7 unchanged sentences
Based on the gap assessment, for example, we have taken a number of actions intended to reduce our cybersecurity risk, including enhancing our email and end-point security programs, implementing a single dashboard for security monitoring and improving our web application filtering programs.
−Removed: We are focused on the continuous improvement of key processes such as data security, asset management, access control, vulnerability management, incident response, and third-party risk management.
−Removed: We also maintain business continuity management certification to ensure the ongoing review of our business continuity, disaster recovery and incident management processes, including as a result of a cybersecurity breach.
+Added: We are focused on the continuous improvement of key processes such as data security, asset management, information protection processes and procedures, protective technologies, and continuous monitoring.
+Added: We also maintain business continuity management certification to ensure the ongoing review of our business continuity, disaster recovery and incident management processes.
Our Information Technology (IT) team is responsible for our cybersecurity monitoring and leverages a 24x7 Managed Detection & Response (MDR) third-party vendor to provide real-time cybersecurity threat monitoring and incident response, as well as to conduct a quarterly risk assessment.
2 unchanged sentences
Pursuant to this plan, we will also utilize third-party experts to help identify, contain and remediate any incident that could have a significant impact on us.
−Removed: In addition, we use third-party experts to assist us in performing annual penetration testing and active breach assessment simulations to verify implementation of security tools, mitigating controls, and our ability to respond to real-world scenarios pursuant to our incident response policy.
+Added: In addition, we use third-party experts to assist us in performing annual penetration testing and red team exercises to verify implementation of security tools, mitigating controls, and our ability to respond to real-world scenarios pursuant to our incident response policy.
As part of our cybersecurity roadmap, we also assess third-party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers and other business partners associated with our use of third-party service providers.
2 unchanged sentences
We are highly focused on cybersecurity awareness and perform annual certification of our employees, execute ongoing phishing campaigns, intervene with phish-prone individuals, publish monthly cybersecurity newsletters, and participate in Cybersecurity Awareness Month, in October each year.
−Removed: As of the date of this Annual Report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations and financial condition.
+Added: In early September 2025, we became aware that unauthorized persons, reportedly associated with a nation-state actor, had gained access to our IT network.
+Added: We promptly initiated our incident response plan and began an investigation, containment and remediation effort using multiple third-party cybersecurity experts, including federal law enforcement.
+Added: We are not aware of evidence indicating that the threat actor accessed or exfiltrated any material information.
+Added: Several customer files saved outside of the main network appear to have been accessed by the threat actor and those customers have been notified by us.
+Added: The September 2025 incident, including the costs of our remediation activities, did not have a material adverse effect on our business strategy, results of operations or financial condition.
+Added: Further, as of the date of this Annual Report, we are not aware of any other risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us , including our business strategy, results of operations and financial condition.
Cybersecurity Risk Governance
2 unchanged sentences
Key cybersecurity topics are presented regularly to the Audit Committee.
−Removed: In addition, if any cybersecurity incident is determined under our incident response policy to pose a risk in excess of an identified threshold (as set forth in the policy), our
−Removed: Chief Legal Officer will promptly notify the Audit Committee regarding the incident.
+Added: In addition, if any cybersecurity incident is determined under our incident response policy to pose a risk in excess of an identified threshold (as set forth in the policy), our Chief Legal Officer will promptly notify the Audit Committee regarding the incident.
The notification to the Audit Committee will include management’s determination regarding whether or not the incident is material to us.
2 unchanged sentences
Prior to Ericsson, she held cybersecurity positions at Walgreens, Fortunes Brands Home & Security, and W.W.
−Removed: She is a Certified Information Security Manager, has operated her own security firm, and has over 20 years of cybersecurity experience, including her time as a US Navy Operations and Training Manager.
+Added: She is a Certified Information Security Manager, has operated her own security firm, and has over 20 years of cybersecurity experience, including her time as a U.S.
+Added: Navy Operations and Training Manager.
Our CIO has held that position (or Head of IT) at Ribbon for over seven years.
5 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.