vulnerabilities, which could impact IBM’s ability to market its products, mitigate cybersecurity risks or fulfill its contractual obligations to customers.
Cybersecurity and Privacy Considerations Could Impact the Company’s Business: There are numerous and evolving risks to cybersecurity and privacy, including risks originating from intentional acts of criminal hackers, hacktivists, nation states and competitors; from intentional and unintentional acts of customers, contractors, business partners, vendors, employees and other third parties; and from errors in processes or technologies. Computer hackers and others routinely attempt to attack the security of technology products, services, systems and networks. Such attacks may involve fraudulently inducing customers, contractors, business partners, vendors, employees and other third parties to disclose information, transfer funds, or unwittingly provide access to systems or data. The company is at risk of security breaches not only of our own products, services, systems and networks, but also those of customers, contractors, business partners, vendors, employees and other third parties. Cyber threats are continually evolving, making it difficult to detect and defend against certain threats and vulnerabilities that can persist over extended periods of time. The company’s products, services, systems and networks, including cloud-based systems and systems and technologies that the company maintains on behalf of its customers, may be used in critical company, customer or third-party operations, and may involve the storage, processing and transmission of sensitive data, including valuable intellectual property, other proprietary or confidential data, regulated data, and personal information of employees, customers and others. These products, services, systems and networks are also used by customers in heavily regulated industries, including those in the financial services, healthcare, critical infrastructure and government sectors. Successful cybersecurity attacks or other security incidents could result in, for example, one or more of the following: unauthorized access to, disclosure, modification, misuse, loss, or destruction of company, customer, or other third party data or systems; theft or import or export of sensitive, regulated, or confidential data including personal information and intellectual property; the loss of access to critical data or systems through ransomware, crypto mining, destructive attacks or other means; and business delays, service or system disruptions or denials of service. In the event of such actions, the company, its customers and other third parties could be exposed to liability, litigation, and regulatory or other government action, as well as the loss of existing or potential customers, damage to brand and reputation, and other financial loss. In addition, the cost and operational consequences of responding to cybersecurity incidents and implementing remediation measures could be significant. In the company’s industry, security vulnerabilities are increasingly discovered, publicized and exploited across a broad range of hardware, software or other infrastructure, elevating the risk of attacks and the potential cost of response and remediation for the company and its customers. In addition, the fast-paced, evolving, pervasive, and sophisticated nature of certain cyber threats and vulnerabilities, as well as the scale and complexity of the business and infrastructure, make it possible that certain threats or vulnerabilities will be undetected or unmitigated in time to prevent an attack on the company or its customers, and may not be detected or remediated for some time afterward particularly if additional steps are required to implement remediation-related updates. Cybersecurity risk to the company and its customers also depends on factors such as the actions, practices and investments of customers, contractors, business partners, vendors and other third parties. Cyber attacks or other catastrophic events resulting in disruptions to or failures in power, information technology, communication systems or other critical infrastructure could result in interruptions or delays to company, customer, or other third party operations or services, financial loss, injury or death to persons or property, potential liability, and damage to brand and reputation. Although the company continuously takes significant steps to mitigate cybersecurity risk across a range of functions, such measures can never eliminate the risk entirely or provide absolute security. To date, while the company continues to monitor for, identify, investigate, respond to and remediate security incidents, including those associated with cybersecurity attacks, there has not been a cybersecurity attack that has had a material adverse effect on the company, though there is no assurance that there will not be a cybersecurity attack that has a material adverse effect in the future.
As a global enterprise, the regulatory environment with regard to cybersecurity, privacy and data protection issues is increasingly complex and will continue to impact the company’s business, including through increased risk, increased costs, and expanded or otherwise altered compliance obligations. As the company’s reliance on data grows, the potential impact of regulations on the company’s business, risks, and reputation will grow accordingly. The enactment and expansion of data protection and privacy laws and regulations around the globe, the lack of harmonization of such laws and regulations, and the potential regulation of new and emerging technologies such as artificial intelligence will continue to result in increased compliance costs and risks. Any additional costs and penalties associated with increased compliance and risk reduction could make certain offerings less profitable or increase the difficulty of bringing certain offerings to market.