29 paragraphs of its Risk Factors mention Cybersecurity, against 29 the year before.
Compare companies, side by side
The same facts from the filings for each company in a group, where each stands among the others, and what each wrote about a topic in its latest 10-K.
- Sales growth
- -0.3%
- Gross margin
- 34%
- Operating margin
- 26%
- Net margin
- 13%
The 3 largest with KMI, ranked among the group
Each corner is the share of Energy companies the company is above on that ratio. The dashed line is the middle of the group. A rank, not a score.
10 paragraphs of its Risk Factors mention Cybersecurity, against 11 the year before.
19 paragraphs of its Risk Factors mention Cybersecurity, against 16 the year before.
Energy: the same facts for each company
| Company | Revenue, 12 months | Sales growth | Gross / operating margin | Net margin | Debt / equity | Accounting items | Insider buys | Investors | Open |
|---|---|---|---|---|---|---|---|---|---|
| KMIYou came from Kinder Morgan | $18.3B
|
+12% |
GM -OM 29%
|
20% | 1.05 | 0 of 4to read | 1 | 0 | 10-K |
| XOM ExxonMobil | $334.2B
|
-5.0% |
GM -OM -
|
7.6% | 0.19 | 0 of 5to read | 0 | 0 | 10-K |
| CVX Chevron Corporation | $233.3B
|
-6.8% |
GM 42%OM -
|
12% | 0.17 | 2 of 6to read | 0 | 0 | 10-K |
| MPC Marathon Petroleum | $174.8B
|
-4.4% |
GM 16%OM 13%
|
8.4% | 1.42 | 2 of 6to read | 0 | 0 | 10-K |
| PSX Phillips 66 | $168.2B
|
-7.5% |
GM 15%OM -
|
7.5% | 0.54 | 2 of 6to read | 0 | 0 | 10-K |
| VLO Valero Energy | $153.3B
|
-5.5% |
GM 12%OM 11%
|
8.4% | 0.39 | 1 of 6to read | 0 | 0 | 10-K |
| COP ConocoPhillips | $67.7B
|
+7.7% |
GM 51%OM -
|
17% | 0.35 | 0 of 6to read | 0 | 0 | 10-K |
| OKE Oneok | $43.2B
|
+55% |
GM 25%OM 14%
|
9.4% | 1.22 | 1 of 6to read | 0 | 0 | 10-K |
| SLB Schlumberger | $36.9B
|
-1.6% |
GM -OM -
|
8.4% | 0.43 | 2 of 6to read | 0 | 0 | 10-K |
| EOG EOG Resources | $29.7B
|
-4.5% |
GM -OM 36%
|
28% | 0.24 | 1 of 6to read | 0 | 0 | 10-K |
| BKR Baker Hughes | $28.7B
|
-0.3% |
GM -OM -
|
10% | 0.91 | 0 of 6to read | 1 | 0 | 10-K |
| OXY Occidental Petroleum | $25.0B
|
-1.9% |
GM -OM -
|
30% | 0.25 | 0 of 6to read | 0 | 0 | 10-K |
| HAL Halliburton | $22.5B
|
-3.3% |
GM -OM 13%
|
8.9% | 0.64 | 1 of 6to read | 0 | 0 | 10-K |
| DVN Devon Energy | $22.2B
|
+7.8% |
GM -OM -
|
16% | 0.25 | 0 of 6to read | 1 | 0 | 10-K |
| FANG Diamondback Energy | $18.6B
|
+36% |
GM -OM 13%
|
11% | 0.30 | 0 of 5to read | 0 | 0 | 10-K |
| TRGP Targa Resources | $18.2B
|
+3.9% |
GM 42%OM 23%
|
13% | 5.20 | 1 of 6to read | 0 | 0 | 10-K |
| WMB Williams Companies | $15.4B
|
+18% |
GM -OM 30%
|
20% | 2.33 | 1 of 6to read | 0 | 0 | 10-K |
| EXE Expand Energy | $13.9B
|
+186% |
GM -OM 26%
|
20% | 0.24 | 0 of 5to read | 0 | 0 | 10-K |
| APA APA Corporation | $9.9B
|
-11% |
GM -OM 43%
|
22% | 0.46 | 0 of 6to read | 0 | 0 | 10-K |
| EQT EQT Corporation | $9.3B
|
+64% |
GM 83%OM 42%
|
28% | 0.22 | 1 of 5to read | 0 | 0 | 10-K |
| TPL Texas Pacific Land Corporation | $967.8M
|
+13% |
GM -OM 76%
|
61% | - | 0 of 4to read | 33 | 0 | 10-K |
Growth against cash margin
The 14 largest by revenue. A bigger bubble is more revenue; the dashed lines are the median of these companies.
How to read this page
- A radar shows where a company ranks among its group on six ratios. A corner at the edge means it is above every other company on that ratio.
- A table row lists the facts as the filings give them: revenue, growth, margins, debt to equity, the accounting checks, insider buying and followed investors holding.
- A bubble to the right grew faster, and one higher up kept more of its sales as free cash flow.
- A bar is paragraphs that mention the topic this year, and the mark on it is last year.
Risk Factors and XBRL figures from each company's latest 10-K, read nightly from SEC EDGAR. Nothing here is a rating.
Cybersecurity: paragraphs that mention it
All 49 companies
Risk Factors paragraphs in each company's latest 10-K, most mentions first. The bar is this year and the mark is last year. 9 companies have no 10-K downloaded yet.
What the companies wrote
EOG EOG RESOURCES INC
30 paragraphs• security threats, including cybersecurity threats and disruptions to our business and operations from breaches of our information technology systems, physical breaches of our facilities and other infrastructure or breaches of the information technology systems, facilities and infrastructure of third parties with which we transact business, and enhanced regulatory focus on the prevention of, and disclosure requirements relating to, cyber incidents;
Word for word as last year Item 7, MD&A, 10-K Feb 24, 2026
Our systems and networks, and those of our business associates, may become the target of cyber attacks, including, without limitation, denial-of-service attacks; malicious software; data privacy breaches by employees, insiders or others with authorized access; phishing attacks; ransomware …
Word for word as last year Item 1A, Risk Factors, 10-K Feb 24, 2026
HAL HALLIBURTON CO
30 paragraphsof $116 million, primarily related to severance costs, an impairment of assets held for sale, expenses related to a cybersecurity
Item 7, MD&A, 10-K Feb 6, 2026Marked against last year's 10-K
Impairments and other charges. During 2024, we took a pre-tax chargeof $116millionmillion, primarily related to severance costs, an impairment of assets held for sale, expenses related to a cybersecurityincident, a gain on a fair value adjustment of an equity investment, and other items. See Notes to Consolidated Financial Statements, Note 2 for further discussion on these charges.
cybersecurity incident. In the event there is a cyber security incident, an Incident Response Team will assess the cybersecurity
New this year 10-K, 10-K Feb 6, 2026
KMI KINDER MORGAN, INC.
29 paragraphsIn accordance with government mandates, we have implemented and maintain a cybersecurity program - both internal and incorporating industry expertise - designed to protect our IT, OT, and data systems from attacks, however, we can provide no assurance that our cybersecurity program …
Item 1A, Risk Factors, 10-K Feb 13, 2026Marked against last year's 10-K
In accordance with government mandates, we have implemented and maintain a cybersecurity program - both internal and incorporating industry expertise - designed to protect our IT,OTOT, and data systems from attacks, however, we can provide no assurance that our cybersecurity program will be completely effective. We have experienced increases in the number of attempts by external parties to access our networks or our company data without authorization. While we have taken additional steps to secure our networks and systems to specifically respond to new and elevated risks associated with remote work, we may nevertheless be more vulnerable to a successful cyber-attack or information security incident when significant numbers of our employees are working remotely. The risk of a disruption or breach of our operational systems, or the compromise of the data processed in connection with our operations, has increased as attempted attacks, including acts of terrorism or cyber sabotage, which may be escalated during periods of heightened geopolitical tensions, have advanced in sophistication and number around the world.
… In the event of such an incident, we may need to retain cybersecurity experts to assist us in stopping, diagnosing, and recovering from the attack. There is no assurance that adequate cyber sabotage and terrorism insurance will be available at …
Item 1A, Risk Factors, 10-K Feb 13, 2026Marked against last year's 10-K
The U.S. government has issued public warnings indicating that pipelines and other infrastructure assets might be specific targets of terrorist organizations or “cyber sabotage” events. Potential targets include our pipeline systems, terminals, processing plants,databasesdatabases, or operating systems. Risk of these attacks may escalate during periods of heightened geopolitical tensions. The occurrence of an attack could cause a substantial decrease in revenues and cash flows, increased costs to respond or other financial loss, significant reporting requirements, damage to our reputation, increased regulation orlitigationlitigation, or inaccurate information reported from our operations. In the event of such an incident, we may need to retain cybersecurity experts to assist us in stopping, diagnosing, and recovering from the attack. There is no assurance that adequate cyber sabotage and terrorism insurance will be available at rates we believe are reasonable in the near future. The potential for an attack may subject our operations to increased risks and costs, and, depending on their ultimate magnitude, have a material adverse effect on our business, results of operations, financialconditioncondition, and/or business reputation.
BKR Baker Hughes Co
24 paragraphsIncreased cybersecurity vulnerabilities and threats, and more sophisticated and targeted cyber-attacks and other security incidents, pose risks to our systems, data and business, and our relationships with customers and other third parties.
Word for word as last year Item 1A, Risk Factors, 10-K Feb 5, 2026
… Increased cybersecurity vulnerabilities and threats, and more sophisticated and targeted cyber-attacks and other security incidents, pose risks to our and our customers', collaborators', suppliers' and third-party service providers' systems, data, and business, and the confidentiality, availability, and integrity …
Item 1A, Risk Factors, 10-K Feb 5, 2026Marked against last year's 10-K
In the course of conducting our business, we may hold or have access to sensitive, confidential, proprietary or personal data or information belonging to us, our employees or third parties, including customers,partnerscollaborators or suppliers. Increased cybersecurity vulnerabilities and threats, and more sophisticated and targeted cyber-attacks and other security incidents, pose risks to our and our customers',partners',collaborators', suppliers' and third-party service providers' systems, data, and business, and the confidentiality, availability, and integrity of our data, as well as the data of our employees, customers, suppliers, andour employees' and customers' data.other third-party business partners. We utilize various procedures and controls to monitor and mitigate our exposure including maintaining a dedicated Cyber Fusion Center ("CFC") and engagingthird partythird-party experts. For more information see the "Risk Management & Strategy" section of Part 1 of Item 1C herein. While we attempt to mitigate these risks, we remain vulnerable to cyber-attacks and other security incidents, including ransomware incidents. Given our global footprint, the large number of customers, partners, suppliers and service providers with which we do business, and the increasing sophistication and complexity of cyber-attacks, including, without limitation, due to the application of generative AI, an incident could occur and persist for an extended period without detection. Any investigation of a cyber-attack or other security incident would be inherently unpredictable, and it would take time before the completion of any investigation and the availability of full and reliable information. During such time we would not necessarily know the extent of the harm or how best to remediate it, and certain errors or actions could be repeated or compounded before they are discovered and remediated, all or any of which would further increase the costs and consequences of such an incident. We may be required to expend significant resources to protect against, respond to, and recover from any cyber-attacks and other security incidents. As cyber-attacks continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. In addition, our remediation efforts may not be successful, or the impacts may be
EXE EXPAND ENERGY Corp
23 paragraphs… CIRCIA mandates that all owners and operators of critical infrastructure report cyber incidents to the U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) within 72 hours and ransomware payments within 24 hours. These new requirements …
Item 1A, Risk Factors, 10-K Feb 18, 2026Marked against last year's 10-K
In the event of a cyber-attack, we may be required by federal and state laws or regulations to provide notification to regulators or individuals. For example, the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) was signed into law on March 15, 2022. CIRCIA mandates that all owners and operators of critical infrastructure report cyber incidents to the U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) within 72 hours and ransomware payments within 24 hours. These new requirements will become effective once CISA promulgates rules pursuant to the CIRCIA. CISA issued a notice of proposed rulemaking on April 4, 2024 and isrequiredexpected toissue apublish the final rulewithin 18 months of issuing the proposed rule.in May 2026.
We have been, and we and our customers, business partners, and counterparties may become, the subject of cyber-attacks on our and their internal IT and OT systems and through those of third parties. Any such cyber-attacks or information …
Item 1A, Risk Factors, 10-K Feb 18, 2026Marked against last year's 10-K
We have been, and we and our customers, business partners, and counterparties may become, the subject of cyber-attacks on our and their internal IT and OT systems and through those of third parties. Any such cyber-attacks or information securitybreachbreaches could have a material adverse effect on ourrevenuesbusiness and financial results and increase our operating and capital costs, as well as disrupt our business plans and negatively impact our reputation and operations. As an energy company, we expect to continue to be a target for such attacks in the future from nation-state sponsored foreign actors and other attackers. We face evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our digital technologies and business data, including malicious attacks by third parties or insiders, social engineering/phishing and human error, as well as bugs, misconfigurations of hardware or software and other vulnerabilities that may exist in our or our third-party providers’ systems or technologies. Unauthorized access to our seismic data, reserves information, customer or employee data or other proprietary or commercially sensitive information could lead to data corruption, communication interruption, or other disruptions in our exploration or production operations or planned business transactions, any of which could have a material adverse impact on our results of operations. If our information technology systems do not function properly or our cybersecurity is breached or otherwise insufficient, we could suffer disruptions to our normal operations,
TPL Texas Pacific Land Corp
23 paragraphs… In addition, our cyber liability insurance policy may cover only a portion of losses incurred in investigating or remediating a cybersecurity incident, if at all, and may not cover all claims made against us. As cybersecurity threats continue to evolve …
Word for word as last year Item 1A, Risk Factors, 10-K Feb 18, 2026
… Even without a direct breach of our systems, cybersecurity attacks on such third parties could adversely impact our business and reputation. In addition, certain cyber incidents, such as surveillance, may remain undetected for some period of time.
Word for word as last year Item 1A, Risk Factors, 10-K Feb 18, 2026
Show all 49 companies' quotes
APA APA Corp
22 paragraphs… Cyberattacks, including malicious software, data privacy breaches by employees, insiders, or others with authorized access to the Company’s systems, cyber or phishing attacks, ransomware attacks, supply chain vulnerabilities, business email compromises, other attempts to gain unauthorized access to the …
Item 1A, Risk Factors, 10-K Feb 26, 2026Marked against last year's 10-K
The Companyexpends significantmay be required to expend further resources to protect its digital systems anddata, whether suchdatais housed internally or externally by third parties, against cyberattacks and may be required to expend further resourcesas cyber threat actors become more sophisticated and as regulations related to cyberattacks become more complex. Cyberattacks, including malicious software, data privacy breaches by employees, insiders, or others with authorized access to the Company’s systems, cyber or phishing attacks, ransomware attacks, supply chain vulnerabilities, business email compromises, other attempts to gain unauthorized access to the Company’s data and systems, and other electronic security breaches could have a material adverse effect on the Company’s business, cause it to incur a material financial loss, subject it to possible legal claims and liability, and/or damage its reputation.
There are numerous and evolving risks to the Company’s data, technology, and information systems from cyber threat actors, including criminal hackers, state-sponsored intrusions, industrial espionage, and employee malfeasance. The Company’s operations are dependent on digital technologies, including …
Word for word as last year Item 1A, Risk Factors, 10-K Feb 26, 2026
WMB WILLIAMS COMPANIES, INC.
22 paragraphs• A breach of information technology infrastructure, including a breach caused by a cybersecurity attack on Williams, Transco, or NWP, or the third parties with whom they are interconnected, may interfere with the safe operation of assets, result in the disclosure of personal or proprietary information, and cause reputational harm.
Word for word as last year Item 1A, Risk Factors, 10-K Feb 24, 2026
A breach of information technology infrastructure, including a breach caused by a cybersecurity attack on Williams, Transco, or NWP, or the third parties with whom they are interconnected, may interfere with the safe operation of assets, result in the disclosure of personal or proprietary information, and cause reputational harm.
Word for word as last year Item 1A, Risk Factors, 10-K Feb 24, 2026
COP CONOCOPHILLIPS
21 paragraphsFor additional information regarding our cybersecurity risk management, strategy and governance, see Item 1C. Cybersecurity.
Word for word as last year Item 1A, Risk Factors, 10-K Feb 17, 2026
If our data, IT, operational technology (OT), including industrial control and supervisory control and data acquisition (SCADA) systems were to be breached, damaged or disrupted due to a cybersecurity incident or cyber-attack (directly, indirectly through third parties or through …
Word for word as last year Item 1A, Risk Factors, 10-K Feb 17, 2026
CVX CHEVRON CORP
19 paragraphs… operations There are numerous and evolving risks to Chevron’s cybersecurity and privacy from cyber threat actors, including criminal hackers, state-sponsored intrusions, industrial espionage and employee malfeasance. These cyber threat actors, whether internal or external to Chevron, are becoming …
Item 1A, Risk Factors, 10-K Feb 24, 2026Marked against last year's 10-K
Cyberattacks and events affecting Chevron’s operational technology networks or other digital infrastructure could have a material adverse impact on the company’s business and results of operations There are numerous and evolving risks to Chevron’s cybersecurity and privacy from cyber threat actors, including criminal hackers, state-sponsored intrusions, industrial espionage and employee malfeasance. These cyber threat actors, whether internal or external to Chevron, are becoming more sophisticated and coordinated in their attempts to access the company’s information technology (IT) systems and data, including the IT systems of cloud providers and other third parties with whom the company conducts business through, without limitation, malicious software; data breaches by employees, insiders or others with authorized access; cyber or phishing-attacks; ransomware; attempts to gain unauthorized access to our data and systems; and other electronic security breaches. The cyber risk landscape changes over time due to a variety of internal and external factors, including during organizational changes, relocating work to international geographies, or other corporate transactions; political tensions; war or other military conflicts; or civil unrest. Although Chevron devotes significant resources to prevent unwanted intrusions and to protect its systems and data, whether such data is housed internally or by external third parties, the company has experienced and will continue to experience cyber incidents of varying degrees in the conduct of its
… Any of the foregoing can be exacerbated by a delay or failure to detect a cyber incident or the full extent of such incident. Further, the company is increasingly experiencing cyber incidents related to its third-party vendors. Some third …
Item 1A, Risk Factors, 10-K Feb 24, 2026Marked against last year's 10-K
including during organizational changes, relocating work to international geographies, or other corporate transactions; political tensions; war or other military conflicts; or civil unrest. Although Chevron devotes significant resources to prevent unwanted intrusions and to protect its systems and data, whether such data is housed internally or by external third parties, the company has experienced and will continue to experience cyber incidents of varying degrees in the conduct of itsbusiness. Cyber threat actors could compromise the company’s operational technology networks or other critical systems and infrastructure, resulting in disruptions to its business operations, injury to people, harm to the environment or its assets, disruptions in access to its financial reporting systems, or loss, misuse or corruption of its critical data and proprietary information, including without limitation its intellectual property and business information and that of its employees, customers, partners and other third parties. Any of the foregoing can be exacerbated by a delay or failure to detect a cyber incident or the full extent of such incident. Further, the company is increasingly experiencing cyber incidents related to its third-party vendors. Some third-party vendors house the company’s critical data and proprietary information on their IT systems, including the cloud; others have access to Chevron’s IT systems or provide software through which threat actors could gain access or introduce malware to Chevron’s IT systems. Our use of third-party software, services and support may also result in unintentional, non-malicious events or outages that affect our ability to operate critical business systems. Regardless of the precise method or form, events affecting our networks or digital infrastructure could result in significant financial losses, legal or regulatory violations, reputational harm, and legal liability and could ultimately have a material adverse effect on the company’s business and results of operations.
FANG Diamondback Energy, Inc.
18 paragraphsOur IT Systems and Confidential Information, and that of our vendors, service providers and other third-party providers and business partners, are vulnerable to evolving cybersecurity threats, including, without limitation, denial-of-service attacks; malicious software (e.g., ransomware); the …
Item 1A, Risk Factors, 10-K Feb 25, 2026Marked against last year's 10-K
Risks from cybersecurity threats have not materially affected,Our IT Systems andare not currently anticipated to materially affect our company, including our business strategy, results of operationsConfidential Information, andfinancial condition. However, our systems and networks, and thosethat of our vendors, service providers and other third-partyproviders, may become the target ofproviders and business partners, are vulnerable to evolving cybersecurityattacks,threats, including, without limitation, denial-of-service attacks; malicioussoftware;software (e.g., ransomware); the exploitation of known and unknown misconfigurations, “bugs,” and other hardware or software vulnerabilities; data privacy breaches by employees, insiders or others with authorized access;cyber or phishing-attacks; ransomware;social engineering (e.g. phishing) attacks; attempts to gain unauthorized access to our data and systems; and other electronic or physical security breaches.Security incidents can also occur as a result of non-technical issues, such as physical theft.More recently, advancements inartificial intelligence (“AI”) mayAI pose serious risks for many of the traditional tools used to identify individuals, including voice recognition (whether by machine or the human ear), facial recognition or screening questions to confirm identities. In addition, generative AI systemsmay also beare increasingly used by malicious actors to create more sophisticated cyber-attacks (i.e., more realistic phishing or otherattacks). Theattacks) and to circumvent controls, evade detection and even remove forensic evidence, rendering incident detection and remediation more challenging. These and other threat-related advancementsin AI could lead to an increase in the frequency of identity fraud or cyberattacks (whether successful or unsuccessful), which could causeexpose us toincurincreasing costs, including costs to deploy additional personnel, protection technologies and policies and procedures, train employees, and engage third-party experts and consultants.If any of theseThere can be no assurance that our cybersecurity risk management program, including our controls or processes, will be fully implemented, complied with or effective in protecting our IT Systems and Confidential Information. Moreover, we do not manage the securitybreaches werecontrols or processes deployed by our third-party providers, such as cloud services that support our operations, and therefore, successful cyberattacks that disrupt or result in unauthorized access tooccur,third-party IT Systems could materially impact our operations and financial results. Similarly, we have acquired and continue to acquire companies that may have cybersecurity vulnerabilities or unsophisticated measures, which exposes us to significant risk.
• Failure to comply with cybersecurity and data privacy laws and regulations could have a material effect on our reputation, results of operations or financial loss.
New this year Item 1A, Risk Factors, 10-K Feb 25, 2026
MPC Marathon Petroleum Corp
18 paragraphsOur information systems (and those of our third-party business partners and service providers), including our cloud computing environments and operational technology environments, are subject to numerous and evolving cybersecurity threats and attacks, including ransomware and other malware, phishing and …
Item 1A, Risk Factors, 10-K Feb 26, 2026Marked against last year's 10-K
Our information systems (and those of our third-party business partners and service providers), including our cloud computing environments and operational technology environments, are subject to numerous and evolving cybersecurity threats and attacks, including ransomware and other malware, phishing and social engineering schemes, supply chain attacks, and advanced artificial intelligence attacks, which can compromise our ability tooperateoperate, and the confidentiality, availability, and integrity of data in our systems or those of our third-party business partners and service providers. These and other cybersecurity threats may originate with criminal attackers, advanced persistent threats and nation-state actors, state-sponsoredactorsactors, or employee error or malfeasance. Cybersecurity threat actors also may attempt to exploit vulnerabilities in software, including software commonly used by companies in cloud-based services and bundled software. Because the techniques used to obtain unauthorized access, or to disable or degrade systems, continuously evolve and some have become increasingly complex and sophisticated, and can remain undetected for a period of time despite efforts to detect and respond in a timely manner, we (and our third-party business partners and service providers) are subject to the risk of cyberattacks and cybersecurity incidents.
Our cybersecurity and infrastructure protection technologies, disaster recovery plans and systems, employee training and vendor risk management may not be sufficient to defend us against all unauthorized attempts to access our information or impact our systems. We and our third …
Word for word as last year Item 1A, Risk Factors, 10-K Feb 26, 2026
PSX Phillips 66
18 paragraphs… As cyber threats targeting the energy sector grow in frequency and sophistication, we are required to devote additional resources to maintain and enhance our cybersecurity programs and controls. Failure to comply with applicable cybersecurity laws and regulations, or to effectively …
New this year Item 1A, Risk Factors, 10-K Feb 20, 2026
… other disruptions, including ransomware and other malware, phishing and social engineering schemes, deepfakes, malicious software, data privacy incidents, insiders or others with authorized access, attempts to gain unauthorized access to our data and systems, and other cybersecurity incidents. Any such …
Item 1A, Risk Factors, 10-K Feb 20, 2026Marked against last year's 10-K
Our information technology and infrastructure,or information technology and infrastructure of ourincluding systems operated by third-party service providers (e.g., cloud-based service providers), may be vulnerable to attacks by malicious actors or breached due to human error, malfeasance or other disruptions, including ransomware and other malware, phishing and social engineering schemes, deepfakes, malicious software, data privacy incidents, insiders or others with authorized access, attempts to gain unauthorized access to our data and systems, and other cybersecurity incidents. Any such incidents could compromise our networks and the information stored there could be accessed, publicly disclosed, lost or stolen. Any such unauthorized access, disclosure or other loss of information could result in one or more of the following outcomes: (i) unauthorized access to or a loss or misuse of intellectual property, proprietary information, or employee, customer or vendor data; (ii) public disclosure of sensitive information; (iii) increased costs to prevent, respond to, or mitigate cybersecurity events, such as deploying additional personnel and protection technologies, training employees, and engaging third-party experts and consultants; (iv) systems interruption; (v) disruption of our business operations; (vi) remediation costs for repairs of system damage, or regulatory fines or penalties; (vii) reputational damage that adversely affects customer or investor confidence; (viii) exposure to legal liability; and (ix) damage to our competitiveness, stock price, and long-term shareholder value. Generative artificial intelligence has also contributed to an increase in the prevalence of such attacks and threats, expandingourpotential exposure to disruptions. Any of the foregoingcancould be exacerbated by a delay or failure to detect a cybersecurity incident or the full extent of such incident.
TRGP Targa Resources Corp.
18 paragraphs• We are subject to cybersecurity risks. A cyber incident could occur and result in information theft, data corruption, operational disruption, disclosure of business sensitive, confidential or personally identifiable information, misdirected wire transfers, reputational harm, and financial loss.
Word for word as last year Item 1A, Risk Factors, 10-K Feb 19, 2026
We are subject to cybersecurity risks. A cyber incident could occur and result in information theft, data corruption, operational disruption, disclosure of business sensitive, confidential or personally identifiable information, misdirected wire transfers, reputational harm, and financial loss.
Word for word as last year Item 1A, Risk Factors, 10-K Feb 19, 2026
EQT EQT Corp
16 paragraphsCyber incidents targeting our digital work environment or other technologies or energy infrastructure may adversely impact our operations.
Word for word as last year Item 1A, Risk Factors, 10-K Feb 18, 2026
… Further, as cyber incidents continue to evolve and cyber attackers become more sophisticated, we may be required to expend additional resources to continue to modify or enhance our protective measures or to investigate and remediate any vulnerability to cyber incidents …
Item 1A, Risk Factors, 10-K Feb 18, 2026Marked against last year's 10-K
The U.S. government has issued public warnings that indicate that energy assets might be specific targets of cyber or other security or physical threats, and the continuing armed conflict between Russia and Ukraine and associated economic sanctions onRussiaRussia, as well as evolving geopolitical unrest in other parts of the world, may have increased the likelihood of such threats. We can provide no assurance that we will not suffer such attacks in the future. Deliberate attacks on, or unintentional events affecting, our digital work environment or other technologies and infrastructure, the systems or infrastructure of third parties or the cloud could lead to corruption or loss of our proprietary data and potentially sensitive data, delays in production or delivery of natural gas, NGLs and oil, difficulty in completing and settling transactions, challenges in maintaining our books and records, communication interruptions, environmental damage, personal injury, property damage, other operational disruptions and third-party liability. Further, as cyber incidents continue to evolve and cyber attackers become more sophisticated, we may be required to expend additional resources to continue to modify or enhance our protective measures or to investigate and remediate any vulnerability to cyber incidents. The cost to remedy an unintended dissemination of sensitive information or data may be significant. Furthermore, the continuing and evolving threat of cyber-attacks has resulted in increased regulatory focus on prevention. To the extent we face increased regulatory requirements, we may be required to expend significant additional resources to meet such requirements.
OXY OCCIDENTAL PETROLEUM CORP /DE/
16 paragraphsDespite robust cybersecurity measures, the Company has experienced cyber-attacks in the past and expects such threats to continue to evolve, including increasing in magnitude and sophistication. The cyber risk landscape changes over time due to a variety of internal …
Item 1A, Risk Factors, 10-K Feb 18, 2026Marked against last year's 10-K
While OccidentalDespite robust cybersecurity measures, the Company has experiencedcyber attackscyber-attacks in thepast, it has not suffered any material losses. However, thepast and expects such threats to continue to evolve, including increasing in magnitude and sophistication. The cyber risk landscape changes over time due to a variety of internal and external factors, including duringpolitical tensions, war or other military conflict or civil unrest.geopolitical tensions and as a result of technological developments. There can be no assurance thatOccidental’sthe Company’s cybersecurity and operational resilience measures, or the efforts of its partners, will be sufficient toprevent orprevent, identifycybersecurity incidents. Although Occidental has implemented controls and multiple layers of security that it believes are reasonable to mitigate the risks of a cybersecurity incident, there can be no assurance that Occidental’s response will be successfulor effectively addressancybersecurity incidents. The Company may incur significant increased costs in order to continue to enhance its cybersecurity measures and to investigate and remediate cybersecurity incidents. A significant cyber incident could have a material adverse affect ona timely basis.the Company’s financial condition, results of operations or cash flows.
… evolving threats, including unauthorized access, ransomware or other malware, service disruptions, threats to the security of facilities and infrastructure, cyber terrorism, critical infrastructure attacks, supply chain attacks and other attacks on third-party vendors. Cyber incidents, whether from insiders or …
New this year Item 1A, Risk Factors, 10-K Feb 18, 2026
VLO VALERO ENERGY CORP/TX
16 paragraphs… Transportation Security Administration following the Colonial Pipeline cybersecurity incident, the obligations imposed by the U.S. Cyber Incident Reporting for Critical Infrastructure Act. We have been, and may continue to be, required to expend significant resources to comply with such …
Item 1A, Risk Factors, 10-K Feb 25, 2026Marked against last year's 10-K
costs and repairs of system damage, (vi) reputational damage that adversely affectscustomer, supplier, or investorconfidence,confidence; and (vii) damage to our business and competitiveness. AI may also be leveraged by threat actors to enhance the volume and sophistication of their attacks. A breach could also originate from or compromise our customers’, vendors’, suppliers’, or other third-party networks outside of our control that could impact our business and operations, as occurred with the Colonial Pipeline cybersecurity incident in May 2021. Our vendors and suppliers are also increasingly using and offering platforms powered by AI. Although we implement internal controls on the connectivity of third parties to our systems that attempt to prevent or mitigate the impact from incidents affecting third-party systems, we have limited control over ensuring that third parties themselves are consistently enforcing strong controls over their systems. Increased risks of such attacks and disruptions also exist because of global geopolitical and other conflicts and tensions. A breach may also result in legal claims or proceedings against us by our stockholders, employees, customers, vendors, suppliers, and government authorities. There can be no assurance that our current or future infrastructure protection technologies and disaster recovery plans can prevent or mitigate such breaches,cyber,cyber- and ransom-related incidents, or systems failures, any of which could have a material adverse effect on our business, financial condition, results of operations, and liquidity. The continuing and evolving threat of cybersecurity incidents (including through AI) has resulted in increased regulatory focus on prevention and disclosure, such as the directive issued by the U.S. Transportation Security Administration following the Colonial Pipeline cybersecurity incident, the obligations imposed by the U.S. Cyber Incident Reporting for Critical InfrastructureAct adopted in March 2022, and the SEC’s cybersecurity and governance disclosure rules issued in 2023.Act. We have been, and may continue to be, required to expend significant resources to comply with such laws and regulations, and otherwise be exposed to litigation andregulatoryenforcement related thereto. See “ITEM 1C. CYBERSECURITY” for additional information on such matters.
Our information systems and network infrastructure have been and continue to be subject to frequent unauthorized access attempts and other cyber attacks, including ransom-related incidents, which could result in increased costs to detect, prevent, respond to, and mitigate these …
Item 1A, Risk Factors, 10-K Feb 25, 2026Marked against last year's 10-K
Our information systems and network infrastructure have been and continue to be subject to frequent unauthorized access attempts and other cyber attacks, including ransom-related incidents, which could result in increased costs to detect, prevent, respond to, andmitigate.mitigate these threats. Such efforts include, amongother measures,others, deploying additional personnel and protection technologies, training employees, and engaging third-party experts and consultants. These attacks could also result in (i) a loss of intellectual property, proprietary information, or employee, customer,supplier,vendor, orvendor data,supplier data; (ii) public disclosure of sensitiveinformation,information; (iii) systemsinterruption,interruption; (iv) disruption of our businessoperations,operations; (v) remediation costs and repairs of system damage; (vi) reputational damage that adversely affects
OKE ONEOK INC /NEW/
14 paragraphsTerrorist attacks, including cyber sabotage, aimed at our facilities could adversely affect our business, results of operations, financial position and cash flows.
Item 1A, Risk Factors, 10-K Feb 24, 2026Marked against last year's 10-K
Terrorist attacks, including cyber sabotage, aimed at our facilities could adversely affectadverselyour business, results of operations, financial position and cash flows.
A breach of information security, including a cybersecurity attack, or failure of one or more key information technology or operational systems, or those of third parties, may adversely affect our operations, financial results or reputation.
Item 1A, Risk Factors, 10-K Feb 24, 2026Marked against last year's 10-K
A breach of information security, including a cybersecurity attack, or failure of one or more key information technology or operational systems, or those of third parties, may adversely affectadverselyour operations, financial results or reputation.
SLB SLB LIMITED/NV
14 paragraphs… There can be no assurance that our cybersecurity risk management program, processes, or systems we have designed to prevent or limit the effects of cyber incidents or attacks will be sufficient to prevent or detect material consequences arising from such …
Word for word as last year Item 1A, Risk Factors, 10-K Jan 23, 2026
Our operations are subject to cyber incidents that could have a material adverse effect on our reputation, business, financial condition, results of operations, and cash flows.
Word for word as last year Item 1A, Risk Factors, 10-K Jan 23, 2026
DVN DEVON ENERGY CORP/DE
11 paragraphs… ransomware, which could be enhanced or facilitated by artificial intelligence. In addition, our vendors (including third-party cloud and IT service providers), midstream providers and other business partners may separately suffer disruptions or breaches from cyberattacks or other cyber-related …
Item 1A, Risk Factors, 10-K Feb 18, 2026Marked against last year's 10-K
We rely heavily on information systems, operational technologies and other digital technologies to conduct our business, and weanticipateare expanding the use of and reliance on these systems and technologies, including through artificial intelligence, process automation and data analytics. Concurrent with the growing dependence on technology is a greater sensitivity to cyberattacks and other cyber-related incidents, which have increasingly targeted our industry. Perpetrators of cyberattacks often attempt to gain unauthorized access to digital systems for purposes of misappropriating confidential, proprietary or personal information, intellectual property or financial assets, corrupting data or causing operational disruptions, as well as preventing users from accessing systems or information for the purpose of demanding payment in order for users to regain access. A wide variety of individuals or groups may perpetuate cyberattacks, ranging from highly sophisticated criminal organizations and state-sponsored actors to disgruntled employees, and the nature of, and methods used in, cyberattacks are similarly diverse and constantly evolving, with examples including phishing attempts, distributed denial of service attacks orransomware.ransomware, which could be enhanced or facilitated by artificial intelligence. In addition, our vendors (including third-party cloud and IT service providers), midstream providers and other business partners may separately suffer disruptions or breaches from cyberattacks or other cyber-related incidents, which, in turn, could adversely impact our operations and compromise our information. Moreover, we and other upstream companies rely on extensive oil and gas infrastructure and distribution systems to deliver our production to market, which, in turn, depend upon digital technologies; we also rely on other critical infrastructure to operate our business, such as communication networks and power grids. Any cyberattack directed at such infrastructure or systems could adversely impact our business and operations, including by limiting our ability to transport and market our production. Furthermore, human error by our employees, contractors or third-party business partners may also cause or exacerbate a cybersecurity incident, and geopolitical instability may heighten the risk of cyberattacks against us or the infrastructure we rely upon.
As of the date of this report, though the Company and certain of our service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity incidents that have materially affected, or are reasonably likely to materially …
Item 1A, Risk Factors, 10-K Feb 18, 2026Marked against last year's 10-K
As of the date of this report, though the Company and certain of our service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, the Company. However, there is no assurance that such a breach has not already occurred and we are unaware of it, or that we will not suffer such a loss in the future. We devote significant resources to prevent cybersecurity incidents and protect our data, butour systems and procedures for identifying and protecting against such attacks and mitigating such risks may prove to be insufficient due to system vulnerabilities, human error or malfeasance or other factors. Any such attacks could have an adverse impact on our business, operations or reputation and lead to remediation costs, litigation or regulatory actions. Moreover, as the sophistication and volume of cyberattacks continue to increase, we may be required to expend significant additional resources to further enhance our digital security or to remediate vulnerabilities, and we may face difficulties in fully anticipating or implementing adequate preventive measures or mitigating potential harm.
XOM EXXON MOBIL CORP
10 paragraphs… ExxonMobil is regularly subject to attempted cybersecurity disruptions from a variety of sources including state-sponsored actors. See Item 1C in this report for information on ExxonMobil’s program for managing cybersecurity risks. If the measures we are taking to …
Item 1A, Risk Factors, 10-K Feb 18, 2026Marked against last year's 10-K
Cybersecurity. ExxonMobil is regularly subject to attempted cybersecurity disruptions from a variety of sources including state-sponsored actors. See Item 1C in this report for information on ExxonMobil’s program for managing cybersecurity risks. If the measures we are taking to protect against cybersecurity disruptions prove to be insufficient or if our proprietary data is otherwise not protected, ExxonMobil, as well as our customers, employees, or third parties, could be adversely affected. We have limited ability to influence third parties, including our partners,supplierssuppliers, and service providers (including providers of cloud-hosting services for our data or applications), to implement strong cybersecurity controls and are exposed to potential harm from cybersecurity events that may affect their operations. Cybersecurity disruptions could cause physical harm to people or the environment; damage or destroy assets; compromise business systems; result in proprietary information being altered, lost, or stolen; result in employee, customer, or third-party information being compromised; or otherwise disrupt our business operations. We could incur significant costs to remedy the effects of a major cybersecurity disruption in addition to costs in connection with resulting regulatory actions, litigation, or reputational harm.
… Successful operation of particular facilities or projects may be disrupted by civil unrest, military conflict, acts of sabotage, piracy, terrorism, cybersecurity attacks, the application of national security laws or policies that result in restricting our ability to do business in …
Item 1A, Risk Factors, 10-K Feb 18, 2026Marked against last year's 10-K
Security concerns. Successful operation of particular facilities or projects may be disrupted by civil unrest, military conflict, acts of sabotage, piracy,orterrorism, cybersecurity attacks, the application of national security laws or policies that result in restricting our ability to do business in a particularjurisdiction,jurisdiction or region, strikes or protests, and otherlocallocal, national, regional, or global security concerns. Such concerns may be directed specifically at ourcompany,Company, our industry, or as part of broader movements and may require us to incur greater costs for security or to shut down operations for a period of time.
AM Antero Midstream Corp
0 paragraphsNot mentioned in the latest 10-K.
AR ANTERO RESOURCES Corp
0 paragraphsNot mentioned in the latest 10-K.
ARLP ALLIANCE RESOURCE PARTNERS LP
0 paragraphsNot mentioned in the latest 10-K.
AROC Archrock, Inc.
0 paragraphsNot mentioned in the latest 10-K.
BSM Black Stone Minerals, L.P.
0 paragraphsNot mentioned in the latest 10-K.
CHRD Chord Energy Corp
0 paragraphsNot mentioned in the latest 10-K.
CNR Core Natural Resources, Inc.
0 paragraphsNot mentioned in the latest 10-K.
CNX CNX Resources Corp
0 paragraphsNot mentioned in the latest 10-K.
CRC California Resources Corp
0 paragraphsNot mentioned in the latest 10-K.
CRK COMSTOCK RESOURCES INC
0 paragraphsNot mentioned in the latest 10-K.
DTM DT Midstream, Inc.
0 paragraphsNot mentioned in the latest 10-K.
EPD ENTERPRISE PRODUCTS PARTNERS L.P.
0 paragraphsNot mentioned in the latest 10-K.
GPOR GULFPORT ENERGY CORP
0 paragraphsNot mentioned in the latest 10-K.
HCC WARRIOR MET COAL, INC.
0 paragraphsNot mentioned in the latest 10-K.
HESM Hess Midstream LP
0 paragraphsNot mentioned in the latest 10-K.
HP Helmerich & Payne, Inc.
0 paragraphsNot mentioned in the latest 10-K.
KGS Kodiak Gas Services, Inc.
0 paragraphsNot mentioned in the latest 10-K.
KNTK Kinetik Holdings Inc.
0 paragraphsNot mentioned in the latest 10-K.
LBRT Liberty Energy Inc.
0 paragraphsNot mentioned in the latest 10-K.
MGY Magnolia Oil & Gas Corp
0 paragraphsNot mentioned in the latest 10-K.
MTDR Matador Resources Co
0 paragraphsNot mentioned in the latest 10-K.
MUR MURPHY OIL CORP
0 paragraphsNot mentioned in the latest 10-K.
NE Noble Corp plc
0 paragraphsNot mentioned in the latest 10-K.
NOG NORTHERN OIL & GAS, INC.
0 paragraphsNot mentioned in the latest 10-K.
OII OCEANEERING INTERNATIONAL INC
0 paragraphsNot mentioned in the latest 10-K.
OVV Ovintiv Inc.
0 paragraphsNot mentioned in the latest 10-K.
PBF PBF Energy Inc.
0 paragraphsNot mentioned in the latest 10-K.
PR Permian Resources Corp
0 paragraphsNot mentioned in the latest 10-K.