16 paragraphs of its Risk Factors mention Cybersecurity, against 18 the year before.
Compare companies, side by side
The same facts from the filings for each company in a group, where each stands among the others, and what each wrote about a topic in its latest 10-K.
- Sales growth
- +5.1%
- Gross margin
- 59%
- Operating margin
- 40%
- Net margin
- 22%
The 3 largest with EXR, ranked among the group
Each corner is the share of Real estate companies the company is above on that ratio. The dashed line is the middle of the group. A rank, not a score.
19 paragraphs of its Risk Factors mention Cybersecurity, against 18 the year before.
15 paragraphs of its Risk Factors mention Cybersecurity, against 14 the year before.
Real estate: the same facts for each company
| Company | Revenue, 12 months | Sales growth | Gross / operating margin | Net margin | Debt / equity | Accounting items | Insider buys | Investors | Open |
|---|---|---|---|---|---|---|---|---|---|
| EXRYou came from Extra Space Storage | $3.5B
|
+3.7% |
GM -OM 44%
|
30% | - | 0 of 5to read | 0 | 0 | 10-K |
| CBRE CBRE Group | $45.0B
|
+13% |
GM 17%OM 4.6%
|
3.1% | 0.91 | 0 of 5to read | 0 | 0 | 10-K |
| WELL Welltower | $13.8B
|
+36% |
GM 22%OM -
|
12% | 0.37 | 1 of 5to read | 4 | 0 | 10-K |
| AMT American Tower | $11.0B
|
+5.1% |
GM -OM 45%
|
30% | 10.69 | 1 of 5to read | 2 | 0 | 10-K |
| EQIX Equinix | $10.1B
|
+5.4% |
GM 52%OM 23%
|
16% | 1.57 | 0 of 5to read | 0 | 0 | 10-K |
| PLD Prologis | $8.9B
|
+7.2% |
GM -OM 52%
|
42% | 0.65 | 1 of 5to read | 0 | 0 | 10-K |
| IRM Iron Mountain | $7.8B
|
+12% |
GM -OM 19%
|
5.9% | - | 0 of 4to read | 0 | 0 | 10-K |
| SPG Simon Property Group | $7.2B
|
+6.7% |
GM -OM 46%
|
63% | 6.96 | 2 of 4to read | 11 | 0 | 10-K |
| WY Weyerhaeuser | $7.0B
|
-3.1% |
GM 15%OM 12%
|
6.5% | 0.57 | 0 of 6to read | 0 | 0 | 10-K |
| VTR Ventas | $6.8B
|
+18% |
GM -OM -
|
3.9% | 0.79 | 0 of 5to read | 0 | 0 | 10-K |
| DLR Digital Realty | $6.3B
|
+10% |
GM -OM 12%
|
22% | - | 2 of 5to read | 0 | 0 | 10-K |
| HST Host Hotels & Resorts | $6.2B
|
+7.6% |
GM -OM 15%
|
15% | 0.20 | 0 of 4to read | 0 | 0 | 10-K |
| O Realty Income | $6.2B
|
+9.1% |
GM -OM -
|
22% | 0.04 | 2 of 5to read | 0 | 0 | 10-K |
| PSA Public Storage | $5.0B
|
+2.7% |
GM -OM -
|
38% | 0.84 | 0 of 4to read | 0 | 0 | 10-K |
| VICI Vici Properties | $4.2B
|
+4.1% |
GM 99%OM -
|
56% | 0.58 | 1 of 4to read | 0 | 0 | 10-K |
| CCI Crown Castle | $4.1B
|
-4.4% |
GM -OM 47%
|
20% | - | 3 of 5to read | 0 | 0 | 10-K |
| CSGP CoStar Group | $3.7B
|
+19% |
GM 78%OM 5.8%
|
4.9% | 0.13 | 1 of 5to read | 0 | 0 | 10-K |
| BXP BXP, Inc. | $3.5B
|
+2.2% |
GM 59%OM -
|
8.4% | 0.15 | 1 of 5to read | 0 | 0 | 10-K |
| DOC Healthpeak Properties | $3.1B
|
+4.5% |
GM -OM -
|
12% | 1.19 | 1 of 5to read | 0 | 0 | 10-K |
| INVH Invitation Homes | $2.9B
|
+4.2% |
GM -OM -
|
24% | 0.99 | 0 of 4to read | 0 | 0 | 10-K |
| SBAC SBA Communications | $2.9B
|
+5.1% |
GM 76%OM 48%
|
35% | - | 1 of 5to read | 0 | 0 | 10-K |
| ARE Alexandria Real Estate Equities | $2.8B
|
-2.9% |
GM -OM -
|
-52% | 0.87 | 1 of 5to read | 2 | 0 | 10-K |
| MAA Mid-America Apartment Communities | $2.2B
|
+0.8% |
GM -OM -
|
18% | - | 0 of 4to read | 1 | 0 | 10-K |
| KIM Kimco Realty | $2.2B
|
+5.1% |
GM -OM 36%
|
28% | 0.75 | 1 of 4to read | 0 | 0 | 10-K |
| ESS Essex Property Trust | $1.9B
|
+6.4% |
GM 70%OM 33%
|
21% | 1.20 | 0 of 4to read | 0 | 0 | 10-K |
| UDR UDR, Inc. | $1.7B
|
+2.4% |
GM -OM 52%
|
41% | 1.84 | 0 of 4to read | 0 | 0 | 10-K |
| REG Regency Centers | $1.6B
|
+6.9% |
GM -OM 72%
|
34% | 0.73 | 0 of 5to read | 0 | 0 | 10-K |
| CPT Camden Property Trust | $1.6B
|
+1.9% |
GM -OM -
|
72% | 1.06 | 0 of 4to read | 0 | 0 | 10-K |
| FRT Federal Realty Investment Trust | $1.3B
|
+6.4% |
GM -OM 54%
|
39% | 1.50 | 0 of 3to read | 0 | 0 | 10-K |
| VMRK Vivmark Residential | -
|
- |
GM -OM -
|
- | 0.84 | 0 of 4to read | 0 | 0 | 10-K |
Growth against cash margin
The 12 largest by revenue. A bigger bubble is more revenue; the dashed lines are the median of these companies.
How to read this page
- A radar shows where a company ranks among its group on six ratios. A corner at the edge means it is above every other company on that ratio.
- A table row lists the facts as the filings give them: revenue, growth, margins, debt to equity, the accounting checks, insider buying and followed investors holding.
- A bubble to the right grew faster, and one higher up kept more of its sales as free cash flow.
- A bar is paragraphs that mention the topic this year, and the mark on it is last year.
Risk Factors and XBRL figures from each company's latest 10-K, read nightly from SEC EDGAR. Nothing here is a rating.
Cybersecurity: paragraphs that mention it
All 81 companies
Risk Factors paragraphs in each company's latest 10-K, most mentions first. The bar is this year and the mark is last year. 16 companies have no 10-K downloaded yet.
What the companies wrote
VTR Ventas, Inc.
38 paragraphsCybersecurity threats and incidents, such as those involving software bugs, server malfunctions, software or hardware failure, telecommunications failures, error or misconduct, ransomware, covertly introduced malware, denial-of-service attacks, impersonation of authorized users or other social engineering schemes (including phishing …
Word for word as last year Item 1A, Risk Factors, 10-K Feb 6, 2026
… For more information about applicable data privacy and cybersecurity laws and regulations, see “Government Regulation - United States Healthcare Regulation, Licensing and Enforcement - Data Privacy and Cybersecurity” for a discussion of U.S. data privacy and cybersecurity laws and regulations and …
Item 1A, Risk Factors, 10-K Feb 6, 2026Marked against last year's 10-K
In the ordinary course of business, we and our managers, tenants and borrowers collect, use, store, disclose, transfer and otherwise process personal information, including personal information specific to tenants, residents and employees. We or our managers, tenants and borrowers may transfer some of this personal information to third parties who assist with certain aspects of our or their business for limited purposes. Accordingly, we and our managers, tenants and borrowers are subject to a variety of stringent data privacy and cybersecurity laws and regulations at thestate,state and federal level andinternational level,outside the United States (including HIPAA and the U.K. GDPR), as well as contractual requirements and other obligations related to data privacy and cybersecurity. For more information about applicable data privacy and cybersecurity laws and regulations, see “Government Regulation - United States Healthcare Regulation, Licensing and Enforcement - Data Privacy and Cybersecurity” for a discussion of U.S. data privacy and cybersecurity laws and regulations and “Government Regulation -InternationalForeign Healthcare Regulation” for a discussion ofinternationalforeign data privacy and cybersecurity laws and regulations.
INVH Invitation Homes Inc.
32 paragraphsUnited States regulators have also increased their focus on cyber security vulnerabilities and risks. Compliance with laws and regulations concerning cyber security, such as SEC rules requiring disclosure of material cybersecurity incidents, data governance, and data protection could result in …
Item 1A, Risk Factors, 10-K Feb 19, 2026Marked against last year's 10-K
United States regulators have also increased their focus on cyber security vulnerabilities and risks. Compliance with laws and regulations concerning cyber security, such asthe recently enactedSEC rules requiring disclosure of material cybersecurity incidents, data governance, and data protection could result in significant expense, and any failure to comply could result in proceedings against us by regulatory authorities or other third parties. See “ - Our business is subject to laws and regulations regarding privacy, data protection, consumer protection, and other matters. Many of these laws and regulations are subject to change and uncertain interpretation, and could result in claims, changes to our business practices, monetary penalties, or otherwise harm our business. ”
… We maintain cyber liability insurance; however, this insurance may not be sufficient to cover the financial, legal, business, or reputational losses that may result from an interruption or breach of our systems. In connection with our flexible work arrangements, a …
Item 1A, Risk Factors, 10-K Feb 19, 2026Marked against last year's 10-K
Information security risks have generally increased in recent years due to the rise in new technologies and the increased sophistication and activities of perpetrators of cyberattacks. In the ordinary course of our business, we acquire and store sensitive data, including intellectual property, our proprietary business information, and personally identifiable information of our prospective and current residents, associates, and third-party service providers. The secure processing and maintenance of such information is critical to our operations and business strategy. Despite our security measures, our information technology and infrastructure are subject to ongoing threats and attacks and may be vulnerable to attacks by malicious third parties or breached due to employee error, malfeasance, or other disruptions. Due to the nature of some of the attacks, there is a risk that they may remain undetected for a period of time. Since the techniques used to obtain unauthorized access to systems, or to otherwise sabotage them, change frequently and are often not recognized until launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative measures. While we have invested in the protection of data and information technology and implemented processes, procedures, and internal controls that are designed to mitigate cybersecurity risks and cyber intrusions, there can be no assurance that our efforts will prevent cyber incidents or security breaches. Any such breach could compromise our networks and the information stored therein could be accessed, publicly disclosed, misused, lost, or stolen. Any such access, disclosure or other loss of information could result in legal claims or proceedings, misstated or unreliable financial data, liability under laws that protect the privacy of personal information,regulatory penalties, disruption to our operations and the services we provide to customers, including our residents, or damage our reputation, any of which could adversely affect our results of operations, reputation, and competitive position. We maintain cyber liability insurance; however, this insurance may not be sufficient to cover the financial, legal, business, or reputational losses that may result from an interruption or breach of our systems. In connection with our flexible work arrangements, a significant number of our associates work remotely on a recurring basis. An extended period of remote work arrangements could strain our business continuity plans, introduce operational risk, including, but not limited to cybersecurity risks, and impair our ability to manage our business.
ARE ALEXANDRIA REAL ESTATE EQUITIES, INC.
29 paragraphsIn particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our
Word for word as last year Item 1A, Risk Factors, 10-K Jan 26, 2026
payments due to, for example, applicable laws or regulations prohibiting such payments. Ransomware and similar attacks that
Item 1A, Risk Factors, 10-K Jan 26, 2026Marked against last year's 10-K
payments due to, for example, applicable laws or regulations prohibiting such payments. Ransomware and similar attacks that
DOC HEALTHPEAK PROPERTIES, INC.
24 paragraphsCybersecurity incidents and cybersecurity threats affecting our or our operators’ or other third party providers’ information systems, including those caused by physical or electronic break-ins, computer viruses, malware, worms, attacks by hackers or foreign governments, ransomware attacks, disruptions from …
Word for word as last year Item 1A, Risk Factors, 10-K Feb 3, 2026
Cybersecurity threat actors may utilize AI tools to automate and enhance cybersecurity attacks against us. We utilize software and platforms designed to detect such cybersecurity threats, including AI-based tools, but these threats could become more sophisticated and harder to …
Word for word as last year Item 1A, Risk Factors, 10-K Feb 3, 2026
EQIX EQUINIX INC
24 paragraphs… Recent developments in the cyber threat landscape include use of AI and machine learning, as well as an increased number of cyber extortion and ransomware attacks, with the potential for higher financial ransom demand amounts and increasing sophistication and variety …
Item 1A, Risk Factors, 10-K Feb 11, 2026Marked against last year's 10-K
As techniques used to breach security change frequently and are generally not recognized until launched against a target, we may not be able to promptly detect that a cyber breach has occurred, or implement security measures in a timely manner or, if and when implemented, we may not be able to determine the extent to which these measures could be circumvented. Recent developments in the cyber threat landscape include use of AI and machine learning, as well as an increased number of cyber extortion and ransomware attacks, with the potential for higher financial ransom demand amounts and increasing sophistication and variety of ransomware techniques and methodology. Further, any adoption of AI by us or by third parties may pose new security challenges. A party who is able to compromise the security measures on our networks or the security of our infrastructure could misappropriate the proprietary or sensitive information of Equinix, our customers, including government customers, or the personal information of our employees, or cause interruptions or malfunctions in our operations or our customers' operations. As we provide assurances to our customers that we provide a high level of security, such a compromise could be particularly harmful to our brand and reputation. We also may be required to expend significant capital and resources to protect against such threats or to alleviate problems caused by cyber breaches in our physical or virtual security systems. Any breaches that may occur in the future could expose us to increased risk of lawsuits, regulatory penalties, loss of existing or potential customers, damage relating to loss of proprietary information, harm to our reputation and increases in our security costs, which could have a material adverse effect on our financial performance and results of operations. The international cybersecurity regulatory landscape continues to evolve and compliance with the proposed reporting requirements could further complicate our ability to resolve cyber-attacks. We maintain insurance coverage for cyber risks, but such coverage may be unavailable or insufficient to cover our losses.
computer systems, loss or destruction of data, computer viruses, ransomware, malware, distributed denial-of-service attacks or other malicious activities, and the impact of such events in the future may be material. A cyber attack may originate from either an …
Item 1A, Risk Factors, 10-K Feb 11, 2026Marked against last year's 10-K
Despite our efforts to protect against cyber-attacks, we are not fully insulated from such threats. We have experienced cybersecurity attacks and security incidents to varying degrees, and in some cases threat actors have gained unauthorized access to our systems and data. For example, in September 2020, we discovered ransomware on certain of our internal systems. While this and other incidents have been resolved, and their impacts have been immaterial, we expect we will continue to face risks associated with unauthorized access to ourcomputer systems, loss or destruction of data, computer viruses, ransomware, malware, distributed denial-of-service attacks or other malicious activities, and the impact of such events in the future may be material. A cyber attack may originate from either an external actor or an insider threat within the organization. In the course of our business, we utilize vendors and other partners who are also sources of cyber risks to us. In addition, ouradaptation to ahybrid working model, that includes both work from home and inan office,office working environments, could expose us tonewadditional security risks.
PSA Public Storage
24 paragraphs… Despite our security measures, we face cybersecurity threats, including system, network, or Internet failures; cyberattacks, ransomware, and other malware; social engineering; and phishing schemes. In these cases, our information technology and infrastructure could be vulnerable and our or our customers …
Word for word as last year Item 1A, Risk Factors, 10-K Feb 12, 2026
Further information relating to cybersecurity risk management is discussed in Item 1C. “Cybersecurity” in this report.
Word for word as last year Item 1A, Risk Factors, 10-K Feb 12, 2026
Show all 81 companies' quotes
SPG SIMON PROPERTY GROUP INC.
22 paragraphs… We face numerous and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our IT Systems and Confidential Information. The risk of a cyber incident has generally increased as the number, intensity and sophistication of attempted attacks have …
Word for word as last year Item 1A, Risk Factors, 10-K Feb 25, 2026
We face risks associated with security breaches through cyber-attacks, cyber intrusions or otherwise, as well as other significant disruptions of our computer systems, hardware, technology infrastructure, online sites and related systems.
Word for word as last year Item 1A, Risk Factors, 10-K Feb 25, 2026
REG REGENCY CENTERS CORP
21 paragraphs… theft, use, manipulation, destruction or other compromises of our confidential information stored in such systems, including through cyber-attacks such as ransomware, denial of service or other methods, such a breach may cause us to lose tenants and employees, result …
Item 1A, Risk Factors, 10-K Feb 13, 2026Marked against last year's 10-K
Like all companies, we face numerous and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our information technology systems and confidential information, including from diverse threat actors, such as state-sponsored organizations, opportunistic hackers and hacktivists,as well asand through diverse attack vectors, such as social engineering/phishing, malware (including ransomware), "deep fakes" generated through the use of Artificial Intelligence ("AI") tools, malfeasance by insiders, human or technological error, and as a result of malicious code embedded in open-source software, or misconfigurations, bugs or other vulnerabilities in commercial software that is integrated into our (or our suppliers’ or service providers’) information technology systems, products or services. We have experienced cyberattacks and cybersecurity incidents in the past (although none had material adverse impacts on our business or results of operations) and expect to face similar ongoing threats in the future. To the extent we or a third party were to experience a material breach of our information technology systems that results in the unauthorized access, theft, use, manipulation, destruction or other compromises of our confidential information stored in such systems, including through cyber-attacks such as ransomware, denial of service or other methods, such a breach may cause us to lose tenants and employees, result in adverse financial impact, incur third party claims and cause disruption to our business and plans. Despite planning, preparation, and preventative and risk-management measures, our business may be significantly disrupted if unable to quickly recover. Remote and hybrid working arrangements at our company (and at many third-party providers) may also increase cybersecurity risks due to the challenges associated with managing remote computing assets and security vulnerabilities that are present in many non-corporate and home networks. Additionally, any integration of AI in our or any service providers’ operations, products or services may pose new or unknown cybersecurity risks and challenges. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls and procedures, will be fully implemented, complied with or effective in protecting our systems and information. Such security breaches also could subject us to litigation and governmental investigations and proceedings into potential violations of applicableU.S.privacy or other laws. Any of these events could result in our exposure to material civil or criminal liability, and we may not be able to fully recover these expenses from our service providers, responsible parties, or insurance carriers, or that applicable insurance will be available to us in the future on economically reasonable terms or at all. We can provide no assurance that the ongoing significant investments in technology and training we make relating to cybersecurity will avoid or prevent such breaches or attacks.
… Despite the implementation of training of our employees and security measures for our disaster recovery and business continuity plans, our information systems may be vulnerable to damage or other adverse impact from multiple sources other than cybersecurity risks, including computer …
Item 1A, Risk Factors, 10-K Feb 13, 2026Marked against last year's 10-K
Cyberattacks are expected toaccelerateincrease on a global basis in frequency and magnitude as threat actors are becoming increasingly sophisticated in using techniques and tools - includingartificial intelligenceAI - that trick humans into taking unwarranted actions, circumvent security controls, evade detection and remove forensic evidence. Despite the implementation of training of our employees and security measures for our disaster recovery and business continuity plans, our information systems may be vulnerable to damage or other adverse impact from multiple sources other than cybersecurity risks, including computer viruses, energy blackouts, natural disasters, terrorism, war, and telecommunication failure. Any system failure or accident that causes disruption or interruptions to our information systems could result in a material disruption to our operations and business, and cause us to incur material costs to remedy such damages or adverse impacts.
CSGP COSTAR GROUP, INC.
20 paragraphsNumerous and evolving cybersecurity risks, including from diverse threat actors, such as state-sponsored organizations, opportunistic hackers and hacktivists, as well as through diverse attack vectors, such as advanced cyberattacks, phishing, social engineering schemes, malware (including ransomware), malfeasance by insiders …
Word for word as last year Item 1A, Risk Factors, 10-K Feb 26, 2026
… It is increasingly difficult to detect, investigate, and remediate cyber-attacks, and attacks often are not recognized or detected until after they have been launched against a target. We expect that unauthorized parties will continue to attempt to gain access …
Item 1A, Risk Factors, 10-K Feb 26, 2026Marked against last year's 10-K
Our IT Systems, or those of third parties on which we rely, may be disrupted or damaged and our Confidential Information may be compromised, corrupted, lost, or stolen. The toolsTools and techniques (including AI) used to obtain unauthorized, improper, or illegal access to a target’s systems, data, or customers’ data, disable or degrade services, or sabotage systems are constantly evolving and have become increasingly complex and sophisticated. It is increasingly difficult to detect, investigate, and remediatecyber-attacks quicklycyber-attacks, and attacks often are not recognized or detected until after they have been launched against a target. We expect that unauthorized parties will continue to attempt to gain access to or disrupt our IT systems or facilities through various means, including hacking into IT Systems or facilities or those of our customers or vendors, installing malware (including ransomware) or attempting to fraudulently induce (for example, through spear phishing attacks or social engineering) our employees, customers, vendors, or other users of IT Systems into disclosing access credentials or other sensitive information to access our IT Systems.
AMT AMERICAN TOWER CORP /MA/
19 paragraphs… Such cyber-attacks could be in the form of espionage, phishing campaigns and otherwise. Additionally, the use of AI technologies has led to increased exposure to cybersecurity threats globally. AI systems may be used by threat actors to exploit vulnerabilities …
New this year Item 1A, Risk Factors, 10-K Feb 24, 2026
… We are vulnerable to physical or cybersecurity breaches, attacks, computer viruses, ransomware, malware, fraud, worms, adverse impacts of artificial intelligence, social engineering, denial-of-service attacks, malicious software programs, insider threats, unauthorized access and other cybersecurity incidents that could disrupt …
Item 1A, Risk Factors, 10-K Feb 24, 2026Marked against last year's 10-K
As part of our normal business activities, including in our data centers, we rely on energy systems, cooling systems, communication networks, information technology and other computing resources, and collect, store, manage and otherwise process third-party data, including our customers’ data, our vendors’ data and our own data. We are vulnerable to physical or cybersecurity breaches, attacks, computer viruses, ransomware, malware, fraud, worms, adverse impacts of artificial intelligence, social engineering, denial-of-service attacks, malicious software programs, insider threats, unauthorized access and other cybersecurity incidents that could disrupt our, our customers’ or our vendors’ operations, expose us to liability and have a material adverse effect on our financial performance and operating results. These threats may result from human error, equipment failure, fraud or malice on the part of employees or third parties. A party who is able to compromise the security measures on our or our vendors’ networks or the security of our communications infrastructure could misappropriate our proprietary information or the personal information of our customers, our vendors, our employees or management, or cause interruptions or malfunctions in our operations or our customers’ operations. As we provide assurances to our customers that we provide a high level of security, such a compromise could be particularly harmful to our brand and reputation. We may be required to expend significant capital and resources to address any breaches, protect against such threats or to alleviate problems caused bybreaches in security.security breaches.
BXP BXP, Inc.
19 paragraphs• We face risks associated with security breaches, incidents and compromises through cyber attacks, cyber intrusions or otherwise, as well as other significant disruptions of our information technology (IT) networks and related systems.
Item 1A, Risk Factors, 10-K Feb 27, 2026Marked against last year's 10-K
• We face risks associated with security breaches,incidents,incidents and compromises through cyber attacks, cyber intrusions or otherwise, as well as other significant disruptions of our information technology (IT) networks and related systems.
We face risks associated with security breaches, incidents and compromises through cyber-attacks, cyber intrusions or otherwise, as well as other significant disruptions of our information technology (IT) networks and related systems.
Item 1A, Risk Factors, 10-K Feb 27, 2026Marked against last year's 10-K
We face risks associated with security breaches,incidents,incidents and compromises through cyber-attacks, cyber intrusions or otherwise, as well as other significant disruptions of our information technology (IT) networks and related systems.
CBRE CBRE GROUP, INC.
19 paragraphsWe are also subject to an increasing number of reporting obligations in respect of material cybersecurity incidents. These reporting requirements have been proposed or implemented by a number of regulators in different jurisdictions, may vary in their scope and application …
Word for word as last year Item 1A, Risk Factors, 10-K Feb 12, 2026
Our business is subject to complex and evolving United States and international laws and regulations regarding privacy, data protection, and cybersecurity. Many of these laws and regulations are subject to change and uncertain interpretation and could result in claims, increased cost of operations or otherwise harm our business.
Word for word as last year Item 1A, Risk Factors, 10-K Feb 12, 2026
DLR DIGITAL REALTY TRUST, INC.
19 paragraphsRegulators around the world are increasingly focusing on, and investigating, cybersecurity matters. For example, as we most recently disclosed in our Quarterly Report on Form 10-Q filed on October 31, 2025, we cooperated with the Division of Enforcement of …
Item 1A, Risk Factors, 10-K Feb 13, 2026Marked against last year's 10-K
Regulators around the world are increasingly focusing on, and investigating, cybersecurity matters. For example, as we most recently disclosed in our Quarterly Report on Form 10-Q filed onNovember 9, 2023,October 31, 2025, we cooperated with the Division of Enforcement of the U.S. Securities and Exchange Commission (SEC)is conducting anin their investigation into the adequacy of our disclosures of cybersecurity risks and our related disclosure controls and procedures.We are cooperating withBy letter dated December 22, 2025, the SEC Division of Enforcement informed us that based on the information it had as of that date, it had concluded the investigation and did not intend to recommend an enforcement action by the SEC against the Company. We are not aware of any cybersecurity issue or event that caused the Staff to open this matter.Responding to an investigation of this type can be costly and time-consuming. While we are unable to predict the likely outcome of this matter or the potential cost or exposure or duration of the process, based on the information we currently possess, we do not expect the total potential cost to be material to our financial condition. If the SEC believes that violations occurred, it could seek remedies including, but not limited to, civil monetary penalties and injunctive relief, and/or file litigation against the Company.
… In addition, transitioning to new or upgraded Information Systems, and integrating acquired Information Systems and data, creates challenges, causes disruption to current processes, governance and structures, and can increase our cybersecurity vulnerabilities and costs to mitigate and remediate such vulnerabilities …
Word for word as last year Item 1A, Risk Factors, 10-K Feb 13, 2026
HST HOST HOTELS & RESORTS, INC.
19 paragraphs… numerous and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of systems and information such as system, network or internet failures; computer hacking or operational disruption (e.g., due to ransomware or data extortion); cyber-terrorism; viruses, worms …
Item 1A, Risk Factors, 10-K Feb 25, 2026Marked against last year's 10-K
Our third-party hotel managers are dependent on information technology networks and systems, including the internet, to access, process, transmit and store proprietary and customer information. These complex networks include reservation systems, vacation exchange systems, hotel management systems, customer databases, call centers, administrative systems, and third-party vendor systems. These systems require the collection and retention of large volumes of personally identifiable information of hotel guests, including credit card numbers and passport numbers. Our hotel managers may store and process such customer information as well as proprietary information both on systems located at the hotels that we own and other hotels that they operate and manage, their corporate locations and at third-party owned facilities, including, for example, in a third-party hosted cloud environment. These information networks and systems are vulnerable to numerous and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of systems and information such as system, network or internet failures; computer hacking or operational disruption (e.g., due toransomware);ransomware or data extortion); cyber-terrorism; viruses, worms or other malicious softwareprograms; social engineering (e.g., phishing); employee error, negligence, malfeasance or fraud; and misconfigurations, "bugs" or other known or unknown vulnerabilities in software and hardware.
… as the SEC and other regulators have increased their focus on companies' cybersecurity vulnerabilities and risks, and increase the costs of compliance and remediation. We currently maintain cyber insurance, which includes coverage for third-party liability (damages and settlements to …
Item 1A, Risk Factors, 10-K Feb 25, 2026Marked against last year's 10-K
Disruptions in service, system shutdowns and security breaches in the information technologies and systems we, our managers or third-party providers maintain, including unauthorized access to or disclosure of confidential information, could have a material adverse effect on our business or financial reporting, subject us to liability claims or regulatory penalties, which amounts could be significant, as the SEC and other regulators have increased their focus on companies' cybersecurity vulnerabilities and risks, and increase the costs of compliance and remediation. We currently maintain cyber insurance, which includes coverage for third-party liability (damages and settlements to third parties) and first-party loss (costs incurred by us in response to a network security or privacy event). However, as with our operator’s coverage, ourpolicy is subject to limits and sub-limits for certain types of claims, and we do not expect that this policy will cover all the losses that we could experience from these exposures.
SBAC SBA COMMUNICATIONS CORP
19 paragraphsInformation technology disruptions, including as a result of cybersecurity breaches, could compromise our information, which would cause our business and reputation to suffer.
Word for word as last year Item 1A, Risk Factors, 10-K Feb 27, 2026
… Our computer systems, or those of our cloud or Internet-based providers, could fail on their own accord and are subject to interruption or damage from power outages, computer and telecommunications failures, computer viruses, security breaches (including through cyber-attack …
Item 1A, Risk Factors, 10-K Feb 27, 2026Marked against last year's 10-K
As part of our day-to-day operations, we rely on information technology and other computer resources and infrastructure to carry out important business activities and to maintain our business records. Our computer systems, or those of our cloud or Internet-based providers, could fail on their own accord and are subject to interruption or damage from power outages, computer and telecommunications failures, computer viruses, security breaches (including through cyber-attack, data theft, and exploiting potentially vulnerable services, such as virtual private networks and collaboration platforms as a result of remote working), errors, adverse impacts of artificial intelligence, catastrophic events such as natural disasters, and other events beyond our control. If our, or those of ouror our vendors’vendors’, computer systems and backup systems are compromised, degraded, damaged, or breached, or otherwise cease to function properly, we could suffer interruptions in our operations or unintentionally allow misappropriation of proprietary or confidential information (including information about our tenants or landlords). This could damage our reputation and disrupt our operations and the services we provide to customers, which could adversely affect our business and operating results. In addition, security incidents that impact our customers and other business partners could adversely affect our business and operating results. Furthermore, our investments in ancillary services and emerging technologies, including data centers and our mobile edge computing initiative, may leave us more vulnerable to security incidents, create new exposure for us to different types of security incidents or exacerbate the impact of such incidents on our business and operating results. In addition, wemay, from time to time, upgradeare in the process of upgrading our data processing systems and other operating technologies andtaketaking other steps to improve the efficiency of our information technology. These upgrades may require us to divert financial, operational, technical, and managerial resources which could adversely affect our business and operations. Additionally, if we are unable to effectively upgrade and improve the efficiency of our information technology systems, we may experience disruptions to our operations and services.
UDR UDR, Inc.
19 paragraphs… While we maintain cyber risk insurance to provide some coverage for certain risks arising out of cybersecurity breaches, there is no assurance that such insurance would cover all or a significant portion of the costs or consequences associated with a …
Item 1A, Risk Factors, 10-K Feb 17, 2026Marked against last year's 10-K
A Breach of Information Technology Systems On Which We Rely Could Materially and Adversely Impact Our Business, Financial Condition, Results of Operations and Reputation. We rely on information technology systems, including the internet and networks and systems and software developed, maintained and controlled by third party vendors and other third parties, to process, transmit and store information and to manage or support our business processes. Third party vendors may collect and hold personally identifiable information and other confidential information of our tenants, prospective tenants and employees. We also maintain such information and financial and business information regarding us and persons and entities with which we do business on our information technology systems. While we take steps, and generally require third party vendors to take steps, to protect the security of the information maintained in our and third party vendors’ information technology systems, including associate training and testing and the use of commercially available systems, software, tools and monitoring to provide security for processing, transmitting and storing of the information, it is possible that our or our third party vendors’ security measures will not be able to prevent human error or the systems’ or software’s improper functioning, or the loss, misappropriation, disclosure or corruption of personally identifiable information or other confidential or sensitive information, including information about our tenants and employees. Cybersecurity breaches, including physical or electronic break-ins, computer viruses, malware, phishing scams, attacks by hackers, breaches due to employee error or misconduct, and similar breaches, can create system disruptions, shutdowns or unauthorized access to information maintained on our information technology systems or the information technology systems of our third party vendors or other third parties or otherwise cause disruption or negative impacts to occur to our business and adversely affect our financial condition and results of operations. While we maintain cyber risk insurance to provide some coverage for certain risks arising out of cybersecurity breaches, there is no assurance that such insurance would cover all or a significant portion of the costs or consequences associated with a cybersecurity breach or other occurrence or that such insurance will continue to be available at rates that we consider reasonable or at all. We have in the past experienced cybersecurity breaches on our information technology systems or relating to software or third party vendor systems that we utilize, and, while none todate have been material to us, we expect such breaches may occur in the future. As the techniques used to obtain unauthorized access to information technology systems become more varied and sophisticated and the occurrence of such breaches becomes more frequent, we and our third party vendors and other third parties may be unable to adequately anticipate these techniques or breaches or implement appropriate preventative measures. Any failure to prevent cybersecurity breaches and maintain the proper function, security and availability of our or our third party vendors’ and other third parties’ information technology systems could interrupt our operations, damage our reputation and brand, damage our competitive position, make it difficult for us to attract and retain residents or other tenants, and subject us to liability claims or regulatory penalties that could adversely affect our business, financial condition and results of operations.
… Any failure to prevent cybersecurity breaches and maintain the proper function, security and availability of our or our third party vendors’ and other third parties’ information technology systems could interrupt our operations, damage our reputation and brand, damage our competitive …
Item 1A, Risk Factors, 10-K Feb 17, 2026Marked against last year's 10-K
A Breach of Information Technology Systems On Which We Rely Could Materially and Adversely Impact Our Business, Financial Condition, Results of Operations and Reputation. We rely on information technology systems, including the internet and networks and systems and software developed, maintained and controlled by third party vendors and other third parties, to process, transmit and store information and to manage or support our business processes. Third party vendors may collect and hold personally identifiable information and other confidential information of our tenants, prospective tenants and employees. We also maintain such information and financial and business information regarding us and persons and entities with which we do business on our information technology systems. While we take steps, and generally require third party vendors to take steps, to protect the security of the information maintained in our and third party vendors’ information technology systems, including associate training and testing and the use of commercially available systems, software, tools and monitoring to provide security for processing, transmitting and storing of the information, it is possible that our or our third party vendors’ security measures will not be able to prevent human error or the systems’ or software’s improper functioning, or the loss, misappropriation, disclosure or corruption of personally identifiable information or other confidential or sensitive information, including information about our tenants and employees. Cybersecurity breaches, including physical or electronic break-ins, computer viruses, malware, phishing scams, attacks by hackers, breaches due to employee error or misconduct, and similar breaches, can create system disruptions, shutdowns or unauthorized access to information maintained on our information technology systems or the information technology systems of our third party vendors or other third parties or otherwise cause disruption or negative impacts to occur to our business and adversely affect our financial condition and results of operations. While we maintain cyber risk insurance to provide some coverage for certain risks arising out of cybersecurity breaches, there is no assurance that such insurance would cover all or a significant portion of the costs or consequences associated with a cybersecurity breach or other occurrence or that such insurance will continue to be available at rates that we consider reasonable or at all. We have in the past experienced cybersecurity breaches on our information technology systems or relating to software or third party vendor systems that we utilize, and, while none todate have been material to us, we expect such breaches may occur in the future. As the techniques used to obtain unauthorized access to information technology systems become more varied and sophisticated and the occurrence of such breaches becomes more frequent, we and our third party vendors and other third parties may be unable to adequately anticipate these techniques or breaches or implement appropriate preventative measures. Any failure to prevent cybersecurity breaches and maintain the proper function, security and availability of our or our third party vendors’ and other third parties’ information technology systems could interrupt our operations, damage our reputation and brand, damage our competitive position, make it difficult for us to attract and retain residents or other tenants, and subject us to liability claims or regulatory penalties that could adversely affect our business, financial condition and results of operations.
IRM IRON MOUNTAIN INC
18 paragraphs… Recent developments in the cybersecurity threat landscape include the use of AI and machine learning, as well as an increased number of cyber extortion and ransomware attacks. As techniques used to breach security change frequently and are generally not recognized …
Item 1A, Risk Factors, 10-K Feb 12, 2026Marked against last year's 10-K
Our reputation for providing secure information storage to customers is critical to the success of our business. Our reputation or brand, and specifically, the trust our customers place in us, could be negatively impacted in the event of perceived or actual failures by us to store information securely. Although we seek to prevent and detect attempts by unauthorized users to gain access to our IT systems, and incur significant costs to do so, our IT and network infrastructure has in the past been and may in the future be vulnerable toattackscyberattacks and security incidents, including byhackers, includingstate-sponsored organizations with significant financial and technological resources, breaches due to employee or contractor error, fraud or malice or other disruptions (including, but not limited to, computer viruses and other malware, denial of service and ransomware), which may involve a breach requiring us to notify regulators, clients or employees and enlist identity theft protection. Recent developments in the cybersecurity threat landscape include the use of AI and machine learning, as well as an increased number of cyber extortion and ransomware attacks. As techniques used to breach security change frequently and are generally not recognized until launched against a target, we may not be able to promptly detect that a cyber breach has occurred, or implement security measures in a timely manner or, if and when implemented, we may not be able to determine the extent to which these measures could be circumvented. Moreover, until we have migrated businesses we acquire onto our IT systems or ensured compliance with our information technology security standards, we have in the past and may in the future face additional risks because of the continued use of predecessor IT systems. We utilize remote work arrangements and outsource certain support services, including cloud storage systems and cloud computing services, to third parties, which has in the past and may in the future subject our IT and other sensitive information to additional risk. A successful breach of the security of our IT systems could lead to theft or misuse of our customers’ proprietary or confidential information or our employees’ personal information and result in third party claims against us, regulatory penalties and reputational harm. Although we maintain insurance coverage for various cybersecurity risks, there is no guarantee that all costs or losses incurred will be fully insured. Damage to our reputation could make us less competitive, which could negatively impact our business, financial condition and results of operations.
We and our customers are subject to numerous laws and regulations relating to data privacy and cybersecurity. These regulations are complex, change frequently and have tended to become more stringent over time. In addition, a growing number of regulatory bodies …
Word for word as last year Item 1A, Risk Factors, 10-K Feb 12, 2026
VICI VICI PROPERTIES INC.
18 paragraphs… These and future cybersecurity incidents or other disruptions may be caused by individuals within our organization, individuals outside our organization with authorized access, or by unauthorized individuals from outside our organization. The risk of such incidents, particularly through cyber attacks …
Item 1A, Risk Factors, 10-K Feb 25, 2026Marked against last year's 10-K
We use our own IT networks and related systems to access, store, transmit, and manage or support a variety of our business processes and information and face risks associated with cybersecurity incidents and other disruptions of our IT networks and related systems, including as a result of unauthorized access attempts, denial of service or intrusions over the internet, malware, ransomware or other extortion tactics, computer phishing attempts and other forms of social engineering, fraudulent schemes, other cybersecurity incidents, attacks, intentional or unintentional intrusions or interruptions. We have experienced cybersecurity events such as viruses, phishing attempts and attacks on our IT networks and related systems, although none of these events have had a material impact on our business, operations or financial results to date. These and future cybersecurity incidents or other disruptions may be caused by individuals within our organization, individuals outside our organization with authorized access, or by unauthorized individuals from outside our organization. The risk of such incidents, particularly through cyber attacks or intrusions, including by computer hackers, foreign governments and cyber terrorists, has generally continued to increase due to the growing number, intensity, and sophistication of attempted attacks and intrusions worldwide. Although we make efforts to maintain the security and integrity of our IT networks and related systems and have implemented various measures to manage these risks, there can be no assurance that our security efforts and measures will be effective or that attempted cybersecurity incidents or disruptions would not be successful or damaging to our operations.AFurther, these risks are exacerbated with the advancement and accessibility of artificial intelligence (“AI”) technology, including the adoption of AI tools by us or by third parties. Threat actors may use AI technology and tools to develop new, more sophisticated attacks or automate or increase the frequency of such attacks. We use software and platforms designed to detect such cybersecurity threats, but these threats could become more sophisticated and harder to detect and counteract, which may pose significant risks to our data security and systems. An actual or suspected cybersecurity incident or significant disruption involving our IT networks and related systems could, among other things: (i) disrupt the proper functioning of our networks and systems; (ii) result in misstated financial reports, violations of financial and reporting covenants and/or missed reporting deadlines; (iii) lead to our inability to monitor or maintain compliance with applicable legal and regulatory requirements; (iv) result in unauthorized access to, and destruction, loss, theft, misappropriation or release of proprietary, confidential, sensitive or otherwise valuable information, which unauthorized parties could use for competitive purposes or disruptive, destructive or otherwise harmful outcomes; (v) require significant management attention and resources to address orremedymitigate any resultingdamages;impact; (vi) expose us to litigation, including claims for breach of contract, damages, credits, penalties or termination of certain agreements; (vii) subject us to regulatory scrutiny, including civil or criminal penalties, fines, injunctive orders, investigations, and enforcement actions; and (viii) damage our reputation among our tenants, borrowers and investors. Any or all of the foregoing could have a material adverse effect on our business, financial condition, results of operations, liquidity, and prospects, including the value of our common stock and our ability to make distributions. Additionally, increased regulation of data collection, use, and retention practices, including self-regulation and industry standards, changes in existing laws and regulations, enactment of new laws and regulations, increased enforcement activity, and changes in the interpretation of laws, could increase our compliance and operational costs or otherwise harm our business.
We maintain cybersecurity insurance coverage, although there may be exceptions to our insurance coverage that result in our insurance policies not covering some or all aspects of a cybersecurity incident. Even where a cybersecurity incident is covered by our insurance …
Word for word as last year Item 1A, Risk Factors, 10-K Feb 25, 2026
WY WEYERHAEUSER CO
18 paragraphs… computer hackers, foreign governments and cyber terrorists; malicious code (such as malware, viruses and ransomware); an intentional or unintentional personnel action; a natural disaster; a hardware or software corruption, failure or error; a telecommunications system failure or disruption; a service …
Item 1A, Risk Factors, 10-K Feb 13, 2026Marked against last year's 10-K
We use IT systems to carry out our operating activities, maintain our business records, and collect and store sensitive data, including but not limited to intellectual property and personally identifiable information. Some of our systems are internally managed and some are maintained by third-party service providers. Although we employ, and we believe our third-party service providers employ, what we deem to be reasonably adequate security measures and controls, there can be no assurance that our efforts will be effective against the risks we face from cyber-attacks, including from: computer hackers, foreign governments and cyber terrorists; malicious code (such as malware, viruses and ransomware); an intentional or unintentional personnel action; a natural disaster; a hardware or software corruption, failure or error; a telecommunications system failure or disruption; a service provider failure or error; or any one or more other causes of a security breach, system failure or disruption. The increased prevalence and sophistication of Artificial Intelligence (AI) tools, such as AI-enabled malware, could increase the risks of cyber-attacks to our systems and to those of our third-party service providers. Implementation of new IT systems, including replacement of legacy systems with new or upgraded versions, could also pose a significant risk to us, as any such implementation could involve system failure, potential loss or corruption of our important data, security or internal control failures, delays, cost overruns and disruption to our operations.
Although we have, on occasion, experienced cybersecurity threats to our data and IT systems, including phishing attacks, to date no events of this nature have had a material adverse effect on our business or otherwise caused material harm to the …
Word for word as last year Item 1A, Risk Factors, 10-K Feb 13, 2026
EXR Extra Space Storage Inc.
16 paragraphs… Additionally, any integration of artificial intelligence in our or any third party’s operations, products or services is expected to pose new or unknown cybersecurity risks and challenges. Furthermore, remote and hybrid working arrangements at our company (and at many …
Item 1A, Risk Factors, 10-K Feb 20, 2026Marked against last year's 10-K
We rely on information technology networks and systems, including the Internet, to process, transmit and store confidential information, and to manage or support a variety of business processes, including financial transactions and records, intellectual property, proprietary business information, and personal information of our employees, contractors and customers, such as tenant and lease data (collectively, “Confidential Information”). We also rely on third-party vendors for information technology and services, including commercially available systems, software, tools and monitoring to provide security for the processing, transmission and storage of Confidential Information. Our information technology systems and those of our third-party service providers, strategic partners and other contractors or consultants are vulnerable to attack and damage or interruption from computer viruses and malware (e.g. ransomware), software or hardware errors, misconfigurations, bugs or other vulnerabilities, malicious code, natural disasters, terrorism, war, telecommunication and electrical failures, hacking, cyberattacks, phishing attacks and other social engineering schemes, employee theft or misuse, human error, fraud, denial or degradation of service attacks, and sophisticated nation-state and nation-state-supported actors. Additionally, any integration of artificial intelligence in our or any third party’s operations, products or services is expected to pose new or unknown cybersecurity risks and challenges. Furthermore, remote and hybrid working arrangements at our company (and at many third-party providers) also increase cybersecurity risks due to the challenges associated with managing remote computing assets and security vulnerabilities that are present in many non-corporate and home networks. Although we have taken steps to protect the security of our information technology systems and Confidential Information, it is possible that our cybersecurity risk management program and processes, including our policies, safety and security measures, will not be fully implemented, complied with or able to prevent such systems’ improper functioning or damage, or the improper accessing or disclosure of Confidential Information, from such security breaches, disruptions, and shutdowns. The costs associated with the investigation, remediation and potential notification of such breaches to counter-parties and data subjects could be material.
… Cybersecurity threat actors may also utilize AI tools to automate and enhance cybersecurity attacks against us and could lead to data breaches, loss of confidential or sensitive information, and financial or reputational harm.
New this year Item 1A, Risk Factors, 10-K Feb 20, 2026
KIM KIMCO REALTY CORP
16 paragraphsWe have experienced cybersecurity incidents that to date have not resulted in, and are not expected to result in, a material impact on the Company’s business operations or financial results. For example, we are regularly subject to phishing attempts …
Item 1A, Risk Factors, 10-K Feb 20, 2026Marked against last year's 10-K
We have experienced cybersecurity incidents that to date have notresulted,resulted in, and are not expected toresult, inresult in, a material impact on the Company’s business operations or financial results. For example, we are regularly subject to phishing attempts, certain of our third-party service providers have experienced incidents, and in February 2023, the Company experienced a criminal ransomware attack affecting data contained on legacy servers of Weingarten Realty Investors(“WRI”). The(“WRI”), which the Company acquiredWRIin August 2021.The affected servers and exfiltrated data were onAlthough none of these incidents materially impacted theWRI network. The WRI network is separate and isCompany, we cannot guarantee that material incidents will notconnected tooccur in theCompany’s network. The Company promptly initiated an investigation and its response protocols, including deploying containment measures such as taking affected systems offline, implementing enhanced monitoring technology and data recovery processes. The Company also notified federal law enforcement, engaged the services of cybersecurity and forensics professionals, and restored affected systems. The WRI network data is historical and stored for archival purposes. Wefuture. Moreover, we have acquired in the past and may acquire in the future companies with cybersecurity vulnerabilities or unsophisticated security measures, which could expose us to significant cybersecurity, operational, and financial risks.
A cyber incident could materially affect our operations and financial condition by:
Word for word as last year Item 1A, Risk Factors, 10-K Feb 20, 2026
MAA MID AMERICA APARTMENT COMMUNITIES INC.
16 paragraphs… This risk of a data breach or security failure, particularly through cyber-attacks or cyber-intrusion, has generally increased due to the rise in new technologies, such as ransomware and generative artificial intelligence, and the increased sophistication and activities of …
Word for word as last year Item 1A, Risk Factors, 10-K Feb 6, 2026
… The rapid evolution and increased adoption of artificial intelligence technologies, by us and our third-party service providers, may also heighten our cybersecurity risks by making cyber attacks more difficult to detect, contain and mitigate. In addition, third-party information …
Word for word as last year Item 1A, Risk Factors, 10-K Feb 6, 2026
ESS ESSEX PROPERTY TRUST, INC.
15 paragraphs… We maintain cyber risk insurance, but this may be an insufficient type or amount to cover us against claims related to a cybersecurity incident, and we cannot be certain that such insurance will continue to be available to us on …
Item 1A, Risk Factors, 10-K Feb 20, 2026Marked against last year's 10-K
Privacy and cybersecurity risks have generally increased in recent years because of the proliferation of new techniques and tools that circumvent security tools, evade detection and remove forensic evidence, such as artificial intelligence,andthe increased sophistication, techniques and activities of threatactors;actors, and the broader adoption of remote and hybrid work arrangements that introduce additional security vulnerabilities due to off-network access; accordingly, the Company may be unable to anticipate these techniques or implement adequate preventative measures. There can also be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our IT Systems and Confidential Information. Furthermore, given the nature of complex IT Systems we rely upon, and the scanning tools that we deploy across our networks and products, we regularly identify and track security vulnerabilities. Additionally, remote and hybrid working arrangements at our company (and at many third-party providers) also increase cybersecurity risks due to the challenges associated with managing remote computing assets and security vulnerabilities that are present in many non-corporate and home networks. We may be unable to comprehensively apply patches or confirm that measures are in place to mitigate all such vulnerabilities, or that patches will be applied before vulnerabilities are exploited by a threat actor. We maintain cyber riskinsurance whichinsurance, but this may be an insufficient type or amount to cover us against claims related to a cybersecurity incident, and we cannot be certain that such insurance will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claims.
Finally, in the future, the Company may expend additional resources to continue to enhance the Company’s cybersecurity measures to investigate and remediate any cybersecurity vulnerabilities and/or to further ensure compliance with privacy and cybersecurity laws. Despite these steps …
Item 1A, Risk Factors, 10-K Feb 20, 2026Marked against last year's 10-K
InFinally, in the future, the Company may expend additional resources to continue to enhance the Company’s cybersecurity measures to investigate and remediate any cybersecurity vulnerabilities and/or to further ensure compliance with privacy and cybersecurity laws. Despite these steps, the Company may suffer a significant cybersecurity incident in the future, unauthorized parties may gain access to Confidential Information stored on the Company’s or its vendors’ IT Systems, and any such incident may not be discovered in a timely manner. Any cybersecurity incident or failure in the implementation, compliance with or effectiveness of the Company’s IT Systems or cybersecurity program or those of third party service providers, or a breach of other third party systems that ultimately impacts the operational or IT Systems of the Company could result in a wide range of material adverse effects to our business and results of operations.
WELL WELLTOWER INC.
15 paragraphs… through distributed denial-of-service or ransomware attacks, data extortion attempts, state-sponsored cybersecurity attacks, insider threats, incidents related to our increased receipt and use of data from multiple sources and other cybersecurity incidents within our environment or our business …
Item 1A, Risk Factors, 10-K Feb 12, 2026Marked against last year's 10-K
Our business is at risk from and may be impacted by material cybersecurityincidents, includingincidents. We may be subject to attempts to gain unauthorized access to our confidential data through social engineering attacks or other malicious activity, attempts to interrupt our access to, or use of information technology systems through distributed denial-of-service or ransomware attacks, data extortion attempts, state-sponsored cybersecurity attacks, insider threats, incidents related to our increased receipt and use of data from multiple sources and other cybersecurity incidents within our environment or our businesspartners'partners’ environments, including those resulting from human error, product defects and technology failures. Such cyber incidents can range from individual attempts to gain unauthorized access to our or our businesspartners'partners’ information technology systems to more sophisticated security threats and may be specifically targetedtoat our business or more general industry wide risks. While we employ a number of measures designed to prevent, detect and mitigate these threats, there is no guarantee such efforts will be successful in preventing or detecting a cybersecurity threat. The cybersecurity threat landscape is rapidly evolving and threat actors may leverage new and evolving technologies, such as AI, previously unknown vulnerabilities to perpetrate attacks, as well as sophisticated anti-forensics techniques to evade detection. We may be unable to anticipate evolving techniques, implement adequate cybersecurity barriers or other preventative measures, mitigate the risks from and recover from a cybersecurity incident without operational impact, and thus it is impossible for us to entirely mitigate this risk. Additionally, the use of AI by us or our business partners may create new cybersecurity vulnerabilities, including those which may not be recognized at the time, and malicious actors may employ AI to aid in launching more sophisticated and effective cybersecurity incidents. We regularly defend against, respond to and mitigate risks from cybersecurity incidents; however, there is no assurance that such impacts will not be material in the future. Cybersecurity incidents could disrupt our or our critical business partners’ business, damage our reputation, trigger governmental notice requirements and public disclosures, cause us to incur significant remediation expense and expose us to legal or regulatory claims or proceedings, including enforcement actions under data privacy or disclosure regulations. We maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity-related incidents that impact our cybersecurity and information technology infrastructure. However, our insurance coverage may not sufficiently cover all types of losses or claims that may arise or be subject to exclusions.
• our reliance on data and technology systems and the increasing risks of cybersecurity incidents;
Word for word as last year Item 1A, Risk Factors, 10-K Feb 12, 2026
O REALTY INCOME CORP
14 paragraphs… Cyberattacks are malicious cyber activity and a security incident is a successful cyberattack that has the potential to expose sensitive data, internal systems or otherwise disrupt business operations. Those cyberattacks and security incidents may be due to intentional or unintentional …
Item 1A, Risk Factors, 10-K Feb 25, 2026Marked against last year's 10-K
We, like all businesses, are subject tocyber-attackscyberattacks and security incidents, which threaten the confidentiality,integrity,integrity and availability of our systems and information resources.Cyber-attacksCyberattacks are malicious cyber activity and a security incident is a successfulcyber-attackcyberattack that has the potential to expose sensitive data, internalsystems,systems or otherwise disrupt business operations. Thoseattackscyberattacks and security incidents may be due to intentional or unintentional acts by employees, contractors orthird-parties,third parties, who seek to gain unauthorized access to our or our service providers’ systems to disrupt operations, corruptdata,data or steal confidential information through malware, computer viruses, ransomware, social engineering (e.g., phishing attachments to e-mails) or other vectors.
The risk of a cybersecurity breach or operational disruption, including by computer hackers, foreign governments and cyber terrorists, has generally increased as the number, intensity and sophistication of attempted attacks (including through the use of artificial intelligence) and intrusions from …
Item 1A, Risk Factors, 10-K Feb 25, 2026Marked against last year's 10-K
The risk of a cybersecurity breach or operational disruption,particularly through a cyber incident,including by computer hackers, foreign governments and cyber terrorists, has generally increased as the number, intensity and sophistication of attempted attacks (including through the use of artificial intelligence) and intrusions from around the world have increased, particularly as remote working has become more common. Ourinformation technology (“IT”)IT networks and related systems are essential to the operation of our business and our ability to perform day-to-day operations and, in some cases, may be critical to the operations of certain of our clients. Although we make efforts to maintain the security and integrity of these types of IT networks and related systems, and we have implemented various measures to manage the risk of a security breach ordisruption (such as the implementation of systems and/or vendors that provide constant monitoring of our IT networks and related systems for cyber-attacks and incidents); however,disruption, there can be no assurance that our security efforts and measures will be effective or that attempted security breaches or disruptions would not be successful or damaging.
CPT CAMDEN PROPERTY TRUST
13 paragraphs… Cyber-attacks can include third parties gaining unauthorized access to our data, including sensitive information about our residents, as well as our vendors' data or information technology systems. These attacks may occur through stolen credentials, computer malware, phishing attacks, ransomware …
New this year Item 1A, Risk Factors, 10-K Feb 12, 2026
… and identify cybersecurity risks associated with our operations, we may become increasingly vulnerable to such risks and may be liable for consequential litigation and remediation costs. Additionally, the measures we have implemented to prevent security breaches and cyber incidents may …
Item 1A, Risk Factors, 10-K Feb 12, 2026Marked against last year's 10-K
We use technology in substantially all aspects of our business operations, including internet and cloud-based systems and applications. We also use mobile devices, social networking, outside vendors, and other online activities to connect with our employees, suppliers, and residents. Such uses and the on-going advancement in technology such as generative artificial intelligence, machine learning, and remote connectivity solutions give rise to potential cybersecurity risks with increasing sophistication, including but not limited to, security breaches, espionage, system disruption, theft, and inadvertent release of confidential information.Our business involves the storage and transmission of numerous classes of sensitive and confidential information and intellectual property, including residents' and suppliers' personal information, private information about employees, and financial and strategic information about us.Further, asAs we pursue our strategy to grow through acquisitions and developments andto pursuenew initiatives to improve our operations, we are also expanding our information technologies, resulting in a larger technological presence and corresponding exposure to cybersecurity risk. If we fail to assess and identify cybersecurity risks associated with our operations, we may become increasingly vulnerable to such risks and may be liable fortheconsequential litigation and remediation costs. Additionally, the measures we have implemented to prevent security breaches and cyber incidents may not be effective and there can be no complete assurance of prevention or anticipation of such incidents. The theft, destruction, loss, misappropriation, or release of sensitive data, confidential information or intellectual property, or interference with our information technology systems or the technology systems of third parties on which we rely could result in business disruption, negative publicity, brand damage, violation of privacy laws, loss of residents, potential liability, and competitive disadvantage, any of which could result in a material adverse effect on our financial condition or results of operations.
VMRK VIVMARK RESIDENTIAL
12 paragraphsThe occurrence of cyber incidents, or a deficiency in our cybersecurity, could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our reputation and business relationships, all of which could negatively impact our financial results.
Word for word as last year Item 1A, Risk Factors, 10-K Feb 13, 2026
… We face risks associated with security breaches, whether through cyber attacks or cyber intrusions over the Internet, malware, computer viruses, attachments to emails, phishing attempts, social engineering, ransomware or other scams, persons inside our organization or persons/vendors with access …
Item 1A, Risk Factors, 10-K Feb 13, 2026Marked against last year's 10-K
Despite system redundancy, the implementation of security measures, required employee awareness training and the existence of a disaster recovery plan, our information technology systems, including those maintained by third-party vendors with which we do business, are vulnerable to damage and interruption from any number of sources beyond our control, including energy blackouts, natural disasters, terrorism, geopolitical events, telecommunication failures and cyber attacks. We face risks associated with security breaches, whether through cyber attacks or cyber intrusions over the Internet, malware, computer viruses, attachments to emails, phishing attempts, social engineering, ransomware or other scams, persons inside our organization or persons/vendors with access to our systems and other significant disruptions of our information technology networks and related systems, including property infrastructure. These risks have increased due to increased reliance on cloud-based applications, remote working and other electronic interactions with our current and prospective residents. Our information technology networks and related systems are essential to the operation of our business and our ability to perform day-to-day operations. We use these systems to manage our resident and vendor relationships, internal communications, accounting and record-keeping systems and many other key aspects of our business. Our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks, which also depend on the strength of our procedures and the effectiveness of our internal controls as well as those of vendors with whom we do business. Even the most well-protected information, networks, systems and facilities remain potentially vulnerable because the techniques used in such attempted security breaches evolve and generally are not recognized until launched against a target, and in some cases are designed not to be detected and, in fact, may not be detected. The rapid evolution and increased adoption of artificial intelligence technologies, by us and our third-party service providers, may also heighten our cybersecurity risks by making cyber attacks more difficult to detect, contain and mitigate. Accordingly, we may be unable to anticipate these techniques or to implement adequate security barriers or other preventative measures, and thus it is impossible for us to entirely mitigate this risk.
CCI CROWN CASTLE INC.
11 paragraphsDespite existing security measures, certain of our information technology and communications infrastructure may be subject to damage, disruptions, or shutdowns due to unauthorized access, computer viruses, ransomware or other malicious software, cyber-attacks and other security breaches. In addition, integration and adoption of artificial intelligence and machine learning ("AI") into our business may pose new information security risks and challenges. The increased prevalence of AI may
Item 1A, Risk Factors, 10-K Feb 23, 2026Marked against last year's 10-K
Despite existing security measures, certain of our information technology and communications infrastructure may be subject to damage, disruptions, or shutdowns due to unauthorized access, computer viruses, ransomware or other malicious software, cyber-attacks and other security breaches. In addition, integration and adoption of artificial intelligence and machine learning ("AI") into ourreliance on cloud- or internet-based servicesbusiness may pose new information security risks andon remotechallenges. The increased prevalence of AI may
… our cybersecurity or information technology, or that of our cloud- or internet-based service providers, occurs, the market perception of the effectiveness of our security measures could be harmed, and we could lose tenants. Further, the perpetrators of cyber-attacks …
Item 1A, Risk Factors, 10-K Feb 23, 2026Marked against last year's 10-K
Additionally, security incidents impacting our tenants, vendors and business partners could result in a material adverse effect on our business. We may be required to expend significant resources to protect against or recover from such threats. If an actual or perceived breach of our cybersecurity or information technology, or that of our cloud- or internet-based service providers, occurs, the market perception of the effectiveness of our security measures could be harmed, and we could lose tenants. Further, the perpetrators of cyber-attacks are not restricted to particular groups or persons. These threats can arise from external parties, such as cyber terrorists or nation-state actors, as well as insiders, such as our employees or contractors, who knowingly or unknowingly engage in or enable malicious cyber activities. In addition, ouracquisitions,acquisitions and divestitures, both past and future, may alter our potential exposure to the risks described above. While we maintain insurance that includes coverage in the event of cybersecurity or other information technology breaches, there can be no assurances that such coverage will be adequate to cover exposure from such incidents.
FRT FEDERAL REALTY INVESTMENT TRUST
7 paragraphs… A cyber attack could compromise the confidential information of our employees, tenants, and vendors. A successful attack could adversely affect our business operations, results of operations, or financial condition by, among other things, disrupting our collection of revenue, interfering with …
Item 1A, Risk Factors, 10-K Feb 12, 2026Marked against last year's 10-K
We rely extensively on information technology systems to process transactions and manage our business, and our business is at risk from and may be impacted by cybersecurity incidents. These could include attempts to gain unauthorized access to our data and computer systems as well as attacks on third party's information technology systems that we rely on to provide importantinformation technology services relating to key business functions, such as payroll. Cyber attacks can be both individual and/or highly organized attempts by very sophisticated hacking organizations. A cyber attack could compromise the confidential information of our employees, tenants, and vendors. A successful attack could adversely affect our business operations, results of operations, or financial condition by, among other things, disrupting our collection of revenue, interfering with our ability to satisfy our financial obligations by restricting access to our assets, or causing inaccuracies in our financial reporting. We employ a number of measures to prevent, detect, and mitigate these threats, which include password encryption, multi-factor authentication, frequent password change events, firewall detection systems, anti-virus software in-place, frequent backups, a redundant data system for core applications, and penetration testing; however, there is no guarantee such efforts will be successful in preventing a material cybersecurity incident.
We face risks relating to cyber threats that could cause loss of confidential information and other business disruptions.
Word for word as last year Item 1A, Risk Factors, 10-K Feb 12, 2026
PLD Prologis, Inc.
6 paragraphs… number of sources, including energy blackouts, natural disasters, terrorism, war, adverse impacts of AI, telecommunication failures and cybersecurity attacks, such as malware, ransomware, or unauthorized access. Any system failure or accident that causes interruptions in our operations could result in …
Item 1A, Risk Factors, 10-K Feb 13, 2026Marked against last year's 10-K
Despite system redundancy, the implementation of security measures and the existence of a disaster recovery plan for our internal and hosted information technology systems, our systems are vulnerable to damages from any number of sources, including energy blackouts, natural disasters, terrorism, war, adverse impacts of AI, telecommunication failures and cybersecurity attacks, such as malware, ransomware, or unauthorized access. Any system failure or accident that causes interruptions in our operations could result in a material disruption to our business. We may incur additional costs for remediation caused by such disruptions. Third-party security events at vendors, sub-processors, and service providers could also impact our data and operations through unauthorized access to information or disruption of services which may ultimately result in losses. Despite training, detection systems and response procedures, an increase in email attacks (phishing and business email compromise) and the rise in use of AI tools may create disruption to our business, financial and reputational risk.
Our business and operations could suffer in the event of system failures, cybersecurity attacks or risks associated with AI.
Item 1A, Risk Factors, 10-K Feb 13, 2026Marked against last year's 10-K
Our business and operations could suffer in the event of systemfailuresfailures, cybersecurity attacks orcybersecurity attacks.risks associated with AI.
ABR ARBOR REALTY TRUST INC
0 paragraphsNot mentioned in the latest 10-K.
ADC AGREE REALTY CORP
0 paragraphsNot mentioned in the latest 10-K.
AGNC AGNC Investment Corp.
0 paragraphsNot mentioned in the latest 10-K.
AHR American Healthcare REIT, Inc.
0 paragraphsNot mentioned in the latest 10-K.
AKR ACADIA REALTY TRUST
0 paragraphsNot mentioned in the latest 10-K.
AMH American Homes 4 Rent
0 paragraphsNot mentioned in the latest 10-K.
APLE Apple Hospitality REIT, Inc.
0 paragraphsNot mentioned in the latest 10-K.
BNL Broadstone Net Lease, Inc.
0 paragraphsNot mentioned in the latest 10-K.
BRX Brixmor Property Group Inc.
0 paragraphsNot mentioned in the latest 10-K.
BXMT BLACKSTONE MORTGAGE TRUST, INC.
0 paragraphsNot mentioned in the latest 10-K.
CDP COPT DEFENSE PROPERTIES
0 paragraphsNot mentioned in the latest 10-K.
COLD AMERICOLD REALTY TRUST
0 paragraphsNot mentioned in the latest 10-K.
COMP Compass, Inc.
0 paragraphsNot mentioned in the latest 10-K.
CTRE CareTrust REIT, Inc.
0 paragraphsNot mentioned in the latest 10-K.
CUBE CubeSmart
0 paragraphsNot mentioned in the latest 10-K.
CURB Curbline Properties Corp.
0 paragraphsNot mentioned in the latest 10-K.
CUZ COUSINS PROPERTIES INC
0 paragraphsNot mentioned in the latest 10-K.
CWK Cushman & Wakefield Ltd.
0 paragraphsNot mentioned in the latest 10-K.
CXW CoreCivic, Inc.
0 paragraphsNot mentioned in the latest 10-K.
DEI Douglas Emmett Inc
0 paragraphsNot mentioned in the latest 10-K.
DRH DiamondRock Hospitality Co
0 paragraphsNot mentioned in the latest 10-K.
EGP EASTGROUP PROPERTIES INC
0 paragraphsNot mentioned in the latest 10-K.
ELS EQUITY LIFESTYLE PROPERTIES INC
0 paragraphsNot mentioned in the latest 10-K.
EPR EPR PROPERTIES
0 paragraphsNot mentioned in the latest 10-K.
EPRT ESSENTIAL PROPERTIES REALTY TRUST, INC.
0 paragraphsNot mentioned in the latest 10-K.
FCPT Four Corners Property Trust, Inc.
0 paragraphsNot mentioned in the latest 10-K.
FR FIRST INDUSTRIAL REALTY TRUST INC
0 paragraphsNot mentioned in the latest 10-K.
GLPI Gaming & Leisure Properties, Inc.
0 paragraphsNot mentioned in the latest 10-K.
GNL Global Net Lease, Inc.
0 paragraphsNot mentioned in the latest 10-K.
HHH Howard Hughes Holdings Inc.
0 paragraphsNot mentioned in the latest 10-K.
HIW HIGHWOODS PROPERTIES, INC.
0 paragraphsNot mentioned in the latest 10-K.
HR Healthcare Realty Trust Inc
0 paragraphsNot mentioned in the latest 10-K.
IRT INDEPENDENCE REALTY TRUST, INC.
0 paragraphsNot mentioned in the latest 10-K.
IVT InvenTrust Properties Corp.
0 paragraphsNot mentioned in the latest 10-K.
JLL JONES LANG LASALLE INC
0 paragraphsNot mentioned in the latest 10-K.
JOE ST JOE Co
0 paragraphsNot mentioned in the latest 10-K.
KRC KILROY REALTY CORP
0 paragraphsNot mentioned in the latest 10-K.
KRG KITE REALTY GROUP TRUST
0 paragraphsNot mentioned in the latest 10-K.
LAMR LAMAR ADVERTISING CO/NEW
0 paragraphsNot mentioned in the latest 10-K.
LINE Lineage, Inc.
0 paragraphsNot mentioned in the latest 10-K.
LXP LXP Industrial Trust
0 paragraphsNot mentioned in the latest 10-K.
MAC MACERICH CO
0 paragraphsNot mentioned in the latest 10-K.
MPT MEDICAL PROPERTIES TRUST INC
0 paragraphsNot mentioned in the latest 10-K.
MRP Millrose Properties, Inc.
0 paragraphsNot mentioned in the latest 10-K.
NHI NATIONAL HEALTH INVESTORS INC
0 paragraphsNot mentioned in the latest 10-K.
NLY ANNALY CAPITAL MANAGEMENT INC
0 paragraphsNot mentioned in the latest 10-K.
NMRK NEWMARK GROUP, INC.
0 paragraphsNot mentioned in the latest 10-K.
NNN NNN REIT, INC.
0 paragraphsNot mentioned in the latest 10-K.
OHI OMEGA HEALTHCARE INVESTORS INC
0 paragraphsNot mentioned in the latest 10-K.
OUT OUTFRONT Media Inc.
0 paragraphsNot mentioned in the latest 10-K.
PECO Phillips Edison & Company, Inc.
0 paragraphsNot mentioned in the latest 10-K.