We use information technology and security systems to process, transmit and store electronic information in connection with the operation of our business. We also use such systems to protect proprietary and confidential information, including that of physicians, patients, and other individuals involved in clinical trials, suppliers, and employees. We face risks associated with cybersecurity incidents and other significant disruptions of such systems, including denial of service or other similar attacks, to our facilities or systems; unauthorized access to or acquisition of personal information, confidential information or other data we process or maintain; or viruses, loggers, or other malfeasant code, including ransomware, in our data or software. These cybersecurity incidents or other significant disruptions could be caused by persons inside our organization, persons outside our organization with authorized access to systems inside our organization, or by individuals outside our organization. The risk of a cybersecurity incident or disruption, particularly through cyber-attack or cyber-intrusion, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased. Although we have not experienced any cybersecurity incidents to date, and have not been affected by any incidents incurred by third-party partners, such incidents could have a material adverse effect on our business, financial condition or results of operations in the future. Additionally, future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks, as our information technology and systems could be negatively affected by vulnerabilities present in acquired or integrated entities' systems and technologies. Furthermore, we may learn of cybersecurity issues that were not identified during due diligence of such entities, and it may be difficult to integrate entities into our information technology environment and security program.
We also rely on a number of third-party service providers to host, store or otherwise process information for us, or to provide other facilities or infrastructure that we make use of, including "cloud-based" providers of corporate infrastructure services relating to, among other things, human resources, communication services and some financial functions, and we are therefore dependent on the security systems of these providers. These third-party entities are subject to similar risks as we are relating to cybersecurity, business interruption and systems and employee failures and a cybersecurity incident or other significant disruption affecting such third parties could have a material adverse effect on our business. While we may be entitled to damages if our third-party service providers fail to satisfy their security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.
Because the techniques used to obtain unauthorized access to or sabotage security systems change frequently and are often not recognized until after an attack, we and our third-party service providers may be unable to anticipate the techniques or implement adequate preventative measures, thereby exposing us to material adverse effects on our business, financial condition, results of operations and growth prospects. In order to address risks to our information systems, we continue to make investments in personnel, technologies and training. Data protection laws and regulations around the world, including in jurisdictions where operate, like the U.S. and EU, often require "reasonable," "appropriate," or "adequate" technical and organizational security measures, and the interpretation and application of those laws and regulations are often uncertain and evolving; there can be no assurance that our security measures will be deemed adequate, appropriate or reasonable by a regulator or court. Moreover, even security measures that are deemed appropriate, reasonable and/or in accordance with applicable legal requirements may not be able to protect the information we maintain. A cybersecurity incident or other significant disruption impacting us or our third-party service providers could require a substantial level of financial resources to rectify and otherwise respond to, may be difficult to identify or address in a timely manner, may compromise our research, the therapies we are developing or other intellectual property or trade secrets, and may divert management's attention and require the expenditure of significant time and resources. Such cybersecurity incidents or other significant disruptions could result in claims, increased regulatory scrutiny or investigations, and may cause us to incur substantial fines, penalties or other liability and related legal and other costs. Any actual or perceived cybersecurity incident or significant disruption may also interfere with our ability to comply with financial reporting requirements and harm our reputation and market position, especially given that we handle sensitive information, including clinical trial data. Any of the foregoing matters could harm our operating results and financial condition.
While we have purchased cybersecurity insurance, there are no assurances that the coverage would be adequate in relation to any incurred losses. Moreover, as cyber-attacks increase in frequency and magnitude, we may be unable to obtain cybersecurity insurance in amounts and on terms we view as adequate for our operations.