We rely upon hardware, software, and information technology systems and networks, some of which are managed by third parties, to process, transmit and store electronic information. Additionally, we collect and store sensitive data, including proprietary business information, in data centers and on information technology networks (including networks that may be controlled or maintained by third parties). We do not generally collect or store personally identifiable information of individuals. The confidentiality, integrity and availability of these systems and networks, and maintenance of the information processed by these systems and networks, is critical to our business operations and strategy. We face numerous and evolving risks that threaten the confidentiality, integrity and availability of our systems, networks and information, as well as the risk of operational disruption, failure or capacity constraints of any of the third parties that facilitate our business activities. Such parties could also be the source of a cyberattack on, or breach of, our operational systems, network, data or infrastructure. Our information technology systems and networks, as well as those of our service providers, are vulnerable to intrusion damage, disruptions or shutdowns caused by attacks by hackers, computer viruses or worms, malware (including ransomware), social engineering attacks (such as phishing), denial of service attacks or breaches due to errors, negligence or malfeasance by employees, contractors and others who have access to or obtain unauthorized access to these systems and networks. Remote and hybrid working arrangements also increase cybersecurity risks due to the challenges associated with managing remote computing assets and security vulnerabilities that are present in many non-corporate and home networks. We are also vulnerable to malicious code that may be embedded in open-source software as well as "bugs," misconfigurations and other vulnerabilities associated with commercial software that is integrated into our or our service providers' systems, networks, products or services. Therefore, no assurance can be given that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems, networks and information.
The occurrence of a major cyberattack or other security incident could materially compromise the confidentiality, integrity and/or availability of critical systems and networks and data that resides within them. Similarly, such an occurrence could result in the compromise or loss of the information processed by these systems and networks. Such events could result in, among other things, the loss of proprietary data, interruptions or delays in our business operations and damage to our reputation. In addition, such events could increase the risk of claims by regulatory agencies or private parties alleging that we are non-compliant with applicable laws or regulations, subjecting us to potential liability or regulatory penalties and related costs under laws protecting the security of confidential data; increase our costs of compliance and remediation; require us to change aspects of our business, our systems or our service providers; disrupt our operations; and/or harm our reputation. There can be no guarantee that any or all costs or losses incurred will be partially or fully insured.
We regularly experience and expect to continue to experience cybersecurity attacks and security incidents in varying degrees. See "Item 1A Risk Factors -- We may face litigation and other risks as a result of the material weaknesses in our internal control over financial reporting". Cybersecurity threats and threat actors are becoming more sophisticated. Such threats are unpredictable as to their timing, nature and scope. As a result, we may be unable to anticipate or prevent future attacks, particularly as the methodologies utilized by attackers change frequently or are not recognized until launched, and we may be unable to investigate or remediate incidents due to the increased use by threat actors of tools and techniques that are designed to circumvent controls (including through the use of artificial intelligence), to avoid detection, and to remove or obfuscate forensic evidence.