Teradata (TDC) Risk Analysis

As a technology company, our intellectual property portfolio is crucial to our continuing ability to be a leading multi-cloud data and analytics platform provider. We strive to enhance and, as much as is legally and reasonably possible, protect our proprietary intellectual property rights through patent, copyright, trademark and trade secret laws, as well as through technological safeguards and the actions of our people. These efforts include protection of the offerings and application, diagnostic and other software we develop. Where gaps exist in our intellectual property protection, even if such gaps are reasonable, our business could be materially adversely impacted. We may be unable to prevent third parties from using our technology without our authorization or independently developing technology that is similar to ours, particularly in those countries where the laws do not protect our proprietary rights as fully as in the United States (such as Iran, China and certain Eastern European countries who may use NSSAPC to advance their own industries). With respect to inventions for which we choose to file patent applications, we may not be successful in securing patents for these claims, and our competitors may already have applied for patents that, once issued, will prevail over our patent rights or otherwise limit our ability to sell our offerings. While we take steps to provide for confidentiality obligations of employees and third parties with whom we do business (including customers, suppliers and strategic partners), there is a risk that such parties will breach such obligations and jeopardize our intellectual property rights. Many customers have outsourced the administration and management of their data and analytics environments to third parties, including some of our competitors, who then have access to our confidential information. Although we have agreements in place to mitigate this risk, there can be no assurance that such protections will be sufficient. In addition, our ability to capture and re-use field-based developed intellectual property is important to future business opportunities and profits. We are seeing an extended trend towards aggressive enforcement of intellectual property rights, especially by so-called "patent assertion entities" ("PAEs") or "non-practicing entities" ("NPEs"), as the functionality of offerings in our industry increasingly overlaps and the volume of issued software patents continues to grow. As a result, we have been, and in the future could be, subject to infringement claims which, regardless of their validity, could: - Be expensive, time consuming, and divert company resources and management attention away from normal business operations;- Require us to pay monetary damages or enter into non-standard royalty and licensing agreements;- Require us to modify our product sales and development plans; or - Require us to satisfy indemnification obligations to our customers. Regardless of whether these claims have any merit, they can be burdensome to defend or settle and can harm our business, reputation, financial condition and results of operations.

Our operations are critically dependent on the security of our computer systems, the computer systems of our key suppliers and third parties, and the information stored in such systems. We face risks from, among other things, natural disasters (such as earthquakes and fires), technological threats (such as cyber-attacks, power outages, and telecommunications failures), and human actions (such as unauthorized access or exploitations, insider actions, phishing schemes, and other events). Increasingly, companies are subject to a wide variety of attacks on their networks on an ongoing basis. Incidences of cyberattacks and other cybersecurity breaches and incidents have increased and are likely to continue to increase. The occurrence of one or more of these events could result in data loss, system outages, and other interruptions in our operations, which could have a material adverse effect on our business, financial condition or results of operations. Despite robust data security measures and skilled computer programmers, nation state sponsored cyber attackers (including from countries such as Iran, China, Russia and certain Eastern European nations) and hackers may be able to penetrate our network security or that of our third-party providers and misappropriate or compromise our intellectual property or other confidential information or that of our customers, create system disruptions or cause shutdowns. They may also be able to develop and deploy viruses, worms, and other malicious software programs that attack our systems or products or otherwise exploit security vulnerabilities of our systems or products. In addition, phishing-scheme-perpetrators may be able to lure employees or contractors into providing such perpetrators with information that may enable them to avoid some of our network security controls or those of third-party providers which could result in system disruptions or a loss of confidential and proprietary information. While immaterial in impact, we have been subject to actual and threatened cyber-attacks, and there can be no assurance that our defensive measures will be adequate to prevent them in the future. From time to time we discover vulnerabilities in our software products, and while we routinely perform regular system updates and patches to our various information systems and our products to address such vulnerabilities, our security measures may not be able to detect and address each vulnerability, which if exploited by threat actors, can result in a cyber incident with material impact to our business, financial condition and results of operations. When such attacks occur, we could incur significant liability to our customers whose information was compromised, and our product platform may be perceived as less desirable, which could negatively affect our business and damage our reputation. Further, because we do not control our third-party service providers, or the processing of data by our third-party service providers, we cannot ensure the integrity or security of measures they take to protect customer information and prevent data loss. These types of activities will recur and persist, one or more of them may be successful in the future, and one or more of them may have been or will be successful but not detected, prevented, remediated or mitigated by us, and the costs to us to eliminate, detect, prevent, remediate, mitigate or alleviate cyber security or security vulnerabilities could be significant, and our efforts to address these problems may not be successful and could adversely impact our future results of operations. If as a result of these events, the information stored on our or our customers' systems could be accessed, publicly disclosed, altered, lost or stolen, they can subject us to additional liability and cause us financial harm. In addition, our disclosures concerning security incidents may become the subject of litigation, and cause us, especially in the event of an adverse court ruling, additional financial strain and reputational harm. While we take and will continue to take remediation steps, there is no guarantee that our preventative and mitigation actions with respect to any cybersecurity incident will fully eliminate the risk of a malicious compromise of our, our third-party service providers' or our customers' systems. Additionally, we offer the ability for our employees to choose a remote work location which introduces additional security challenges. The increase in endpoints to manage and reliance on employees to adhere to information security policies and hygiene practices, heightens the vulnerability of our systems to security breaches. While we maintain insurance coverage for certain liabilities related to cyber-attacks and/or data breaches, such coverage may not adequately cover all costs, expenses, liability and damages that we or our customers may incur as a result of such incidents.