In the ordinary course of our business, we generate and store sensitive data, including research data, intellectual property and proprietary business information owned or controlled by ourselves or our employees, partners and other parties. We manage and maintain our applications and data utilizing a combination of on-site systems and cloud-based data centers. We utilize external security and infrastructure vendors to manage parts of our data centers. These applications and data encompass a wide variety of business-critical information, including research and development information, commercial information and business and financial information. We face a number of risks relative to protecting this critical information, including loss of access risk, inappropriate use or disclosure, accidental exposure, unauthorized access, inappropriate modification and the risk of our being unable to adequately monitor, audit, and modify our controls over our critical information. This risk extends to the third party vendors and subcontractors we use to manage this sensitive data or otherwise process it on our behalf.
Attacks upon information technology systems are increasing in their frequency, levels of persistence, sophistication and intensity, and are being conducted by sophisticated and organized groups and individuals with a wide range of motives and expertise. Further, to the extent our employees are working remotely, additional risks may arise as a result of depending on the networking and security in place in the remote environments. Furthermore, because the techniques used to obtain unauthorized access to, infiltrate, or sabotage systems change frequently and often are not recognized until after they occur, we may be unable to anticipate these exploits or implement adequate preventative measures. We may experience security breaches that may remain undetected for an extended period. Our third-party service providers and partners are also subject to these heightened risks. The secure processing, storage, maintenance and transmission of this critical information are vital to our operations and business strategy, and we devote significant resources to protecting such information. Although we take reasonable measures to protect sensitive data from unauthorized access, use or disclosure, our information technology and infrastructure and those of our third-party service providers, strategic partners and other contractors or consultants are vulnerable to attack, damage and interruption from viruses or other malware (e.g. ransomware), malicious code, natural disasters, terrorism, war, telecommunication and electrical failures, hacking, cyberattacks, phishing attacks and other social engineering schemes, employee theft or misuse, human error, fraud, denial or degradation of service attacks, sophisticated nation-state and nation-state-supported actors or unauthorized access or use by persons inside our organization, or persons with access to systems inside our organization.
We and our third-party service providers and partners are from time to time subject to cyberattacks and security incidents. While we do not believe that we have experienced any significant system failure, accident or security breach to date, if such an event were to occur and cause interruptions in our operations, it could result in a material disruption of our development programs and our business operations, whether due to a loss, corruption or unauthorized disclosure of our trade secrets, personal information or other proprietary or sensitive information or other similar disruptions. It could also expose us to risks, including an inability to provide our services and fulfill contractual demands, and could cause management distraction and the obligation to devote significant financial and other resources to mitigate such problems, which would increase our future information security costs, including through organizational changes, deploying additional personnel, reinforcing administrative, physical and technical safeguards, further training of employees, changing third-party vendor control practices and engaging third-party subject matter experts and consultants and reduce the demand for our technology and services.
If a security breach or other incident were to result in the unauthorized access to or unauthorized use, disclosure, release or other processing of personal information, it may be necessary to notify individuals, governmental authorities, supervisory bodies, the media and other parties pursuant to privacy and security laws. Any security compromise affecting us, our service providers, partners, other contractors, consultants, or our industry, whether real or perceived, could harm our reputation, erode confidence in the effectiveness of our security measures and lead to regulatory scrutiny. To the extent that any disruption or security breach were to result in a loss of, or damage to, our data or systems, or inappropriate disclosure of confidential or proprietary or personal information, we could incur liability, including litigation exposure, penalties and fines, we could become the subject of regulatory action or investigation, our competitive position could be harmed and the further development and commercialization of our products and services could be delayed. If such an event were to occur and cause interruptions in our operations, it could result in a material disruption of our business. Furthermore, federal, state and international laws and regulations can expose us to enforcement actions and investigations by regulatory authorities, and potentially result in regulatory penalties, fines and significant legal liability, if our information technology security efforts fail. We may also be exposed to a risk of loss or litigation and potential liability, which could materially and adversely affect our business, results of operations or financial condition. Additionally, although we maintain cybersecurity insurance coverage, we cannot be certain that such coverage will be adequate for data security liabilities actually incurred, will cover any indemnification claims against us relating to any incident, will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could adversely affect our reputation, business, financial condition and results of operations.