2 unchanged sentences
Cybersecurity Risk Management
−Removed: As part of our overall enterprise risk management program, we maintain a robust cybersecurity risk management program.
−Removed: The cross-functional group responsible for the cybersecurity risk management program includes members of our information security, data privacy and product security personnel, including members of our senior management team.
−Removed: Our cybersecurity program provides a foundation for identifying, monitoring, evaluating, and responding to cybersecurity threats and incidents, including those associated with our use of
−Removed: software, applications, services, and cloud infrastructure developed or provided by third-party vendors and service providers.
−Removed: This framework includes steps for identifying the source of a cybersecurity threat or incident, including whether such cybersecurity threat or incident is associated with a third-party vendor or service provider, assessing the severity and overall risk of a cybersecurity threat or incident, implementing cybersecurity countermeasures and mitigation or remediation strategies, and informing the relevant members of our senior management team, which informs the Audit Committee and our Board of Directors of material cybersecurity threats and incidents.
−Removed: We engage third parties, including vendors and other external service providers, to support our cybersecurity and data privacy processes.
+Added: As part of our overall enterprise risk management program, we maintain a robust cybersecurity risk management program led by a cross-functional team which includes members of our information security, data privacy and product security personnel, including members of our senior management team.
+Added: Our cybersecurity program is designed to identify, monitor, evaluate, and respond to cybersecurity threats and incidents, including those associated with third-party software, cloud infrastructure and services.
+Added: This framework includes steps for identifying the source of a cybersecurity threat or incident, including if such cybersecurity threat or incident is associated with a third-party vendor or service provider, assessing severity and overall risk, implementing countermeasures and mitigation or remediation strategies, and escalating to our senior management team, and for material threats or incidents, which then informs the Audit Committee and our Board of Directors.
+Added: We engage third parties, including vendors, counsel and other external service providers, to support our cybersecurity and data privacy processes.
For example, we regularly engage independent third parties for penetration testing and evaluation of our various security compliance standards.
1 unchanged sentence
We review and update our cybersecurity policies, standards and procedures as needed, to account for changes in the threat and operational landscapes, as well as in response to legal and regulatory developments.
−Removed: Our team has established a continuous improvement process through which we regularly update our risk register against the evolving capabilities of adversaries and incorporate findings from internal and external testing.
+Added: Our team has established a continuous improvement process through which we regularly update our risk register to reflect the evolving capabilities of threat actors and incorporate findings from internal and external testing.
Further, we require mandatory training for all employees and contractors on our cybersecurity and privacy policies.
−Removed: We also have processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers.
−Removed: To that end, we maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.
+Added: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as risks from third-party systems that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.
In addition, we perform diligence on our vendors and prospective vendors regarding their cybersecurity posture.
Although we have continued to invest in our diligence, onboarding, and monitoring capabilities over our critical third parties, including our third-party vendors and service providers, our control over the security posture of our critical third parties is limited, and there can be no assurance that we can prevent or mitigate the risk of any compromise or failure in the information assets owned or controlled by such third parties.
−Removed: A cross-functional incident response team, comprised of representatives from information security, information technology, privacy and legal, is responsible for the monitoring and disposition of potential occurrences such as data breaches, intrusions, and other security incidents and implementing our detailed incident response plan.
−Removed: Our incident response plan includes processes and procedures for assessing potential internal and external threats, activation and notification, and post-incident recovery designed to safeguard the confidentiality, availability, and integrity of our information assets.
+Added: A cross-functional incident response team, comprised of representatives from information security, information technology, privacy and legal, is responsible for monitoring and responding to data breaches, intrusions, and other security incidents in accordance with our incident response plan.
+Added: Our incident response plan includes processes and procedures for assessing potential internal and external threats, escalation and stakeholder notification, law enforcement notification where required, and post-incident recovery designed to safeguard the confidentiality, availability, and integrity of our information assets.
In fiscal 2026, and through the filing of this Annual Report on Form 10-K, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business strategy, operating results, and/or financial condition.
3 unchanged sentences
Our Board of Directors has oversight responsibility for our overall enterprise risk management, and cybersecurity risk management in particular is regularly reviewed and overseen by our Audit Committee.
−Removed: The Audit Committee provides oversight and reviews management policies, processes, and procedures designed to identify, monitor, evaluate, and respond to cybersecurity risks to which the company is exposed.
−Removed: Management regularly reports to the Audit Committee regarding its process and procedures to mitigate or remediate cybersecurity risks, threats and incidents, along with monitoring activities of the cybersecurity team.
−Removed: Our Audit Committee provides oversight of our cybersecurity program and receives quarterly cybersecurity updates from our Chief Information Security Officer (CISO) through written reports and presentations.
−Removed: Our CISO has over 20 years of experience in cybersecurity, and has held senior leadership positions at publicly traded companies in the technology industry, bringing extensive expertise in managing cybersecurity risks.
−Removed: The CISO’s leadership team consists of seasoned information security professionals with experience at globally recognized organizations, ensuring a robust and comprehensive approach to cybersecurity oversight.
−Removed: Management is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures, and maintaining cybersecurity programs.
−Removed: Our cybersecurity programs are under the direction of our CISO, who is a member of our executive management team and closely coordinates as needed with other senior management personnel including the President of Product, Technology, and Operations and the Chief Legal Officer, who collectively possess significant experience in evaluating, managing and mitigating security and other risks, including cybersecurity risks.
+Added: The Audit Committee reviews management policies, processes, and procedures designed to identify, monitor, evaluate, and respond to cybersecurity risks to which the company is exposed.
+Added: Management regularly reports to the Audit Committee regarding its process and procedures to mitigate or remediate cybersecurity risks, threats and incidents, as well as monitoring activities of the cybersecurity team.
+Added: Our Audit Committee provides oversight of our cybersecurity program and receives quarterly cybersecurity updates from our Chief Trust Officer (CTO).
+Added: Our CTO has over 25 years of experience leading technology and security transformation at large-scale, public technology organizations.
+Added: This expertise, supported by a leadership team of seasoned information security professionals with experience at globally recognized organizations, ensuring a robust and comprehensive approach to cybersecurity oversight.
+Added: Management is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes to monitor potential cybersecurity risks and implementing appropriate mitigation or remediation measures, and maintaining cybersecurity programs.
+Added: Our cybersecurity programs are under the direction of our CTO, who is a member of our executive management team and closely coordinates as needed with other senior management personnel, including the President, Product and Technology and the Chief Legal Officer, who collectively possess significant experience in evaluating, managing and mitigating security and other risks, including cybersecurity risks.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.