledande specialist på programvara för telekom och cybersäkerhet.”

Annual report 2024A · The company itself

“Vår produktportfölj omfattar bland annat avancerade brandväggar som skyddar mobilnätverk från cyberattacker, samt lösningar för trafikklassificering, optimering av videotrafik och hantering av WiFi-nätverk.”

Annual report 2024A · The company itself

“Vår affärsidé är att utveckla och sälja mjukvara som skyddar och effektiviserar kommunikation i mobil- och företagsnätverk.”

Annual report 2024A · The company itself

“Attacker mot mobila enheter Bedrägerier meddelandetjänster Regleringar för kritisk *eg SIM Jacker * Artificial Traffic Inflation infrastruktur Säkerhetshot för Försvar på djupet Zero trust Signaleringsattacker meddelandetjänster AI-drivna hot som standard AI & AUTOMATION Data i API exponering Orkestrering över föråldrade Processbaserad flera domäner sidor maskininlärning Vägledd inlärning Generativ AI MOLN & VIRTUALISERING Separerad hård- Nätverks- Privata moln Partnerskap med hyperscaler och mjukvara virtualisering Säkerhet via Portabilitet Containerisering molntjänst (SASE) mellan moln 5G 6G 4G 3G 2G Wi-Fi MOBILNÄTETS UTVECKLING RAPPORTER NÄTVERK Specialiserade mjukvarulösningar för att optimera och hantera data i nätverk, förhöja prestandan och förbättra kundupplevelsen.”

Annual report 2024A · The company itself

“Vi erbjuder produkter och lösningar för digital infrastruktur såsom telekom- och kommunikationsnätverk. Erbjudandet bygger på en unik samlad kompetens som våra specialister besitter inom bland annat 5G, cybersäkerhet och molnbaserade lösningar.”

Annual report 2024A · The company itself

“Specialiserade mjukvarulösningar inom cybersäkerhet för att skydda nätverk mot intrång, hot och attacker.”

Annual report 2024A · The company itself

“Enea är en global leverantör av programvara för telekom - munikation och cybersäkerhet. Intäkterna genereras i huvudsak inom produktgrupperna Nätverkslösningar och Säkerhetslösningar, vilket omfattar mobil och fast telekommunikation samt företagsnätverk.”

Annual report 2024A · The company itself

“Enea är verksamt inom telekomnätverk, inomhusnätverk, cybersäkerhetslösningar samt drift av telekomnätverk.”

Annual report 2024A · The company itself

“En annan viktig kundgrupp är leverantörer av företagsmjukvara som bygger in vår mjukvara i sina lösningar på licens. Till exempel vår DPI för inbyggnad, som är integrerad i kundernas egna applikationer för användning i företagsnätverk och cybersäkerhetslösningar.”

Annual report 2024A · The company itself

“Ett annat kundsegment där vi har etablerat en stark position är med stora CPaaS-leverantörer (Communication Platform as a Service) och meddelandeaggregatorer. Dessa kunder använder våra AI-baserade säkerhetsbrandväggar för meddelandehantering för att skydda företag och prenumeranter från oönskad och bedräglig SMS-trafik.”

Annual report 2024A · The company itself

“Safe and uninterrupted functioning of Enento Group’s IT network and systems, cyber security and mitigation of cyber risks, are critical for the Group’s business. Unauthorized access to or disclosure of information as well as loss or abuse of information may lead to a breach of data protection and other applicable laws by the Group, harm to reputation, loss of income, claims or measures taken by the authorities.”

Annual report 2025A · The company itself

“IT och cybersäkerhet Beroende av att kunna erbjuda kunder tillförlitliga IT-lösningar samt ha en säker intern IT-struktur. Driftsstörningar, cyberattacker och stöld av information skadar vårt förtroende på marknaden och kan orsaka stora finansiella skador. Eniro jobbar kontinuerligt med att förbygga och motverka negativa effekter av dessa.”

Annual report 2024A · The company itself

“Det uppkopplade tåget ställer krav på både tillförlitlighet och cybersäkerhet och här har affärsenheten ett komplett erbjudande av högsta kvalitet.”

Annual report 2024A · The company itself

“» Under året gjorde Westermo betydande satsningar inom cybersäkerhetsområdet för att garantera trygg datakommunikation för tåg, järnvägsinfrastruktur och energiförsörjning. Affärsenheten certifierades enligt IEC 62443–4, en cybersäkerhetsstandard som säkerställer att enhetens produkter är utvecklade och tillverkade med cybersäkerhet i åtanke. » Westermos etablering i Bangalore, Indien, fortskred enligt plan med rekrytering av såväl ledning som medarbetare.”

Annual report 2024A · The company itself

“Affärsenheten har även satsat på produktutveckling med främsta fokus på ännu bättre cybersäkerhetsfunktionalitet.”

Annual report 2024A · The company itself

“Risken för större konjunkturnedgångar som får allvarliga konsekvenser för affärsenheternas försäljningsutveckling och resultat balanseras genom att fokussegmenten har olika cykler och olika stor känslighet för konjunktursvängningar, samt genom interna anpassningar och stor kostnadsmedvetenhet. • IT-säkerhetsrisk: Risken för intrång i datorsystem, stöld av affärskritiska data eller sabotage av kritiska datorsystem genom cyberattacker motarbetas med hjälp av ett noga utformat säkerhetsarbete och regelbundna utbildningsinsatser. • Beroende av kunder: Risken att förändringar hos enskilda kunder medför betydande negativ påverkan på försäljning och resultat balanseras genom att affärsenheterna har olika exponering och att affärslogiken skiljer sig åt inom de fem fokussegmenten. • Störningar och skador som påverkar produktions- och försörjningskedjan: Risken för betydande förseningar och problem vid uppstart av ny produktserie, vid kraftig tillväxt eller vid leverantörsrelaterade störningar, hanteras genom väl etablerade processer för såväl teknik- som kompetensöverföring, ett rutinbaserat arbetssätt som säkerställer kvalitet och genom de satsningar som skett för att stärka försörjningskedjan och säkerställa redundans.”

Annual report 2024A · The company itself

“Försäljning miljarder kr medarbetare Rörelseresultat miljoner kr Verksamhet i länder Detta är Ependion Ependion är en växande global teknikkoncern som erbjuder digitala lösningar för säker kontroll, styrning, visualisering och datakommunikation för industriella tillämpningar i miljöer där tillförlitlighet och hög kvalitet är kritiska faktorer.”

Annual report 2024A · The company itself

“Robusta lösningar för säkra resor och transporter Westermos erbjudande inom tågsegmentet handlar om säker kommunikation, kontroll och styrning. Lösningarna bygger på egenutvecklad hård- och mjukvara som produceras av affärsenheten i kombination med behovsanpassade servicetjänster.”

Annual report 2024A · The company itself

“Inom digitalisering erbjuder Beijer Electronics lösningar för industriell datakommunikation, fjärråtkomst samt Edge, som ger snabbare åtkomst till data och högre säkerhetsnivå.”

Annual report 2024A · The company itself

“Ependion erbjuder marknaden digitala lösningar för säker kontroll, visualisering och datakommunikation för industriella tillämpningar i miljöer där tillförlitlighet och hög kvalitet är kritiska faktorer.”

Annual report 2024A · The company itself

“Epiroc kan uppleva affärsavbrott orsakade av cyberbrottslighet, avbrott i kritiska IT-tjänster eller andra intrång i dess informationssystem som kan leda till förlust av immateriella rättigheter. De senaste årens ökning av distansarbete har medfört ytterligare risker genom exponering för fler potentiella attackvektorer.”

Annual report 2024A · The company itself

“Epiroc erbjuder den högsta nivån av säkerhetssystem på marknaden, Collision Avoidance System (CAS) Level 9. När detta system, Titan CAS, kombineras med vårt smarta Onboardsystem, får kunderna både kollisionsförebyggande åtgärder och trafikmedvetenhet över långa avstånd.”

Annual report 2024A · The company itself

“Because our products and services involve the storage and transmission of personal information of consumers, we are routinely the target of attempted cyber and other security threats by outside third parties, including technically sophisticated and well-resourced bad actors attempting to access or steal the data we store.”

Annual report 2025A · The company itself

“We have previously experienced a material cybersecurity incident and if we experience additional breaches of our security measures, including from incidents that we fail to detect for a period of time, sensitive data may be accessed, stolen, disclosed or lost. Any such access, disclosure or other loss of information could subject us to business interruption, significant litigation, regulatory fines or penalties, any of which could have a material adverse effect on our cash flows, competitive position, financial condition or results of operations.”

Annual report 2025A · The company itself

“For example, our reputation with consumers and other stakeholders and our customer relationships were damaged following a prior material cybersecurity incident, resulting in a negative impact on our revenue for a period of time.”

Annual report 2025A · The company itself

“We are required by customers and business partners to obtain various industry or technical certifications. Such certifications are critical to our business because certain of our current and potential customers and the contracts governing certain customer relationships, as well as certain of our data suppliers, require us to maintain them as a requirement of doing business.”

Annual report 2025A · The company itself

“Other Planned Uses of Capital We will continue to invest in sales, marketing, new product development, security and our technology, as well as continue to make strategic acquisitions that align with our business strategy.”

Annual report 2025A · The company itself

“With Equinix, they can scale with speed and agility, accelerate the launch of new digital offerings while safeguarding data, and implement AI applications at scale to achieve business success. We enable customers to simplify their digital infrastructure, ensure interoperability across platforms, and maximize speed, efficiency and security to deliver superior customer, partner and employee experiences.”

Annual report 2025A · The company itself

“Regulations such as the US Cyber Incident Reporting for Critical Infrastructure Act of 2022 (“CIRCIA 2022”), the SEC Cybersecurity Disclosure Rule, the EU Network and Information Security Directive No.2 (“NIS 2”), the EU Digital Operational Resilience Act (“DORA”), and Australia’s Security of Critical Infrastructure Act 2018 make it mandatory for Equinix to comply with more stringent requirements related to cybersecurity, data privacy, controls on data storage and cross border data transfer and operational resilience, more so, in countries where our entities and/or IBXs are designated as critical information or critical national infrastructure.”

Annual report 2025A · The company itself

“Risk Management and Strategy Our enterprise risk management framework considers cybersecurity risk in conjunction with our other Company risks as part of the overall risk assessment process. Our enterprise risk management team collaborates with the cybersecurity function, led by the Chief Information Security Officer (“CISO”), to gather their insights and risk mitigation strategies for managing cybersecurity threats. This integrated approach helps us assess, identify, and manage cybersecurity risks along with our other operational, financial and strategic risks, assisting in more effectively managing interdependencies among risks and enhancing risk mitigation strategies.”

Annual report 2026A · The company itself

“Table of Contents We have experienced cybersecurity incidents of varying degrees on our information technology; however, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operation or financial condition. However, we cannot eliminate all risks and the compromise or interruption of, or damage to, our information technology (including our operational technology and websites) by cybersecurity incidents could have a material negative impact on our business.”

Annual report 2026A · The company itself

“We have implemented a cybersecurity program including processes, technologies, and controls to assess, identify, and manage material risks from cybersecurity threats. This program includes implementing and evolving new technologies to proactively identify and monitor new vulnerabilities and reduce risk, conducting due diligence of third-party vendors’ information security programs, maintaining security policies and standards and regularly updating and testing our response planning and protocols.”

Annual report 2026A · The company itself

“We maintain a formal information security training program for employees that includes training on matters such as identifying phishing attempts and web browsing/email security best practices. Employees are also required to complete mandatory training on data privacy.”

Annual report 2026A · The company itself

“Any significant disruptions or unapproved third-party access to our global systems or the internet for any reason, which could include equipment or network failures; co-location facility failures; power outages; sabotage; government interference, employee error or other actions; cyber-attacks or other security breaches; reliance on third party technology; geo-political activity or natural disasters; all of which could have a material negative effect on our results. Significant disruptions to, or unapproved third‑party access into our networks and systems could materially harm our business and financial results by interrupting critical operations and degrading systems continuity.”

Annual report 2025A · The company itself

“F-Secure may not be able to keep up with rapid changes in customer demand, distribution channels, technologies such as AI and the evolution of consumer cybersecurity threats such as scams, which could have an adverse effect on F-Secure reputation, competitiveness, operational results and financial position.”

Annual report 2025A · The company itself

“Actual, possible, or perceived defects, disruptions or vulnerabilities in F-Secure products or services, including risks from usage of AI technologies, could lead to security breaches or cybersecurity attacks and errors. Such incidents may also result from errors or misuse by F-Secure employees or business partners.”

Annual report 2025A · The company itself

“Standard Type Description Time horizon Environment Risk (DVC/OO) Failure to meet climate change mitigation targets may negatively impact channel business Mid-term and Long-term Social Opportunity (OO) Evolving threat landscape, protecting consumers against evolving threat landscape (for example scams) benefits both F-Secure and partners Short-term, mid-term and long-term Opportunity (OO) Use data and AI in security applications, for more effective protection and better user experience.”

Annual report 2025A · The company itself

“CEO Use of AI in security applications AI increases risk of security breach While our Code of Conduct is applicable for Consumers and End-Users, serving customers and partners in a business ethical manner is described in the Business Conduct section and under the "Code of Conduct training target".”

Annual report 2025A · The company itself

“F-Secure continues to have a relationship with Lookout and WithSecure for certain protection capabilities after the Lookout Life acquisition and Withsecure demerger. The inability of third parties such as Lookout or WithSecure to provide these protection capabilities could have a material adverse effect on F-Secure’s business and its customers.”

Annual report 2025A · The company itself

“Risk (DVC/UVC, OO) Security of vendors and partners Security vulnerabilities from suppliers and partners, relying on external vendors, especially vendors who are one step removed in the supply chain, adds layers of vulnerability.”

Annual report 2025A · The company itself

“F-Secure reports Partner channel revenue divided into its main product portfolios: Security Suite and Embedded Security. This reporting approach aims to increase transparency in the development of the company's product mix, as the portfolios have different levels of profitability.”

Annual report 2025A · The company itself

“In 2025, F‑Secure’s Technology function focused on scam protection, simplifying our product and systems landscape, improving delivery discipline, and strengthening the foundations for efficient growth and Tier 1 readiness.”

Annual report 2025A · The company itself

“Our advances in scam protection were recognized with an AI award in 2025. We continued to deepen our understanding of online fraud through ongoing research and market assessment, including work on deepfake detection and cross‑channel scams.”

Annual report 2025A · The company itself

“F-Secure sees the potential to grow faster than the market, focusing on partner channel and its offering around Embedded security and Scam Protection.”

Annual report 2025A · The company itself

“We handle personally identifiable information securely, never sell it to third parties, and provide regular workforce training on PII handling as part of our Code of Conduct.”

Annual report 2025A · The company itself

“During 2025, we continued to expand our scam protection capabilities and launched a dedicated Scam Protection offering in our Direct Business in May 2025. This activity continues during our strategy period (2026–2028) and is executed across our focus regions and channels.”

Annual report 2025A · The company itself

“Creating Awareness About Cyber Crimes Increasing consumer awareness on cybercrime is critical to help consumers stay safe when online. Our dual strategy raises awareness directly with service providers and consumers while equipping our 200+ channel partners to educate their customers.”

Annual report 2025A · The company itself

“Actions to mitigate material risks Our most material impact is protecting consumers' digital moments through holistic, engaging cybersecurity products and services directly and through partners.”

Annual report 2025A · The company itself

“F-Secure's main product and service portfolios are: Security Suite: F-Secure Total, which is an all-in-one consumer cybersecurity application that provides complete protection against scams as well as security, privacy and identity protection on all consumers’ personal devices.”

Annual report 2025A · The company itself

“Embedded Security: Comprehensive portfolio of consumer cybersecurity capabilities available as Software Development Kits (SDKs) and cloud Application Programming Interfaces (APIs) that can be embedded into Service Provider’s app or service. Embedded Security portfolio also includes F-Secure Sense, an SDK based solution that provides whole home protection embedded inside a Wi-Fi-router.”

Annual report 2025A · The company itself

“Services: F-Secure Security Business Platform based scalable expert and cloud-based services supporting both Security Suite and Embedded Security business such as delivery and integration, customer care, and partner success services that support F-Secure’s Partner Business.”

Annual report 2025A · The company itself

“Material impact, risk or opportunity Description Personal safety of consumers and/or end-users Security of a person - Protecting our customers Opportunity (OO) Use of AI in security applications AI-powered monitoring tools observe user behavior, detect anomalies, and react accordingly Opportunity (OO) Evolving threat landscape Scams have become commonplace. Opportunities to offer engaging and relevant protection services Risk (OO) Consumer willingness to pay Intensifying competition and negative macro-economic situation may have negative impact on consumer willingness to pay.”

Annual report 2025A · The company itself

“F-Secure business F-Secure designs and offers security and privacy products and services that help millions of consumers to protect themselves against online threats. F-Secure’s offering includes a comprehensive range of security and privacy products and services related to endpoint security, privacy protection, password management and digital identity protection, and router security that protects consumers’ entire connected home.”

Annual report 2025A · The company itself

“Table of Contents Legal and Regulatory Risks Our failure to adequately protect personal information could have a material adverse effect on our business A wide variety of local, state, national, and international laws, directives and regulations apply to the collection, use, retention, protection, disclosure, transfer, and other processing of personal data. These data protection and privacy-related laws and regulations continue to evolve and may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions and increased costs of compliance.”

Annual report 2025A · The company itself

“Item 1.Business General F5 is a multicloud application delivery and security provider committed to bringing a better digital world to life. F5 partners with the world’s largest, most advanced organizations to optimize and secure every application and Application Programming Interface ("API") anywhere, including on-premises, in the cloud, and at the network edge.”

Annual report 2025A · The company itself

“First, our current portfolio is solving security and performance challenges associated with AI model training and inference and in support of AI-driven workloads. We are selling F5 solutions in support of AI data delivery, AI runtime security and AI factory load balancing use cases.”

Annual report 2025A · The company itself

“We sell application delivery and security solutions for web application and API protection, hybrid multicloud networking, enterprise AI delivery and security, application migration, application modernization, zero trust architecture and post quantum cryptography readiness.”

Annual report 2025A · The company itself

“F5 Distributed Cloud Service offerings are available as packaged software and SaaS-based consumption models and include the following: •F5 Distributed Cloud Web App and API Protection ("WAAP"). A comprehensive SaaS-based security solution, F5 Distributed Cloud WAAP allows our customers to accelerate time-to-service, lower total cost of ownership, and increase security efficacy on a cloud native platform that is fully integrated across a single policy engine and management console.”

Annual report 2025A · The company itself

“•Mitigation against OSI Model Layer 3-Layer 7 application-based and volumetric DDoS attacks through advanced F5 Distributed Cloud DDoS Mitigation, a managed, cloud-delivered mitigation service that detects and mitigates large-scale network, SSL, and application-targeted attacks in real time. •Enhanced API security, which leverages machine-based learning, auto-discovery, and anomaly detection, which automates the entire process of finding, securing, and monitoring APIs for anomalous behavior. •Next-generation, AI enabled bot mitigation through F5 Distributed Cloud Bot Defense provides our customers the ability to defend applications and APIs from automated attacks.”

Annual report 2025A · The company itself

“The solution leverages AI to analyze massive amounts of traffic and machine learning to ensure sustainable bot prediction models with high efficacy. •Protection from sophisticated account takeover attempts. •F5 Distributed Cloud Multi-Cloud Networking ("MCN"). Our MCN solutions simplifies networking with an integrated service stack that securely connects both networks and application workloads, lowering operational costs and increasing agility.”

Annual report 2025A · The company itself

“Cybersecurity, Technology and Data Security Risks Unauthorized access to confidential data including client data, other cyber-attacks, and the failure of our cyber-security systems and procedures Many of our products, as well as our internal systems and processes, involve the collection, retrieval, processing, storage and transmission of our own, as well as supplier and client, proprietary information and sensitive or confidential data through a variety of media channels. We rely on, and continuously invest in, internal processes, controls, policies, procedures and employee training programs designed to protect confidential data received in the ordinary course of business, including information from client portfolios and strategies. However, these measures do not guarantee security, and improper access to or release of confidential information may still occur—whether due to employee error or malfeasance, system error, inadvertent release, failure to properly purge or protect data, or through cyber-attacks.”

Annual report 2025A · The company itself

“Our size, scale and role in the financial markets increases our risk for cyber-attacks and our exposure to other cyber-security risks. We use third-party service providers for certain critical functions. We and our third-party service providers are subject to the risks of system failures, security breaches and cyber-attacks, such as those sponsored by nation-states, terrorist organizations, or global corporations seeking to illicitly obtain technology or other intellectual property, including through the use of generative AI, agentic AI, phishing scams, hacking, viruses, denial of service attacks, tampering, intrusions, physical break-ins, ransomware and malware, employee errors or malfeasance.”

Annual report 2025A · The company itself

“While significant effort is placed on addressing information technology security issues with respect to the companies we acquire, we may inherit such risks when these acquisitions are integrated into our infrastructure. Although we conduct due diligence during acquisition processes, acquired businesses may not have invested as heavily in security measures and technology, and this may introduce additional security risk.”

Annual report 2025A · The company itself

“Operational Risks If our cybersecurity measures are compromised or unauthorized access to customer or consumer data is otherwise obtained, our products and services may be perceived as not being secure, customers may curtail or cease their use of our products and services, our reputation may be damaged and we could incur significant liabilities. Because our business requires the storage, transmission and utilization of sensitive consumer and customer information, we will continue to routinely be the target of attempted cybersecurity and other security threats by technically sophisticated and well-resourced outside third parties, among others, attempting to access or steal the data we store.”

Annual report 2025A · The company itself

“Furthermore, we are subject to an increasing number of cybersecurity compliance and reporting obligations in different jurisdictions that vary in their scope and application, creating conflicting reporting requirements.”

Annual report 2026A · The company itself

“Our business is subject to complex and evolving United States and foreign laws and regulations regarding data protection and cybersecurity, which impose significant costs and regulatory risks that are likely to increase over time. There has recently been heightened regulatory and enforcement focus relating to the collection, use, storage, retention, transfer, and processing of personal data in the United States (at both the state and federal level) and internationally, including the EU’s General Data Protection Regulation, the United States executive order relating to sharing information with China and other covered countries, the California Consumer Privacy Act (as amended by the California Privacy Rights Act, the “CCPA”), the Virginia Consumer Data Protection Act, the Canada Personal Information Protection and Electronic Documents Act (“PIPEDA”), and other similar laws that have been or will be enacted by other jurisdictions.”

Annual report 2026A · The company itself

“Laws and regulations regarding data privacy, data security, cybersecurity, and AI in North America continue to be updated and expanded. Enforcement actions relating to these areas continue to increase and be an area of focus.”

Annual report 2026A · The company itself

“We face significant and evolving risks from cyberattacks, data breaches, and operational disruptions, which may be random or targeted and can originate from a variety of sources, including external actors, malicious insiders, and third-party service providers. These risks are heightened by the increasing number, intensity, and sophistication of attempted attacks globally, as well as the growing reliance on connected information technology systems to store and transmit sensitive data.”

Annual report 2026A · The company itself

“FedEx and our third-party service providers have experienced, and we and our third-party service providers may experience in the future, breaches or disruptions of our technology infrastructure, which could result in unauthorized access to, or loss of, sensitive or confidential information regarding our operations, customers, employees, or suppliers, including personal information.”

Annual report 2026A · The company itself

“If we are unable to protect our sensitive data and information systems against data corruption, cybersecurity incidents or network security breaches, or if we are unable to provide adequate security in the electronic transmission of sensitive data, it could materially adversely affect our business, financial condition and results of operations. We face global cybersecurity threats, which range from uncoordinated individual attempts to sophisticated and targeted measures, known as advanced persistent threats, directed at us and our customers, suppliers, and service providers.”

Annual report 2025A · The company itself

“For example, the rapid evolution of AI and machine learning technologies and the implementation of pilot programs integrating generative AI into both our internal and external-facing systems may intensify our cybersecurity, privacy and data security risks, such as the risk of increased vulnerability to cybersecurity threats and exposure or theft of proprietary, confidential, personal or otherwise sensitive information (which could result in such information being made available to our competitors and other members of the public), the generation of factually incorrect or biased outputs and reliance on outdated or unverified data.”

Annual report 2025A · The company itself

“Changing market dynamics, particularly in the areas of digital delivery, information security and AI are transforming the way our clients operate and compete. These dynamics are driving increased demand for integrated, modular solutions built on our intellectual property.”

Annual report 2025A · The company itself

“In November 2025, the European Supervisory Authorities ("ESAs") designated the Company as a Critical Third-Party Provider ("CTPP") of Information and Communication Technology ("ICT") Services under DORA.”

Annual report 2025A · The company itself

“Risks Related to Our Business and Operations Security breaches, privacy breaches, cyberattacks, unintentional disclosures of confidential information, breaches of third party service providers, service outages, or a failure to comply with information security laws or regulations, contractual provisions, or industry security requirements by us, our vendors, clients, or technology partners could harm our business by disrupting delivery of services, exposing sensitive or confidential information, or damaging our reputation, any of which could result in a breach of one or more client contracts or regulatory investigations, enforcement actions, fines or litigation.”

Annual report 2025A · The company itself

“The New York Department of Financial Services has enacted rules that require covered financial institutions to establish and maintain cybersecurity programs. Other states also have data security laws that vary in several respects, including with regard to specificity and detail of requirements and the extent to which such requirements apply to the data we collect from individuals.”

Annual report 2025A · The company itself

“High profile digital banking security breaches or information system failures could impact consumer payment behavior patterns in the future and reduce our transaction volumes. We are unable to predict whether or when high profile digital banking security breaches or other information system failures will occur and, if they occur, whether consumers will reduce their digital banking service. If consumers reduce digital banking services, and we are not able to adapt to offer our clients alternative technologies, then our revenue and related earnings could be adversely affected.”

Annual report 2025A · The company itself

“BRICS countries are working to reduce their reliance on the U.S. dollar and Western financial infrastructure due to sanctions, wars, and tariffs. BRICS is an international organization currently comprised of 11 countries, including Brazil, Russia, India, China, South Africa, Saudi Arabia, Egypt, United Arab Emirates, Ethiopia, Indonesia, and Iran. Intelligence sources, along with peer assessments and other observers, suggest that cyber actors from some of the BRICS countries may conduct attacks on payment infrastructure, including third-party fintech services, to undermine trust in the Western financial infrastructure.”

Annual report 2025A · The company itself

“Our decision solutions offer a spectrum of options that cover the account lifecycle from helping to identify qualified account applicants to managing existing customer accounts and fraud. Our applications enable Know Your Customer, new account decisioning and opening, account and transaction management, fraud management and collections. Our risk management solutions use our proprietary risk management models and data sources to assist in detecting fraud and assessing the risk of opening a new account. Our systems use a combination of advanced authentication procedures, predictive analytics, AI modeling and proprietary and shared databases to assess and detect fraud risk for deposit, card and other transactions for financial institutions. •Card and Retail Payments.”

Annual report 2025A · The company itself

“General Risk Factors •Cybersecurity incidents or information or security breaches, or those of third parties with which we do business, could have a material adverse effect on our business, financial condition, and results of operations.”

Annual report 2025A · The company itself

“Our operations rely on our information systems, including hardware, software, and networks, as well as on the information systems of third parties with which we do business (including their upstream and/or downstream service providers, as applicable), to securely process, store, and transmit proprietary, confidential, and other information, including intellectual property and personally identifiable information. We also rely heavily on these information systems to operate our manufacturing lines. These information systems may be compromised by cybersecurity incidents, including those caused by computer viruses, malware, ransomware and other cyber-attacks, as well as other events, including information and security breaches, that could be materially disruptive to our business operations and could put the security of our information, and that of the third parties with which we do business, at risk of misappropriation or destruction.”

Annual report 2025A · The company itself

“Recent developments in the threat landscape include the use of AI and machine learning, as well as an increased number of cyber extortion attacks, with higher financial ransom demand amounts and increasing sophistication and variety of ransomware techniques and methodology. While we have instituted security measures and procured insurance to mitigate the likelihood and impact of a cybersecurity incident and other events, including information and security breaches, there is no assurance that these measures, or those of the third parties with which we do 38 Table of Contents business, will be adequate in the future.”

Annual report 2025A · The company itself

“Privacy and Cybersecurity Regulations. We provide services that involve the collection and processing of significant amounts of personal, financial, and other sensitive data which subject our offerings to various federal, state, local and foreign privacy and cybersecurity laws and regulations, as well as association and network privacy and cybersecurity rules, which govern, among other things, the collection, processing, storage, deletion, use and disclosure of personal information.”

Annual report 2025A · The company itself

“Operational and Security Risks Security incidents or other technological risks involving our systems and data, or those of our clients, partners or vendors, could expose us to liability or damage our reputation. Our operations depend on receiving, storing, processing and transmitting sensitive information pertaining to our business, our employees, our clients and their customers.”

Annual report 2025A · The company itself

“Legislative or regulatory initiatives on cybersecurity and data privacy could adversely impact our business and financial results. Cybersecurity and data privacy risks have received heightened legislative and regulatory attention. In Europe and the U.K., their respective General Data Protection Regulations (collectively, “GDPR”) extends the scope of their data protection laws to companies processing data of individuals within the E.U. and the U.K., regardless of the company’s location, subject to certain limitations. The law requires companies to meet stringent requirements regarding the handling of personal data.”

Annual report 2025A · The company itself

“These products and services include merchant acquiring and digital commerce services; mobile payment services; security and fraud protection solutions; stored-value solutions; and pay-by-bank solutions.”

Annual report 2025A · The company itself

“The business lines (operating segments) aggregated within the Financial segment consist of the following: •Digital Payments – provides debit card processing services; debit network services; security and fraud protection products; bill payment; person-to-person payments; and account-to-account transfers 88 Table of Contents •Issuing – provides credit card processing services; prepaid card processing services; card production services; print services; government payment processing; and student loan processing •Banking – provides customer loan and deposit account processing; digital banking; financial and risk management; professional services and consulting; and check processing Corporate and Other supports the reportable segments described above, and consists of amortization of acquisition-related intangible assets, unallocated corporate expenses and other activities that are not considered when management evaluates segment performance, such as gains or losses on sales of businesses, certain assets or investments; costs associated with acquisition and divestiture activity; certain services revenue associated with various dispositions; expenses associated with the Company’s transformation initiative focused on operational excellence; and postage reimbursements.”

Annual report 2025A · The company itself

“Table of Contents A breach of our IT or physical security systems, or a cybersecurity incident affecting our operations, products, or third parties upon which we rely, could materially disrupt our business, damage our reputation, and expose us to significant costs and liability. We rely on our information systems, some of which are managed by third parties, to process, transmit, and store electronic information (including sensitive data such as confidential business information and personally identifiable information relating to employees, customers, vendors, and other business partners), and to manage or support critical business processes and activities, including manufacturing, design and engineering services, financial reporting, inventory management, procurement, invoicing, and electronic communications.”

Annual report 2026A · The company itself

“Our ability to monitor third parties' information security practices is limited, supply chain attacks have increased in frequency and severity, and we cannot guarantee that third parties, including cloud or hosted solution providers, have not been compromised or that their systems are free from exploitable defects.”

Annual report 2026A · The company itself

“We regularly move data across borders to operate our global business, and are consequently subject to a broad and continuously evolving set of privacy and data protection laws and regulations both domestically and internationally, including the European Union General Data Protection Regulation ("GDPR"), the UK GDPR, China's Personal Information Protection Law ("PIPL"), India's Digital Personal Data Protection Act, and comprehensive privacy statutes in numerous U.S. states, including the California Consumer Privacy Act ("CCPA"), as amended by the California Privacy Rights Act ("CPRA").”

Annual report 2026A · The company itself

“These laws impose numerous, and oftentimes differing, obligations on data controllers and processors, and new requirements continue to be proposed and enacted across U.S. federal, state, and international jurisdictions. Compliance can be costly, and the complexity and inconsistency of these frameworks across jurisdictions poses significant compliance challenges that have resulted, and will continue to result, in increased costs and required modifications to our data processing practices and policies.”

Annual report 2026A · The company itself

“Revenue from the sale of new, or from the renewal of existing, FortiGuard and other security subscriptions and FortiCare technical support service contracts may decline and fluctuate as a result of a number of factors, including fluctuations and changes in the mix of our sales from secure networking, unified SASE and security operations between products and services, end-customers’ level of satisfaction with our products and services, the prices of our products and services, the prices of products and services offered by our competitors, reductions in our customers’ spending levels and the timing of revenue recognition with respect to such sales.”

Annual report 2025A · The company itself

“•We are susceptible to defects or vulnerabilities, including critical vulnerabilities, in our products or services, as well as reputational harm from the failure or misuse of our products or services, and any actual or perceived defects or vulnerabilities, including critical vulnerabilities, in our products or services, failure of our products or services to detect or prevent a security incident or to cause a disruption to operations, failure of our customers to implement preventative actions such as updates to one of our deployed solutions or failure to help secure our customers, could cause our products or services to allow unauthorized access to our customers’ networks and harm our operational results and reputation more significantly as compared to other companies.”

Annual report 2025A · The company itself

“If our new products, services or enhancements do not achieve adequate acceptance in the market, our competitive position will be impaired, our revenue will be diminished and the effect on our operating results may be particularly acute because of the significant research, development, marketing, sales and other expenses we incurred in connection with the new product, service or enhancement. The network security market is rapidly evolving and the complex technology incorporated in our products makes them difficult to develop. If we do not accurately predict, prepare for and respond promptly to technological and market developments, changing end-customer needs, and expanding regulatory requirements and standards, our competitive position and prospects may be harmed.”

Annual report 2025A · The company itself

“The sales prices for our products and services may decline for a variety of reasons or our product mix may change, resulting in lower growth and margins based on a number of factors, including competitive pricing pressures, discounts or promotional programs we offer, a change in our mix of products and services and anticipation of the introduction of new products and services. We have recently conducted such price decreases. Competition continues to increase in the market segments in which we participate, and we expect competition to further increase in the future, thereby leading to increased pricing pressures.”

Annual report 2025A · The company itself

“AI can be exploited by hackers and malicious actors to develop advanced cyberattacks, bypass security measures, and exploit system vulnerabilities including potentially identifying weaknesses in our systems before we become aware of or can remediate them.”

Annual report 2025A · The company itself

“The landscape of laws, regulations, and industry standards related to cybersecurity is evolving globally. We may be subject to increased compliance burdens by regulators and customers with respect to our products and services, as well as additional costs to oversee and monitor security risks. Additionally, this evolving global landscape could impact on our ability to conduct business in certain jurisdictions if the laws, regulation and industry standards in such jurisdictions changed in a manner that is adverse to our business.”

Annual report 2025A · The company itself

“Our network firewall offerings consist of a FortiGate, which can be deployed at branch, campus, data center, internal segmentation, private and public cloud to enable hybrid mesh firewall solutions, as well as encrypted applications (secure sockets layer (“SSL”) inspection, virtual private network and Internet Protocol Security connectivity).”

Annual report 2025A · The company itself

“The Fortinet Unified SASE solution includes a single-vendor SASE solution that includes firewall, SD-WAN, secure web gateway, cloud access services broker, Data Loss Prevention (“DLP”), Digital Experience Monitoring (“DEM”), Remote Browser Isolation (“RBI”) and ZTNA to deliver flexible secure access for all users. We are one of the few vendors to deliver consistent convergence and AI-powered security across Secure SD-WAN and SSE to enable a single-vendor SASE framework with a cloud-centric architecture powered by FortiOS.”

Annual report 2025A · The company itself

“•AI-Driven Security Operations (SecOps)—Our AI-Driven SecOps portfolio provides a suite of cybersecurity solutions that identify, protect, detect, respond and recover from threats, all integrated within the Fortinet Security Fabric. At the core is FortiAnalyzer, which serves as the central SOC platform with its unified data lake that provides: built-in security information and event management (“SIEM”); security, orchestration, automation, and response (“SOAR”); XDR and threat intelligence, enabling centralized visibility, analytics and automation with complete control.”

Annual report 2025A · The company itself

“FortiGuard and Other Security Services are a suite of AI-powered security capabilities that are natively integrated as part of the Fortinet Security Fabric to deliver coordinated detection and enforcement across the entire attack surface. The 4 Table of Contents portfolio consists of FortiGuard application security services, content security services, device security services, NOC/SOC security services and web security services.”

Annual report 2025A · The company itself

“FortiCare Technical Support Service is a technical support service, which provides customers access to experts to ensure efficient and effective operations and maintenance of their Fortinet solution. Global technical support is offered 24x7 with flexible add-ons, including enhanced service-level agreements (“SLAs”) and priority hardware replacement through in-country and local depots.”

Annual report 2025A · The company itself

“•FortiEndpoint—FortiEndpoint converges secure connectivity, endpoint protection and advanced capabilities like endpoint detection and response and Universal Zero Trust Network Access (“ZTNA”), into a single agent. It simplifies management and enhances visibility while reducing costs and complexity.”

Annual report 2025A · The company itself

“Table of Contents These competitive differentiators provide networking and security professionals with a cyber security platform comprised of over 50 products across three solution pillars: •Secure Networking—Our Secure Networking solutions focus on the convergence of networking and security via FortiOS, our networking and security operating system that is the foundation of our Fortinet Security Fabric platform and supports a broad range of functions that can be delivered via a physical, virtual, cloud or SaaS solutions. When delivered through our network firewall appliances, functionality is accelerated through our proprietary ASIC technology.”

Annual report 2025A · The company itself

“Demand for our products may be limited by market perception that individual products from one vendor that provide multiple layers of security protection in one product are inferior to point products from multiple vendors. Sales of many of our products depend on increased demand for incorporating broad security functionality into one appliance.”

Annual report 2025A · The company itself

“Kuten kaikki kriittisiä infrastruktuureja operoivat, altistuu Fortum yhä enenevissä määrin kyberturvallisuusriskeille, mukaan lukien riskit, jotka liittyvät tietoturvaan, operatiivisiin järjestelmiin (OT), digitalisaatioon ja yksityisyydensuojaan.”

Annual report 2025A · The company itself

“Hallituksen toimintakertomus Tilinpäätös Muut 38 Kuluttajien ja oman työvoiman tietosuojaa koskevat tavoitteet Sisältyy tulosperusteisiin kannustinjärjestelmiin 1) Mittayksikkö Tavoitevuosi Tavoitearvo 2025 2024 Muutos edellisvuodesta Asiakkaiden ja oman työvoiman tietosuojaan ja yksityisyydensuojaan liittyvien prosessien vahvistaminen Etenee suunnitellusti, Kyllä/Ei Vuosittain N/A Kyllä N/A N/A Tietosuojakoulutuksen suorittamisaste % N/A 100 98 86 12 1)Kannustinjärjestelmiin sisältyvistä tavoitteista on lisätietoa osiossa 1.5.2 Kestävyyteen liittyvät tulostavoitteet kannustinjärjestelmissä. Vuonna 2025 Fortum asetti uudet tavoitteet henkilöstön ja kuluttajien henkilötietojen yksityisyyden ja suojan parantamiseksi.”

Annual report 2025A · The company itself

“Oma työvoima Mahdollinen kielteinen vaikutus Oma toiminta Keskipitkä aikaväli Fortumin henkilötietojen käsittely voi vaikuttaa kielteisesti työntekijöiden yksityisyyden ja tietosuojan toteutumiseen, esimerkiksi jos tietoja vuotaa tai niitä käytetään väärin kolmansien osapuolten toimesta tai sisäisesti.”

Annual report 2025A · The company itself

“Kuluttajat ja loppukäyttäjät Mahdollinen kielteinen vaikutus Oma toiminta Keskipitkä aikaväli Henkilötietojen käsittelyllä voi olla kielteisiä vaikutuksia asiakkaiden yksityisyyteen ja tietosuojan toteutumiseen esimerkiksi, jos tietoja vuotaa tai niitä käytetään väärin sisäisesti, tai kolmansien osapuolten toimesta.”

Annual report 2025A · The company itself

“Tietosuojaan liittyvät vaikutukset koskevat myös Fortumin henkilöstöä. Fortum käsittelee asiakkaiden ja työntekijöiden henkilötietoja tavalla, joka varmistaa tiedon turvallisuuden.”

Annual report 2025A · The company itself

“The techniques used to access, disable or degrade service or sabotage systems change frequently and continue to become more sophisticated and targeted, and the increasing use of AI may intensify cybersecurity risks and the volume of attacks. In addition, ongoing tensions with China, North Korea, Russia and other nation states, conflicts in the Middle East and Europe, and other geopolitical events may lead to cyberattacks or other actions that could lead to a disruption of services, improper disclosure of personal data or other confidential information, or otherwise negatively impact the Systems (including supply chain disruption and attacks).”

Annual report 2026A · The company itself

“The Company’s high-profile sports and entertainment programming and its extensive news coverage of elections, sociopolitical events and public controversies subject us to heightened cybersecurity risks.”

Annual report 2026A · The company itself

“We are exposed to risks related to cybersecurity. A significant portion of our business is conducted over the internet and we rely on the secure processing, storage and transmission of confidential, sensitive, proprietary and other types of information relating to our business operations and confidential and sensitive information about our customers and employees in our computer systems and networks, and in those of our third-party vendors. Actions by individuals, groups, and state-sponsored organizations pose threats to our operations, our computer systems, our employees, and our customers. The cybersecurity risks we face range from cyber attacks common to most industries, such as the development and deployment of malicious software to gain access to our networks and attempt to steal confidential information, launch distributed denial of service attacks, or attempt 10 other coordinated disruptions, to more advanced threats that target us because of our prominence in the global business and technology insights field.”

Annual report 2025A · The company itself

“•Issues in the development and deployment of AI, including generative AI and emerging AI-enabled cyber threats, could expose us to regulatory, privacy, IP, cybersecurity, operational and reputational risks. •Our acquisitions and divestitures create special risks and challenges that could adversely affect our financial results. •Our revenue and operating results depend significantly on our ability to retain our existing customers and increase their adoption of our offerings, convert existing non-paying customers to paying customers, and add new customers. •If we fail to manage our sales and distribution channels effectively, if our partners choose not to market and sell our solutions to their customers, or if we have an adverse change in our relationships with key third-party partners, service providers or vendors, our operating results could be materially and adversely affected.”

Annual report 2026A · The company itself

“•Our solutions, systems, websites and the data on these sources have been and may continue to be subject to cybersecurity events that could materially harm our reputation and future sales.”

Annual report 2026A · The company itself

“Attack cycles have compressed, threats are more personalized and convincing, and they are almost always aimed at a financial outcome — drained accounts, stolen credentials, and fraudulent transactions. New technologies, smart devices, digital identities and an increasingly more connected world mean consumers will encounter a range of new cyber safety challenges.”

Annual report 2026A · The company itself

“Almost every cyber threat ultimately targets a financial outcome, and almost every financial decision increasingly carries a digital risk. Consumers are no longer looking for a security product and a financial app — they are looking for a trusted platform that protects and empowers their entire digital and financial life, simultaneously and proactively.”

Annual report 2026A · The company itself

“We believe these dynamics — the expanding digital threat landscape, the growing demand for accessible financial wellness solutions, and the convergence of cyber safety and financial protection — will continue to drive demand for integrated platforms that address consumers' digital and financial needs together. Gen operates across both markets, connecting its family of Cyber Safety brands with financial wellness and marketplace capabilities to serve consumers across all aspects of their digital and financial lives.”

Annual report 2026A · The company itself

“Additionally, deployment of agentic AI with access to our systems, data, and third-party tools creates an expanded surface for cyberattacks, as threat actors may exploit inadequate controls to manipulate agents into executing unauthorized actions, accessing sensitive information, or initiating malicious transactions, and the autonomous nature of these systems may enable attackers to conduct multi-step attacks that evade traditional security controls before detection occurs.”

Annual report 2026A · The company itself

“Additionally, there often exists a lack of transparency regarding the sources of data (including personal data) used to train or develop third-party AI technologies or how inputs are converted to outputs, and we may not be able to fully validate this process and its accuracy (particularly where it is part of a complex, multi-step process and inaccurate or incomplete information may be compounded across many steps, such as in agentic AI systems).”

Annual report 2026A · The company itself

“Use of open-source software may also present additional security risks because the public availability of such software may make it easier for hackers and other third parties to determine how to breach our website and systems that rely on open-source software.”

Annual report 2026A · The company itself

“We also have a global threat response and security technology organization that is comprised of our dedicated team of threat and security researchers, supported by advanced systems to innovate security technology and threat intelligence. We have one of the world’s largest consumer cyber safety networks. Leveraging our capabilities, our global threat response team handles a wide variety of attacks, including social engineering attacks, file-based attacks, web and network-based attacks, privacy and data exfiltration attacks, identity theft attacks, algorithmic manipulation attacks, and more.”

Annual report 2026A · The company itself

“Much of our software and underlying technology is proprietary, and thus we are highly dependent on our ability to protect such technology. There is no guarantee that confidentiality agreements, our procedures and copyright, patent, trademark and trade secret laws will be sufficient to protect our technology.”

Annual report 2026A · The company itself

“Company Overview Gen Digital Inc. is a global leader in consumer Cyber Safety and Trust-Based Solutions, empowering people around the world to live safer digital lives while building confidence and control over their financial futures. Through its trusted brands including Norton, Avast, LifeLock, and MoneyLion, Gen helps people protect what matters most — their data, identity, privacy, reputation and financials — through award-winning cyber-security, online privacy, identity protection and financial wellness solutions used by nearly 500 million users in more than 150 countries.”

Annual report 2026A · The company itself

“Our Cyber Safety Platform Segment Cyber Safety Platform includes our security, comprehensive suites, and privacy products, which deliver technology solutions and superior threat protection to help people navigate the digital world, securely, privately and with confidence.”

Annual report 2026A · The company itself

“We are well-positioned across two key Cyber Safety categories: •Security and Performance: Our offerings provide real-time threat protection for PCs, Macs and mobile devices against malware, ransomware, phishing, and other emerging cyber threats. These offerings monitor and block unauthorized access to the device to help protect and secure private and sensitive information.”

Annual report 2026A · The company itself

“Our cyber safety and financial wellness businesses compete with a broad range of companies, including established security software vendors, operating system and platform providers, companies who specialize in a niche segment of the cyber safety market and which are expanding their portfolios into competing cyber safety products, traditional banks and credit unions, licensed and non-bank digital financial service providers, specialty finance companies, digital wealth management and brokerage platforms, embedded finance providers, financial marketplaces, and other technology companies.”

Annual report 2026A · The company itself

“Also, as we increase our connectivity with our products and customers, we may be required to comply with additional data privacy and cybersecurity regulations. For example, personal privacy and data security have become significant issues in the United States, Europe, and in many other jurisdictions in which we operate.”

Annual report 2025A · The company itself

“Risk factors related to cybersecurity Failures or security breaches of our networks or information technology systems could have an adverse effect on our business. We rely heavily on technology both in our products and services for customers and in our IT systems used to run our business.”

Annual report 2025A · The company itself

“Department of War (DoW), the intelligence community and federal civilian agencies have increasingly prioritized technology solutions to drive operational efficiencies, advance security and accelerate mission-decision making in real time. Expanded geopolitical and cyber threats and the demand for advanced warfighter connectivity have accelerated these trends, adding urgency to required technology investments. The result is an increase in federal information technology (IT) modernization and technology spending in recent years and a shift to the rapid development of solutions to meet the ever-changing information-systems and mission-support needs of these customers.”

Annual report 2025A · The company itself

“GDIT provides technology solutions and expertise that underpin our national security systems, modernize government operations, and secure networks, data and information from sophisticated cyber attacks. Operating thousands of complex digital modernization programs across the federal government, GDIT’s expansive portfolio includes cloud services, cybersecurity, network modernization, artificial intelligence/machine learning (AI/ML), application development, high-performance computing, and 5G and advanced communications.”

Annual report 2025A · The company itself

“Mission Systems is a defense electronics manufacturer and integrator for Command, Control, Communications, Computers, Cyber, Intelligence, Surveillance and Reconnaissance (C5ISR) applications in all domains. Our products and solutions are built into platforms and integrated systems critical to our national security.”

Annual report 2025A · The company itself

“Our information technology systems (which includes artificial intelligence) and infrastructure are critical to effectively manage our key business processes including digital marketing, order entry and fulfillment, supply chain management, finance, administration, and other business processes. These technologies enable internal and external communication among our locations, employees, suppliers, customers, and others and include the receipt and storage of personal information about our employees, consumers, and proprietary business information. Our information technology systems, some of which are dependent on services provided by third parties, may be vulnerable to damage, interruption, or shutdown due to any number of causes such as catastrophic events, natural disasters, fires, power outages, systems failures, telecommunications failures, security breaches, computer viruses, hackers, employee error or malfeasance, and other causes. Increased cyber-security threats pose a potential risk to the security and viability of our information technology systems, as well as the confidentiality, integrity, and availability of the data stored on those systems.”

Annual report 2026A · The company itself

“If we experience a security breach, if our internal information systems fail to function properly or if we are unsuccessful in implementing, integrating or upgrading our information systems, our business operations could be materially affected.”

Annual report 2025A · The company itself

“We depend on information systems to process customer orders, manage inventory and accounts receivable collections, purchase products, manage accounts payable processes, ship products to customers on a timely basis, maintain cost effective operations, provide superior service to customers and consolidate financial results, among many other things.”

Annual report 2025A · The company itself

“The success of our e-commerce platform depends on our ability to accurately identify the products to make available through our e-commerce platform, and to provide and maintain an efficient online experience with the highest level of data security for our customers.”

Annual report 2025A · The company itself

“Additionally, we are subject to an increasing number of laws in the various jurisdictions in which we operate as well as governmental regulations relating to taxes, environmental protection, product quality standards, cybersecurity, machine learning, artificial intelligence, data privacy, building and zoning requirements, and employment law matters.”

Annual report 2025A · The company itself

“Likewise, data privacy or cybersecurity incidents or breaches by employees or others, including the unauthorized use of AI tools, can result in the exposure of or misuse of sensitive data, including our intellectual property or trade secrets or the personal information of our employees, patients, customers or other business partners to unauthorized persons or to the public.”

Annual report 2025A · The company itself

“Risks Related to Our Business Model and Operations •Our inability to protect our systems and data from continually evolving cybersecurity threats or other technological risks could adversely affect our ability to deliver our services; damage our reputation among our customers, card issuers, financial institutions, card networks, partners and cardholders; adversely affect our continued card network registration or membership and financial institution sponsorship; and expose us to lost revenues, penalties, fines, liabilities, legal claims and defense costs. •Software and hardware defects, failures, undetected errors and development delays could affect our ability to deliver our services, damage customer relations, expose us to liability and have an adverse effect on our business, financial condition and results of operations. •We depend on relationships with third parties.”

Annual report 2025A · The company itself

“We are a regular target of malicious attempts to identify and exploit system vulnerabilities, and/or to penetrate or bypass our security measures, in order to gain unauthorized access to our networks and systems or those of our associated third parties. Such attempts at unauthorized access can lead, and occasionally have led, to the compromise of sensitive, business, personal or confidential information.”

Annual report 2025A · The company itself

“Further, technology products and solutions that connect to the internet or to other internet-connected devices have an inherent risk of being compromised, thus exposing users to cyber threats. It is critical for GN’s continued success and trust with customers that our products are designed to be secure and resilient toward cyber-attacks.”

Annual report 2025A · The company itself

“Our product cybersecurity improvements take a risk-based approach, evaluating factors such as sales volume, attack surface, and third-party dependencies. We have rolled out secure coding practices and architecture training across our teams.”

Annual report 2025A · The company itself

“There are significant risks involved in the development, adoption, use, deployment and maintenance of AI, such as potential increases in intellectual property infringement or misappropriation claims, privacy, data protection, cybersecurity, confidentiality, operational and technological risks, as well as risks associated with harmful content, accuracy, bias and discrimination, any of which could affect our further development, adoption, use, deployment and maintenance of AI.”

Annual report 2025A · The company itself

“The use or adoption of AI technologies in our solutions may subject us to copyright infringement or other intellectual property claims. If we, or third-party developers whose AI we rely on, do not have sufficient rights to use the data or other material used or processed by such AI technology, we also may incur liability through the actual or alleged violation of applicable laws, rules and regulations, third-party intellectual property, privacy, or other rights or contractual obligations.”

Annual report 2025A · The company itself

“An actual or perceived cybersecurity incident could impair our ability to conduct business, provide our products and services, protect data, and comply with contractual or legal obligations, and may cause us to incur substantial costs, or subject us to significant liability.”

Annual report 2025A · The company itself

“Table of Contents Our failure to properly register or maintain our customers' domain names or comply with applicable laws, rules and regulations relating to domain name registration and maintenance could subject us to additional liability, regulatory action, expenses, claims of loss or negative publicity that could have a material adverse effect on our business. System and process failures related to our domain name registration service may result in inaccurate and incomplete information in our domain name database.”

Annual report 2025A · The company itself

“We could also incur significant fines or lose our ability to give customers the option of using credit cards to pay for our products if we fail to follow payment card industry data security standards, even if there is no compromise of the cardholder information covered by these standards. Although we are in compliance with payment card industry data security standards, it is possible that evolving cybersecurity threats may impact our ability to protect cardholder data which could result in fines or otherwise impact our financial condition, or could result in the suspension of our ability to accept credit cards as a form of payment.”

Annual report 2025A · The company itself

“We cannot ensure the encryption and authentication technology we rely on to secure the 36 Table of Contents transmission of payment information will adequately prevent cybersecurity incidents affecting systems.”

Annual report 2025A · The company itself

“We entered into an agreement, which was approved by the FTC on May 21, 2025, to settle FTC charges related to certain of our security practices, advertising and other related matters. Pursuant to the settlement agreement and related order, GoDaddy is required to comply with specific requirements, including those related to the security of our hosting services, for at least 20 years. If we fail to comply with the final order's terms, we could be subject to FTC investigation, litigation, or reputational harm.”

Annual report 2025A · The company itself

“Activities of customers or the content of their websites could damage our reputation and brand or harm our business and financial results. As a result of the products and services we offer, we may be subject to liability and negative publicity due to our customers' activities on or in connection with their domain names, their websites or the data they store on our servers.”

Annual report 2025A · The company itself

“Security and SSL Certificates. Our security product portfolio is a comprehensive suite of tools designed to help our customers secure their online presence.”

Annual report 2025A · The company itself

“The SEC made certain amendments to Regulation S-P that implements the GLB Act. The amendments to Regulation S-P require broker-dealers, investment companies and investment advisers registered with the SEC to adopt written policies and procedures for incident response programs to address unauthorized access to or use of customer information. The amended Regulation S-P requires covered entities to notify within 30 days individuals affected by an incident involving sensitive customer information and provide them with details about the incident and other information intended to help affected individuals respond appropriately. In December 2025, the amended Regulation S-P became effective for larger covered entities, such as GS&Co.”

Annual report 2025A · The company itself

“Our businesses are also subject to laws and regulations governing cybersecurity and related risks, and which require regulatory disclosures, and, in some instances, individual disclosures, of certain security incidents. These include, but are not limited to, the NYDFS Cybersecurity Requirements for Financial Services Companies. The NYDFS also requires financial institutions regulated by the NYDFS, including GS Bank USA, to, among other things, (i) establish and maintain a cybersecurity program designed to ensure the confidentiality, integrity and availability of their information systems; (ii) implement and maintain a written cybersecurity policy setting forth policies and procedures for the protection of their information systems and nonpublic information; and (iii) designate a Chief Information Security Officer.”

Annual report 2025A · The company itself

“•A failure or disruption in our infrastructure, or in the operational systems or infrastructure of third parties, could impair our liquidity, disrupt our businesses, damage our reputation and cause losses. •The development and use of AI present risks and challenges that may adversely impact our business. •A failure to protect our computer systems, networks and information, and our clients’ information, against cyber attacks and similar threats could impair our ability to conduct our businesses, result in the disclosure, theft or destruction of confidential information, damage our reputation and cause losses. •We have in the past incurred and may in the future incur losses as a result of ineffective risk management processes and strategies.”

Annual report 2025A · The company itself

“Operational A failure in our or third-party operational systems or human error, malfeasance or other misconduct, could impair our liquidity, disrupt our businesses, result in the disclosure of confidential information, damage our reputation and cause losses. Our businesses are highly dependent on our ability to process and monitor, on a daily basis, a very large number of transactions, many of which are highly complex and occur at high volumes and frequencies, across numerous and diverse markets in many currencies.”

Annual report 2025A · The company itself

“Computers and computer networks are subject to various risks, including, among others, cyber attacks, inherent technological defects, system disruptions and failures and human error. For example, fundamental security flaws in computer chips found in many types of these computing devices and phones have been reported in the past and may occur in the future, and in July 2024 there was a widely publicized information technology outage as a result of a faulty update to a cybersecurity software product that affected many businesses worldwide.”

Annual report 2025A · The company itself

“In addition to our use of AI technologies, we are exposed to risks arising from the use of AI technologies by bad actors to commit fraud and misappropriate funds and to facilitate cyber attacks. Generative AI, if used to perpetrate fraud or launch cyber attacks, could result in losses, liquidity outflows or other adverse effects for us and our clients.”

Annual report 2025A · The company itself

“A failure to protect our computer systems, networks and information, and our clients’ information, against cyber attacks and similar threats could impair our ability to conduct our businesses, result in the disclosure, theft or destruction of confidential information, damage our reputation and cause losses. Our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks and those of our vendors. There have been a number of highly publicized cases involving financial services companies, consumer-based companies, software and information technology service providers, governmental agencies and other organizations reporting the unauthorized access or disclosure of client, customer or other confidential information in recent years, as well as cyber attacks involving the dissemination, theft and destruction of corporate information or other assets, as a result of inadequate procedures or the failure to follow procedures by employees or contractors or as a result of actions by third parties, including actions by foreign governments.”

Annual report 2025A · The company itself

“We are regularly the target of attempted cyber attacks, including denial-of-service attacks, and must continuously monitor and develop our systems to protect the integrity and functionality of our technology infrastructure and access to and the security of our data. We have faced a high volume of cyber attacks as we expand our mobile- and other internet-based products and services, as well as our usage of mobile and cloud technologies, and as we provide these services to individual consumers. Further, the use of AI by cybercriminals may increase the frequency and severity of cybersecurity attacks against us or our third-party vendors and clients.”

Annual report 2025A · The company itself

“In addition, due to our interconnectivity with third-party vendors (and their respective service providers), agent banks, exchanges, clearinghouses and other financial institutions, we have been, and could in the future be, adversely impacted if any of them is subject to a successful cyber attack or other information security event. These impacts could include the loss of access to information or services from the third party subject to the cyber attack or other information security event or could result in unauthorized access to or disclosure of client, customer or other confidential information, which could, in turn, interrupt certain of our businesses or adversely affect our results of operations and reputation.”

Annual report 2025A · The company itself

“Although we take protective measures proactively and endeavor to modify them as circumstances warrant, our computer systems, software and networks may be vulnerable to unauthorized access, misuse, phishing or other fraudulent schemes, computer viruses or other malicious code, cyber attacks on our vendors and other events that could have a security impact. Risks relating to cyber attacks on our vendors have been increasing given the greater frequency and severity in recent years of supply chain attacks affecting software and information technology service providers.”

Annual report 2025A · The company itself

“The increased use of mobile and cloud technologies heightens these and other operational risks, as do hybrid work arrangements. Certain aspects of the security of these technologies are unpredictable or beyond our control, and the failure by mobile technology and cloud service providers to adequately safeguard their systems and prevent cyber attacks could disrupt our operations and result in misappropriation, corruption, unavailability or loss of confidential and other information.”

Annual report 2025A · The company itself

“We routinely transmit and receive personal, confidential and proprietary information by email and other electronic means. We have discussed and worked with clients, vendors, service providers, counterparties and other third parties to develop secure transmission capabilities and protect against cyber attacks, but we do not have, and may be unable to put in place, secure capabilities with all of our clients, vendors, service providers, counterparties and other third parties and we may not be able to ensure that these third parties have appropriate controls in place to protect the confidentiality of the information. An interception, misuse or mishandling of personal, confidential or proprietary information being sent to or received from a client, vendor, service provider, counterparty or other third party could result in legal liability, regulatory action, reputational harm and losses.”

Annual report 2025A · The company itself

“Cybersäkerhet. Risken för cyberattacker ökar och vi arbetar proaktivt för att skydda både oss själva och våra kunder genom förstärkt datasäkerhet och robusta IT-system.”

Annual report 2024A · The company itself

“Kraftigt ökade försök till dataintrång hos myndigheter och storföretag har ökat betydelsen av säker datahantering. HANZA hanterar information om såväl kunder som komponenter till deras produkter vilket omfattar ritningar och annat underlag som delas med oss. Potentiellt kan kunderna komma till skada om denna information sprids. För oss som leverantör och kontraktstillverkare är vår förmåga att skydda kunders data och informationssäkerhet avgörande för förtroendet och konkurrenssituationen.”

Annual report 2024A · The company itself

“Strategic and Operational Risks Our businesses may suffer and we may incur substantial costs if we are unable to access our systems and safeguard the security of our data in the event of a disaster, cyber breach, other information security incident or technology failure. We use technology to process, store, retrieve, evaluate and analyze customer and company data and information.”

Annual report 2025A · The company itself

“Our systems have been, and will likely continue to be, subject to viruses or other malicious code, unauthorized access, cyber-attacks (such as ransomware and denial of service), cyber frauds or other computer related penetrations. The frequency and sophistication of such threats continue to increase as well.”

Annual report 2025A · The company itself

“Use of artificial intelligence by us or by such third parties could also result in inadvertent disclosure of our confidential information.”

Annual report 2025A · The company itself

“during the course of employment, or from equipment, with each loss resulting in short-term or long-term disability payments. •Longevity- Risk of loss from increased life expectancy trends among policyholders receiving long-term benefit payments. •Cyber Insurance- Risk of loss to property, breach of data and business interruption from various types of cyber-attacks.”

Annual report 2025A · The company itself

“Operational risks include: compliance with laws and regulations, cybersecurity, business disruption, technology failure, inadequate execution or process management, reliance on model and data analytics, internal fraud, external fraud, third party dependency and attraction and retention of talent.”

Annual report 2025A · The company itself

“In addition, certain insurance products offered by The Hartford provide coverage for losses incurred due to cyber events and the Company has assessed and modeled how those products would respond to different events in order to manage its aggregate exposure to losses incurred under the insurance policies we sell. The Company models numerous deterministic scenarios including losses caused by malware, data breach, distributed denial of service attacks, intrusions of cloud environments and attacks of power grids.”

Annual report 2025A · The company itself

“We and our partners maintain systems and processes designed to protect this data, but notwithstanding such protective measures, there is a risk of intrusion, cyber-attacks or tampering that could compromise the integrity and privacy of this data. Cyber-attacks continue to increase in their frequency, sophistication and intensity, and are becoming increasingly difficult to detect.”

Annual report 2025A · The company itself

“Risks related to technology, data privacy and cybersecurity: • Cybersecurity incidents or other forms of data breaches could result in the compromise of our facilities, confidential data or critical data systems, causing our operations to be impaired or impacted. A cybersecurity incident or other form of data breach could also give rise to potential harm to patients; remediation and other expenses; and exposure to liability under privacy and security laws, consumer protection laws, common law theories or other laws.”

Annual report 2025A · The company itself

“Cybersecurity threat actors may utilize AI tools to automate and enhance cybersecurity attacks against us. We utilize software and platforms designed to detect such cybersecurity threats, including AI-based tools, but these threats could become more sophisticated and harder to detect and counteract, which may pose significant risks to our data security and systems.”

Annual report 2025A · The company itself

“Our vendors may use AI tools in their products or services without our knowledge, and the providers of these tools may not meet the evolving regulatory or industry standards for privacy and data protection. Consequently, this may inhibit our or our vendors’ ability to uphold an appropriate level of service and data privacy.”

Annual report 2025A · The company itself

“Security risks generally associated with our information systems and our technology products and services have in the recent past adversely affected our business and results of operations, and could in the future materially adversely affect our business and our results of operations if such products, services, or systems (or third-party systems we rely on) are interrupted, damaged by unforeseen events, are subject to cyberattacks or fail for any extended period of time.”

Annual report 2025A · The company itself

“Despite these efforts, our facilities and systems and those of our third-party service providers have been, and may in the future be, vulnerable to privacy and security incidents, cybersecurity attacks and data breaches, acts of vandalism or theft, computer viruses and other malicious code, misplaced or lost data, programming and/or human errors, attacks or other acts undermining IS of third party business partners including our customers, or other similar events that could impact the security, reliability and availability of our systems.”

Annual report 2025A · The company itself

“As a practical matter, so long as we depend on IS to operate our business, and our business partners do the same, there can be no guaranty that such measures will successfully stop any one particular cybersecurity incident given the constantly evolving nature of the threat. We have incurred, continue to incur, and may in the future incur substantial costs as we update our cybersecurity defense systems and our general computer controls to meet evolving challenges, and legislative or regulatory action related to cybersecurity which may increase our costs to develop or implement new technology products and services.”

Annual report 2025A · The company itself

“In addition, we develop products and provide services to our customers that are technology-based, and a cyberattack that bypasses the IS supporting our products or services causing a security breach and/or perceived security vulnerabilities in our products or services could also cause significant loss of business and reputational harm, and actual or perceived vulnerabilities may lead to claims against us by our customers and/or governmental agencies. In addition, certain of our practice management products and services purchased by health care providers, such as physicians and dentists, are used to store and manage patient medical or dental records, and when cloud-based approaches are used, we may be responsible for hosting those records.”

Annual report 2025A · The company itself

“In addition to state-specific data breach notification laws (which exist in all U.S. states and territories), cybersecurity laws such as the federal Cyber Incident Reporting for Critical Infrastructure Act of 2022, proposed Federal Acquisition Regulations and amendments to SEC reporting requirements may require us to provide notifications about cybersecurity incidents in limited timeframes and before investigations are complete. Our businesses’ failure to comply with these laws and regulations could expose us to breach of contract claims, substantial fines, penalties and other liabilities and expenses, costs for remediation and harm to our reputation.”

Annual report 2025A · The company itself

“We have spent, and plan to expend in the future, additional resources to continue to protect against, or to address problems caused by, business interruptions and data security breaches. We also may be perceived as a more vulnerable target of the cyber hackers as a result of the October 2023 incident.”

Annual report 2025A · The company itself

“These customers and we are subject to laws, regulations and industry standards, such as HIPAA and the Payment Card Industry (PCI) Data Security Standards, which require the protection of the privacy and security of those records. Our products or services may be used as part of these customers’ comprehensive data security programs, including in connection with their efforts to comply with applicable data privacy and security laws and contractual requirements.”

Annual report 2025A · The company itself

“The cybersecurity threat landscape is rapidly evolving and becoming increasingly sophisticated, and there can be no assurance that our controls and procedures will be sufficient to address future threats or remediate future incidents. Further, there has been an increase in the frequency and sophistication of attacks, and we expect these activities to continue to increase, including malicious actors potentially leveraging AI to develop malicious code or sophisticated phishing attempts.”

Annual report 2025A · The company itself

“Additionally, the proliferation of generative AI models within the internal systems, processes, and tools of HPE, our suppliers, our customers, or other third parties with whom we do business may create new attack methods for threat actors.”

Annual report 2025A · The company itself

“Malicious parties may also be able to otherwise develop and deploy viruses, worms, ransomware, and other malicious software programs that attack our products or otherwise exploit any security vulnerabilities of our products, including within our cloud-based environments and offerings, such that we may be unable to anticipate such malicious parties’ techniques, implement adequate preventative measures, or remediate any intrusion on a timely or effective basis even if our security measures are appropriate, reasonable, and comply with applicable legal requirements. Advanced persistent threats can include 22 Table of Content highly sophisticated intrusions by threat actors aiming to establish prolonged access within our network.”

Annual report 2025A · The company itself

“With our business increasingly providing aaS offerings, malicious parties could target such services, potentially resulting in an increased risk of compromise of customer or employee data resulting in regulatory exposure. Incidents involving our cyber or physical security measures or the accidental loss, inadvertent disclosure, or unapproved dissemination of proprietary information, intellectual property, or sensitive, confidential, or personal data about us, our clients, or our customers, including the potential loss or disclosure of such data as a result of fraud or other forms of deception, could expose us, our customers, or the individuals affected to a risk of loss or misuse of this information; result in regulatory fines, litigation, and potential liability for us; damage our brand and reputation; or otherwise harm our business.”

Annual report 2025A · The company itself

“Our suppliers, vendors, partners, and other third parties with whom we do business also face similar cybersecurity threats, risks, and concerns as those set forth above, which introduces vulnerabilities to our business and operations, including our manufacturing supply chain. Although HPE requires strict cybersecurity and data controls through its contractual agreements with third parties, if these third parties do not have adequate safeguards or their safeguards fail, it may result in breaches of their systems, networks, or applications, potentially leading to breaches of our networks and systems or unauthorized access to or disclosure of our and/or our customers' confidential data, thereby compromising us and our customers.”

Annual report 2025A · The company itself

“Risk Management and Strategy Our Cybersecurity and Digital Risk Management (“CDRM”) organization, under the leadership of a Global Chief Information Security Officer (“Global CISO”), operates a cybersecurity program that is designed to help us identify, assess, manage, and mitigate risks relating to cybersecurity threats and incidents. We design our cybersecurity standards, policies, processes and controls to operate in an integrated manner, leveraging applicable industry standards and security frameworks, including the NIST Cybersecurity Framework, as guidance in supporting our ability to perform such functions. CDRM manages our cybersecurity program, including by fostering collaboration with partners across business units and global functions to identify and assess material cybersecurity threats, evaluate their severity, and establish actions to mitigate and manage such risks.”

Annual report 2025A · The company itself

“Within CDRM, our Cybersecurity Defense Center (“CDC”) has established policies, processes, and controls that are designed to monitor, detect, investigate, respond to, and escalate management of cybersecurity threats and incidents. If we experience a cybersecurity incident, the CDC activates our incident response plan, which includes processes to enable us to triage, assess severity of, escalate, contain, investigate, and remediate the incident, as well as to comply with applicable legal obligations and mitigate brand and reputational harm.”

Annual report 2025A · The company itself

“In addition to monitoring risks from threats to our own assets, we apply third-party risk management practices that endeavor to help identify and manage supply chain and vendor risk arising from our critical suppliers and other service provider organizations. We do so in a variety of ways, such as gathering information on third parties’ cybersecurity programs and controls, performing due diligence, undertaking cybersecurity reviews and/or audits, and/or mandating certain contractual requirements, such as notification of cybersecurity incidents and return or destruction of all HPE data upon termination of the relationship.”

Annual report 2025A · The company itself

“Table of Content In Networking, we are investing in a broad portfolio of networking and security capabilities, addressing campus, branch, data center, wide area networking, and cloud use cases. We are leveraging AI to enhance network performance and reliability through predictive analytics, automated fault detection, and intelligent traffic management—supporting scalable, self-optimizing infrastructure aligned with customer demands.”

Annual report 2025A · The company itself

“Framsteg inom digital teknologi som exempelvis artificiell intelligens och ökad uppkoppling av enheter har medfört nya säkerhetsutmaningar eftersom anställda och Hexagons partners, kunder och tjänsteleverantörer i större utsträckning arbetar på distans från nätverk som inte hanteras av företaget. Incidenter kan också leda till missbruk av personuppgifter så som obehörig användning, spridning eller förlust av data. Användningen av AI-driven programvara kan ytterligare förvärra denna risk.”

Annual report 2024A · The company itself

“Cyberrisker ökar i samhället i allmänhet och Hexagon arbetar kontinuerligt med att hålla koncernens IT-system väl skyddade. Hexagon investerar även i förbättrade återställningsplaner och datalagringsfunktioner, expertis och verktyg för cybersäkerhet och andra lämpliga riskreduceringstekniker.”

Annual report 2024A · The company itself

“Qognify har fler än 4 000 kunder världen över inom bank, myndigheter, logistik, tillverkning, detaljhandel, transport med flera. Dess lösningar kopplar ihop informationsflöden från verksamheten med videodata för att hantera säkerhets-, trygghets- och driftincidenter.”

Annual report 2024A · The company itself

“HMS NETWORKS ÅRSREDOVISNING 2024 5 HMS mission "We enable valuable data and insights from industrial equipment allowing our customers to increase productivity and sustainability."”

Annual report 2024A · The company itself

“Bartek S Candell Senior Vice President  HÅLLBAR INDUSTRI, INNOVATIONER OCH INFRASTRUKTUR HMS bidrag till Agenda 2030 - mål 9    Varumärken: Anybus Embedded, Anybus Gateway/ Wireless, Ixxat Safety ÖKAD AUTOMATION DRIVANDE TRENDER: NÄTVERKSSÄKERHET AI DIGITALISERING 32 % av HMS intäkter* 6 % Marknads -tillväxt   HMS bistår med:  Nätverksuppkoppling för automationsprodukter      Nätverksgateways  -  Trådlöst i industrin    Uppkoppling till säkerhetsnätverk    HMS NETWORKS ÅRSREDOVISNING 2024 15 New Industries HÅLLBARA STÄDER OCH SAMHÄLLEN HMS bidrag till Agenda 2030 - mål 11     Building Automation        DRIVANDE TRENDER: DATAANALYS DRIFTSÄKERHETHÅLLBARHETENERGIEFFEKTIVITET Industriell kommunikation för nischade applikationer i växande branscher.”

Annual report 2024A · The company itself

“Under de senaste åren har vi sett en betydande ökning av antal cyberattacker mot finanssektorn och kriminellas verktyg och tillvägagångssätt blir alltmer avancerade. De regulatoriska kraven på finansbranschen vad gäller informationssäkerhet är högt ställda och kommer utvecklas ytterligare över kommande år.”

Annual report 2024A · The company itself

“The Company believes that it faces threats of cyberattacks due to the industries it serves, the locations of its operations, and its technological innovations. The Company has experienced cybersecurity attacks in the past, including breaches of its information technology systems in which information was taken, and may experience them in the future, potentially with more frequency or sophistication.”

Annual report 2025A · The company itself

“While the Company continually works to safeguard its systems and mitigate potential risks, there is no assurance that such actions will be sufficient to prevent cybersecurity incidents that manipulate or improperly use the Company’s systems or networks, compromise confidential, personal or otherwise protected information, destroy or corrupt data, block access to its systems, or otherwise disrupt its operations. The occurrence of such events could negatively impact Howmet’s reputation and its competitive position and could result in litigation with third parties, regulatory action, loss of business, potential liability, and increased remediation costs, any of which could have a material adverse effect on its financial condition and results of operations.”

Annual report 2025A · The company itself

“System security risks, data protection breaches, cyberattacks, system outages and systems integration issues could disrupt our internal operations or services provided to customers, and could reduce our revenue, increase our expenses, damage our reputation and adversely affect our cash flows and stock price. We are exposed to cyberattacks seeking to penetrate our network security and misappropriate or compromise our confidential information or that of third parties, create system disruptions or cause shutdowns. Such attacks may involve the deployment of ransomware and other malicious software programs that attack our products or otherwise exploit security vulnerabilities, or attempt to fraudulently induce our employees, customers, or others to disclose passwords, other sensitive information or provide access to our systems or data.”

Annual report 2025A · The company itself

“Because we process proprietary information and sensitive or confidential data relating to our business (including data relating to employees, independent contractors and other personnel), our customers and third parties, breaches of our security measures or accidental loss, inadvertent disclosure or unapproved dissemination of such data can expose us, our customers, third parties and the individuals affected to a risk of loss, alteration or misuse of such information. A breach could also damage our brand and reputation or otherwise harm our business, and could result in government enforcement actions, litigation, civil monetary penalties or fines and other potential liability for us.”

Annual report 2025A · The company itself

“Our broad range of security capabilities are designed to protect an increasingly distributed user base through security enhanced PCs and printers, hardware-enforced endpoint security software (for both HP and non-HP PCs), and endpoint security services. Our security solutions provide layered resiliency using enhanced features such as containment and isolation technology as well as the use of AI deep-learning to identify and remove malware threats.”

Annual report 2025A · The company itself

“We are subject to risks surrounding our information technology systems and industrial controls systems failures, and the use of emerging technologies, including artificial intelligence, as well as, network disruptions, breaches in data security and compliance with data privacy laws or regulations. We are highly dependent on various software and information technology systems to record and process operational, human resources and financial transactions. The proper functioning of Hubbell’s information technology systems is critical to the successful operation of our business.”

Annual report 2025A · The company itself

“Cybersäkerhet I takt med att fastighetsbranschen blir alltmer digitaliserad ökar sårbarheten för dataintrång, virusangrepp och bedrägerier. Dessa kan få stora konsekvenser, exempelvis i form av förstörd och förlorad data eller läckt konfidentiell information.”

Annual report 2024A · The company itself

“In the ordinary course of our business, we process, store and transmit large amounts of data, and rely on third-party service providers to do the same, including protected personal information subject to privacy, security or data breach notification laws, as well as proprietary or confidential information relating to our business or a third-party with which we do business. We have been, and will likely continue to be, regular targets of attempted cybersecurity attacks and other security threats and may be, and have been, subject to breaches of our information technology systems, including breaches of the information technology systems of third-party service providers.”

Annual report 2025A · The company itself

“For example, in February 2024, Change Healthcare experienced a significant cybersecurity incident that disrupted its ability to provide services, impacting payers, providers and pharmacies nationwide, including us. Although the impact of such attacks has not been material to our operations or results of operations, financial position, or cash flow through December 31, 2025, we can provide no assurance that we will be able to detect, prevent, or contain the effects of such cybersecurity attacks or other information security risks or threats, or that such an attack will not be material to our business, in the future.”

Annual report 2025A · The company itself

“Violations of HIPAA or applicable federal or state laws or regulations could subject us to significant criminal or civil penalties, including significant monetary penalties. Compliance with HIPAA and other privacy regulations requires significant systems enhancements, training and administrative effort.”

Annual report 2025A · The company itself

“The costs to detect, prevent, eliminate or address cybersecurity threats and vulnerabilities before or after an incident could be substantial. Our remediation efforts may not be successful and could result in interruptions, delays, or cessation of service, and loss of existing or potential members.”

Annual report 2025A · The company itself

“Cybersecurity and Data Privacy Federal and state legislation and regulations contain extensive cybersecurity and data privacy provisions. Our regulatory agencies including the CFPB, FDIC, Federal Reserve, and OCC also have oversight over us, the Bank, and our subsidiaries with respect to cybersecurity and data privacy.”

Annual report 2025A · The company itself

“Operational Risks •Our operational or security systems or infrastructure, or those of third parties, could fail or be breached, which could disrupt our business and adversely impact our operations, liquidity, and financial condition, as well as cause legal or reputational harm. •We face risks from cyber-attacks and other information or security breaches, including denial of service attacks, hacking, social engineering attacks targeting our colleagues, contractors, and customers, malware intrusion or data corruption attempts, and identity theft that could result in the disclosure of confidential, proprietary, personal and other information, any of which could adversely affect our business or reputation, and create significant legal and financial exposure.”

Annual report 2025A · The company itself

“We face indirect technology, cybersecurity, data privacy and operational risks relating to the contractors, customers, clients, and other third parties with which we do business or upon which we rely to facilitate or enable our business activities, including, for example, financial counterparties, regulators, and providers of critical infrastructure such as internet access and electrical power. As a result of increasing consolidation, interdependence, and complexity of financial entities and technology systems and infrastructure, a disruption, compromise or failure that significantly degrades, damages or destroys the systems or infrastructure, or the confidential, proprietary, personal and other information stored or processed thereon, of one or more financial entities could have a material impact on counterparties or other market participants, including us.”

Annual report 2025A · The company itself

“Our financial, accounting, data processing, backup, or other operational or security systems and infrastructure may also fail to operate properly or become disabled or damaged as a result of a number of factors, including events that are wholly or partially beyond our control, which could adversely affect our ability to process transactions, provide services, or otherwise conduct business. Such events may include: sudden increases in customer transaction volume; electrical, telecommunications, or other major service outages; disruptions in client access to our digital platforms and mobile applications; disease pandemics; cyber-attacks or other information or security breaches; software or hardware failures; and events arising from local or larger scale political or social matters, including wars and terrorist attacks.”

Annual report 2025A · The company itself

“In addition, the enactment of the CIRCIA in 2022, once rulemaking is complete, will require, among other things, certain companies to report significant cyber incidents to the CISA Agency within 72 hours from the time the company reasonably believes the incident occurred (and within 24 hours of making a ransom payment as a result of a ransomware attack). On April 4, 2024, the CISA Agency proposed a rule under the CIRCIA that would clarify the scope of cyber incidents to be reported and would further define covered entities subject to the CIRCIA to expressly include companies in the financial services industry that are required to report cyber incidents to their primary federal regulators. Although the CIRCIA originally required the CISA Agency to finalize its regulations by October 4, 2025, the CISA Agency has extended such deadline to May 2026.”

Annual report 2025A · The company itself

“In addition, the Federal Reserve, OCC, and FDIC require, among other things, a banking organization to notify its primary federal regulator as soon as possible and within 36 hours after identifying a “computer-security incident” that the banking organization believes in good faith could materially disrupt, degrade, or impair its business or operations in a manner that would, among other things, jeopardize the viability of its operations, result in customers being unable to access their deposit and other accounts, result in a material loss of revenue, profit, or franchise value, or pose a threat to the stability of the U.S. financial sector.”

Annual report 2025A · The company itself

“Cybersecurity and data privacy are areas of heightened legislative and regulatory focus. As cybersecurity and data privacy risks for banking organizations and the broader financial system have significantly increased in recent years, cybersecurity and data privacy issues have become the subject of increasing legislative and regulatory focus.”

Annual report 2025A · The company itself

“Cybersecurity Cybersecurity represents an important component of Huntington’s overall cross-functional approach to risk management. We actively manage a cybersecurity operation designed to detect, contain, and respond to cybersecurity threats and incidents in a prompt and effective manner with the goal of minimizing disruptions to our business.”

Annual report 2025A · The company itself

“The CISA is intended to improve cybersecurity in the U.S. by enhanced sharing of information about security threats among the U.S. government and private sector entities, including financial institutions, and empowers the CISA Agency to oversee this information-sharing process. The CISA also authorizes companies to monitor their own systems notwithstanding any other provision of law and allows companies to carry out defensive measures on their own systems from cyber-attacks or other information or security breaches. The law includes liability protections for companies that share cyber-threat information with third parties so long as such sharing activity is conducted in accordance with the CISA. Although the CISA originally expired on September 30, 2025 and was temporarily reauthorized to remain in effect through January 30, 2026, the long-term status of the CISA remains uncertain pending further action by the U.S.”

Annual report 2025A · The company itself

“Samaan aikaan julkinen sektori on siirtynyt digitaaliseen viestintään, mikä on vauhdittanut koko yhteiskunnan digitaalista loikkaa ja korostanut tietoturvan merkitystä.”

Annual report 2025A · The company itself

“Konsernin merkittävimmät riskit liittyvät tietoturvaan, kyberturvallisuuteen, nopeasti muuttuvaan kilpailutilanteeseen teknologiympäristössä, tekoälyn tuomiin mahdollisuuksiin, mutta myös tietosuoja- ja tekijänoikeusasioihin, yleiseen markkinatilanteeseen erityisesti Suomessa, osaavan henkilöstön saatavuuteen ja vaihtuvuuteen.”

Annual report 2025A · The company itself

“IT-alueella suurin riski on kyberturvallisuus. Hallintaa vahvistavat tietoturvan systemaattinen johtaminen, ISO27001-sertifikaatti sekä henkilöstön kouluttaminen.”

Annual report 2025A · The company itself

“ISO/IEC 27001 -sertifikaatti tarjoaa asiakkaillemme: ● Varmuuden datavastuullisuudesta: Asiakkaat voivat luottaa siihen, että heidän dataansa käsitellään parhaiden standardien mukaisesti. ● Riskien minimoinnin: Systemaattinen riskienhallinta vähentää liiketoimintakatkosten ja tietomurtojen todennäköisyyttä. ● Helppouden hankintaprosesseissa: Sertifikaatti nopeuttaa ja sujuvoittaa asiakkaiden tekemiä toimittaja-arviointeja, sillä se on puolueeton osoitus tietoturvan tasosta.”

Annual report 2025A · The company itself

“Erityisesti Euroopan unionin kyberturvallisuusdirektiivi (NIS2) ja kansallinen kyberturvallisuuslaki asettavat tiukkoja vaatimuksia yhteiskunnan kannalta kriittisille toimijoille.”

Annual report 2025A · The company itself

“Kansainvälisessä kasvussa ISO/IEC 27001 on elinehto.”

Annual report 2025A · The company itself

“Digitaalisiin markkinointi- ja teknologiapalveluihin keskittyvien toimintojen merkittävimmät ulkoiset riskit liittyvät tietoturvaan ja kyberturvallisuuteen, koska palveluita tarjotaan internetissä.”

Annual report 2025A · The company itself

“Tarjoamme yrityksien 7 | Vuosikertomus 2025 teknologiakumppaniksi vaihtoehdon, jossa asiakas omistaa datansa ja voi olla varma sen vastuullisesta käsittelystä.”

Annual report 2025A · The company itself

“Liana ja Evermade ovat tilikauden aikana vieneet läpi yhteisen merkittävän tietoturvahankkeen, jonka tuloksena yhtiöille myönnettiin kansainvälisesti tunnustettu ISO/IEC 27001:2022 -tietoturvasertifikaatti.”

Annual report 2025A · The company itself

“Samalla yhtiö investoi jatkuvasti tietoturvan kehittämiseen, ja tilikauden aikana konserniyhtiöistä Lianalle ja Evermadelle myönnettiin kansainvälisesti tunnustettu ISO/IEC 27001:2022 -tietoturvasertifikaatti.”

Annual report 2025A · The company itself

“Table of Contents Failure to maintain the privacy and security of our customer, third-party payor, employee, supplier, or Company information could result in substantial costs and/or subject us to litigation, enforcement actions, and reputational damage.”

Annual report 2025A · The company itself

“Security Paramount to our ability to deliver full compatible smartphone control is our commitment to cybersecurity and information security. With certifications from the International Organization for Standardization (“ISO”) and the Diabetes Technology Society’s cybersecurity and assurance program, Insulet is globally recognized for incorporating the highest standards for cybersecurity, information security, and safety, including secure data transfer between the Pod and PDM or cell phone application, as applicable, as well as secure cloud storage.”

Annual report 2025A · The company itself

“We or third parties regularly identify security vulnerabilities with respect to our processors and other products, as well as the operating systems and workloads that run on them and the components that interact with them. Components and IP we purchase or license from third parties for use in our products, as well as industry-standard specifications we implement in our products, are also regularly subject to security vulnerabilities.”

Annual report 2025A · The company itself

“We are subject to increasing and evolving cybersecurity threats and privacy risks. We face significant and persistent cybersecurity risks due to: the breadth and complexity of our global operations and systems; the technical sophistication, value, and widespread use of our systems, products and processes and their attractiveness to threat actors (including state-sponsored organizations) seeking to inflict harm on us or our customers, and supply chain risk through our use of third-party products, services and components. We also face additional risk with our foundry business where we expect to collect significant amounts of highly sensitive customer data, which may make us a target in an attempt to steal or corrupt such data.”

Annual report 2025A · The company itself

“A cybersecurity incident, whether or not successful, could result in our incurring significant costs related to, for example, rebuilding our internal systems, writing down inventory value, implementing additional threat protection measures, providing modifications to our products and services, defending against litigation or enforcement proceedings, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm.”

Annual report 2025A · The company itself

“Risk Factors 46 Cyber attack attempts are increasing in number, magnitude and technical sophistication, and if successful, may expose us and the affected parties to loss or misuse of proprietary or confidential information or disruptions to our supply chain or business operations, including our manufacturing operations, and could impact our financial results.”

Annual report 2025A · The company itself

“We expect emerging technologies to contribute to the increasing sophistication of attacks and to lead to new threats. For example, threat actors are leveraging emerging AI technologies to develop new hacking tools and attack vectors, exploit vulnerabilities, obscure their activities and increase the difficulty of threat attribution. The proliferation of generative AI increases the risk of these technologies being used by threat actors to impersonate authorized individuals, which may make attacks even more difficult to detect and prevent. Moreover, the increased adoption of generative AI models within our internal systems, processes and tools may create new attack methods for threat actors.”

Annual report 2025A · The company itself

“We are required to comply with stringent, complex and evolving laws, rules, regulations and standards in many jurisdictions, as well as contractual obligations, relating to cybersecurity, data protection and privacy. Any failure or perceived failure by us to so comply, or any compromise of security that results in unauthorized access to, or unauthorized loss, destruction, use, modification, acquisition, disclosure, release or transfer of personal data, may result in our having to modify or cease certain operations or practices; the expenditure of substantial costs, time and other resources; legal proceedings or actions against us (including class action lawsuits); or governmental investigations or fines.”

Annual report 2025A · The company itself

“Cybersecurity Our business is susceptible to cyberattacks due to our reliance on technology and software used by us and third parties, as well as due to our use and retention of confidential data.”

Annual report 2025A · The company itself

“Our role in the global financial system positions us at a greater risk for cyberattacks, cyberterrorism and other cybersecurity risks. The cybersecurity threat landscape remains a macro concern for most organizations, and particularly those associated with the U.S. financial infrastructure. We may be more likely than other companies to be a target of cyberattacks and other cybersecurity risks due to our role in the global financial ecosystem and the high-profile nature of many of our businesses that deliver critical services to a broad range of financial market participants.”

Annual report 2025A · The company itself

“Systems failures in the derivatives and securities trading industry and mortgage technology industry have in the past negatively impacted us, and could in the future negatively impact us. High-profile system failures in the derivatives and securities trading industry and mortgage technology industry, including due to cybersecurity disruptions and attacks, have in the past, and could in the future, negatively impact our business and result in a loss of confidence in our technology and our markets, regulatory investigations, fines and penalties and business activity slowdown or interruptions.”

Annual report 2025A · The company itself

“Although we have not been subject to cyberattacks or other cyber incidents that have had a material impact on our operations or financial condition, we have from time to time experienced cybersecurity events including distributed denial of service, or DDoS, attacks, malware infections, phishing, web attacks, zero day and/or emerging vulnerabilities with known exploits and other information technology incidents that are typical for a financial services company of our size. For example, although not material, we experienced DDoS attempts, brand misuse, cyber fraud attempts, and phishing attempts directed toward employee systems and employee email accounts during 2025. While we operate an Information Security program that is designed to prevent, detect, track and mitigate cyber incidents and that has detected and mitigated such incidents in the past, we cannot assure you that these measures will be sufficient to identify and protect our business against future attacks.”

Annual report 2025A · The company itself

“Any such attacks could result in reputational damage, cause system failures or delays that could cause us to lose customers, cause us to experience lower current and future trading volumes or incur significant liabilities or have a negative impact on our competitive position or reputation.”

Annual report 2025A · The company itself

“Further, cybersecurity threats to, and incidents involving, vendors and other third parties who support our activities - particularly those with less-sophisticated defenses - could impact us.”

Annual report 2025A · The company itself

“M Cybersäkerhetsrisk Vi är beroende av tillgängliga och väl fungerande IT-system. Avbrott och fel i verksamhetskritiska system kan utgöra risker för verksamheten och vårt anseende.”

Annual report 2024A · The company itself

“Risk Beskrivning Hantering J Dataskyddsrisk Vår verksamhet är beroende av stora mängder information, varav en del innehåller personuppgifter. Intrum prioriterar sekretess och korrekt behörighetsåtkomst till information.”

Annual report 2024A · The company itself

“Viktiga interna styrdokument Instruktion mot korruption och mutor Uppförandekod GRI 205-3 Bekräftade fall av korruption och vidtagna åtgärder Bekräftade fall av korruption och vidtagna åtgärder 0 0 0 0 0 GRI 205-1 Verksamheter som genomgått utvärdering av korruptionsrisker Andel verksamheter som genomgått utvärdering av korruptionsrisker 100% 100% 100% 100% 100% Företagsspecifikt nyckeltal – Visselblåsarkanal Antal fall i visselblåsarkanalen ”Code of Conduct Hotline” som har lett till vidtagen åtgärd 13 5 6 8 3 H8.10 Datasäkerhet Baserat på den stora mängd data vi hanterar om kunder och uppdragsgivare är informationssäkerhet och datahantering en av våra viktigaste hållbarhetsfrågor. Vi har både ett juridiskt och etiskt ansvar att handha känsliga uppgifter på ett sätt som garanterar respekt för den personliga integriteten, och som tar hänsyn till den mänskliga rättigheten om frihet från otillåten inblandning i privatlivet.”

Annual report 2024A · The company itself

“•Third parties may offer to sell remanufactured or unauthorized instruments and accessories to our customers or provide unauthorized service on our systems, which could adversely impact safety, our financial results, and our reputation. •Our business is subject to complex and evolving laws and regulations regarding data privacy, data protection, artificial intelligence, and responsible use of data, and any failure to comply may result in significant liability, negative publicity, and/or erosion of trust, which may adversely affect our business, financial condition, or results of operations. •Ongoing and future global conflicts could adversely affect our business, financial condition, or results of operations. •Disruptions at the FDA and other government agencies or notified bodies could prevent our products from being cleared, certified, approved, or commercialized in a timely manner or at all, or could hinder their ability to procure our products, which may adversely affect our business, financial condition, or results of operations.”

Annual report 2025A · The company itself

“Data Privacy and Security Laws In connection with operating our business, we receive, store, use, and otherwise process information that relates to individuals and/or constitutes “personal data,” “personal information,” “personally identifiable information,” or similar terms under applicable data privacy laws. Numerous state, federal, and foreign laws, regulations, standards, and other obligations govern the collection, use, disclosure, confidentiality, and security of personal information, including health-related information.”

Annual report 2025A · The company itself

“We are also subject to various foreign data privacy laws, including the European Union General Data Protection Regulation 2016/679 and applicable national supplementing laws and to the United Kingdom General Data Protection Regulation and Data Protection Act 2018, as well as applicable data privacy laws in China.”

Annual report 2025A · The company itself

“Our use of AI technologies may involve the storage and transmission of confidential or sensitive information, including personal information of employees, customers, and others, as well as protected health information of clients’ patients. In addition, due to the sensitive nature of the information, the security features of our computers and systems, network, and communications systems infrastructure are critical to the success of our business.”

Annual report 2025A · The company itself

“•Our business is vulnerable to deficiencies and failures in support systems, including data management, and customer service functions that could lead to breaches and errors or reputational harm, resulting in loss of customers or claims against us or our subsidiaries. •Disruptions in the markets, to market participants and to the operations of third parties whose functions are integral to our ETF platforms may adversely affect the prices at which ETFs trade, particularly during periods of market volatility. •The recent advancements in and increased use of artificial intelligence (AI) present risks and challenges that may adversely impact our business.”

Annual report 2025A · The company itself

“We are highly dependent upon the use of various proprietary and third-party information and security technology, software applications and other technology systems to operate our business. We are also dependent on the effectiveness of our information and cyber security infrastructure, policies, procedures and capabilities to protect our technology and digital systems and the data that reside on or are transmitted through them, including data provided by third parties that is significant to portions of our business and products. We use our technology to, among other things, manage and trade portfolio investments, obtain securities pricing information, process client transactions, protect the privacy of clients', employees' and business partners' data, support our other operations and provide other services to our clients.”

Annual report 2025A · The company itself

“Cyber security incidents and cyber-attacks have been occurring globally at a more frequent and severe level. Our status as a global financial institution and the nature of our client base may enhance the risk that we are targeted by such cyber threats. Although we take protective measures, including measures to secure information effectively through system security technology, have many controls, processes, digital backup and recovery processes in place, and seek to continually monitor and develop our systems to protect our technology infrastructure and data from misappropriation or corruption, our technology systems may still be vulnerable to unauthorized access as a result of an external attack, actions by employees or vendors with access to our systems, computer malware or other events that have a security impact and that result in the disclosure or release of confidential information inadvertently or through malfeasance, or result in the loss (temporarily or permanently) of data, applications or systems.”

Annual report 2025A · The company itself

“In addition to our use of AI technologies, we are exposed to risks arising from the use of AI technologies by bad actors to commit fraud and misappropriate funds and to facilitate cyberattacks. Generative AI may be exploited to create sophisticated phishing schemes, ransomware attacks, or other cyber threats, which could result in financial losses, liquidity outflows, or systemic market disruptions.”

Annual report 2025A · The company itself

“Current and anticipated regulatory developments include requirements related to AI, cybersecurity, and digital operational resilience, as well as evolving ESG disclosure standards and cross-border data transfer restrictions. Global divergence in these regulations could create conflicting obligations and increase compliance complexity. These changes may require significant investment of management time and resources, impact product design and distribution, and materially increase compliance costs or capital requirements.”

Annual report 2025A · The company itself

“Data Privacy Patient health information is among the most sensitive of personal information, and it is critically important that information about an individual’s healthcare is properly protected from inappropriate access, use and disclosure. Real world evidence -- information that allows us to examine actual practices and outcomes -- is essential to increase access to care, improve outcomes, and lower costs. IQVIA uses a wide variety of privacy-enhancing technologies and safeguards to protect individual privacy while generating and analyzing information on a scale that helps healthcare stakeholders identify disease patterns and correlate with the precise treatment path and therapy needed for better outcomes.”

Annual report 2025A · The company itself

“IT systems and Information •Security breaches and unauthorized use of our IT systems and information could expose us, our clients, our data suppliers or others to risk of loss. •We may experience challenges with the acquisition, development, enhancement or deployment of technology necessary for our business. •Data protection, privacy and similar laws restrict access, use and disclosure of personal information, and failure to comply with these laws could materially harm our business.”

Annual report 2025A · The company itself

“Data protection, privacy and similar laws and regulations in the United States and around the world restrict access, use and disclosure of personal information, and failure to comply with or adapt to changes in these laws could materially and adversely harm our business. The confidentiality, collection, use, retention, security, transfer and disclosure of personal information is subject to governmental regulation in the countries where the personal information was collected or processed.”

Annual report 2025A · The company itself

“We and our customers are subject to numerous laws and regulations relating to data privacy and cybersecurity. These regulations are complex, change frequently and have tended to become more stringent over time.”

Annual report 2025A · The company itself

“Expansion into Global Digital Solutions and ALM services means that our data privacy and security risk profile is increasing.”

Annual report 2025A · The company itself

“Our reputation for providing secure information storage to customers is critical to the success of our business. Our reputation or brand, and specifically, the trust our customers place in us, could be negatively impacted in the event of perceived or actual failures by us to store information securely. Although we seek to prevent and detect attempts by unauthorized users to gain access to our IT systems, and incur significant costs to do so, our IT and network infrastructure has in the past been and may in the future be vulnerable to cyberattacks and security incidents, including by state-sponsored organizations with significant financial and technological resources, breaches due to employee or contractor error, fraud or malice or other disruptions (including, but not limited to, computer viruses and other malware, denial of service and ransomware), which may involve a breach requiring us to notify regulators, clients or employees and enlist identity theft protection.”

Annual report 2025A · The company itself

“The use of AI in our product initiatives and offerings or services, or in our internal business operations, may give rise to risks related to accuracy, bias, discrimination, intellectual property infringement, misappropriation or leakage of proprietary, confidential and personal information, defamation, data privacy, and cybersecurity. Any error, defect, or vulnerability in our AI-powered products or business processes could undermine the quality of our products and services, adversely impact our clients’ businesses, subject us or our clients to regulatory scrutiny, fines or litigation and cause reputational harm.”

Annual report 2025A · The company itself

“If our efforts to protect our intellectual property are not adequate, such as in the event of a cybersecurity incident, if any third party misappropriates or infringes on our intellectual property, or if we are alleged to be misappropriating or infringing on the intellectual property rights of others, the value of our brands may be harmed, which could have a material adverse effect on our business.”

Annual report 2026A · The company itself

“Furthermore, the rapid evolution of emerging technologies such as artificial intelligence may intensify our cybersecurity risks. We are regularly the target of attempted cyber and other security threats. Therefore, we continuously monitor and update our IT networks and infrastructure to prevent, detect, address, and mitigate the risk of unauthorized access, misuse, computer viruses, phishing attacks, malware, ransomware, social engineering, password theft, physical breaches, and other events that could have a security impact.”

Annual report 2026A · The company itself

“Further, as we integrate emerging and rapidly evolving technologies, including artificial intelligence and machine learning into our products and services, we may not be able to anticipate or identify vulnerabilities, design flaws or security threats resulting from the use of such technology and develop adequate protection measures. As a result, these products may not achieve market acceptance and our brand image could suffer.”

Annual report 2025A · The company itself

“Cybersecurity incidents impacting our IT systems and digital products could disrupt business operations, result in the loss of critical and confidential information, and materially and adversely affect our reputation and results of operations.”

Annual report 2025A · The company itself

“Global cybersecurity threats and incidents can range from uncoordinated individual attempts to gain unauthorized access to IT systems to sophisticated and targeted measures known as advanced persistent threats directed at the Company, its products, its customers and/or its third-party service providers, including cloud providers. We and third parties utilize vendors to support our business and operations have experienced, and expect to continue to experience, these types of threats and incidents, which add to the risks to our IT systems (including our cloud services providers’ systems), internal networks, our customers’ systems and the information that they store and process.”

Annual report 2025A · The company itself

“An increasing number of our products, services and technologies, including our OpenBlue software platform, are delivered with digital capabilities and accompanying interconnected device networks, which include sensors, data, building management systems and advanced computing and analytics capabilities. If we are unable to manage the lifecycle cybersecurity risk in development, deployment and operation of our digital platforms and services, they could become susceptible to cybersecurity incidents and lead to third-party claims that our product failures have caused damage to our customers. This risk is enhanced by the increasingly connected nature of our products and the role they play in managing building systems.”

Annual report 2025A · The company itself

“We collect, store, have access to and otherwise process certain confidential or sensitive data, including proprietary business information, customer data, personal data or other information that is subject to privacy and security laws, regulations and/or customer-imposed controls. Despite our efforts to protect such data, our business, data and our products have been and will in the future be vulnerable to security incidents, theft, misplaced or lost data, programming errors, or errors that could potentially lead to the compromise or further compromise of such data, improper use of our products, systems, software solutions or networks, unauthorized access, use, disclosure, modification or destruction of information, defective products, production downtimes and operational disruptions.”

Annual report 2025A · The company itself

“Our customers, including the U.S. government, are increasingly requiring cybersecurity protections and mandating cybersecurity standards in our products, and we may incur additional costs to comply with such demands.”

Annual report 2025A · The company itself

“JPMorganChase has experienced and expects that it will continue to experience failures and disruptions in the stability of its operational systems, including: •degraded performance of data processing systems •data quality issues •disruptions of network connectivity •malfunctioning software •disruptions in its ability to access and use the operational systems of third parties, and •interruptions in service from third-party service providers. These incidents have resulted in various negative effects for customers, including: •the inability to access account information or transact through ATM, internet or mobile channels •the exfiltration of customer personal data •the recording of duplicative transactions, and •extended delays for call center services.”

Annual report 2025A · The company itself

“Furthermore, the widespread interconnectivity among financial institutions, clearing banks, CCPs, payments processors, financial technology companies, securities exchanges, clearing houses, financial messaging networks and other financial market infrastructures increases the risk that the disruption of an operational system involving one entity could cause industry-wide operational disruptions that could materially affect JPMorganChase’s ability to conduct business. In addition, the risks associated with the disruption of an operational system of a third-party could be exacerbated if the services provided by that system are widely used by market participants.”

Annual report 2025A · The company itself

“A successful cyber attack could cause significant harm to JPMorganChase and its clients and customers. JPMorganChase experiences numerous cyber attacks on its computer systems, software, networks and other technology assets.”

Annual report 2025A · The company itself

“•obtain unauthorized access to JPMorganChase’s systems or to confidential information belonging to 21 Part I JPMorganChase or its clients, customers, counterparties or employees •manipulate or destroy data •disrupt, sabotage or degrade service on JPMorganChase’s systems and websites, including those that provide online banking and other services •steal money, or •extort money through the use of so-called “ransomware.” Threat actors that perpetrate cyber attacks include individuals or groups that are: •sponsored by, or acting on behalf of, hostile countries or terrorist organizations •cyber-criminals, or •engaged in using technology to promote a political or social agenda (i.e., “hacktivists”). JPMorganChase has experienced security breaches due to cyber attacks in the past, and future breaches are inevitable.”

Annual report 2025A · The company itself

“JPMorganChase cannot guarantee that it will always detect cybersecurity threats to its systems or implement effective preventive measures against those threats. The reasons for this include: •the techniques used in cyber attacks evolve frequently and increase in sophistication, and therefore a cyber attack may not be recognized until launched or may go undetected for extended periods •it is possible that a third-party, after establishing a foothold on an internal network without being detected, may gain access to other networks and systems •cyber attacks can originate from a wide variety of sources, including certain threat actors that are well-resourced and can sustain malicious activities for extended periods, and •JPMorganChase does not have control over the cybersecurity of the systems of the numerous clients, customers, counterparties and third-party service providers with which it does business.”

Annual report 2025A · The company itself

“The cybersecurity risks that JPMorganChase faces could be intensified by factors such as: •increased volume and complexity of cyber attacks during periods of heightened geopolitical tensions •technological advances such as artificial intelligence (“AI”) and quantum computing that may enable malicious actors to develop more advanced social engineering attacks, including targeted phishing attacks, and •technological advances which may counteract or nullify existing information security protections, including cryptographic protections, potentially exposing data. In addition, JPMorganChase could be required to make significant investments in technology in order to transition effectively to more robust security protections, including quantum-resistant encryption.”

Annual report 2025A · The company itself

“The extent of a particular cyber attack, the methods used by threat actors, and the steps that JPMorganChase may need to take to investigate the attack may not be immediately clear, and it could take a significant amount of time before such an investigation can be completed. While such an investigation is ongoing, JPMorganChase may not know the full extent of the harm caused by the cyber attack, and that damage could continue to spread.”

Annual report 2025A · The company itself

“The growing sophistication of technology poses a heightened risk of identity fraud, as malicious actors may exploit technology to create convincing false identities or manipulate verification processes. Failure to manage these risks or to implement effective countermeasures could lead to unauthorized transactions, financial losses, increased regulatory scrutiny and reputational harm.”

Annual report 2025A · The company itself

“In addition, if a third-party, whether authorized or unauthorized, obtains and misappropriates data from JPMorganChase’s systems, JPMorganChase and its clients and customers could experience negative outcomes, including a heightened risk of fraudulent transactions using JPMorganChase’s systems, losses from fraudulent transactions and reputational harm from perceived system insecurity.”

Annual report 2025A · The company itself

“Ett omfattande haveri eller annan störning (såsom en cyberattack) i IT - systemen kan påverka Karnovs förmåga att bedriva verksamheten och uppfylla sina kundåtaganden. Det finns också en risk att företagshemligheter, personuppgifter eller annan känslig information om anställda eller kunder, används på ett felaktigt sätt eller kapas om Karnov utsätts för dataintrång En beredskapsplan för Karnovs verksamhet har antagits för att hantera störningar på grund av oförutsedda händelser.”

Annual report 2024A · The company itself

“•Increased concerns related to the use or disposal of plastics or other packaging materials can adversely affect our business and financial performance. •Significant additional labeling or warning requirements or limitations on the marketing or sale of our products may inhibit sales of affected products. •Our use of information technology and third-party service providers exposes us to cybersecurity breaches and other business disruptions that could adversely affect us. •Failure to comply with personal data protection and privacy laws can adversely affect our business. •Climate change or related legislation could adversely affect our business. •Water scarcity and quality could adversely affect our business. •Fluctuations in our effective tax rate may result in volatility in our financial results. •We may not complete the proposed JDE Peet's Acquisition within the time frame we anticipate, or at all, which could adversely affect our business.”

Annual report 2025A · The company itself

“Our information systems contain proprietary and other confidential information related to our business. These systems and services are vulnerable to interruptions or other failures resulting from, among other things, natural disasters, terrorist attacks, software, equipment, or telecommunications failures, processing errors, computer viruses, other security issues or supplier defaults.”

Annual report 2025A · The company itself

“We, and our third-party service providers, use information technology to support our global business processes and activities, including supporting critical business operations; communicating with our suppliers, customers, and employees; maintaining financial information and effective accounting processes and financial and disclosure controls; engaging in mergers and acquisitions and other corporate transactions; conducting research and development activities; meeting regulatory, legal, and tax requirements; and executing various digital marketing and consumer promotion activities. Global shared service centers managed by third parties provide an increasing amount of services to conduct our business, including a number of accounting, internal control, information technology, human resources, and computing functions.”

Annual report 2025A · The company itself

“Operational risk includes the risk of fraud by employees or others outside of Key, clerical and recordkeeping errors, nonperformance by vendors, threats from cyber activity, and computer/telecommunications malfunctions. Fraudulent activity has escalated, become more sophisticated, and is ever evolving as there are more options to access financial services.”

Annual report 2025A · The company itself

“In addition, several financial institutions, including Key, have experienced significant distributed denial-of-service attacks, some of which involved sophisticated and targeted attacks intended to disrupt, disable, or degrade services, or sabotage systems or data. Other attacks have attempted to obtain unauthorized access to confidential, proprietary, or personal information or intellectual property, to extort money through the use of “ransomware” or other extortion tactics, or to alter or destroy data or systems, often through various attack vectors and methods, including the introduction of computer viruses or malicious or destructive code (commonly referred to as “malware”), phishing, cyberattacks, account takeovers, credential stuffing, and other means.”

Annual report 2025A · The company itself

“If the business’s systems that process or store debit or credit card information experience a security breach, our card holders may experience fraud on their card accounts. We may suffer losses associated with such fraudulent transactions, as well as for other costs, such as replacing impacted cards.”

Annual report 2025A · The company itself

“Table of contents We also face risks related to the interdependence and interconnectivity of financial entities and technology systems. A technology failure, cyberattack or other security breach that significantly compromises the systems of one or more financial parties or service providers in the financial system could have a material impact on counterparties or market participants, including us.”

Annual report 2025A · The company itself

“Additionally, the increasing use of third-party financial data aggregators and emerging technologies, including the use of AI, introduces new information security risks and exposure for us and for our third party service providers, and, additionally, such technologies may be used to identify vulnerabilities; such technologies have resulted in a substantial increase in the volume and sophistication of cyberattacks against financial and other institutions, including the use of generative AI to conduct more sophisticated social engineering attacks.”

Annual report 2025A · The company itself

“Security attacks can originate from a wide variety of sources/malicious actors, including, but not limited to, persons who constitute an insider threat, who are involved with organized crime, or who may be linked to terrorist organizations or hostile foreign governments. Those same parties may also attempt to fraudulently induce employees, customers, or other users of our systems to disclose sensitive information in order to gain access to our data or that of our customers or clients through social engineering, phishing, mobile phone malware and SIM card swapping, and other methods.”

Annual report 2025A · The company itself

“Any mishandling or misuse of personal information by Key or our vendors or our failure to comply with notification requirements related to incidents relating to such personal information could expose us to litigation or regulatory fines, penalties, or other sanctions.”

Annual report 2025A · The company itself

“In addition, there has been a significant increase in privacy-related litigation in recent years with respect to how organizations collect information and technical data from their public facing websites, and federal and state courts have been creating new legal frameworks around consumer and website privacy, which also creates new risks on businesses. As new privacy-related laws and regulations, and judicially-created frameworks, are implemented in jurisdictions in which KeyBank operates, the time and resources needed for us to comply with such laws and regulations, as well as our potential liability for noncompliance and reporting obligations in the case of data breaches, may significantly increase.”

Annual report 2025A · The company itself

“We are also subject to the risk that disruptions to how our customers access our banking services, such as disruptions to our technology platforms (e.g., online banking websites or mobile applications) or other impacts to our branches, could harm our reputation with customers. In particular, a cybersecurity event impacting Key or our customers’ data or personal information could negatively impact our reputation and customer confidence in Key and our data security procedures.”

Annual report 2025A · The company itself

“Also, rules adopted by the federal banking agencies require a financial institution to notify its primary federal regulator within 36 hours of certain computer-security incidents, including an incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, an institution’s operations or activities or its ability to deliver products or services to a material portion of its customer base. In addition, the SEC has adopted final rules requiring public companies (including KeyCorp) to disclose on Form 8-K material cybersecurity incidents and to disclose annually on Form 10-K information regarding their cybersecurity risk management, strategy, and governance.”

Annual report 2025A · The company itself

“Our third-party service providers could experience, and have experienced, certain cyber incidents, and as a result, unauthorized individuals have gained access to our clients’, and could improperly gain access to our, confidential data through such third parties.”

Annual report 2025A · The company itself

“We continuously face various security threats on a regular basis, including ongoing cybersecurity threats to, and attacks on, our information technology infrastructure that are intended to gain access to our confidential information, destroy data or disable, degrade or sabotage our systems. The risk of a security breach or disruption has increased as the number, intensity, and sophistication of attempted attacks and intrusions from around the world have increased.”

Annual report 2025A · The company itself

“Privacy, data protection, cybersecurity and artificial intelligence laws may increase compliance costs and subject us to enforcement risks and reputational risks. Data privacy, data protection and cybersecurity have become priorities for regulators around the world, and rapidly evolving and changing laws and regulations, including with respect to artificial intelligence, may increase compliance and legal costs and expose us to enforcement risk, litigation, and reputational harm.”

Annual report 2025A · The company itself

“Our insurance business processes sensitive personal information of policyholders, which exposes it to heightened privacy and cybersecurity risk, and our insurance subsidiaries are subject to additional cybersecurity requirements, including the New York State Department of Financial Services (“NYSDFS”) cybersecurity regulation, which requires covered entities to maintain cybersecurity programs, conduct risk assessments, and satisfy certain incident reporting and governance requirements. In November 2023, the NYSDFS finalized amendments to its cybersecurity regulations that significantly expanded the NYSDFS’ regulation of data privacy matters.”

Annual report 2025A · The company itself

“We depend on information technology for our business and are exposed to risks related to cybersecurity threats and cyber incidents affecting our, our customers’, suppliers’ and other service providers’ systems and networks.”

Annual report 2026A · The company itself

“Cybersecurity incidents affecting our customers could result in substantial delays in our ability to ship to those customers or install our products, which could result in delays in revenue recognition or the cancellation of orders, and cybersecurity incidents affecting our suppliers could result in substantial delays in our ability to obtain necessary components for our products from those suppliers, which could hamper our ability to ship our products to our customers and service them, harming our results of operations.”

Annual report 2026A · The company itself

“Vi er spesielt utsatt for cyber- og fysiske trusler fra utenlandske etterretningstjenester, ettersom vi leverer kritiske høyteknologiske løsninger. I tillegg introduserer den raske utviklingen av kunstig intelligens et nytt lag av usikkerhet i cyberdomenet.”

Annual report 2024A · The company itself

“Vi investerer tungt i innovativ teknologi og digitalisering, for å sikre at både nye og eksisterende fartøy med utstyr fra Kongsberg Maritime er trygge, leverer høy grad av operasjonell effektivitet og ivaretar krav til cybersikkerhet. Våre løsninger er fremtidsrettede med fokus på redusert energiforbruk og økt bruk av grønne energibærere.”

Annual report 2024A · The company itself

“Digital enhet og cybersikkerhet •For å møte behovet til våre kunder etablerte Kongsberg Maritime i 2024 en egen digital enhet for utvikling og skalering av digitale funksjoner.”

Annual report 2024A · The company itself

“Propulsion & Handling Vi definerer fremtiden for fremdrift og håndtering •Kongsberg Maritime er en verdensledende leverandør av fremdriftssystemer, manøvrerings- og håndteringssystemer. •Vi leverer et stort utvalg av produkter og systemer innenfor sikkerhetskritisk dekksmaskineri, testet for å fungere under ekstreme forhold. •Innenfor fremdrift tilbyr vi propell, vannjet og thrustere som spenner fra mekaniske til elektriske.”

Annual report 2024A · The company itself

“Vi utvikler derfor teknologiske løsninger som muliggjør aktivitet og sikrer kommunikasjon til tross for fiendtlig aktivitet og trusler som kan påvirke aktivitet til havs, i luften eller under vann.”

Annual report 2024A · The company itself

“Management considers data security breaches one of the key risk factors due to the importance of the data Konsolidator® stores and the increased risk of hacker attacks.”

Annual report 2025A · The company itself

“SAFETY, TRUST, AND GOVERNANCE As Konsolidator expands its product portfolio, safety, trust, and governance remain a priority. Thus, the company maintains its ISAE 3402 Type 2 certification. This commitment is supported by ongoing investments in platform security, including Single Sign-On (SSO), API key management, and penetration testing, to ensure secure access and reliable handling of sensitive financial data.”

Annual report 2025A · The company itself

“Our technology systems have been, and may be in the future, disrupted from circumstances beyond our control, as we regularly defend against and respond to data security related attacks. Cyber-attackers have targeted and accessed, and may in the future again target and, if successful, access information stored in our or certain third parties’ systems in order to misappropriate confidential customer or business information.”

Annual report 2026A · The company itself

“Our cybersecurity program, continued investment in our information technology systems, and our processes to evaluate and select vendors with reasonable information security controls may not effectively insulate us from potential attacks, data breaches or disruptions to our business operations, which could result in a loss of customers or business information, negative publicity, damage to our reputation, and exposure to claims from customers, financial institutions, regulatory authorities, payment card associations, associates and other persons. Any such events could have an adverse effect on our business, financial condition, results of operations or cash flows and may not be covered by our insurance. In addition, compliance with rapidly changing privacy and information security laws and standards may result in significant expense due to increased investment in technology and the development of new operational processes and may require us to devote significant management resources to address these issues.”

Annual report 2026A · The company itself

“As part of Denmark’s critical infrastructure, CPH depends on stable and secure IT systems. Cyber attacks in particular are becoming increasingly sophisticated, which increases the risk of data, system integrity and accessibility being compromised.”

Annual report 2025A · The company itself

“CPH played an important role during Denmark’s EU Presidency in the second half of 2025, and our security checkpoint was named the best in the world.”

Annual report 2025A · The company itself

“Security, Privacy, and Confidentiality of Health Information and Other Personal Information The Company and its third party service providers are subject to laws and regulations related to protecting the privacy and security of personal information, as well as national security concerns relating to cross-border access to personal information. In the U.S., HIPAA governs the security and confidentiality of certain health information in a manner designed to improve the efficiency and effectiveness of the healthcare system by facilitating the electronic exchange of information in certain financial and administrative transactions.”

Annual report 2025A · The company itself

“The Company collects, stores, transmits, and processes personal and financial information, and works with third-party service providers in connection with such data processing activities. A compromise of the Company’s or a vendor’s systems that results in confidential information being acquired, accessed, or changed by unauthorized persons, or failure to meet security standards, such as the HIPAA security regulations and the Payment Card Industry Data Security Standard, could harm the Company’s reputation, operations, financial condition, and liquidity, and may result in litigation, fines, or regulatory actions.”

Annual report 2025A · The company itself

“Cybersecurity incidents and unauthorized access to the Company's or its customers’ data could harm the Company’s reputation and adversely affect its business. The Company continues to face cybersecurity threats, including ransomware attempts, data breaches, and phishing and social engineering attempts targeting its systems and its employees, and those of third-party vendors.”

Annual report 2025A · The company itself

“Increasingly sophisticated methods, including the use of AI by threat actors, heighten these risks.”

Annual report 2025A · The company itself

“DATA PRIVACY, CYBERSECURITY AND ARTIFICIAL INTELLIGENCE LAWS Some of our operations and service offerings involve access to and use by us of personal information and/or protected health information. These activities are regulated by extensive federal, state and international data privacy and security laws requiring organizations to, among other things, provide certain privacy protections and security safeguards for such information.”

Annual report 2026A · The company itself

“We are also subject to the CMMC requirements, which require successful assessment by a third party against specified cyber controls in order to be eligible for contract awards. To the extent we are unable to achieve or maintain certification at the level required for a particular contract award, we will be unable to bid on such contract awards or follow-on awards for existing work with the DoW, which could adversely impact our revenue and our profitability.”

Annual report 2026A · The company itself

“We may also be subject to additional emerging and as yet unspecified cybersecurity requirements under the FAR and other federal regulations. Should we or our supply chain fail to implement these new requirements, this may adversely affect our ability to receive awards or execute on relevant government programs.”

Annual report 2026A · The company itself

“The overarching complexity of data privacy and security laws and regulations around the world poses a compliance challenge that could manifest in costs, damages, or liability in other forms as a result of failure to implement proper programmatic controls, failure to adhere to those controls, or the breach of applicable data privacy and security requirements by us, our employees, our business partners (including our service providers, suppliers or subcontractors) or our customers.”

Annual report 2026A · The company itself

“Any failure or perceived failure by us, our service providers, suppliers, subcontractors, or other business partners to comply with applicable laws, regulations, our public privacy policies and other public statements about data privacy and security and other obligations in these areas could result in regulatory or government actions lawsuits against us (including civil claims, such as representative actions and other class action-type litigation), legal liability, monetary penalties, fines, sanctions, damages and other costs, orders to cease or change our processing of data, changes to our business practices, diversion of internal resources, and harm to our reputation, all of which could adversely affect our business, financial condition and results of operations. We may also incur substantial expenses in implementing and maintaining compliance with such laws, regulations, and other obligations.”

Annual report 2026A · The company itself

“As a government contractor and a provider of information technology services operating in multiple regulated industries and geographies, we and our service providers, suppliers and subcontractors collect, store, transmit, and otherwise process personal, confidential, proprietary, and sensitive information, including protected health information, personnel information, personal information, classified information, controlled unclassified information, intellectual property and financial information, concerning our business, employees, and customers. Therefore, we are continuously exposed to unauthorized attempts to compromise access, release or otherwise compromise such information through cyber-attacks and other information security threats, including, among other things, physical break-ins, theft, denial-of-service attacks, worms, computer viruses, software bugs, malicious or destructive code, social engineering, phishing attacks and impersonating authorized users, credential stuffing, account takeovers, insider threats, malfeasance or improper access by employees or service providers, human error, fraud, use of AI, “bots” or other automation software, or other similar disruptions.”

Annual report 2026A · The company itself

“We are also increasingly subject to customer-driven cybersecurity certification requirements, including but not limited to CMMC, which are expected to be necessary to win future contracts.”

Annual report 2026A · The company itself

“We do not control our service providers and our ability to monitor their cybersecurity is limited, so we cannot ensure the cybersecurity measures they take will be sufficient to protect any information we share with them. Due to applicable laws and regulations or contractual obligations, we may be held accountable for cybersecurity breaches or other information security incidents attributed to our service providers as they relate to the information we share with them.”

Annual report 2026A · The company itself

“Headquartered in Reston, Virginia, with 47,000, global employees, we pursue strategic growth across five pillars: space and maritime; energy infrastructure; digital modernization and cyber; mission software; and managed health services.”

Annual report 2026A · The company itself

“uMission Software – We deliver trusted national security software leveraging artificial intelligence tools for defense, intelligence, and homeland security customers. uMulti-Domain Solutions – We provide services by using artificial intelligence and machine learning to coordinate sea, ground, air and space rapidly and securely to provide warfighters the right information at the right time for mission advantage. uCyber Operations – We offer full-spectrum cyber solutions to include offensive, defensive, and physical cyber operations delivering global-scale cryptographic management solutions to protect our customers’ most critical information and assets. uIntelligence Analysis, Mission Support, and Global Logistics Services – We provide intelligence analysis, operational support, logistics operations, security, linguistics, force production, biometrics, Chemical, Biological, Radiological, Nuclear, and Explosives, energetics, training and other services to Intelligence Community customers.”

Annual report 2026A · The company itself

“With over 30,000 products deployed across more than 120 countries, including people scanners, computed tomography carry-on baggage scanners, checked baggage scanners, and explosive trace detectors. We are also the primary supplier to CBP and other international customers of mobile, non-intrusive ports and borders inspection systems that secure the flow of travel and trade by effectively detecting and mitigating threats across cargo, vehicles, and individuals.”

Annual report 2026A · The company itself

“We could incur significant liabilities and suffer negative publicity if our inspection or detection systems fail to detect bombs, explosives, weapons, contraband or other threats. We design, develop, manufacture, sell, service, and maintain various inspection systems and related integration and automation systems designed to assist in detecting bombs, explosives, weapons, contraband, or other threats. In some instances, we also train operators of such systems.”

Annual report 2026A · The company itself

“Despite our security measures as well as those of our business partners and third-party service providers, the information systems we rely upon may be vulnerable to interruption or damage from cyber attacks, computer viruses, worms or other destructive or disruptive software, process breakdowns, denial of service attacks, malicious social engineering or other malicious activities, or any combination thereof. Further, as AI technologies advance, new and increasingly sophisticated attack methods are emerging, including fraud involving impersonation technologies or other forms of generative AI that enhance the scale, frequency, and effectiveness of cyber threats.”

Annual report 2025A · The company itself

“Det finns risk på kort till lång sikt att något Lifcobolag läcker, blir utsatt för stöld av eller på något annat sätt förlorar kund- eller leverantörsinformation. Det finns risk på kort till lång sikt att Lifco eller något Lifcobolag drabbas av att en leverantör eller kund läcker, blir utsatt för eller på något annat sätt blir av med information om Lifco eller ett Lifcobolag.”

Annual report 2024A · The company itself

“Hög IT-säkerhet inklusive skydd av persondata är affärskritiskt och är därför fokusområden för Lifcobolagen. För Lifco är kundintegritet och datasäkerhet en central del av en ansvarsfull affärsverksamhet.”

Annual report 2024A · The company itself

“In addition, rules and regulations are being introduced, or are being considered, in the areas of AI, information security and climate change, which may also affect CNA’s business.”

Annual report 2025A · The company itself

“CNA also is subject to numerous regulations governing the protection of personal and confidential information of its customers and employees, including medical records, credit card data and financial information. These laws and regulations, including regulations related to cybersecurity protocols (which continue to evolve in breadth, sophistication and maturity in response to an ever-evolving threat landscape), are increasing in complexity and number, change frequently, sometimes conflict, and could expose CNA to significant monetary damages, regulatory enforcement actions, fines and/or criminal prosecution in one or more jurisdictions.”

Annual report 2025A · The company itself

“Boardwalk Pipelines’ business is dependent upon its computer systems, devices and networks (operational and information technology), and those of its customers, suppliers and others with whom Boardwalk Pipelines does business, to collect, process and store the data necessary to conduct almost all aspects of its business, including the operation of its pipeline and storage facilities and the recording and reporting of commercial and financial information. Despite Boardwalk Pipelines’ security measures, the information and operational technology and infrastructure it relies on may be vulnerable to attacks by third parties, such as hackers, cybercriminals, nation-states, insiders or other third parties, or breached due to human error, malfeasance or other disruptions.”

Annual report 2025A · The company itself

“Through government intelligence reports, Boardwalk Pipelines is aware of credible global threats to third-party, U.S. critical infrastructure sectors on which it depends, such as the telecommunications sector.”

Annual report 2025A · The company itself

“As the cybersecurity threat landscape continues to evolve, Boardwalk Pipelines may be required to expend significant additional resources to continue to modify or enhance its protective measures or to investigate and remediate any information security vulnerabilities.”

Annual report 2025A · The company itself

“Advances in computer capabilities, discoveries in the field of artificial intelligence, cryptography, inadequate facility security or other developments may result in a compromise or breach of the technology Boardwalk Pipelines uses to safeguard its operational and information technology systems and confidential, personal, or otherwise protected information. As the breadth and complexity of the technologies Boardwalk Pipelines uses continue to grow, including as a result of the use of mobile devices, cloud services, artificial intelligence, open-source software, social media and the increased reliance on devices connected to the internet, the potential risk of cyberattacks and cybersecurity incidents also increases.”

Annual report 2025A · The company itself

“As cybersecurity incidents continue to evolve, more legislation could be enacted to seek to mitigate cybersecurity threats. This may require Boardwalk Pipelines to expend additional resources to continue to modify or enhance its protective measures or to investigate and remediate vulnerabilities to cybersecurity incidents at significantly increased costs.”

Annual report 2025A · The company itself

“A failure, security breach, disruption or degradation impacting Boardwalk Pipelines’ operational or information technology systems or those of third parties with whom it does business could negatively affect its ability to safely and reliably operate its assets and/or result in delays in providing services for its customers, contamination or degradation of the products it transports and store, damage to or destruction of its or third-party pipelines, property or facilities, catastrophic events, injury or death to its employees or other persons, the inadvertent release of hydrocarbons or the release or destruction of confidential, proprietary or business-critical information or intellectual property, which could result in outages, reduced revenue, unexpected costs and expenses, litigation and reputational damage, any or all of which may be irreversible and may materially adversely affect its results of operations, cash flows, financial condition and ability to operate its business.”

Annual report 2025A · The company itself

“In addition, access, disclosure or other loss of information or other consequences could result in legal claims or proceedings, liability under laws that protect the privacy of personal information or personally identifiable information, regulatory penalties for divulging or failing to adequately protect such information, disruption of Boardwalk Pipelines’ operations, incident response and remediation costs, damage to its reputation, and loss of confidence in its services.”

Annual report 2025A · The company itself

“Specialty includes the following business groups: Management & Professional Liability: Management & Professional Liability consists of the following coverages and products: •professional liability coverages and risk management services to various professional firms, including architects, real estate agents, accounting firms and law firms; •directors and officers (“D&O”), errors and omissions (“E&O”), employment practices, fiduciary, fidelity and cyber coverages.”

Annual report 2025A · The company itself

“Samtidigt är kontantberoendet stort och mängden kontanter i omlopp fortsätter att öka. Hot mot integriteten vid digitala betalningar och att kostnader för digitala transaktioner alltmer läggs på konsumenten, särskilt i USA, bidrar till att bibehålla efterfrågan på att kunna hantera kontanter.”

Annual report 2024A · The company itself

“Loomis verksamhet bygger på att Loomis övertar kundens risker förknippade med att hantera, transportera och lagerhålla kontanter, ädel metaller och andra värdeföremål. Verksamheten innebär att det dels finns risk att kontanter och värdeföremål går förlorade på grund av brottslighet eller brister i hanteringen, dels risk för personskador.”

Annual report 2024A · The company itself

“Luotean toiminta ja sen tarjoamat palvelut ovat laajasti riippuvaisia tietoverkoista ja digitaalisista ratkaisuista, ja niiden häiriöt ja niihin kohdistuvat loukkaukset tai hyökkäykset sekä mahdollinen epäonnistuminen tietojärjestelmien kehityshankkeissa sekä riittävien tietojenkäsittelysopimusten puute voivat vaikuttaa haitallisesti Luotean liiketoimintaan ja taloudelliseen asemaan sekä aiheuttaa mainehaittaa.”

Annual report 2025A · The company itself

“• Osittaisjakautumisen myötä tieto- ja viestintäjärjestelmiin ja niiden käyttöönottoon liittyvät häiriöt, viivästykset ja toiminnalliset haasteet voivat vaikuttaa Luotean toimintaan ja asiakaspalveluun. • Liiketoimintakriittisten järjestelmien uusimiset voivat aiheuttaa häiriöitä palvelutuotannossa. • Kyberrikollisuus voi vaarantaa yhtiön tietoturvan ja tietosuojan sekä häiritä liiketoiminnan jatkuvuutta esimerkiksi tietomurtojen, haittaohjelmien tai palvelunestohyökkäysten seurauksena. • Järjestelmäympäristön kehittäminen ja ICT-ympäristön käyttövarmuuden turvaaminen mm. kartoittamalla toiminnalle kriittiset järjestelmät ja määrittelemällä ja tarkentamalla vastuita järjestelmätoimittajien ja Luotean välillä. • Uusien järjestelmien ja niihin liittyvien toimintamallien käyttöönottojen perusteellinen suunnittelu. • Tietoturvaa ja tietosuojaa koskevat ohjeet ja henkilöstön kouluttaminen.”

Annual report 2025A · The company itself

“Luotealla on käytössä ilmoituskanava, jonka kautta Luotean työntekijät, asiakkaat, toimittajat ja muut sidosryhmät voivat ilmoittaa Luotean toimintaan kohdistuvista väärinkäytösepäilyistä liittyen lainsäädännön tai toimittajien eettisten periaatteiden rikkomiseen. Ilmoituskanavan kautta on mahdollista ilmoittaa Luotean toimintaan liittyvistä väärinkäytösepäilyistä luottamuksellisesti.”

Annual report 2025A · The company itself

“Tietosuojapolitiikka määrittelee Luotealla sisäisesti hyväksytyt tietosuojaperiaatteet asiakkaiden, yhteistyökumppaneiden ja muiden sidosryhmien sekä työntekijöiden ja työnhakijoiden henkilötietojen käsittelemiseksi. Tietosuojapolitiikalla ja politiikasta johdetuilla toimintokohtaisilla tietosuojaohjeistuksilla Luotea pyrkii varmistamaan henkilötietojen lainmukaisen käsittelyn ja asianmukaisen tietosuojan tason.”

Annual report 2025A · The company itself

“Kaikkien työntekijöiden tulee tuntea työtehtäviinsä liittyvät tietosuoja- ja tietoturvavelvoitteet ja noudattaa niitä. Vuonna 2025 toimihenkilöistä 92 % oli suorittanut tietoturvapolitiikan sisältöihin perehdyttävän verkkokoulutuksen, joka sisältää myös tietosuojapolitiikan keskeisimmät aihealueet.”

Annual report 2025A · The company itself

“Mandatumin tietoturvallisuutta kehitetään jatkuvasti konsernin johtoryhmän hyväksymän tietoturvastrategian mukaisesti niin, että se vastaa asiakkaiden ja viranomaisten odotuksia sekä alati muuttuvaa uhkaympäristöä. Tieto- ja kyberturvallisuuden tasoa arvioidaan aktiivisesti ja prosesseja ja järjestelmiä koskevia testejä tehdään säännöllisesti. Tietoturva- ja kyberriskejä seurataan aktiivisesti myös erilaisin mittarein ja niistä raportoidaan neljännesvuosittain tietoturvaja kyberriskien komitealle.”

Annual report 2025A · The company itself

“S4 Kuluttajat ja loppukäyttäjät Tietoihin liittyvät kuluttajiin ja loppukäyttäjiin kohdistuvat vaikutukset Henkilötietojen käsittely on keskeisessä roolissa vakuutus- ja sijoituspalveluihin liittyvässä liiketoiminnassa. Asiakkaat ja muut sidosryhmät odottavat Mandatumilta henkilötietojen luottamuksellista ja asianmukaista käsittelyä koko henkilötietojen käsittelyn elinkaaren ajan.”

Annual report 2025A · The company itself

“Politiikoissa määritetyt vaatimukset koskevat Mandatumin oman henkilöstön lisäksi palveluntarjoajia ja muita ulkoisia sidosryhmiä, joiden osalta vaatimukset on sisällytetty niiden kanssa tehtyihin sopimuksiin.”

Annual report 2025A · The company itself

“Mandatumin tieto- ja kyberturvallisuus perustuvat Code of Conduct -toimintaperiaatteisiin, tietoturvapolitiikkaan ja tiedonhallintapolitiikkaan. Tietoturvapolitiikka määrittää roolit, vastuut, tavoitteet ja linjaukset tietoturvallisuuden toteuttamiselle.”

Annual report 2025A · The company itself

“We are exposed to risks and costs associated with protecting the integrity and security of data. In the operation of our business, we collect, store, use, and transmit large volumes of personal data regarding associates, guests, customers, hotel owners, service providers, other third parties, and our own business operations, including credit card numbers, reservation and loyalty data, and other personal data, in various information systems that we maintain and in systems maintained by third parties, including those of our hotel owners, service providers, and other third parties with whom we or they do business.”

Annual report 2025A · The company itself

“We are subject to numerous, complex, and frequently changing laws, regulations, and contractual obligations designed to protect personal information. Various U.S. federal and state laws, non-U.S. laws, payment card industry security standards, and other information privacy and security standards are all applicable to us.”

Annual report 2025A · The company itself

“Compliance with changes in applicable data security and privacy laws and regulations and contractual obligations (including resolutions with regulators), including the need to respond to investigations into our compliance, has increased and is expected to in the future increase our costs, and may restrict our business operations, increase our exposure to payment obligations and litigation in the event of alleged noncompliance, and adversely affect our reputation.”

Annual report 2025A · The company itself

“The information, security, and privacy requirements imposed by global laws and regulations, our contractual obligations, and the requirements of the payment card industry continue to become increasingly stringent in many jurisdictions in which we operate. Our information systems and the information systems maintained or used by our hotel owners, service providers, and other third parties with whom we or they do business may not be able to satisfy these changing legal and regulatory requirements and associate and guest expectations; we and/or these third parties may require significant additional investments or time to do so; and security controls that we and/or these third parties may implement sometimes do not operate effectively or as intended.”

Annual report 2025A · The company itself

“In operating our business and providing services and solutions to clients, we collect, use, store, transmit and otherwise process certain electronic information, including personal, confidential, proprietary and sensitive data such as financial records, health care, mergers and acquisitions and personal data of our clients, colleagues and vendors. We rely on the efficient, uninterrupted and secure operation of complex information technology systems and networks to operate our business and securely process, transmit and store electronic information. In the normal course of business, we also share electronic information with our vendors and other third parties, which in some cases is critical to our ability to deliver services to our clients. This electronic information comprises sensitive and confidential data, including information related to financial records, health care, mergers and acquisitions and clients’ personal data.”

Annual report 2025A · The company itself

“Our Privacy by Design, Data by Design and AI Governance processes are designed to ensure we embed multiple layers of privacy, data protection and information security controls in all our products and services, keeping a clear focus on protecting customers’ and individuals’ data and privacy, as well as making our AI more accurate and effective.”

Annual report 2025A · The company itself

“We employ a multi-layered approach to help protect the global payments ecosystem, including a robust program designed to protect our network from cyber and information security threats. Our network and platforms incorporate multiple layers of protection, providing greater resiliency and security protection.”

Annual report 2025A · The company itself

“Our programs are assessed by third parties and incorporate benchmarking and other data from peer companies and consultants. We engage in many efforts to mitigate information security challenges, including maintaining an information security program, an enterprise resilience program and insurance coverage, as well as regularly testing our systems to address potential vulnerabilities.”

Annual report 2025A · The company itself

“With respect to information security, any single breach could require parallel notifications to data protection authorities, cyber authorities and/or law-enforcement, often requiring different thresholds, reporting deadlines and formats.”

Annual report 2025A · The company itself

“For example, as a provider of global threat intelligence services through Recorded Future, we are subject to increased exposure to certain laws and regulations, including global cybercrime and other laws and regulations in various jurisdictions.”

Annual report 2025A · The company itself

“Furthermore, the complexity of this payment technology requires careful management to address information security vulnerabilities that are different from those faced on our payment network. Operational difficulties, such as the temporary unavailability of our services or products, or information security breaches on our real-time account-based payments network could cause a loss of business for these products and services, result in potential liability for us and adversely affect our reputation.”

Annual report 2025A · The company itself

“Information security risks for payments and technology companies such as ours have significantly increased in recent years in part because of the proliferation of new technologies (including AI), the use of the Internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, “hacktivists”, terrorists, nation-states, state-sponsored actors and other external parties. These threats may derive from fraud or malice on the part of our employees or third parties, or may result from human error, software bugs, server malfunctions, software or hardware failure or other technological failure. These threats include cyber-attacks such as computer viruses, denial-of-service attacks, malicious code (including ransomware), social-engineering attacks (including phishing attacks) or information security breaches and could lead to the misappropriation or loss of consumer account and other information and identity theft.”

Annual report 2025A · The company itself

“In addition to information security risks for our systems and networks, we also routinely encounter account data compromise events involving merchants and third-party payment processors that process, store or transmit payment transaction data, which affect millions of Mastercard, Visa, Discover, American Express and other types of account holders.”

Annual report 2025A · The company itself

“However, increased fraud levels and cyber-attacks involving our products, services and/or network, or misconduct or negligence by third parties switching or otherwise servicing our products and services could damage our reputation and reduce the use and acceptance of our products and services and/or increase our compliance costs. Further, such occurrences have resulted in and could further result in legislative or regulatory intervention, which could lead to enhanced security requirements and liabilities.”

Annual report 2025A · The company itself

“Data and AI. We create a range of products and services for our customers using our data and artificial intelligence (“AI”) assets, technology, platforms and expertise. These products and services are designed to make commerce smarter, more secure and more personal.”

Annual report 2025A · The company itself

“We focus on securing transactions by replacing card numbers with secure tokens, scaling Mastercard Authentication (including enabling device-based biometrics, such as fingerprints or facial scans, through Mastercard Payment Passkey Service) and streamlining online checkout by eliminating manual entry (through Click to Pay and Secure Card on File). We aim to improve the effectiveness of those transactions by increasing the number of transactions we switch through our differentiated services, increasing approval rates by utilizing inputs from our network and lifting spend and activation rates through personalized campaigns and data-driven strategies.”

Annual report 2025A · The company itself

“Our Privacy by Design, Data by Design and AI Governance processes are designed to ensure we embed multiple layers of privacy, data protection and information security controls in all our products and services, keeping a clear focus on protecting customers’ and individuals’ data.”

Annual report 2025A · The company itself

“Security Solutions We offer products and services designed to safeguard the payments and digital ecosystem from fraud and cyber-attacks and to enhance security for payments across card and non-card rails. Our security solutions suite provides organizations with the ability to adapt to the dynamic and multifaceted nature of threats while maintaining continuity and confidence in their operations. This includes: •Prevention solutions designed to help customers establish and strengthen measures that keep systems, applications and data secure from potential security risks.”

Annual report 2025A · The company itself

“•Identification solutions designed to help banks and merchants verify identities and authenticate consumers during digital interactions like account openings, account access and money movements using identity data and identity signals, device intelligence, biometric technologies and behavioral user data assessments. Key 2025 Developments •In 2025, we launched Mastercard Threat Intelligence, which combines Mastercard’s payment expertise and global network visibility with Recorded Future’s leading cyber threat intelligence capabilities in order to prevent payment fraud by proactively detecting cyberattacks.”

Annual report 2025A · The company itself

“•In 2025, we announced Mastercard Account-to-Account Protect, a new solution designed to combine our fraud prevention technology with a new dispute resolution framework in order to safeguard consumers when making account-to-account payments. •In 2025, we launched Merchant Cloud, a unified platform designed to offer a single point of entry to cutting-edge payment services (including payment gateways, security solutions and data) to simplify and support commerce growth in the global acceptance ecosystem and deliver exceptional experiences for end users. •Detection solutions designed to both spot and take action to stop fraudulent behavior and cyber-attacks.”

Annual report 2025A · The company itself

“•Remediation solutions designed to facilitate the flow of information to ensure consumers have transparency of their transaction data, as well as solutions designed to communicate and remediate disputes related to either fraud or failures in delivery of services to consumers. •Business continuity solutions designed to enable uninterrupted commerce, fostering trust and reliability for both merchants and consumers. These solutions include Mastercard’s Stand-In processing, which is designed to ensure transaction continuity when a card issuer’s systems are unavailable.”

Annual report 2025A · The company itself

“Within our value-added services and solutions, we generate revenue primarily related to the following: •Security solutions •Consumer acquisition and engagement services •Business and market insights •Digital and authentication solutions •Processing and gateway •Other solutions (including ACH batch and real-time account-based payments and solutions, bill payments, cross-border services and open finance) See “Management’s Discussion and Analysis of Financial Condition and Results of Operations - Revenue” in Part II, Item 7 and Note 3 (Revenue) to the consolidated financial statements included in Part II, Item 8 for more detail about our revenue.”

Annual report 2025A · The company itself

“Furthermore, our information technology systems, and the systems of our customers, vendors, suppliers, and other third-party service providers, are subject to cyber-attacks or other security incidents including computer viruses or other malicious codes, phishing attacks, unauthorized access attempts, cyber extortion, business email compromise, deepfake or social engineering schemes, denial of service attacks, hacking, ransomware, or other cyberattacks attempting to exploit vulnerabilities. Cybercriminals have increasingly demonstrated advanced capabilities, such as use of zero-day vulnerabilities, and rapid integration of new technology such as generative artificial intelligence.”

Annual report 2025A · The company itself

“Security incidents and breaches have occurred from time to time and may occur in the future involving our systems, the systems of the parties with whom we communicate or collaborate (including franchisees) or the systems of third-party providers. Additionally, cybersecurity threats continue to become more sophisticated, including AI-enabled attacks and deepfake technology.”

Annual report 2025A · The company itself

“Cybersecurity, Data Security, Privacy, and AI: We are subject to many cybersecurity, privacy, and data protection laws that change frequently and have requirements that vary from jurisdiction to jurisdiction. Our efforts to comply with these laws complicate our operations and add to our costs.”

Annual report 2026A · The company itself

“Despite our physical, technical, and administrative security measures as well as third party risk management processes as discussed in “Cybersecurity” in Item 1C of Part I below, technology systems and operations of the Company and third parties, including our external service providers and vendors, with which we do business, have experienced cybersecurity incidents and are subject to future cyberattacks and cybersecurity incidents. Companies in the healthcare industry are increasingly targeted for cyberattacks.”

Annual report 2026A · The company itself

“The risk and efficacy of cyberattacks increases from time to time due to a variety of internal and external factors, including, but not limited to, the use by threat actors of sophisticated and rapidly evolving techniques, such as adversarial AI (which makes cyberattacks more likely and may make them more difficult to detect, contain, or mitigate), and the existence of political or military unrest. Our own adoption and use of AI also may create new attack surfaces or methods and generally increase cybersecurity and data protection risks and costs.”

Annual report 2026A · The company itself

“Data Privacy and Security Laws and Regulations As a business with a significant global footprint, compliance with evolving regulations and standards in data privacy and cybersecurity has resulted, and may continue to result, in increased costs, new compliance challenges, and the threat of increased regulatory enforcement activity. Our business relies on the secure electronic transmission, storage and hosting of sensitive information, including personal information, protected health information, financial information, intellectual property and other sensitive information related to our products and therapies, customers, patients, and workforce.”

Annual report 2026A · The company itself

“We rely on the proper function, security and availability of our information technology systems and data, as well as those of third parties throughout our global supply chain and our customer and payor base, to operate our business, and a breach, cyber-attack or other disruption to these systems or data could materially and adversely affect our business, results of operations, financial condition, cash flows, reputation or competitive position.”

Annual report 2026A · The company itself

“The techniques used to obtain unauthorized access to, or disrupt, information technology systems continue to evolve and may be further amplified by the use of AI and other emerging technologies by malicious actors. Like all organizations, we routinely experience attempted interference with the integrity of, and interruptions in, our technology systems via events such as cyber-attacks, malicious intrusions, or other breakdowns. The consequences of such an event could mean data breaches, interference with the integrity of our products and data, the compromising of our intellectual property or other proprietary information, operational disruptions, the need to implement manual processes or other temporary workarounds, or other significant disruptions.”

Annual report 2026A · The company itself

“Furthermore, we rely on third-party vendors to supply and/or support certain aspects of our information technology systems and resulting products, and customers and payors use information technology systems to process payments relating to our products and services. These third-party systems could also become vulnerable to cyber-attack, malicious intrusions, breakdowns, interference, or other significant disruptions, and may contain defects in design or manufacture or other problems that could result in system disruption or compromise the information security of our own systems. Cybersecurity incidents affecting third-party service providers, or systems on which we rely, may adversely impact our operations even if our own systems are not directly compromised.”

Annual report 2026A · The company itself

“The legislative and regulatory landscape for privacy and data protection continues to evolve and enforcement and litigation in this space continue to increase. In the U.S., the number of state privacy laws to which the Company is subject is increasing, with a particular focus on the regulation of consumer health data and sensitive personal information, often broadly defined.”

Annual report 2025A · The company itself

“The Data Security Program, established by the U.S. Department of Justice in 2025 in response to Executive Order 14117, introduced new restrictions on certain types of data sharing to prevent foreign adversaries from accessing bulk U.S. sensitive personal data and U.S. government-related data.”

Annual report 2025A · The company itself

“Table of Contents •Developments following regulatory approval or authorization may adversely affect sales of the Company’s products. •The Company is subject to a variety of U.S. and international laws and regulations. •The Company is subject to evolving and complex tax laws, which may result in additional liabilities that may affect results of operations and financial condition. •Adverse outcomes in current or future legal matters could negatively affect the Company’s business. •Product liability insurance for products may be limited, cost prohibitive or unavailable. •The Company is increasingly dependent on sophisticated software applications and computing infrastructure, including the use of cloud-based applications and environments. The Company continues to be a target of cyber-attacks that could lead to a disruption of its worldwide operations, including manufacturing, research and sales operations.”

Annual report 2025A · The company itself

“Furthermore, the deployment of AI systems could expose the Company to increased cybersecurity threats, such as data breaches and unauthorized access leading to financial losses, legal liabilities, and reputational damage. The Company also faces competitive risks if it fails to adopt AI or other machine learning technologies in a timely fashion.”

Annual report 2025A · The company itself

“Customers may use our products and/or software to generate or manage critical information. Though we take steps to ensure our products and/or software are secure, it is possible that a cyber attack could result in the loss or compromise of critical information. If a customer alleges that a cyber attack causes or contributes to a loss or compromise of critical information, whether or not caused by us, we could face harm to our reputation and financial condition.”

Annual report 2025A · The company itself

“In addition, regulatory or legislative action related to cybersecurity, privacy, and data protection worldwide, such as the European General Data Protection Regulation, increases the costs to develop, implement, or secure our products or services. We expect cybersecurity regulations to continue to evolve and be costly to implement. If we violate or fail to comply with such regulatory or legislative requirements, we could be fined or otherwise sanctioned, and such fines or penalties could have a material adverse effect on our business and operations.”

Annual report 2025A · The company itself

“The failure to maintain the integrity of our information and other systems or customer information could result in damage to our reputation, subject us to fines, payment of damages, lawsuits and restrictions on our use of data, and have a material adverse effect on our business, financial condition, and results of operations. We collect and process information relating to our employees, guests, and others for various business purposes, including marketing and promotional purposes. The collection and use of personal data are governed by privacy laws and regulations enacted by the various states, the United States and other jurisdictions around the world.”

Annual report 2025A · The company itself

“In addition, non-compliance with applicable privacy laws and regulations by us (or in some circumstances non-compliance by third parties engaged by us), including accidental loss, inadvertent disclosure, unapproved dissemination or a breach of security on systems storing our customer data can result in damage to our reputation, subject us to investigations, fines, payment of damages, lawsuits or restrictions on our use or transfer of data, and have a material adverse effect on our business, financial condition, results of operations, and cash flows.”

Annual report 2025A · The company itself

“To be awarded new contracts after November 10, 2025 for the U.S. government, we may be required to meet a CMMC level that we may not meet, or may choose not to meet. Over time, more government contracts may require higher Cybersecurity Maturity Model requirements and if we do not meet them, we will become ineligible for certain contracts.”

Annual report 2026A · The company itself

“Over time, failure to comply with CMMC requirements required by the U.S. Department of War and its prime customers may make us ineligible for government contracts.”

Annual report 2026A · The company itself

“New technology trends, such as cyber resiliency and security requirements and the rapid adoption of AI, require us, and our customers and suppliers, to keep pace with evolving regulations and industry standards. In the U.S., the EU, and China, there are various current and proposed regulatory frameworks relating to cybersecurity, AI development, and the deployment of automation and AI in products, services and operations, including the EU AI Act, China’s generative AI regulations, and various current or proposed U.S. federal and state AI and/or cybersecurity legislative or governance frameworks, executive orders, rules, regulations and laws.”

Annual report 2026A · The company itself

“New and evolving laws and regulations relating to cybersecurity, data privacy, digital products, and AI impose requirements for information confidentiality, integrity, availability, personal and proprietary data collection, storage, use, sharing, deletion, and AI systems to be appropriately transparent, fair, secure, responsibly deployed, and accountable. Along with these laws and regulations, standards and market expectations could cause us to incur additional direct costs for compliance, as well as increased indirect costs resulting from our customers, suppliers, or partners reluctance to share information or solutions due to actual or perceived inadequate controls. As a result of these considerations, we could experience a reduction of production or sales of our products; remediation costs and activities; increased compliance costs; regulatory penalties, fines, civil or criminal sanctions, and other legal liabilities; and reputational challenges.”

Annual report 2025A · The company itself

“Threat actors also utilize emerging technologies such as AI and machine learning to, among other things, increase the speed and scale of attacks by generating and refining malicious content and code, automate reconnaissance and targeting, accelerate their ability to detect or exploit vulnerabilities, and rapidly iterate on attack techniques, which can broaden the scope, intensity, and sophistication of campaigns and reduce the time we have to identify and mitigate emerging threats.”

Annual report 2026A · The company itself

“Increasing use of AI, including models, algorithms, copilots, and autonomous or semi-autonomous agents, in our internal or third-party systems may create new attack surfaces or methods for adversaries. Our business policies and internal security controls may not keep pace with emerging threats or the evolving regulatory landscape.”

Annual report 2026A · The company itself

“PART I Item 1A • Cybersecurity: Legislative and regulatory actions related to cybersecurity may increase the costs associated with developing, implementing, or securing our products and services. The legal and regulatory environment in this area is complex and continues to evolve across multiple jurisdictions. As a result, there is considerable uncertainty regarding both current and future compliance obligations.”

Annual report 2026A · The company itself

“Public scrutiny of our decisions regarding user privacy, data practices, content, or development and deployment of AI. • Data security breaches, cybersecurity incidents, responsible AI failures, compliance failures, or actions of partners or individual employees.”

Annual report 2026A · The company itself

“The Ambitions That Drive Us To achieve our vision, our research and development efforts focus on three interconnected ambitions: • Reinvent productivity and business processes to help organizations and individuals work and collaborate more securely and efficiently. • Build the intelligent cloud and intelligent edge platform to provide a foundation for our customers’ digital workloads, including hybrid consistency, developer productivity, data and AI capabilities, and trusted security and compliance. • Create more personal computing experiences that empower people to play, create, and interact with technology in more intuitive, engaging, and dynamic ways.”

Annual report 2026A · The company itself

“We develop and support a broad portfolio of technology solutions for individuals and businesses, focusing on secure, trusted, and innovative platforms and applications that meet evolving customer needs across AI, cloud computing, productivity and collaboration, and personal computing.”

Annual report 2026A · The company itself

“What We Offer Founded in 1975, we develop and support software, services, devices, and solutions that deliver new value for customers and help people and businesses realize their full potential. We offer an array of services, including cloud-based solutions that provide customers with AI, software, services, platforms, and content, and we provide solution support and consulting services.”

Annual report 2026A · The company itself

“We rely on information technology systems in our operations, and any breach or security failure of those systems could materially adversely affect our business, financial condition, results of operations and reputation.”

Annual report 2025A · The company itself

“Såväl bolagets som bolagets konsulter och samarbetspartners IT-system är utsatta för risken att utsättas för datavirus, obehöriga intrång, naturkatastrofer, terrorism, krig och sammanbrott i telekommunikations- eller elnätet. Sådana händelser skulle kunna orsaka störningar i bolagets verksamhet, såsom förlust av data från framtida kliniska studier avseende bolagets produktkandidater. Läckage av oregistrerbara immateriella rättigheter kan försämra Bolagets marknadsposition, vilket kan föranleda en lägre marknadsandel för Bolaget och därmed att försäljningen minskar.”

Annual report 2024A · The company itself

“Cybersecurity incidents impacting our information systems and violations of data privacy laws and regulations could disrupt our business operations and adversely impact our reputation and results of operations. Our information systems may be the target of cyberattacks or other security breaches, which, if successful, could, among other things, disrupt our operations, applications or services, cause the loss of key business, employee, customer or vendor information, cause us to breach our legal, regulatory or contractual obligations, prevent us from accessing or relying upon critical business records, cause reputational damage, or impact the costs or ability to obtain adequate insurance coverage.”

Annual report 2025A · The company itself

“Additionally, our implementation of the ERP system involves greater utilization of third-party cloud computing services in connection with our business operations. Problems faced by us or our third-party cloud computing providers, including technological or business-related disruptions, as well as cybersecurity threats, could adversely impact our business, results of operations and financial condition for future periods.”

Annual report 2025A · The company itself

“IT-säkerhet och cyberrisker Momentum Group måste upprätthålla en välfungerande IT-infrastruktur för att säkerställa kontinuitet och förbättra effektiviteten i verksamheten. Brister i cybersäkerhet kan exempelvis föranleda oförutsedda och otillåtna intrång i koncernens interna IT-miljöer, i leverantörs och distributörskedjan och/eller i Momentum Group-koncernens uppkopplade produkter. Information om produkter, avtal, försäljningspriser och kostnader utgör känslig information som skulle kunna vara föremål för cyberhot. Momentum Group är främst exponerat för attacker med skadliga program och utpressningstrojaner, men cyberrelaterade risker kan också uppkomma genom förlust av information till följd av otillräckliga eller felaktiga interna processer, avbrott eller tekniska fel, mänskliga fel eller naturkatastrofer.”

Annual report 2024A · The company itself

“Cybersecurity risks, data protection or privacy breaches, cyberattacks, systems integration issues and unauthorized use of AI tools could disrupt our internal operations and/or harm our reputation, and any such disruption or harm could cause a reduction in our expected revenue, increase our expenses, negatively impact our results of operation or otherwise adversely affect our stock price.”

Annual report 2025A · The company itself

“Remote working arrangements, current and potential global conflicts, and AI-powered cybersecurity threats have also heightened our potential exposure to cyberattacks, which could put the data we store on our internal or third-party systems at risk.”

Annual report 2025A · The company itself

“Maintaining security of information on our and third-party networks and the protection features of the solutions and services we use are both critical to our operations and business strategy. We devote significant resources to network security, data encryption, and other security measures to protect the systems and data.”

Annual report 2025A · The company itself

“Table of Contents Cybersecurity incidents could lead to disruptions in or loss of access to our data or business systems; an inability to process customer orders or lost customer orders; unauthorized release of confidential, proprietary or otherwise protected information belonging to us or our employees, customers, consumers, partners, suppliers, or other third party service providers; lost revenues or other costs due to office, plant, production, warehouse or other facility disruption or shutdown; additional expenses, including the cost of remediating incidents or improving security measures, increased insurance costs, or ransomware payments; and corruption or destruction of data.”

Annual report 2025A · The company itself

“These third-party service providers and partners, with whom we may share data and operational systems, have, and could in the future, experience cybersecurity incidents.”

Annual report 2025A · The company itself

“Technology Risks The Company Is Exposed to Risks Related to Cybersecurity and Protection of Confidential Information.”

Annual report 2025A · The company itself

“The risks the Company faces range from cyber-attacks common to most industries, to more advanced threats that target the Company because of its prominence in the global marketplace, or due to its ratings of sovereign debt and corporate issuers.”

Annual report 2025A · The company itself

“The Company and its third-party service providers, including our vendors, regularly experience cyber-attacks and data breaches of varying degrees.”

Annual report 2025A · The company itself

“Cyber-attacks targeting Moody’s or Moody’s vendors’ technology and systems, whether from circumvention of security systems, exploitation of security vulnerabilities, denial-of-service attacks, ransomware, malware, hacking, social engineering or "phishing" attacks, deepfake attacks, computer viruses, employee or insider threats, malfeasance, supply chain attacks, physical breaches, vendor email compromise, payment fraud or other cyber-attacks some of which may be carried out by state-sponsored actors, may result in unauthorized access, exfiltration, manipulation, encryption or corruption of sensitive data, material interruptions or malfunctions in the Company’s or such vendors’ web sites or systems, applications, data processing, or disruption of other business operations.”

Annual report 2025A · The company itself

“In addition, certain aspects of the Company’s business rely on a concentrated group of vendors, and a cybersecurity breach or event and/or an error caused by one or more of such vendors could have a significant impact on the Company’s operations, as well as the operations of the Company's customers and other Third-Party Technology.”

Annual report 2025A · The company itself

“Cyber and Information Security Risk Management and Protection of Client Information The financial services industry faces increased global regulatory focus regarding cyber and information security risk management practices. Many aspects of our businesses are subject to cybersecurity legal, regulatory and disclosure requirements enacted by U.S. federal and state governments and other non-U.S. jurisdictions.”

Annual report 2025A · The company itself

“A cyberattack, information or security breach or a technology failure of ours or a third party could adversely affect our ability to conduct our business or manage our exposure to risk, or result in disclosure or misuse of personal, confidential or proprietary information and otherwise adversely impact our results of operations, liquidity and financial condition, as well as cause reputational harm. Cybersecurity risks for financial institutions have significantly increased in recent years, in part because of the proliferation of new technologies; the use of the internet, mobile telecommunications and cloud technologies to conduct financial transactions; the use of artificial intelligence and the emergence of quantum computing; and the increased sophistication and activities of organized crime, hackers, terrorists, nation-states, state-sponsored actors and other parties.”

Annual report 2025A · The company itself

“Any of these parties may also attempt to fraudulently induce employees, customers, clients, vendors or other third parties or users of our systems to disclose sensitive information in order to gain access to our networks, systems or data or those of our employees or clients, and such parties may see their effectiveness enhanced by the use of advanced systems, such as artificial intelligence. Global events and geopolitical instability have also led to increased nation-state targeting of financial institutions in the U.S. and abroad.”

Annual report 2025A · The company itself

“For example, human error has led to the loss of the Firm's physical data-bearing devices in the past.”

Annual report 2025A · The company itself

“Like other financial services firms, the Firm, its third-party providers and its clients continue to be the subject of unauthorized access attacks; mishandling, loss, theft or misuse of information; computer viruses or malware; cyberattacks designed to obtain confidential information, destroy data, disrupt or degrade service, sabotage systems or networks, impede our ability to execute or confirm settlement of transactions or cause other damage; ransomware; denial of service attacks; data breaches; social engineering attacks; phishing attacks; and other events. There can be no assurance that such unauthorized access, mishandling or misuse of information, or cybersecurity incidents will not occur in the future and they could occur more frequently and on a more significant scale.”

Annual report 2025A · The company itself

“Cybersecurity Risk management and strategy We, our businesses, and the broader financial services industry face an increasingly complex and evolving threat environment. We have made and continue to make substantial investments in cybersecurity and fraud prevention technology, and employ experienced talent to lead our Cybersecurity and Information Security organizations and program under the oversight of the Board and the BOTC.”

Annual report 2025A · The company itself

“Our processes are designed to help oversee, identify and mitigate cybersecurity risks associated with our use of third-party vendors. We maintain a third-party risk management program that evaluates and responds to cybersecurity risks at our third-party vendors.”

Annual report 2025A · The company itself

“Cyberattacks could disrupt our operations and have a material adverse impact on our business. We utilize and rely upon information technology systems in many aspects of our business, including internal and external communications and the management of our accounting, financial, production and supply chain functions. As we become more dependent on information technologies to conduct our operations, and as the number and sophistication of cyberattacks 30 Table of Content increase, the risks associated with cybersecurity increase.”

Annual report 2025A · The company itself

“Ökande digitalisering påverkar all verksamhet, både internt och i relationen till kunder och partners i värdekedjan. Integrerade lösningar, avancerad uppkoppling och hög cybersäkerhet blir allt viktigare.”

Annual report 2024A · The company itself

“Risktyp Beskrivning Hantering S P IT-funktionalitet Störningar i vårt IT-systems funktioner, som avbrott, eller att IT-systemen inte uppfyller relevanta integrationskrav från kunder, kan ha en väsentlig negativ påverkan på verksamheten. För att möta krav på tillgänglighet och funktionalitet från kunder, såväl som från den egna organisationen, övervakas och uppgraderas våra IT-system ständigt, dels internt, dels genom samarbete med externa specialister.”

Annual report 2024A · The company itself

“Customer demand continues to be influenced by cloud adoption, digital transformation initiatives, cybersecurity requirements, and increasing use of artificial intelligence and data-driven applications, driving significant changes in storage architectures and solution requirements. The emergence of artificial intelligence workloads has introduced additional competitive dynamics, particularly in areas related to data readiness, performance, scalability, and integration with compute and cloud ecosystems.”

Annual report 2026A · The company itself

“In response to evolving and increasing security threats, the U.S. government has imposed, and may impose in the future, requirements relating to product security, supply chain security, and cyber/information security that have impacted, and may in the future impact NetApp. Failure to meet these requirements as they apply to us and our products may result in delays or inability to sell our products to government entities.”

Annual report 2026A · The company itself

“In addition, in the EU, various cyber resilience related laws (for example, the EU Cyber Resilience Act and the Network and Information Systems Directive 2) have been enacted and will be applied in phases. These frameworks essentially oblige those doing business in the EU to implement robust cybersecurity standards with respect to the products and services they provide.”

Annual report 2026A · The company itself

“It is critical to our business strategy that our infrastructure, products, and services remain secure and are perceived as secure by customers, and partners.”

Annual report 2026A · The company itself

“Enabling Resilient and Secure Operations: As cyber threats and regulatory requirements intensify, NetApp’s integrated security and data protection capabilities have become essential for enterprises worldwide. Our solutions offer robust ransomware protection, automated data backup and recovery, disaster recovery, and comprehensive governance features. We continue to innovate in cyber resilience, helping customers safeguard their most valuable digital assets and maintain business continuity.”

Annual report 2026A · The company itself

“Data management software NetApp ONTAP software is our foundational technology that underpins NetApp’s critical storage solutions in the on-premises data center and in private and public clouds. ONTAP includes various data management and protection features and capabilities, including autonomous ransomware detection to protect against cyber-attacks, built-in data transport features, and storage efficiency capabilities.”

Annual report 2026A · The company itself

“VERÁ is an AI-enabled platform providing real-time awareness, prediction, and response to hybrid threats”

Annual report 2025A · The company itself

“Key operational risks (continued) Data protection and privacy Given the nature of the solutions that Netcompany provides to governments, financial institutions, and large enterprises around Europe, the exposure to risks related to breach of personal data is inherently high. Such breaches are regulated by the GDPR rules, and if not managed appropriately, Netcompany could become liable for significant fines that immediately impact the financial results and even more so if such events lead to a general loss of trust and faith in Netcompany’s ability to handle personal data in accordance with the GDPR rules.”

Annual report 2025A · The company itself

“The threat level under which Netcompany operates is ever-increasing. As a gross risk, “Cyber risks” is one of our highest-scored risks applying to both our own operations, and to key suppliers that we rely on to deliver our services.”

Annual report 2025A · The company itself

“We protect employee personal data through preventative and responsive measures to maintain trust, comply with legal obligations, and uphold privacy rights.”

Annual report 2025A · The company itself

“All employees complete mandatory privacy and security awareness training during onboarding and at regular intervals. This ensures an understanding of personal data handling responsibilities and fosters a culture of privacy and accountability.”

Annual report 2025A · The company itself

“Our HR systems follow privacy-by-design principles, using data minimisation and encryption. Employees can view and update their information through secure self-service portals, providing transparency and control over their data.”

Annual report 2025A · The company itself

“Access to sensitive employee information is controlled through role-based access rights in HR and IT systems. Regular audits review these rights to prevent unauthorised use or accidental data exposure.”

Annual report 2025A · The company itself

“Risks Related to Information Technology Any significant disruption in or unauthorized access to our computer systems or those of third parties that we utilize in our operations, including those relating to cybersecurity or arising from cyber-attacks, could result in a loss or degradation of service, unauthorized access, disclosure or destruction of data, including member and corporate information, or theft of intellectual property, including digital content assets, which could adversely impact our business.”

Annual report 2025A · The company itself

“Our computer systems and those of third parties we use in our operations are subject to constantly evolving cybersecurity threats, including cyber-attacks such as computer viruses, malware, ransomware, denial of service attacks, physical or electronic break-ins, or insider threats, as well as misconfigurations in information systems, networks, software or hardware, and similar disruptions or errors. These systems and those of third parties with which we do business have experienced and may continue to experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information or intellectual property.”

Annual report 2025A · The company itself

“We and many of the third parties we work with rely on open source software and libraries that are integrated into a variety of applications, tools and systems, which may increase our exposure to vulnerabilities. The addition of new features or upgrades also increases our exposure to vulnerabilities, and generative AI could intensify these cybersecurity risks.”

Annual report 2025A · The company itself

“The use of and reliance on AI may present certain risks such as, but not limited to, AI tools may malfunction, produce inaccurate or biased outputs, or behave unpredictably, and introduce NEE and FPL to additional cybersecurity threats and data privacy risks. In addition, as NEE and FPL rely on third-party vendors for certain AI tools, platforms and collaborations, NEE and FPL could experience third-party vendor issues such as disruptions in vendor relationships, performance issues, cybersecurity threats or disputes over intellectual property rights.”

Annual report 2025A · The company itself

“NEE and FPL operate in a highly regulated industry that requires the continuous functioning of sophisticated information technology systems and network infrastructure. Despite NEE's and FPL's implementation of security measures, all of their technology systems are vulnerable to disability, failures or unauthorized access. If NEE's or FPL's information technology systems were to fail or be breached, sensitive, confidential and other data could be compromised and NEE and FPL could be unable to fulfill critical business functions.”

Annual report 2025A · The company itself

“Table of Contents NEE's and FPL's retail businesses are subject to the risk that sensitive customer data may be compromised, which could result in a material adverse impact to their reputation and/or have a material adverse effect on the business, financial condition, results of operations and prospects of NEE and FPL. NEE's and FPL's retail businesses require access to sensitive customer data in the ordinary course of business.”

Annual report 2025A · The company itself

“NEE's and FPL's nuclear generation facilities are subject to environmental, health and financial risks, including, but not limited to, those relating to site storage of spent nuclear fuel, the disposition of spent nuclear fuel, leakage and emissions of tritium and other radioactive elements in the event of a nuclear accident or otherwise, the threat of a terrorist attack or cyber incident and other potential liabilities arising out of the ownership or operation of the facilities.”

Annual report 2025A · The company itself

“Attacks have become more targeted, coordinated, and technically advanced, underscoring the need for continuous improvement in NNIT’s detection, prevention, and response capabilities. This heightened focus ensures NNIT remains resilient and capable of safeguarding client and internal systems against evolving threats.”

Annual report 2025A · The company itself

“There is a risk that released products have security vulnerabilities, and that Nordic does not meet all customers’ expectations with regards to their preferred mitigating measures (which may vary from application to application). Although Nordic certifies products in accordance with security industry standards, there is a risk of loss of reputation and recognition due to cyberattacks in end products.”

Annual report 2024A · The company itself

“Product security and end-user data protection risks This risk is concentrated in our downstream value chain, where our IoT solutions are integrated into devices processing sensitive user data. Our business model of providing connectivity solutions for applications like health monitoring, smart homes, and industrial control systems makes product security and data protection a systemic risk across our global markets.”

Annual report 2024A · The company itself

“The current financial effects of this material risk include continued investments in security certifications and vulnerability management systems. In the short term (within 12 months), we anticipate additional expenditure for implementing a new vulnerability tracking system and security training modules.”

Annual report 2024A · The company itself

“Material impacts and associated risks Cybersecurity risks across the value chain Nordic’s position as a semiconductor design company handling sensitive intellectual property creates inherent cybersecurity vulnerabilities that directly affect our business model and stakeholders.”

Annual report 2024A · The company itself

“Given our position as a semiconductor design company handling sensitive intellectual property, information security is critical to our business conduct. Our Information Security Policy, ISMS Secure Development Policy, and Quality Policy protect confidential information and technical data exchanged with manufacturing partners and customers.”

Annual report 2024A · The company itself

“TECHNOLOGY RISKS A significant cybersecurity incident or other disruption to our technology infrastructure resulting from internal and external threats could disrupt our business operations. To conduct business, we extensively rely on information and operational technology systems. The threat landscape is vast, with potential attacks from cybercriminals, nation-states, state-sponsored actors and others including, but not limited to, service denials, unauthorized access, compromised equipment or rolling stock, extortion, or theft of data or money.”

Annual report 2025A · The company itself

“Bekey leverer og servicerer digitale adgangssystemer til aflåste opgangsdøre og private hjem i Danmark og Norge”

Annual report 2025A · The company itself

“Hovedparten af koncernens aktiviteter er baserede på eller afhængige af IT-systemer, der er forbundet med internettet, og dermed udgør cybertrusler en risiko. Hvis kritiske systemer bliver utilgængelige i længere tid, vil det kunne medføre tab af kunder, og at virksomhedens omdømme lider skade. Utilsigtede fejl eller cyberangreb kan medføre, at koncernen mister personoplysninger, og at fortrolig information bliver stjålet eller kompromitteret. Dette kan resultere i bøder, tab af kunder, og at virksomhedens omdømme lider skade.”

Annual report 2025A · The company itself

“DATA PRIVACY AND SECURITY Federal law establishes a minimum federal standard of financial privacy by, among other provisions, requiring financial institutions to adopt, disclose, and enforce privacy policies with respect to consumer information, setting limitations on disclosure to third parties of consumer information, setting standards for protecting client information and preventing unlawful access to such information, and requiring notice of data breaches in certain circumstances. For example, the Federal Trade Commission has the authority to regulate and enforce against unfair or deceptive acts or practices in or affecting commerce, including acts and practices with respect to data privacy and security, and the Gramm-Leach-Bliley Act regulates the confidentiality and security of customer information obtained by financial institutions and certain other types of financial services businesses.”

Annual report 2025A · The company itself

“Most U.S. states, the EU and other non-U.S. jurisdictions also have adopted their own statutes and/or regulations concerning data privacy and security and requiring notification of data breaches―for example, the General Data Protection Regulation (GDPR) in Europe and its equivalent in the UK (UK GDPR), the Personal Information Protection Law (PIPL) in China, and the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, CCPA) in the United States. Similar laws are in effect or being implemented in other jurisdictions in which we operate across the globe.”

Annual report 2025A · The company itself

“In the United States, the CCPA broadly defines personal information and substantially increases the rights of California residents to understand how their personal information is collected, used, and otherwise processed by commercial businesses, such as affording them the right to access and request deletion of their information and to opt out of certain sharing and sales of personal information. The CCPA includes a private right of action (permitting lawsuits to be brought by private individuals instead of the state Attorney General or other government actor for certain breaches), and contemplates civil penalties of up to $2,500 for each violation and up to $7,500 for each intentional violation.”

Annual report 2025A · The company itself

“Any failure or perceived failure by us to comply with our privacy policies, or applicable data privacy and security laws, regulations, rules, standards or contractual obligations, or any compromise of security that results in unauthorized access to, or unauthorized loss, destruction, use, modification, acquisition, disclosure, release or transfer of personal information, may result in requirements to modify or cease certain operations or practices, the expenditure of substantial costs, time and other resources, proceedings or actions against us, legal liability, governmental investigations, enforcement actions, claims, fines, judgments, awards, penalties, sanctions and costly litigation (including class actions).”

Annual report 2025A · The company itself

“Despite internal policies in place with respect to the usage of AI, if any of our employees or service providers were to use any third-party AI-powered software in connection with our business or the services they provide to us, it may lead to the inadvertent disclosure or incorporation of our confidential information into publicly available training set, which may impact our ability to realize the benefit of, or adequately maintain, protect and enforce our intellectual property or confidential information, harming our competitive position and business.”

Annual report 2025A · The company itself

“Technology and Cyber Risk Oversight The Technology and Cyber Risk Management function provides oversight to the identification, assessment, measurement, monitoring, and reporting on technology and cyber risk matters. Technology and cyber risk is best managed at the source of the risk, and is mitigated through internal controls and risk management designed to identify, understand, and keep such risk at levels consistent with the organization’s overall risk appetite while also managing the inherent risk in supporting the organization’s growth and client preferences for interacting with technology.”

Annual report 2025A · The company itself

“New laws or other requirements, or changes to existing ones (including, for example, related to cybersecurity, information and data protection, cost accounting, environment, sustainability, securities, competition, compensation costs, employment, taxes, counterfeit parts, pensions, use of certain non-US equipment or acquisitions more broadly), can significantly increase our costs (including compliance costs) and risks, create operational challenges, potentially limit our ability to return cash to shareholders, reduce our profitability and/or adversely affect our competitiveness.”

Annual report 2025A · The company itself

“We face significant cyber and other security threats. They include, among other things, attempts to gain unauthorized access to sensitive information or otherwise compromise the integrity, confidentiality and/or availability of our systems, hardware and networks, and the information on them, insider threats, ransomware, threats to the safety of our directors, officers and employees, threats to our facilities, infrastructure, products (we produce and use), and subcontractors or other suppliers (referred to inclusively as suppliers), and threats from terrorist acts, espionage, civil unrest and other acts of aggression. We are also subject to increasing government, customer and other cyber and security requirements, including disclosure obligations.”

Annual report 2025A · The company itself

“Cyber threats, both on premises and in the cloud, are complex, continuous and evolving and include, but are not limited to: malicious software, destructive malware, ransomware, targeting by more advanced and persistent adversaries, including nation states and other actors, zero-day attacks, attempts to gain unauthorized access to systems or data, disruption to operations, critical systems or denial of service attacks, unauthorized release of confidential, personal or other protected information (ours or that of our employees, customers or partners), corruption of data, networks or systems, harm to individuals, and loss of assets. We have been and could be impacted by cyber threats or other disruptions or vulnerabilities found in products or services we use or in our internal, partners’ or customers’ systems that are used in connection with our business. Further, artificial intelligence techniques to automate and enhance cyber attacks pose an evolving and increased level of risk to our information systems.”

Annual report 2025A · The company itself

“We have experienced cyber attacks and, due to the evolving threat landscape, expect we will continue to experience additional attacks in the future. The various measures and controls we have implemented to monitor and mitigate risks associated with these threats and to increase the cyber resiliency of our infrastructure and products may not always be sufficient or fully effective, particularly against previously unknown vulnerabilities, including those that could go undetected for an extended period, which may inhibit our ability to provide prompt, full, and reliable information about such incidents to our customers, regulators, and the public.”

Annual report 2025A · The company itself

“Cyber events have caused and could cause us harm and require us to undertake remedial actions. Successful attacks can lead to losses or misuse of sensitive information or capabilities, theft or corruption of data, harm to personnel, infrastructure or products, protracted disruptions in our operations and performance, and the misuse of our products. They can also damage our reputation, impact our ability to obtain adequate insurance coverage, and lead to loss of business, regulatory actions, and costs, liabilities or other financial losses for which we may not have adequate sources of recovery.”

Annual report 2025A · The company itself

“Table of Contents NORTHROP GRUMMAN CORPORATION Our customers, suppliers and partners to whom we entrust confidential data, and on whom we rely to provide products and services, face similar threats and growing requirements. We depend on our customers, suppliers, and other business partners to implement and verify adequate controls and safeguards to protect against and report cyber incidents. When they fail to deter, detect, remediate or report cyber incidents in a timely manner, or fail to implement applicable requirements, we suffer, and may in the future suffer, financial and other harm, including to our information, operations, performance, employees and reputation.”

Annual report 2025A · The company itself

“We also face increasing and evolving disclosure obligations related to cybersecurity events and the risk of failing to meet all our existing or future disclosure obligations and/or having our disclosures misinterpreted. National security or public safety considerations may also affect, delay or in limited instances prevent, our public disclosure of a cybersecurity incident.”

Annual report 2025A · The company itself

“In the event of misuse, theft or misappropriation of such intellectual property rights or breach of confidentiality obligations, we may not have -19- Table of Contents NORTHROP GRUMMAN CORPORATION adequate legal remedies. In addition, our trade secrets or other proprietary information may otherwise become known or be independently developed by competitors.”

Annual report 2025A · The company itself

“Table of Contents NORTHROP GRUMMAN CORPORATION MISSION SYSTEMS Mission Systems is a leader in advanced mission solutions and multifunction systems, primarily for the U.S. defense and intelligence community, and international customers. Major products and services include radar, electro-optical/infrared (EO/IR) and acoustic sensors; command, control, communications and computers, intelligence, surveillance and reconnaissance (C4ISR) systems; electronic warfare systems; advanced communications and network systems; advanced microelectronics; navigation and positioning sensors; maritime power, propulsion and payload launch systems; full spectrum cyber solutions; and intelligence processing systems.”

Annual report 2025A · The company itself

“Tillverkare riskerar böta 100 000 kronor per minut – NIS2 måste prioriteras EN ÖKAD HOTBILD OCH RISK FÖR STORA FÖRLUSTER Idag innebär ett stillestånd en enorm förlust för tillverkande företag. Forbes uppskattar att en större organisation kan förlora runt 100 000 kronor per minut och upptill 50 miljoner på en timme – utan att ha räknat in varken böter eller straffavgifter*. Samtidigt så fortsätter riktade cyberattacker att öka och bara under de senaste åren har allt fler välkända företag utsatts för ransomeware-attacker.”

Annual report 2024A · The company itself

“LEDARE INOM INDUSTRIN TVINGAS PRIORITERA För att uppfylla NIS2-kraven måste tillverkande företag vidta flera viktiga åtgärder för att stärka sina cybersäkerhetssystem och skydda sina kritiska OT-infrastrukturer (Operational Technology). Några exempel är: • Skapa en kultur av säkerhet och riskhantering, från fabriksgolv till ledning. • Implementera och följa upp säkerhetsstrategier. • En plan för hur incidenthantering ska hanteras och rapporteras. * https://www.forbes.com/councils/forbestechcouncil/2024/04/10/the-true-cost-of-downtime-and-how-to-avoid-it/ 12 Novotek års- och hållbarhetsredovisning Med ökade cyberhot och produktionsstillestånd som kan kosta miljoner så blir OT-säkerhet en avgörande fråga för tillverkande företag.”

Annual report 2024A · The company itself

“I samband med arbetet med förvärvsanalysen har immateriella tillgångar med ett verkligt värde identifierats enligt följande; teknologi i form av egenutvecklad produkt 6,6 Mkr, uppskjuten skatteskuld 2,1 Mkr och goodwill, 2,2 Mkr . Den goodwill som uppstod vid förvärvet motsvaras främst av de stora möjligheterna vi ser inom konsulting på cyber security och därmed personalstyrkan .”

Annual report 2024A · The company itself

“The operation of the Company's businesses is subject to advanced persistent cyber-based security threats and integrity risk.”

Annual report 2025A · The company itself

“As a result, NRG's information technology systems and infrastructure, and those of its vendors and suppliers, are vulnerable to cyber-based security threats which could compromise confidentiality, integrity or availability. While the Company has controls in place designed to protect its infrastructure, such breaches and threats are becoming increasingly sophisticated and complex, requiring continuing evolution and constant improvements in security programs and technology.”

Annual report 2025A · The company itself

“Furthermore, NRG’s operations can be additionally impaired by disruptions or security failures of third-party vendors and suppliers over which NRG lacks direct control or oversight.”

Annual report 2025A · The company itself

“General Risk Factors We are subject to information technology and cybersecurity threats which could have an adverse effect on our business and results of operations. We utilize various information technology systems to efficiently address business functions ranging from the operation of our production equipment to administrative computation to the storage of data such as intellectual property and proprietary business information.”

Annual report 2025A · The company itself

“Undiscovered vulnerabilities in our products or services could result in loss of data or intangible property, or expose our customers to unscrupulous third parties who develop and deploy malicious software programs that could attack our products or services.”

Annual report 2026A · The company itself

“Product, system security, and data protection incidents or breaches, as well as cyber-attacks, could disrupt our operations, reduce our expected revenue, increase our expenses, and significantly harm our business and reputation. Security breaches, computer malware, social-engineering attacks, denial-of-service attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, and other cyber-attacks are becoming increasingly sophisticated, making it more difficult to successfully detect, defend against them or implement adequate preventative measures.”

Annual report 2026A · The company itself

“We hold confidential, sensitive, personal and proprietary information, including information from partners and customers. Breaches of our security measures, along with reported or perceived vulnerabilities or unapproved dissemination of proprietary information or sensitive or confidential data about us or third parties, could expose us and the parties affected to a risk of loss, or misuse of this information, potentially resulting in litigation and subsequent liability, regulatory inquiries or actions, damage to our brand and reputation or other harm, including financial, to our business.”

Annual report 2026A · The company itself

“For example, we hold proprietary game source code from third-party partners in our GFN service. Breaches of our GFN security measures, which have happened in the past, could expose our partners to the risk of loss or misuse of this source code, damage both us and our partners, and expose NVIDIA to potential litigation and liability.”

Annual report 2026A · The company itself

“Concerns about our practices or the ultimate use of our products and services with regard to the collection, use, retention, security or disclosure of personal information or other privacy-related matters, including for use in AI, even if unfounded, could damage our reputation and adversely affect our operating results.”

Annual report 2026A · The company itself

“To defend against security incidents, we must continuously engineer more secure products and enhance security and reliability features, which is expected to result in increased expenses. We must also continue to develop our security measures, including training programs and security awareness initiatives, designed to ensure our suppliers have appropriate security measures in place, and continue to meet the evolving security requirements of our customers, applicable industry standards, and government regulations.”

Annual report 2026A · The company itself

“We and third parties regularly identify security vulnerabilities with respect to our products and services. The same holds for the operating systems and workloads that run on them and the components that interact with them. Components and Intellectual Property (IP) we purchase or license from third parties for use in our products, as well as industry-standard specifications we implement in our products, are also regularly subject to security vulnerabilities.”

Annual report 2025A · The company itself

“As a result, we are subject to environmental, data privacy, export controls and sanctions, AI technologies, cybersecurity, disclosure and reporting (including reporting of ESG-related data), labor and health and safety laws and regulations in each jurisdiction in which we operate.”

Annual report 2025A · The company itself

“In the current environment, there are numerous and evolving risks to cybersecurity and privacy, including criminal hackers, state-sponsored intrusions, industrial espionage, employee malfeasance, and human or technological error. Computer hackers and others routinely attempt to breach the security of technology products, services, and systems, and those of customers, suppliers, and some of those attempts may be successful. Such breaches could result in, for example, unauthorized access to, disclosure, misuse, loss, or destruction of our, our customer, or other third party data or systems, theft of sensitive or confidential data including personal information (including personal data about our employees, customers or other third parties) and intellectual property, system disruptions, and denial of service.”

Annual report 2025A · The company itself

“A breach of customer, supplier, Team Member, or Company information could damage our reputation or result in substantial additional costs or litigation. Our business involves the receiving, storage, and transmitting of certain personally identifiable or confidential information about our customers, suppliers, Team Members, and the Company, some of which is entrusted to third-party service providers and suppliers.”

Annual report 2025A · The company itself

“We believe that Oracle has been and is a target for computer hackers, cyberattacks and other perpetrators or threat actors because Oracle stores and processes large amounts of data, including sensitive data such as health sciences (including patient health information), financial services, retail, hospitality, telecommunications and government data. We and our third-party vendors are regularly subject to attacks by third parties (which may include individuals or groups of hackers and sophisticated organizations, such as state-sponsored organizations, nation-states and individuals sponsored by them) designed to identify and exploit product and service vulnerabilities, penetrate or bypass our security measures, and gain unauthorized access to our or our customers’, partners’ and suppliers’ software, hardware and cloud offerings, networks and systems.”

Annual report 2026A · The company itself

“When a cyberattack or other security event or incident results in unauthorized access to, or modification, loss, destruction or exfiltration of, our customers’ or suppliers’ data, other external data, our own data or our IT systems, or if the services we provide to our customers are disrupted, or if our products or services are reported to have (or are perceived as having) security vulnerabilities, we have incurred and may continue to incur significant expenses 24 Table of Contents and may suffer substantial damage to our brand and reputation. If our customers lose confidence in the security and reliability of our products and services, including our cloud offerings, they may reduce or terminate their spending with us.”

Annual report 2026A · The company itself

“Changes in government procurement policy, priorities, regulations, technology initiatives and/or requirements may negatively impact our potential for growth in the government sector. For example, the U.S. government imposes evolving cybersecurity requirements, including the FedRAMP authorization process and the Department of War (DoW) Cybersecurity Maturity Model Certification.”

Annual report 2026A · The company itself

“Our products operate in conjunction with and are dependent on a wide variety of third-party products, components and services. If a security vulnerability exists in one of these components, a targeted exploit could lead to increased costs, liability claims, customer dissatisfaction, reduced revenues, or harm to our reputation or competitive position, including as a result of business interruption, data loss or unauthorized access to, or disclosure of, data.”

Annual report 2026A · The company itself

“Cyber-attacks against critical areas of society are expected to increase in a heightened geopolitical environment.”

Annual report 2025A · The company itself

“Significant data breach to Orion’s or its service providers’ systems or databases breaches the data subjects rights and privacy. For Orion, it causes significant reputational damage, settlement work and related costs, non-compliance fees and jeopardises business continuity.”

Annual report 2025A · The company itself

“Orion maintains a robust trademark portfolio, which is actively enforced in key markets to protect Orion’s trademarks and product names and to prevent misuse. In parallel, Orion has implemented serialisation systems. Serialisation systems apply to products on the market’s where serialisation is required by the authorities.”

Annual report 2025A · The company itself

“Further, as we integrate emerging and rapidly evolving technologies, including AI, into our products and services, we face evolving risks related to safety, data governance, regulatory compliance and intellectual property and may not be able to anticipate or identify vulnerabilities, design flaws or security threats resulting from the use of such technology and develop adequate protection measures, which could lead to unintended consequences and significantly impact our business, reputation, and financial results.”

Annual report 2025A · The company itself

“Although we seek to protect such data and design our products to enable our customers to use them while complying with applicable data privacy and cybersecurity laws and/or customer-imposed controls, we have experienced cyberattacks. While these attacks have not to our knowledge had a material adverse impact on the Company to date, our internal systems and products may be vulnerable to further cyberattacks, security breaches, theft, programming errors or employee errors, which could lead to the compromise of confidential and sensitive data, unauthorized access, use, disclosure, modification or destruction of information, improper use of our systems, software solutions or networks, defective products, production downtimes and/or operational disruptions in violation of applicable law and/or contractual obligations.”

Annual report 2025A · The company itself

“Table of Contents In addition, our business may be impacted by disruptions to our own or third-party information technology ("IT") infrastructure, which could result from (among other causes) cyberattacks on or failures of such infrastructure or compromises to its physical security, as well as from damaging weather or other acts of nature. Cyber-based risks, in particular, are evolving and include attacks on our IT infrastructure, as well as attacks targeting the security, integrity and/or availability of the hardware, software and information installed, stored or transmitted in our products, including after the purchase of those products and when they are installed into third-party products, facilities or infrastructure.”

Annual report 2025A · The company itself

“For example, increased government spending on technology aimed at national defense, financial or policy regulation, cybersecurity, or healthcare mandates may drive customer demand at different times throughout our year, the timing of which we may not be able to anticipate and may cause fluctuations in our results of operations.”

Annual report 2025A · The company itself

“It is also possible that remote work arrangements may have a negative impact on our ability to recruit, train, manage, and retain employees; our operations; our information, data security and cybersecurity; consumer privacy and the risk of fraud; the execution of our business plans; our ability to maintain and strengthen our company culture; the 20 Table of Contents productivity and availability of key personnel and other employees necessary to conduct our business; and on third-party service providers who perform critical services for us, or otherwise cause operational failures due to changes in our normal business practices.”

Annual report 2025A · The company itself

“Our success depends in part on our ability to provide effective data security protection in connection with our technology platforms and services, and we rely on information technology networks and systems to securely store, transmit, index, and otherwise process electronic information. Because our platforms and services are used by our customers to store, transmit, index, or otherwise process and analyze large data sets that often contain proprietary, confidential, and/or sensitive information (including in some instances personal or identifying information, personal health information, government classified information, and other information subject to regulatory or statutory control or requirements), our software is perceived as an attractive target for attacks by computer hackers or others seeking unauthorized access, and our software faces threats of unintended exposure, exfiltration, alteration, deletion, loss, or unavailability of data.”

Annual report 2025A · The company itself

“Many governments have enacted laws requiring companies to provide notice of data security breaches or incidents involving certain types of data, including personal data. For example, the SEC adopted cybersecurity risk management and disclosure rules, which require the disclosure of information pertaining to cybersecurity incidents and cybersecurity risk management, strategy, and governance.”

Annual report 2025A · The company itself

“Privacy and Civil Liberties We are committed to ensuring that our software is as effective as possible while preserving individuals’ fundamental rights, including privacy and civil liberties. We have made deep investments to ensure that privacy, civil liberties, and other fundamental rights protections remain central to our software and business practices. Our platforms were built from the start to protect individual privacy and prevent the misuse of information.”

Annual report 2025A · The company itself

“Furthermore, our platforms are in many cases important or essential to our customers’ operations, including in some cases, their cybersecurity or oversight and compliance programs, and subject to service level agreements (“SLAs”). Any interruption in our service, whether as a result of an internal or third-party issue, could damage our brand and reputation, cause our customers to terminate or not renew their contracts with us or decrease use of our platforms and services, require us to indemnify our customers against certain losses, result in our issuing credit or paying penalties or fines, subject us to other losses or liabilities, cause our platforms to be perceived as unreliable or unsecure, and prevent us from gaining new or additional business from current or future customers, any of which could harm our business, financial condition, and results of operations.”

Annual report 2025A · The company itself

“If we do not accurately predict, prepare for, and respond promptly to rapidly evolving technological and market developments and successfully manage product and subscription introductions and transitions to meet changing end-customer needs in the enterprise security industry, our competitive position and prospects will be harmed. The enterprise security industry has grown quickly and continues to evolve rapidly.”

Annual report 2026A · The company itself

“Vulnerabilities within our AI systems may be identified by researchers or malicious actors before we detect or remediate them, which could result in security incidents, data privacy issues, reputational damage, or loss of customer confidence.”

Annual report 2026A · The company itself

“Defects, errors, or vulnerabilities in our products, subscriptions, or support offerings, the failure of our products or subscriptions to block a virus or prevent a security breach or incident, misuse of our products, or risks of product liability claims could harm our reputation and adversely impact our operating results. Because our products and subscriptions are complex, they have contained and may contain design or manufacturing defects, vulnerabilities, or errors that are not detected until after deployment.”

Annual report 2026A · The company itself

“For example, in May 2026, we became aware of an authentication bypass vulnerability in certain versions of our PAN-OS software and published a security advisory, provided software updates, and engaged in customer outreach, support, and remediation efforts.”

Annual report 2026A · The company itself

“Defects, errors, or a technical failure of our products may temporarily or permanently disable our end-customers’ networks, IT infrastructure, or other systems. Our products must interoperate with end-customers’ existing infrastructure, which often has varied specifications, multiple protocol standards, and products from multiple vendors.”

Annual report 2026A · The company itself

“The sale and support of our products and subscriptions also entails the risk of product liability claims.”

Annual report 2026A · The company itself

“Our shared responsibility security model relies on customers to configure and use our products securely, and customer errors could harm our reputation even when we are not at fault. We deliver certain of our products under a model in which we are responsible for the security of the underlying platform and infrastructure and our customers are responsible for configuring, deploying, patching, and using our products and configuring and implementing the security controls and posture within their environments.”

Annual report 2026A · The company itself

“A key element of our strategy is to help our customers simplify their security architectures through consolidating disparate point products. We execute on this strategy by developing our capabilities and packaging our offerings into platforms, which are able to cover many of our customers’ needs in the markets in which we operate. Our platformization strategy combines various products and services into a tightly integrated architecture for more secure, faster, and cost-effective outcomes.”

Annual report 2026A · The company itself

“RESEARCH AND DEVELOPMENT Our research and development efforts are strategically centered on expanding our leadership within the enterprise security industry through AI-powered innovation. We focus on enhancing our integrated platforms and developing new software and hardware capabilities. Our engineering teams apply deep expertise in AI and machine learning across networking security, cloud security, endpoint security, security operations, and identity security to address the rapidly evolving threat landscape.”

Annual report 2026A · The company itself

“(“Chronosphere”), a privately-held observability technology company, forming our next-generation observability platform; in February 2026, we completed the acquisition of CyberArk Software Ltd.”

Annual report 2026A · The company itself

“(“CyberArk”), an identity security company, forming our next-generation identity security platform; in April 2026, we completed the acquisition of Koi, a privately-held endpoint posture management company, which adds agentic endpoint security capabilities to our security operations platform and enhances Prisma® AIRS™; in May 2026, we completed the acquisition of Portkey, Inc.”

Annual report 2026A · The company itself

“Business General Palo Alto Networks, Inc. is a global artificial intelligence (“AI”) cybersecurity provider and our vision is a world where each day is safer and more secure than the one before.”

Annual report 2026A · The company itself

“Our platforms and services help secure enterprise users, networks, clouds, endpoints, AI apps and agents, and identities by delivering comprehensive cybersecurity backed by AI and automation, and provide real-time visibility and monitoring across cloud infrastructure, applications and AI workloads.”

Annual report 2026A · The company itself

“Network & AI Security Our Network & AI Security platform is designed to deliver complete zero trust solutions to our customers. The platform includes: •Secure Access Service Edge (“SASE”). Prisma® Access, when combined with Prisma SD-WAN, provides a comprehensive AI-powered SASE solution that secures users, branches, data, AI apps and agents from the most evasive threats in the new AI landscape. Our Prisma Browser™ further extends zero-trust security and data protection to the browser, where the majority of work is done today, providing users with the freedom to work securely using our secure browser from any device. •Next-Generation Firewalls.”

Annual report 2026A · The company itself

“•Cloud-Delivered Security Services (“CDSS”). Our network security platform integrates a suite of Precision AI powered security capabilities that complements our SASE and NGFW solutions. These include Advanced Threat Prevention, Advanced WildFire®, Advanced URL Filtering, Advanced DNS Security, Device Security, Quantum Security, Next-Gen Trust Protection (“NGTS”), GlobalProtect®, Prisma Access Agent, Enterprise Data Loss Prevention (“Enterprise DLP”), Software as a Service (“SaaS”) Security, and AI Access Security™.”

Annual report 2026A · The company itself

“Prisma AIRS™ is our comprehensive AI security platform designed to help organizations discover, assess, and protect AI agents, applications, models and data across the AI lifecycle. It supports key enterprise use cases, including securing AI-assisted software development, protecting custom AI applications from development through runtime, and governing autonomous AI agents. Prisma AIRS™ brings together AI Gateway, Agent Security, AI Red Teaming, AI Runtime Security™, AI Model Security, and AI Posture Management in a unified platform.”

Annual report 2026A · The company itself

“•Strata Cloud Manager (“SCM”). SCM is our AI-powered unified network security management and operations solution. It enables customers to manage and monitor their NGFW and SASE environments through a single, streamlined interface.”

Annual report 2026A · The company itself

“Cortex Our AI-powered Cortex® platform transforms end-to-end security operations and observability with unified data, AI, and automation for more secure, faster, and cost effective outcomes. •Security Operations. We deliver the next generation of security operations capabilities that unifies standalone Security Information and Event Management (“SIEM”) tools, endpoint security, security automation, cloud detection and response (“CDR”), as well as attack surface management (“ASM”) capabilities on our Cortex platform. These include Cortex XSIAM®, for AI-powered security operations replacing traditional SIEM tools; Cortex XDR®, for the prevention, detection, and response to complex cybersecurity attacks; Cortex XSOAR®, for security orchestration, automation, and response (“SOAR”); Cortex Xpanse®, for ASM; and Koi Agentic Endpoint Security.”

Annual report 2026A · The company itself

“•Cloud Security. We deliver comprehensive security across the cloud application development lifecycle through Cortex Cloud®, delivered as a scalable SaaS offering. As a comprehensive Cloud Native Application Protection Platform (“CNAPP”) combined with CDR, Cortex Cloud secures multi- and hybrid-cloud environments for applications, data, generative AI (“GenAI”) ecosystem, and the cloud native technology stack across the full development lifecycle, from code to cloud to security operations.”

Annual report 2026A · The company itself

“Idira Idira™, our next-generation identity security platform, is designed to secure human, agentic, and machine identities across the enterprise with intelligent privilege controls and continuous threat prevention. By unifying identity access management, privilege access management, and identity governance and administration, organizations can continuously discover and protect against identity risk throughout the end-to-end identity lifecycle.”

Annual report 2026A · The company itself

“The platform includes: •Workforce Identity Security. Our solutions apply identity assurance and modern access controls for the entire workforce, including through adaptive multi-factor authentication (“MFA”), single sign-on (“SSO”), secure browsing, web session protection, workforce password management, and automated identity lifecycle management. Our approach enforces least privilege by elevating access only when required. •Information Technology (“IT”) and Developer Identity Security (Modern Privilege Access Management).”

Annual report 2026A · The company itself

“Our solutions secure high-risk access for IT administrators, third-party vendors, developers, and cloud operations teams across hybrid and multi-cloud environments, delivering just-in-time privileged access, session isolation, credential protection, and zero standing privileges, while providing native, secure access to cloud services, workloads, and development and operations pipelines.”

Annual report 2026A · The company itself

“•Machine Identity Security. Our solutions secure the growing volume of non-human identities—such as workloads, applications, containers, service accounts, certificates, and keys, including through centralized discovery and management of secrets, certificate lifecycle automation, workload identity issuance, public key infrastructure-as-a-service, Kubernetes certificate management, and secure code signing. •Identity Governance and Administration (“IGA”).”

Annual report 2026A · The company itself

“IGA enables visibility into entitlements, automated joiner–mover–leaver processes, access certification, and ongoing identity compliance. AI-supported policy automation helps organizations govern access at scale and enforce a zero-trust model across all identities. •AI Agents Security.”

Annual report 2026A · The company itself

“Threat Intelligence and Advisory Services •Unit 42® brings together world-renowned expertise across threat research, incident response, and security consulting to deliver intelligence-driven, response-ready outcomes that help customers reduce cyber risk. Our elite consultants serve as trusted advisors to our customers by assessing and testing their security controls against sophisticated threats, including Frontier AI, transforming their security strategy with a threat-informed approach, and responding to security incidents on behalf of our clients.”

Annual report 2026A · The company itself

“In April 2026, we launched a new suite of Unit 42 Frontier AI Defense services to help customers proactively discover and neutralize threats introduced by next-generation AI models.”

Annual report 2026A · The company itself

“Prisma Access is a cloud-delivered security offering that helps organizations deliver consistent AI-driven security to remote networks and mobile users. With more than 100 locations around the world, Prisma Access offers global coverage, consistently inspecting all traffic across all ports and providing bidirectional networking to enable branch-to-branch and branch-to-headquarter traffic. Prisma Access consolidates point products into a single cloud-delivered solution, transforming network security and allowing organizations to enable secure hybrid work.”

Annual report 2026A · The company itself

“Our Prisma SD-WAN solution is a next-generation SD-WAN solution that makes the secure cloud-delivered branch possible. Prisma SD-WAN enables organizations to replace traditional wide area network (“WAN”) architectures with affordable broadband and internet transport types that promote improved bandwidth availability, redundancy, and performance. Prisma SD-WAN leverages real-time application performance SLAs and visibility to control and intelligently steer application traffic to deliver a powerful user experience.”

Annual report 2026A · The company itself

“Our hardware and software ML-Powered NGFWs use AI—including machine learning and deep learning—to stop zero-day threats in real time, and detect and secure the entire enterprise including Internet of Things (“IoT”). All of our hardware and software firewalls incorporate the PAN-OS® operating system and include the same rich set of features, ensuring consistent operation across our entire product line. This includes SD-WAN capabilities to intelligently steer traffic to data centers, branches, and the cloud, natively integrated into our NGFWs.”

Annual report 2026A · The company itself

“Cloud-Delivered Security Services •Advanced Threat Prevention. This cloud-delivered security service provides intrusion detection and prevention capabilities and blocks vulnerability exploits, viruses, spyware, buffer overflows, denial-of-service attacks, and port scans from compromising and damaging enterprise information resources. In addition, we offer inline deep learning to deliver real-time detection and prevention of unknown, evasive, and targeted command-and-control (“C2”) communications over HTTP, unknown-TCP, unknown-UDP, and encrypted over SSL.”

Annual report 2026A · The company itself

“Advanced Threat Prevention is the industry’s only offering to protect the enterprise from unknown command and control in real-time with the power of Precision AITM. •Advanced WildFire. This cloud-delivered security service provides protection against targeted malware and advanced persistent threats and provides a near real-time analysis engine for detecting previously unseen malware while resisting attacker evasion techniques. Advanced WildFire combines dynamic and static analysis, recursive analysis, and a custom-built analysis environment with network traffic profiling and fileless attack detection to discover even the most sophisticated and evasive threats.”

Annual report 2026A · The company itself

“•Advanced URL Filtering. This cloud-delivered security service offers the industry’s first Inline Deep Learning powered web protection engine. We deliver real-time detection and prevention of unknown, evasive, and targeted web-based threats, such as phishing.”

Annual report 2026A · The company itself

“In addition, the service includes a cloud-based URL filtering database which consists of millions of URLs across many categories and is designed to analyze web traffic and prevent web-based threats, such as phishing, malware, and C2. •Advanced DNS Security. This cloud-delivered security service uses machine learning to proactively block malicious domains and stop attacks in progress. The service allows our network security platform access to Domain Name System (“DNS”) signatures that are generated using advanced predictive analysis, machine learning, and malicious domain data from a growing threat intelligence sharing community of which we are a part.”

Annual report 2026A · The company itself

“•Device Security. This cloud-delivered security service uses machine learning to accurately identify and classify various IoT, connected medical, operational technology (“OT”), and unmanaged IT devices, including never-been-seen-before devices, critical devices, and unmanaged legacy systems. The service uses machine learning to baseline normal behavior, identify anomalous activity, assess and prioritize risk, provide virtual patching, and provide policy and remediation recommendations. •SaaS Security API.”

Annual report 2026A · The company itself

“SaaS Security API is a multi-mode, cloud access security broker (“CASB”) that helps govern sanctioned SaaS application usage across all users and helps prevent breaches and non-compliance. Specifically, the service enables the discovery and classification of data stored in supported SaaS applications, protects sensitive data from accidental exposure, identifies and protects against known and unknown malware, and performs user activity monitoring to identify potential misuse or data exfiltration.”

Annual report 2026A · The company itself

“•SaaS Security Inline. SaaS Security Inline adds an inline service to automatically gain visibility and control over thousands of known and newly sanctioned, unsanctioned and tolerated SaaS applications in use within organizations today. The service provides enterprise data protection and compliance across all SaaS applications and prevents cloud threats in real time.”

Annual report 2026A · The company itself

“GlobalProtect provides protection for users of both traditional laptop and mobile devices. It expands the boundaries of the end-users’ physical network, effectively establishing a logical perimeter that encompasses remote laptop and mobile device users irrespective of their location. Regardless of the operating system, laptops, tablets, and phones will stay connected to the corporate network when they are on a network of any kind and as a result, are protected as if they never left the corporate campus.”

Annual report 2026A · The company itself

“•Prisma Access Agent. Prisma Access Agent provides secure, remote access to corporate resources for employees working from any location or device. The agent establishes an encrypted tunnel to Prisma Access or our NGFW, ensuring consistent security, data protection, and threat prevention for a distributed workforce accessing any application. •Enterprise DLP.”

Annual report 2026A · The company itself

“This cloud-delivered security service provides consistent and reliable protection of sensitive data, such as personally identifiable information and intellectual property, for all traffic types, applications, and users. Native integration with our products makes the service simple to deploy, while advanced machine learning minimizes management complexity. Enterprise DLP allows organizations to consistently discover, classify, monitor, and protect sensitive data, wherever it may reside. •AI Access Security.”

Annual report 2026A · The company itself

“AI Access Security classifies and prioritizes GenAI applications to assess risk, detect anomalies, and visualize insights across multiple GenAI-specific attributes. The service prevents sensitive data loss and defends against malicious responses, ensuring safe and effective AI adoption.”

Annual report 2026A · The company itself

“Serves as the centralized AI security control plane through which all enterprise AI traffic flows—including LLM calls, tool invocations, agent interactions, and prompt data. AI Gateway enables organizations to govern AI agents, secure AI coding tools, and safely enable enterprise AI apps from a single control plane. The gateway provides real-time visibility into usage, tracks token consumption and cost, and inspects every interaction to prevent data leakage, prompt injection, and unsafe outputs.”

Annual report 2026A · The company itself

“•AI Runtime Security. Provides continuous, real-time protection for live AI autonomous agents, applications and models operating in production. It actively intercepts mid-conversation threats, such as prompt injections, indirect injections, malicious URLs, retrieval manipulation, and tool abuse while enforcing enterprise-grade Data Loss Prevention (“DLP”) across prompts and outputs.”

Annual report 2026A · The company itself

“By stopping exploits as they unfold and preventing unauthorized data exfiltration, AI Runtime Security ensures business continuity, protects high-value enterprise data, and keeps operational agents acting safely within policy boundaries to secure enterprise AI apps and AI-assisted coding. •AI Model Security. Protects the foundation of the AI ecosystem by extending continuous scanning to underlying model architectures, weights, operators, agent artifacts, code dependencies, and skills. AI Model Security inspects components in-place to identify hidden malware, poisoned assets, unsafe permissions, and indirect injection paths before they reach production.”

Annual report 2026A · The company itself

“•AI Posture Management. Provides continuous, real-time risk assessment across cloud, SaaS, and endpoint environments to help eliminate "Shadow AI" blind spots. It discovers deployed chatbots and agents, maps data flows, and enforces policy rules aligned with frameworks like the E.U.”

Annual report 2026A · The company itself

“Strata Cloud Manager (“SCM”). SCM enables our customers to easily manage their Palo Alto Networks’ Network Security infrastructure—including NGFWs and SASE deployments—from the cloud, via one unified management interface. As an AI-powered, unified cloud management solution, SCM enables organizations to enhance their network security posture and streamline operations.”

Annual report 2026A · The company itself

“CORTEX •Cortex XSIAM. Our cloud-based AI-powered security operations platform harnesses the power of AI to significantly improve security outcomes and transform security operations. Cortex XSIAM customers are able to consolidate multiple products into a single unified platform that delivers security information and event management, extended detection and response (“XDR”), SOAR, network traffic analysis, ASM, threat intelligence management (“TIM”), identity threat detection and response, and CDR.”

Annual report 2026A · The company itself

“•Cortex XDR. This cloud-based service enables organizations to collect telemetry from endpoint, network, identity, and cloud data sources and apply advanced analytics and machine learning to quickly find and stop targeted attacks, insider abuse, and compromised endpoints. Cortex XDR has two product tiers: XDR Prevent and XDR Pro.”

Annual report 2026A · The company itself