5 unchanged sentences
As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats.
−Removed: We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments in our data and cybersecurity infrastructure.
+Added: We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations as detailed in our Risk Factors, and we intend to continue to make significant investments in our data and cybersecurity infrastructure.
There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective as cyber criminals are becoming more sophisticated and effective every day and increasingly targeting enterprise software companies.
12 unchanged sentences
Technical Safeguards
+Added: 2025 Annual Report 41
We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats.
7 unchanged sentences
We use a variety of inputs in such risk assessments, including information supplied by providers and third parties.
+Added: These inputs may include, as appropriate, our review of third-party audit reports, ongoing monitoring activities and validation of relevant security certifications.
In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.
2 unchanged sentences
We regularly remind employees of the importance of handling and protecting customer and employee data, including through annual privacy and security training, to enhance employee awareness of how to detect and respond to cybersecurity threats.
+Added: The training we offer to employees covers critical cybersecurity topics such as phishing, insider threats and the secure use of company systems.
External Assessments
12 unchanged sentences
The following individuals have primary responsibility for assessing and managing cybersecurity risks:
−Removed: • Chief customer officer (“CCO”), who oversees the digital transformation, digital technology and security functions
−Removed: • Chief digital information officer (“CDIO”), who oversees enterprise-wide digital transformation
−Removed: • Chief information security officer (“CISO”), who oversees the security function and reports to the CCO
+Added: • Chief product officer (“CPO”) and chief operating officer (“COO”), who oversees the digital transformation, digital technology and security functions
+Added: • Chief digital information officer (“CDIO”), who oversees enterprise-wide digital technology
+Added: • Chief information security officer (“CISO”), who oversees the security function and reports to the COO
• Chief technology officer (“CTO”), who oversees product engineering and advanced technologies
−Removed: • General Counsel, who oversees the legal and compliance functions
+Added: • Chief legal officer (“CLO”), who oversees the legal and compliance functions
These individuals, among others, also serve as members of management’s Security Steering Committee (the “Security Committee”), which is a governing body that drives alignment on security decisions across the Company.
−Removed: The Security Committee meets quarterly to review security performance metrics, identify security risks, and assess the status of approved security enhancements.
+Added: The Security Committee meets periodically to review security performance metrics, identify security risks, and assess the status of approved security enhancements.
The Security Committee also considers and makes recommendations on security policies and procedures, security service requirements, and risk mitigation strategies.
−Removed: Our CCO has served in various roles in information technology and information security for over 20 years, including serving as our Chief Information Officer (“CIO”) and either the Chief Technology Officer or CIO of three other public companies.
−Removed: He holds an undergraduate degree in computer engineering.
+Added: Our CPO and COO has served in various roles in information technology and information security for over 25 years, including serving as the Head of Platform and in other senior leadership roles at two other large public companies overseeing areas such as cloud infrastructure, platform security and enterprise product development.
+Added: He holds an undergraduate degree in electrical and computer engineering and a master’s degree in information networking.
Our CDIO has served in various roles in information technology for over 20 years, including serving as our Senior Vice President of Digital Technology Experience and in similar senior roles at two other public companies.
−Removed: Our CISO has served in various roles in information technology
−Removed: and information security for almost 20 years, including serving as the Chief Information Security Officer or Chief Security Officer at two other large public companies.
−Removed: He holds an undergraduate and master’s degree in computer science.
+Added: Our CISO has served in various roles in information technology and information security for almost 20 years, including serving as the Chief Information Security Officer or Chief Security Officer at three other large public companies.
+Added: He holds undergraduate and master’s degrees in computer science.
Our CTO has served in various roles in information technology for over 25 years and has been with us since 2011.
−Removed: Our General Counsel has over 20 years of experience managing risks, including risks arising from cybersecurity threats, at several large public technology companies.
+Added: Our CLO has over 25 years of experience managing risks, including risks arising from cybersecurity threats, at large public technology companies.
+Added: 2025 Annual Report 43
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.