Gartner (IT) Risk Factors

If we are unable to enforce and protect our intellectual property rights, our competitive position may be harmed. We rely on a combination of copyright, trademark, trade secret, patent, confidentiality, non-compete and other contractual provisions to protect our intellectual property rights. Despite our efforts to protect our intellectual property rights, third parties may obtain unauthorized access to our intellectual property, technology or other information that we regard as proprietary. Our intellectual property rights may not survive a legal challenge to their validity or provide significant protection for us. Additionally, the laws and enforcement mechanisms to protect our intellectual property from unauthorized use in new technologies like AI and machine learning are evolving and may be inadequate. Further, the laws and enforcement mechanisms of certain countries, particularly in emerging markets, do not protect our proprietary rights to the same extent as the laws of the United States. Conducting business in certain foreign jurisdictions may require accepting compromised protections or yielding of rights to technology, data or intellectual property in order to access those markets. Accordingly, we may not be able to protect our intellectual property against unauthorized or undesired third-party copying or use, which could adversely affect our competitive position. From time to time third parties have asserted, and may continue to assert, intellectual property claims that our products infringe the rights of others. Such claims can be expensive and time-consuming to defend, regardless of their merit. The inability to obtain rights to use third-party intellectual property on commercially reasonable terms could also have an adverse impact on our business. We may face claims based on the theft or unauthorized use or disclosure of third-party trade secrets and other confidential business information. Any such incidents and claims could harm our business and reputation, cause us to incur significant expenses, and prevent us from selling certain products, all of which could negatively impact our business and results of operations. Additionally, our employees are subject to restrictive covenant agreements (which include provisions related to employees' ability to compete and solicit customers and employees) and assignment of invention agreements, to the extent permitted under applicable law. When the period expires relating to their particular restrictions, former employees may compete against us. If a former employee violates the provisions of the restrictive covenant agreement, we seek to enforce the restrictions but there is no assurance that we will be successful in our efforts, and enforceability of certain restrictive covenants may decrease significantly due to recent regulatory scrutiny in the U.S. If the laws change to provide greater rights to employees, that could further reduce the effectiveness and enforceability of our restrictive covenant agreements.

A significant portion of our business is conducted over the internet and we rely on the secure processing, storage and transmission of confidential, sensitive, proprietary and other types of information relating to our business operations and confidential and sensitive information about our customers and employees in our computer systems and networks, and in those of our third-party vendors. Individuals, groups, and state-sponsored organizations may take steps that pose threats to our operations, our computer systems, our employees, and our customers. The cybersecurity risks we face range from cyber attacks common to most industries, such as the development and deployment of malicious software to gain access to our networks and attempt to steal confidential information, launch distributed denial of service attacks, or attempt other coordinated disruptions, to more advanced threats that target us because of our prominence in the global research and advisory field. Like many multinational corporations, we, and some third parties upon which we rely, have experienced cyber attacks on our computer systems and networks in the past and may experience them in the future, likely with more frequency and sophistication, and involving a broader range of devices and modes of attack, all of which will increase the difficulty of detecting and successfully defending against them. To date, none have resulted in any material adverse impact to our business, operations, products, services or customers. We have implemented various security controls to meet our security obligations, while also defending against constantly evolving security threats. Our security controls help to secure our information systems, including our computer systems, intranet, proprietary websites, email and other telecommunications and data networks, and we scrutinize the security of outsourced website and service providers prior to retaining their services. However, the security measures implemented by us or by our outside service providers may not be effective and our systems (and those of our outside service providers) are vulnerable to theft, loss, damage and interruption from a number of potential sources and events, including unauthorized access or security breaches, cyber attacks, computer viruses, power loss, or other disruptive events. As a result of operating in a hybrid work environment, most of our employees are working virtually for a period of time, which magnifies the importance of the integrity of our remote access security measures. Cyber criminals use artificial intelligence tools to increase the effectiveness, speed and complexity of attacks, requiring increased vigilance and threat defense. Additionally, the security compliance landscape continues to evolve, requiring us to stay apprised of changes in cybersecurity and data privacy laws, regulations, and security requirements required by our clients, such as the European Union General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), the Brazilian General Data Protection Law (LGPD), the Chinese Cybersecurity, Data Security and Personal Information Protection laws (and other new and proposed data protection laws), International Organization for Standardization (ISO), and National Institute of Standards and Technology (NIST). Recent well-publicized security breaches at other companies have led to enhanced government and regulatory scrutiny of the measures taken by companies to protect against cyber attacks, and may in the future result in heightened cybersecurity requirements, including additional regulatory expectations for oversight of vendors and service providers. A cyber attack, widespread internet failure or internet access limitations, or disruption of our critical information technology systems through denial of service, viruses, or other events could cause delays in initiating or completing sales, impede delivery of our products and services to our clients, disrupt other critical client-facing or business processes or dislocate our critical internal functions. Additionally, any material breaches of cybersecurity or other technology-related catastrophe, or media reports of perceived security vulnerabilities to our systems or those of our third parties, even if no breach has been attempted or occurred, could cause us to experience reputational harm, loss of customers and revenue, fines, regulatory actions and scrutiny, sanctions or other statutory penalties, litigation, liability for failure to safeguard our customers' information, or financial losses that are either not insured against or not fully covered through any insurance maintained by us. Any of the foregoing may have a material adverse effect on our business, operating results and financial condition.