We rely on the capacity, reliability and security of our IT and data security infrastructure, and on our ability to expand and update it as our business changes. Implementing new systems, integrating existing systems and supporting our older systems all increase the risk of security breaches. If an important IT system fails because of increased burdens on our IT infrastructure or a security breach, the resulting disruption could have a material adverse effect on our business, reputation and financial results.
Cybersecurity threats range from uncoordinated individual attempts to gain unauthorized access to sophisticated, targeted attacks known as advanced persistent threats. These are directed at us, our products, our customers and our third-party service providers, including cloud providers. AI and machine learning technologies continue to develop rapidly, and the risks and market disruptions they may cause are impossible to predict. Threat actors already use these technologies to build new hacking tools and attack vectors, exploit vulnerabilities, hide their activities and make attacks harder to attribute. New AI tools can find previously undetected vulnerabilities in short time spans and create exposure to zero-day attacks. These developments may enable faster, larger-scale and more sophisticated attacks on us, our products, connected building environments, customers and third-party providers. They also significantly shorten the time we and our third-party service providers have to detect, respond to and fix vulnerabilities. In addition, the vendors we use to support our business and operations have experienced, and will likely continue to experience, these types of threats and incidents, which add to the risks to our IT systems (including our cloud services providers’ systems), internal networks, our customers’ systems and the information stored and processed on such networks and systems. Despite our efforts to deploy countermeasures to deter, prevent, detect, respond to and mitigate cybersecurity threats, we have experienced, and will likely continue to experience, cybersecurity incidents and attacks. Such incidents have remained, and could in the future remain, undetected for an extended period of time, and the losses arising from such incidents could exceed our available insurance coverage for such matters.
An increasing number of our products, services and technologies are delivered with digital capabilities and interconnected device networks, including sensors, data, building management systems and advanced computing and analytics capabilities. If
13
we fail to manage lifecycle cybersecurity risk in the development, deployment and operation of these digital platforms and services, they could suffer cybersecurity incidents. That could lead to third-party claims that our product failures damaged our customers. This risk is heightened by the increasingly connected nature of our products and the role they play in managing building systems.
Any future cybersecurity incidents or attacks, depending on their nature and scope, may result in the Company incurring significant costs, reputational damage, exposure to legal claims, enforcement actions, audits, investigations and fines levied by governmental organizations, misappropriation, destruction, corruption or unavailability of critical data and confidential or proprietary information (our own or that of third parties), the theft of intellectual property and the diminution in the value of our investment in research, development and engineering, and the disruption of business operations.
Our customers, including the U.S. government, are increasingly requiring cybersecurity protections and mandating cybersecurity standards in our products, and we may incur additional costs to comply with such demands. Evolving cybersecurity laws, standards and customer requirements mandating secure-by-design and lifecycle security controls may increase costs, delay product launches, limit market access, and require us to modify or discontinue offerings that cannot be economically or technically adapted.