8 unchanged sentences
Our cybersecurity program is integrated into our broader enterprise risk management program ("ERM").
−Removed: This integration is designed to ensure that cybersecurity risks are evaluated alongside other risks to the organization.
+Added: This integration is designed to ensure that cybersecurity risks, including the cybersecurity risks associated with AI, are evaluated alongside other risks to the organization as part of our overall risk management framework and strategy.
Our ERM framework is periodically refreshed and involves collaboration with subject matter experts to assess the severity of potential cybersecurity threats and develop appropriate mitigation strategies.
−Removed: • Advanced Cybersecurity Processes:
+Added: • Cybersecurity Processes:
We employ a multi-faceted approach to cybersecurity:
9 unchanged sentences
Our threat intelligence program models and researches potential adversaries, enhancing our preparedness against emerging threats.
+Added: • Monitoring and Mitigation of AI-Enhanced Threats:
+Added: As AI and machine learning capabilities mature, the cybersecurity threat landscape is evolving to include attacks that may be enhanced or facilitated by AI.
+Added: As part of our cybersecurity program, we monitor this evolving threat landscape and evaluate protective measures intended to improve our ability to detect, prevent, triage, and respond to AI-enhanced threats.
• Training and Simulations:
11 unchanged sentences
Regular tabletop exercises help us test and strengthen our incident response capabilities.
+Added: We also have an external bug bounty program to identify and address vulnerabilities before they can be exploited.
• Vendor Risk Management:
Our vendor risk management program is designed to mitigate risks associated with third-party service providers.
−Removed: This program includes pre-engagement diligence , contractual security provisions, and ongoing monitoring of third-party compliance with our security requirements.
−Removed: We also have an external bug bounty program to identify and address vulnerabilities before they can be exploited.
+Added: This program includes pre-engagement diligence , contractual security, privacy, and AI-related data protection provisions, and ongoing monitoring of third-party compliance with our data protection requirements.
Information on the cybersecurity risks we face is discussed in Part I, Item 1A, “Risk Factors.” We believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition.
6 unchanged sentences
The committee also reviews incident response plans and any significant cybersecurity threats or incidents.
−Removed: Our Board's Security and Privacy Committee reports quarterly to our Board regarding its activities in overseeing cybersecurity risk management.
+Added: Our Board's Security and Privacy Committee reports quarterly to our Board regarding its activities in overseeing cybersecurity, AI, data protection and privacy risk management.
• Management's Role:
−Removed: Our Chief Information Security Officer ("CISO") leads our global cybersecurity program, overseeing risk identification, evaluation, and response to material security incidents.
−Removed: The CISO partners with a cross-functional leadership team including the Chief Product Security Officer ("CPSO"), Chief Information Officer ("CIO"), and Legal and Privacy Counsel, to develop and implement our overall cybersecurity strategy.
+Added: Our Chief Information Security Officer ("CISO") partners with a cross-functional leadership team including the Chief Product Security Officer ("CPSO"), Chief Information and Digital Officer ("CIDO"), and Legal and Privacy Counsel, to develop and implement our overall cybersecurity strategy.
This team contributes to the development of policies, monitors evolving risks, manages the overall cybersecurity and privacy programs, and reports on these and related topics to our Board's Security and Privacy Committee.
1 unchanged sentence
He holds an undergraduate degree in computer science.
−Removed: Our CPSO spent most of the first two decades of his career with the U.S.
−Removed: Department of Defense, where he held various roles in information technology and other high-governance technology-driven positions.
−Removed: Over the past ten years, he has built security programs with Nutanix, which has culminated in his current role.
−Removed: He holds an undergraduate degree in computer information systems.
+Added: Our CPSO also previously held the role at Nutanix and served as the Chief Information Security Officer at Intuit.
+Added: He holds a PhD in computer science.
• Incident Management:
1 unchanged sentence
This team assesses incidents' severity, coordinates the response, and communicates with relevant stakeholders.
−Removed: Our Security and Privacy Management Team, including, as appropriate, our CISO, CIO, and CPSO, provides additional expertise and support as needed.
+Added: Our Security and Privacy Management Team, including, as appropriate, our CISO, CIDO, and CPSO, provides additional expertise and support as needed.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.