High-profile security breaches at other companies have increased in recent years. Security industry experts and government officials have warned about the risks of hackers and cyber-attackers targeting information technology products and businesses.?Threats to IT security can take a variety of forms. Individual hackers, groups of hackers, and sophisticated organizations, including state-sponsored organizations, or nation-states themselves, may take steps that threaten our clients, suppliers, third-party technology providers, and us.
Although we are not aware of having experienced any prior material data breaches, regulatory non-compliance incidents or cyber security incidents, we may in the future be impacted by such an event, exposing our clients and us to a risk of someone obtaining access to our information, to information of our clients or their customers, or to our intellectual property, disabling or degrading service, or sabotaging systems or information. Any such security breach could result in a loss of confidence in the security of our services, damage our reputation, disrupt our business, require us to incur significant costs of investigation, remediation and/or payment of a ransom, lead to legal liability, negatively impact our future sales, and result in a substantial financial loss. Additionally, our Pega Cloud offering provides provisioned, monitored, and maintained environments for individual clients to create and deploy Pega-based applications using an Internet-based infrastructure. These services involve storing and transmitting client data and other confidential information.
Our security measures, those of our suppliers, third-party technology providers, and our clients may be breached because of third-party actions or those of employees, consultants, clients, or others, including intentional misconduct by computer hackers, system errors, human errors, technical flaws in our products, or otherwise. Because we do not control the configuration of Pega applications by our clients, the transmissions between our clients and our third-party technology providers, the processing of data on the servers at third-party technology providers, or the internal controls maintained by our clients and third-party technology providers that could prevent unauthorized access or provide appropriate data encryption, we cannot fully ensure the complete integrity or security of such transmissions processing or controls. In addition, privacy, security, and data transmission concerns in some parts of the world may inhibit demand for our Pega Cloud offering or lead to requirements to provide our products or services in configurations that may increase the cost of serving such markets. The techniques used to obtain unauthorized access or sabotage systems change frequently and are generally only recognized once launched against a target. While we have invested in protecting our data and systems and clients' data to reduce these risks and actively monitor for risks of data breaches, regulatory non-compliance incidents and cyber security incidents, there can be no assurance that our efforts will prevent breaches. Moreover, like most software companies, we incorporate open-source code into our software products and services, which also creates a potential risk. We deal with security issues regularly and have experienced security incidents from time to time. We have a standing Compliance and Risk Governing Committee composed of senior representatives across the Company that reports to and assists the Audit Committee and the Board as a whole in the oversight of compliance and risk management programs, including cybersecurity measures. In addition, we have a standing Security Steering Group, whose members include our Chief Information Security Officer, Chief Product Officer and Chief Technical Systems Officer, and which is charged with providing strategic direction for the implementation and ongoing operation of our cyber security program. Even with the efforts the Company has undertaken, there is a risk that a security breach will be successful, and such an event will be material. We carry data breach insurance coverage to mitigate the financial impact of a security breach, though this may prove insufficient in the event of a breach.
Our Pega Cloud offering involves hosting client applications on the servers of third-party technology providers. We also rely on third-party systems and technology, including encryption, virtualized infrastructure, and support, and employ a shared security model with our clients and third-party technology providers.
To defend against security threats, we need to continuously engineer products and services with enhanced security and reliability features, improve the deployment of software updates to address security vulnerabilities, apply technologies that mitigate the risk of attacks, and maintain a digital security infrastructure that protects the integrity of our network, products, and services. The cost of these steps could negatively impact our operating results. While we actively work to improve vulnerability scanning, patching, threat intelligence, security event detection, security event alerting and forensics, it is possible that security breaches, whether due to unpatched vulnerabilities or otherwise, occur and may be undetected when they occur. Any such security breach could result in a loss of confidence in the security of our services, damage our reputation, disrupt our business, require us to incur significant costs of investigation, remediation and/or payment of a ransom, lead to legal liability, negatively impact our future sales, and result in a substantial financial loss.