Factset Research (FDS) Risk Factors

In providing our digital-enabled products and services to clients, we rely on information technology infrastructure that is managed internally along with placing reliance on third-party service providers for critical functions. We and these third-party service providers are subject to the risks of system failures and security breaches, including cyber-attacks (such as those sponsored by nation-states, terrorist organizations, or global corporations seeking to illicitly obtain technology or other intellectual property and those accomplished by phishing scams, hacking, viruses, denials of service attacks, tampering, intrusions, physical break-ins, ransomware and malware), as well as employee errors or malfeasance. In some cases, these risks might be heightened when employees are working remotely. Our and our vendors' use of mobile and cloud technologies may increase our risk for such threats. Our protective systems and procedures and those of third parties to which we are connected, such as cloud computing providers, may not be effective against these threats. Our information technology systems must be constantly updated and patched to protect against known vulnerabilities and to optimize performance. While we have dedicated resources responsible for maintaining appropriate levels of cybersecurity and implemented systems and processes intended to help identify cyberattacks and protect and remediate our network infrastructure, we are aware that these attacks have become increasingly frequent, sophisticated, and difficult to detect and, as a result, we may not be able to anticipate, prevent or detect all such attacks. We also may be impacted by a cyberattack targeting one of our vendors or within our technology supply chain or infrastructure. Our contracts with service providers typically require them to implement and maintain adequate security controls, but we may not have the ability to effectively monitor these security measures. As a result, inadequacies of the third-party security technologies and practices may not be detected until after a security breach has occurred. These risks may be heightened in connection with employees working from remote work environments, as our dependency on certain service providers, such as video conferencing and web conferencing services, has significantly increased. In addition, to access our network, products and services, customers and other third parties may use personal mobile devices or computing devices that are outside of our network environment and are subject to their own security risk. We could suffer significant damage to our brand and reputation: if a cyber-attack or other security incident were to allow unauthorized access to, or modification of, clients' or suppliers' data, other external data, internal data or information technology systems; if the products and services provided to clients were disrupted; or if products and services were perceived as having security vulnerabilities. The costs we would incur to address and resolve these security incidents would increase our expenses. These types of security incidents could also lead to lawsuits, regulatory investigations and claims, loss of business and increased legal liability. Cyberattacks, security breaches or third-party reports of perceived security vulnerability to our systems, even if no breach has occurred, also could damage our brand and reputation, result in litigation, regulatory actions, loss of client confidence and increased legal liability. We also make acquisitions periodically. While significant effort is placed on addressing information technology security issues with respect to the acquired companies, we may inherit such risks when these acquisitions are integrated into our infrastructure. While we maintain insurance coverage that is intended to address certain aspects of cybersecurity and data protection risks, such coverage may not include, or may not be sufficient to cover, all or the majority of the costs, losses or types of claims.

Our clients rely on us for the delivery of time-sensitive, up-to-date data and applications. Our business is dependent on our ability to process substantial volumes of data and transactions rapidly and efficiently on our computer-based networks, database storage facilities, and other network infrastructure, which are located across multiple facilities globally. If we experience significant growth of our customer base, increases in the number of products or services, or increase in the speed at which we are required to provide products and services, it may strain our systems. Additionally, our systems and networks may become strained due to aging or end-of-life technology that we have not yet updated or replaced. Our computer operations, as well as our other business centers, and those of our suppliers and clients, may be vulnerable to interruption by fire, natural disaster, extreme weather or climate conditions, power loss, telecommunications failures, terrorist attacks, acts of war or civil unrest, internet failures, computer viruses or security breaches, employee or systems errors, and other events beyond our reasonable control. In addition, in the remote work environments, the daily activities and productivity of our workforce is now more closely tied to key vendors, such as video conferencing services, consistently delivering their services without material disruption. Our ability to deliver information using the internet and to operate in a remote working environment may be impaired because of infrastructure failures, service outages at third-party internet providers, malicious attacks, or other factors. We also currently use multiple providers of cloud services; however, one supplier provided the majority of our cloud computing support for fiscal 2024. While we believe this provider to be reliable, we have limited control over its performance, and a disruption or loss of service from this provider could impair our system's operation and our ability to operate for a period of time. We maintain back-up facilities and certain other redundancies for each of our data centers to minimize the risk that any such event will disrupt those operations. We are currently in the midst of a multi-year project to enhance our information technology disaster recovery processes with modernized tooling and automation to maximize resiliency and minimize recovery time in the event of a service disruption. However, a loss of our services involving our significant facilities may materially disrupt our business and may induce our clients to seek alternative data suppliers. Any such losses or damages we incur could have a material adverse effect on our business. Although we seek to minimize these risks through security measures, controls, back-up data centers, emergency planning and disaster recovery processes, there can be no assurance that such efforts will be successful or effective. Additionally, we may also face significant increases in our use of power and data storage and may experience a shortage of capacity and increased costs associated with such usage.