Compare companies, side by side

… to data privacy or security breaches, acts of vandalism or theft, malware, ransomware, social engineering attacks (including phishing attacks), denial-of-service attacks or other forms of cyber-attack, misplaced or lost data including paper or electronic media, programming and …

Marked against last year's 10-K

We maintain a system of prevention and detection controls through our security programs; however, our prevention and detection controls may not prevent or identify all such attacks on a timely basis, or at all. Despite our best attempts to maintain adherence to data privacy and security best practices, as well as compliance with applicable laws, regulations, rules, standards and contractual requirements, our facilities, systems and networks, and those of our third-party vendors, may be vulnerable to data privacy or security breaches, acts of vandalism or theft, malware, ransomware, social engineering attacks (including phishing attacks), denial-of-service attacks or other forms of cyber-attack, misplaced or lost data including paper or electronic media, programming and/or human errors or other similar events. We experience attempted external hacking or malicious attacks on a regular basis. In the past, we have experienced cyber-attacks and data breaches, and our third-party vendors have experienced cyber-attacks and security incidents, resulting in disclosure of confidential or protected health information that have not resulted in any material financial loss or penalty to date. For example, in 2024, Change Healthcare, Inc. experienced a cybersecurity incident that disrupted its ability to provide services, impacting payers, providers and pharmacies nationwide, including Centene and some of its subsidiaries. While this incident did not have a material impact on Centene, there can be no assurance that this incident and other privacy or security breaches will not require us to expend significant resources to remediate any damage, interrupt our operations and damage our business or reputation, subject us to state, federal, state or international federal agency review, and result in enforcement actions, material fines and penalties, litigation or other actions which could have a material adverse effect on our business, reputation, results of operations, financial condition and cash flows.

Item 1A, Risk Factors, 10-K Feb 17, 2026open_in_new

• A failure in or breach of our operational or security systems, networks or infrastructure, or those of third-party vendors with which we do business, including as a result of cyber-attacks and other data security incidents, could have a material adverse effect on our business;

Word for word as last year Item 1A, Risk Factors, 10-K Feb 17, 2026open_in_new

While we maintain cyber insurance coverage that is intended to address data security risks, such insurance coverage may be insufficient to cover all losses or claims that may arise.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 3, 2026open_in_new

• Information technology system failures, cyberattacks, or deficiencies in our cybersecurity could harm our business, customer relations, financial condition, or results of operations.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 3, 2026open_in_new

The costs to eliminate or address security threats and vulnerabilities before or after a cyber incident could be significant. Our remediation efforts may not be successful and could result in interruptions, delays or cessation of service and loss of customers. As security threats continually evolve, we may be required to devote additional resources to modify or enhance our operational or security systems and networks and our cybersecurity program.

Marked against last year's 10-K

The costs to eliminate or address security threats and vulnerabilities before or after a cyber-incident cyber incident could be significant. Our remediation efforts may not be successful and could result in interruptions, delays, delays or cessation of service and loss of customers. As security threats continually evolve, we may be required to devote additional resources to modify or enhance our operational or security systems and networks and our cybersecurity program.

Item 1A, Risk Factors, 10-K Feb 26, 2026open_in_new

provide employee awareness training around phishing, malware and other cyber risks; however, such measures may not be effective against all types of security incidents.

New this year Item 1A, Risk Factors, 10-K Feb 26, 2026open_in_new

… Our IT systems have been subject to computer malware, unauthorized access, and other cyber-attacks. There has been an increase in the frequency and sophistication of the cybersecurity threats we and our service providers face, including through the use of …

Marked against last year's 10-K

There are increasingly large volumes of information, including patient data, being generated that need to be securely processed and stored by healthcare organizations. Our IT systems have been subject to computer malware, unauthorized access, and other cyber-attacks. There has been an increase in the frequency and sophistication of the cybersecurity threats we and our service providers face, including through the use of AI by adversaries, and we expect these activities to continue to increase. Geopolitical tensions or conflicts, such as the conflict between Russia and Ukraine, and the increased adoption of AI technologies, may further heighten the risk of cyber-attacks. Additionally, leveraging AI capabilities to potentially improve internal functions and operations presents further risks and challenges, including the possibility of creating new attack methods for adversaries. The use of AI to support business operations carries inherent risks related to data privacy, IP, and security, such as intended, unintended, or inadvertent transmission of proprietary, confidential, or sensitive information, as well as challenges related to implementing and maintaining AI tools, such as developing and maintaining appropriate datasets for such support. If we fail to implement adequate safeguards, the use of AI may introduce additional operational, legal, or regulatory vulnerabilities such as producing inaccurate outcomes based on flaws in the underlying data or methodologies, or unintended results.

Item 1A, Risk Factors, 10-K Feb 4, 2026open_in_new

… If a material cyber incident or other disruption impacting a supplier were to result in its prolonged inability to use, manufacture, and/or ship such components, this could impact our ability to manufacture and/or use our products. In addition …

Marked against last year's 10-K

We rely on software, SaaS, hardware, and other material components from a number of third parties to manufacture our products. products or otherwise operate our business. If a material cyber incident or other disruption impacting a supplier were to result in its prolonged inability to use, manufacture, and/or ship such components, this could impact our ability to manufacture and/or use our products. In addition, third-party sourced software components, malicious code, or a critical vulnerability or error emerging within such software could expose our customers to increased cyber risk. Efforts we have undertaken to mitigate such risks may not prevent all incidents.

Item 1A, Risk Factors, 10-K Feb 4, 2026open_in_new

While we have made, and expect to continue making, significant investments intended to strengthen our cybersecurity posture - including measures designed to protect our products, systems, and data - we cannot guarantee that these efforts will fully prevent, mitigate or remediate cybersecurity …

New this year Item 1A, Risk Factors, 10-K Nov 25, 2025open_in_new

In addition, acquisitions and the integration of acquired companies into our existing and future IT systems and infrastructure, including with third-party vendors and processes, inherently present cybersecurity risks, such as exposing us to vulnerabilities and threats that were previously …

Marked against last year's 10-K

In addition, acquisitions, acquisitions and the integration of acquired companies into the Company’s our existing and future IT systems and infrastructure, including with third-party vendors and processes, inherently presents present cybersecurity risks, such as exposing us to vulnerabilities and threats that were previously unknown or unmanaged. While we attempt to mitigate these risks through due diligence, risk assessments and the implementation of cybersecurity controls and protocols during and after the acquisition process, there can be no assurance that such measures will be sufficient to prevent, mitigate or remediate cybersecurity incidents or breaches, which could have a material adverse effect on our business, financial condition and results of operations.

Item 1A, Risk Factors, 10-K Nov 25, 2025open_in_new

respect to any particular claim. Refer to Part I, Item 1C “Cybersecurity” of this Form 10-K for additional information about the Company’s risk management and strategy and governance with respect to cybersecurity threats and incidents.

Marked against last year's 10-K

Insurance may be insufficient or may not cover the financial, legal, business or reputational losses that may result from a breakdown, breach, cybersecurity threat or incident or other compromise of or interruption to our IT and information systems or confidential and other sensitive information. We also cannot ensure that any limitation of liability or indemnity provisions in our contracts, including with vendors and service providers, for a cybersecurity threat or incident, security lapse or breach or other security incident would be enforceable or adequate or would otherwise protect us from any liabilities or damages with respect to any particular claim. Refer to Part I, Item 1C “Cybersecurity” of this Form 10-K for additional information about the Company’s risk management and strategy and governance with respect to cybersecurity threats and incidents.

Item 1A, Risk Factors, 10-K Feb 26, 2026open_in_new

◦ We are increasingly dependent on IT and information systems and our systems and infrastructure face certain risks, including cybersecurity and data leakage risks.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 26, 2026open_in_new

Cybersecurity threats continue to increase in frequency and sophistication; a successful cybersecurity attack could interrupt or disrupt our information technology systems, or those of our third-party service providers, or cause the loss of confidential or protected data which could disrupt our business, force us to incur excessive costs or cause reputational harm.

Marked against last year's 10-K

Cybersecurity threats continue to increase in frequency and sophistication; a successful cybersecurity attack could interrupt or disrupt our information technology systems, or those of our third-party service providers, or cause the loss of confidential or protected data which could disrupt our business, force us to incur excessive costs or cause reputational harm.

Item 1A, Risk Factors, 10-K Dec 5, 2025open_in_new

… There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. We maintain cyber liability insurance; however, this …

Word for word as last year Item 1A, Risk Factors, 10-K Dec 5, 2025open_in_new

We cannot ensure that we or our third-party service providers will be able to identify, prevent or contain the effects of cyber-attacks or other cybersecurity risks that bypass our or their security measures or disrupt our or their …

Marked against last year's 10-K

We cannot ensure that we or our third-party service providers will be able to identify, prevent or contain the effects of cyber-attacks or other cybersecurity risks that bypass our or their security measures or disrupt our or their information technology systems or business. Hardware, software or applications we develop or procure from third parties may contain defects in design, manufacturer defects or other problems that could unexpectedly compromise information security. In addition, because the techniques used to obtain unauthorized access, disable, disrupt or degrade service or sabotage systems change frequently, are becoming increasingly sophisticated (in part due to the use of evolving technologies), and may not immediately produce signs of intrusion, we may be unable to anticipate these techniques and threats, timely discover or counter them or implement adequate preventative measures. Viruses, worms, malicious software programs or other unauthorized methods of acquiring data may be used to attack our systems or otherwise exploit any security vulnerabilities which may cause system disruptions or shutdowns, or may cause personal, proprietary or confidential information to be disclosed, misappropriated or compromised. We have business continuation and resiliency plans which are maintained, updated and tested regularly in an effort to successfully contain and remediate potential disruptions or cyber events, but there is no guarantee that such efforts will be effective. If those efforts are not effective, the functionality of our information technology systems or those of third parties could be interrupted. Cybersecurity and the continued development and enhancement of our controls, processes and practices designed to protect our systems, computers, software, data and networks from attack, damage and unauthorized access remain a priority for us.

Item 1A, Risk Factors, 10-K Feb 6, 2026open_in_new

… disruptions or cyber events, but there is no guarantee that such efforts will be effective. If those efforts are not effective, the functionality of our information technology systems or those of third parties could be interrupted. Cybersecurity and the continued …

Marked against last year's 10-K

We cannot ensure that we or our third-party service providers will be able to identify, prevent or contain the effects of cyber-attacks or other cybersecurity risks that bypass our or their security measures or disrupt our or their information technology systems or business. Hardware, software or applications we develop or procure from third parties may contain defects in design, manufacturer defects or other problems that could unexpectedly compromise information security. In addition, because the techniques used to obtain unauthorized access, disable, disrupt or degrade service or sabotage systems change frequently, are becoming increasingly sophisticated (in part due to the use of evolving technologies), and may not immediately produce signs of intrusion, we may be unable to anticipate these techniques and threats, timely discover or counter them or implement adequate preventative measures. Viruses, worms, malicious software programs or other unauthorized methods of acquiring data may be used to attack our systems or otherwise exploit any security vulnerabilities which may cause system disruptions or shutdowns, or may cause personal, proprietary or confidential information to be disclosed, misappropriated or compromised. We have business continuation and resiliency plans which are maintained, updated and tested regularly in an effort to successfully contain and remediate potential disruptions or cyber events, but there is no guarantee that such efforts will be effective. If those efforts are not effective, the functionality of our information technology systems or those of third parties could be interrupted. Cybersecurity and the continued development and enhancement of our controls, processes and practices designed to protect our systems, computers, software, data and networks from attack, damage and unauthorized access remain a priority for us.

Item 1A, Risk Factors, 10-K Feb 6, 2026open_in_new

… As a global pharmaceutical company, our systems and assets are the target of frequent cyber-attacks. Such cyber-attacks are of ever-increasing levels of sophistication, including the use of adversarial AI techniques (for example, AI may be used to …

Marked against last year's 10-K

Significant disruptions of IT systems or breaches of information security could adversely affect our business. We extensively rely upon sophisticated IT systems (including cloud services) to operate our business. We produce, collect, process, store and transmit large amounts of confidential information (including personal information and intellectual property), and we deploy and operate an array of technical and procedural controls to maintain the confidentiality, integrity and availability of such confidential information. We develop and operate digital systems to engage patients, healthcare providers, governments, payors and supply chain partners to conduct business and deliver medicines, digital diagnostics, clinical trials and digital therapies. Such systems include mobile applications, wearable devices, internet websites and other digital technologies that may be targets of attack. We have outsourced significant elements of our operations, including significant elements of our IT infrastructure and, as a result, we manage relationships with many third-party providers who may or could have access to our confidential information. We rely on technology developed, supplied and/or maintained by third-parties that may make us vulnerable to “supply chain” style cyber-attacks. Further, technology and security vulnerabilities of acquisitions, business partners or third-party providers may not be identified during due diligence or soon enough to mitigate exploitation. potential risks. The size and complexity of our IT and information security systems, and those of our third-party providers (and the large amounts of confidential information that is present on them), make such systems potentially vulnerable to service interruptions or to security breaches from inadvertent or intentional actions by, but not limited to, our employees, contingent workers, service providers, business partners, customers or malicious attackers. As a global pharmaceutical company, our systems and assets are the target of frequent cyber-attacks. Such cyber-attacks are of ever-increasing levels of sophistication, including the use of adversarial AI techniques, techniques (for example, AI may be used to automate phishing attacks and other forms of social engineering, and accelerate vulnerability exploitation), and are made by groups and individuals with a wide range of motives (including, but not limited to, industrial espionage, extortion, property destruction and personal information theft) and expertise, including, but not limited to, organized criminal groups, “hacktivists,” nation states, employees, business partners and others. Due to the nature sophistication of some of these attacks, there is a risk that they may remain undetected for a period of time. While we have invested in the protection of data and IT and develop and maintain systems and controls, our efforts, like those of other similar companies, have not always prevented and may not in the future prevent service interruptions, extortion, theft of confidential, personal or proprietary information, compromise of data integrity or unauthorized information disclosure. Any technology service interruption or breach of our systems could adversely affect our business operations and/or result in potential legal liability, the loss of personal data, confidential information or intellectual property. Such incidents could require disclosure to government authorities and/or regulators and could require notification to impacted affected individuals and any incident could result in financial, legal, business and reputational harm to us. We maintain cyber liability insurance; however, this insurance may not be sufficient to cover the financial, legal, business or reputational losses that may result from an interruption or breach of our systems.

Item 1A, Risk Factors, 10-K Feb 26, 2026open_in_new

… not be appropriate for the intended use, of poor quality, contain biased information, or that become corrupted during a cyber-attack; and flawed or inappropriate data practices by data scientists, engineers, and end-users could impair results. If the output …

Marked against last year's 10-K

AI AI, including machine learning and generative AI, is increasingly being used in the biopharmaceutical and global healthcare industries. We have begun deploying AI in various parts of our internal and external operations, including in R&D, and continue to explore further use cases for AI, and our investments in AI may not yield anticipated benefits. As with many developing technologies, AI presents risks and challenges. For example, algorithms existing regulatory frameworks governing the use, development, and deployment of AI, including regulatory guidance on the use of AI in medical products, remain uncertain and subject to significant change. New regulatory requirements could impose significant compliance costs, limit our ability to deploy AI, require changes to our practices (including documentation, risk management, testing, or transparency measures), or increase litigation and enforcement risk. In addition, AI may be flawed used by payors to limit access to care or trained to deny prior authorization requests, which could impact Pfizer’s business results. Further, AI technology itself can give rise to risks. Generative AI output is probabilistic in nature and may not be reproducible or generate consistent results over time. AI can generate outputs that are false, misleading, incomplete, or inconsistent, and may be difficult to monitor, explain, or reproduce. AI performance may also degrade over time due to changes in inputs, data drift, updates by vendors, or adversarial manipulation. AI design or training may be flawed, including as a result of external vendors or others training AI models on content without the necessary intellectual property rights or other legal rights or permissions; permissions or using data sets that may not be appropriate for the intended use, of poor quality, contain biased information, or that become corrupted during a cyber-attack; and flawed or inappropriate or controversial data practices by data scientists, engineers, and end-users could impair results. If the outputs output that AI produces or assists in producing are is deficient or inaccurate, we could be subjected to competitive harm, regulatory scrutiny, potential legal liability and brand or reputational harm. Furthermore, The use of AI may lead to the release of confidential information which may impact our ability to realize the benefits of our data, including intellectual property.

Item 1A, Risk Factors, 10-K Feb 26, 2026open_in_new

Abbott invests in its information systems and technology and in the protection of its products and data to reduce the risk of a cybersecurity incident or other significant disruption, and monitors its information systems on an ongoing basis for any …

Marked against last year's 10-K

Abbott invests in its information systems and technology and in the protection of its products and data to reduce the risk of a cybersecurity incident or other significant disruption, and monitors its information systems on an ongoing basis for any current or potential cybersecurity threats or vulnerabilities and as well as for changes in technology and the regulatory environment. There can be no assurance that these measures and efforts will prevent future cybersecurity incidents or other significant disruptions to any of the information systems on which Abbott relies or that related product issues will not arise in the future. Similarly, there can be no assurance that third party third-party information technology providers or other partners with whom Abbott contracts will not suffer a significant cybersecurity incident or disruption that impacts Abbott. Any significant cybersecurity incident or other disruption affecting Abbott’s information systems or products could have a material adverse effect on Abbott’s business, financial condition and results of operations.

Item 1A, Risk Factors, 10-K Feb 20, 2026open_in_new

Similar to other large multi-national companies, the size and complexity of the information systems on which Abbott relies for both its infrastructure and products make them susceptible to a cybersecurity incident, breakdown, destruction, loss of data privacy, or other …

Marked against last year's 10-K

Similar to other large multi-national companies, the size and complexity of the information systems on which Abbott relies for both its infrastructure and products make them susceptible to a cybersecurity incident, breakdown, destruction, loss of data privacy, or other significant disruption. These systems have been and are expected to continue to be the target of malware and other cybersecurity incidents. In addition, third party third-party hacking attempts may cause Abbott’s information systems and related products, protected data, or proprietary information to be compromised or stolen. A significant cybersecurity incident or other disruption could result in adverse consequences, including regulatory inquiries or litigation, increased costs and expenses, manufacturing challenges or disruption, problems with product availability, functionality or safety, damage to customer relations, reputational damage, lost revenue, and fines or penalties.

Item 1A, Risk Factors, 10-K Feb 20, 2026open_in_new

… We could also suffer strained relationships with customers, business partners, physicians and other healthcare professionals, increased costs, litigation or other negative consequences as a result of such cyber incidents. The insurance we have procured related to cybersecurity risks may not …

Marked against last year's 10-K

Our Technology is vulnerable to breakdown, interruption, cyber and other security attacks, system malfunction, unauthorized access, inadvertent exposure or disclosure of information, theft and other events and requires at times requires the manual application of security upgrades or patches on each machine or device that utilizes the Technology. Third-party systems and solutions that we rely upon are also vulnerable to the same risks and may contain defects in design or manufacture or other problems that could result in system disruption or compromise the information security of our own systems and products. Any such vulnerability could compromise our Technology and could expose Protected Information to unauthorized third parties and/or cause temporary or permanent loss or unavailability of such Protected Information. In addition, our Technology may cause product functionality issues that could result in risk to patient safety, field actions or product recalls. We, like other global companies, have experienced cyber incidents in the past (including ones related to the unauthorized access to or disclosure of data), data and to certain of our third-party service providers), and may experience them in the future. These events have exposed and may continue to expose vulnerabilities in our information technology systems. There systems, and could expose Protected Information to unauthorized third parties and/or cause temporary or loss or unavailability of such information. While we continue to invest in improvements to our IT systems, there is no assurance that our investments in the protection of data and Technology (i) have prevented or will prevent future breakdowns, attacks or breaches in our Technology, or cyber incidents or other incidents or (ii) ensure compliance with all applicable cybersecurity and privacy laws, regulations and standards, including with respect to third-party service providers that host or process Protected Information on our behalf. Any failure to protect against such incidents or non-compliance with applicable security and privacy laws, regulations and standards could lead to substantial and material regulatory fines and penalties, business disruption, reputational harm, financial loss or litigation, as well as other damages. Misappropriation or other loss of our intellectual property from any of the foregoing may have an adverse effect on our competitive position and may cause us to incur substantial litigation costs. See “Risks Relating to Legal and Regulatory Matters.” As our customers and FDA and other global regulators, including data protection authorities or supervisory bodies, become more sensitive to risks related to cybersecurity, our ability to meet certain information technology safety standards or evolving customer demands could affect our products’ marketability and competitiveness. incidents. We could also suffer strained relationships with customers, business partners, physicians and other healthcare professionals, increased costs (for security measures, remediation or otherwise), costs, litigation (including class actions and stockholder derivative actions) or other negative consequences (including a decline in stock price) as a result of breaches, such cyber and other security attacks, industrial espionage, ransomware, phishing scams, malware or other cyber incidents, which could compromise our system infrastructure and/or lead to data leakage, including at our third-party providers or other business partners. incidents. The insurance we have procured related to cybersecurity risks may not cover a particular cyber incident or such coverage may be insufficient.

Item 1A, Risk Factors, 10-K Feb 12, 2026open_in_new

• We may experience breaches and breakdowns affecting our information technology systems or protected information, including from obsolescence, cyber security breaches and data leakage.

Marked against last year's 10-K

• Breaches We may experience breaches and breakdowns affecting our information technology systems or protected information, including from obsolescence, cyber security breaches and data leakage, could have a material adverse effect on us. leakage.

Item 1A, Risk Factors, 10-K Feb 12, 2026open_in_new

… as an increased number of cyber extortion attacks, with higher financial ransom demand amounts and increasing sophistication and variety of ransomware techniques and methodology. Geopolitical instability may increase the risk of cybersecurity threats. Cybersecurity threats or incidents may include deployment …

Marked against last year's 10-K

Cybersecurity threats and incidents are increasing in their frequency, sophistication and intensity, and are becoming increasingly difficult to detect, particularly when they impact vendors, customers or suppliers, and other companies in our supply chain. Cybersecurity threats and incidents are often carried out by motivated, well-resourced, skilled and persistent threat actors, including nation states, organized crime groups, “hacktivists” and may include or target employees or contractors acting with careless or malicious intent. Recent developments in the threat landscape include use of adversarial AI techniques and machine learning, as well as an increased number of cyber extortion attacks, with higher financial ransom demand amounts and increasing sophistication and variety of ransomware techniques and methodology. Geopolitical instability, including that related to Russia's invasion of Ukraine or the conflict in the Middle East, instability may increase the risk of cybersecurity threats. Cybersecurity threats or incidents may include deployment of harmful malware and key loggers, ransomware, a denial-of-service attack, a malicious website, the use of social engineering and other means to affect the confidentiality, integrity and availability of our information systems and data. Cybersecurity threats and incidents also include manufacturing, hardware or software supply chain attacks, which could cause a delay in the manufacturing of products or products produced for contract manufacturing or lead to a data privacy or security breach. Our key business partners face similar risks and any security breach of their systems could adversely affect our security posture. In addition, our increased use of cloud technologies heightens these and other operational risks, and any failure by cloud or other technology service providers to adequately safeguard their systems and prevent cyber-attacks could disrupt our operations and result in misappropriation, corruption or loss of confidential or propriety information.

Item 1A, Risk Factors, 10-K Feb 6, 2026open_in_new

While we continue to build and improve our systems and infrastructure, including our business continuity plans, there can be no assurance that our efforts will detect and prevent cybersecurity threats or incidents in our systems and any such incidents could …

Marked against last year's 10-K

While we continue to build and improve our systems and infrastructure, including our business continuity plans, there can be no assurance that our efforts will detect and prevent cybersecurity threats or incidents in our systems and any such incidents could materially adversely affect our business and operations and/or result in the loss of critical or sensitive information, which could result in material financial, legal, operational or reputational harm to us, loss of competitive advantage or loss of consumer confidence. Our liability insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.

Item 1A, Risk Factors, 10-K Feb 6, 2026open_in_new

The Company continues to face cybersecurity threats, including ransomware attempts, data breaches, and phishing and social engineering attempts targeting its systems and its employees, and those of third-party vendors. Increasingly sophisticated methods, including the use of AI by threat …

New this year Item 1A, Risk Factors, 10-K Feb 24, 2026open_in_new

Cybersecurity incidents and unauthorized access to the Company's or its customers’ data could harm the Company’s reputation and adversely affect its business.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 24, 2026open_in_new

We rely on the proper function, availability, and security of our products and IT systems; a successful cyber-attack or other breach or disruption of our products or these systems could have a material adverse effect on our business and results of operations.

Marked against last year's 10-K

We rely on the proper function, availability, and security of our product products and information technology IT systems; a successful cyber-attack or other breach or disruption of our product products or these systems could have a material adverse effect on our business and results of operations.

Item 1A, Risk Factors, 10-K Feb 18, 2026open_in_new

… Further, we expect that the breadth and complexity of our IT systems and infrastructure will increase as we utilize cloud technologies and AI, which present inherent enterprise technology risks, including those related to privacy, data protection, and cybersecurity, that need …

Marked against last year's 10-K

We rely on IT systems to process, transmit, and store electronic information, including personal, financial, and sensitive medical information. Our IT systems support various business processes, including sales, shipping, billing, customer service, procurement, supply chain, manufacturing, and accounts payable. In addition, we use enterprise IT systems for internal financial reporting and to comply with external financial reporting, legal, and tax regulatory requirements. Many of our systems are cloud-hosted and managed by third-party vendors who may have access to confidential business, employee, healthcare professional, and/or customer information. Our IT systems are vulnerable to damage, disruptions, or shutdowns due to various factors such as viruses, hacking, power outages, user error, hardware failures, and catastrophic events. Failure to protect our IT systems could lead to unauthorized access to customer data, theft of intellectual property or other misappropriation of assets, loss of key data, or disruption of operations. Further, we expect that the breadth and complexity of our IT systems and infrastructure will increase as we utilize cloud technologies and AI, which present inherent enterprise technology risks, including those related to privacy, data protection, and cybersecurity, that need to be managed. The foregoing could expose us to further risk of potential breaches, failures, interruptions, and disruptions, which could result in adverse consequences, including regulatory inquiries or litigation, increased costs and expenses, reputational damage, lost revenue, and fines or penalties.

Item 1A, Risk Factors, 10-K Feb 18, 2026open_in_new

… Despite Solventum’s cybersecurity and business continuity measures (including employee and third-party training, monitoring of networks and systems, patching, maintenance and backup of systems and data), its information technology networks and infrastructure are still potentially susceptible to attack, compromise …

Marked against last year's 10-K

In the ordinary course of business, Solventum relies on centralized and local information technology networks and systems, some of which are provided, hosted or managed by vendors and other third parties, to process, transmit and store electronic information, and to manage or support a variety of businesses. That technology includes systems that could be used to process, transmit and store sensitive information, including personal information, protected health information, employee data, financial information, intellectual property, clinical data and sales and marketing data. Further, Solventum expects that the breadth and complexity of its information technology networks and systems will increase as it expands its product and service offerings to utilize AI, machine learning, and other emerging technologies. Third parties and threat actors, including organized criminals, nation-state or nation-state supported actors who are increasingly well-resourced, regularly attempt to gain unauthorized access to the information technology networks and infrastructure, data and other information used by or belonging to Solventum, and many such attempts are increasing in their frequency, sophistication and intensity and are not recognized until launched against a target. In addition, AI is increasing in use among such third parties and threat actors which may lead to more sophisticated and targeted phishing attempts, cyberattacks, phishing attempts, or otherwise enhance the social engineering capabilities of such parties. Despite Solventum’s cybersecurity and business continuity measures (including employee and third-party training, monitoring of networks and systems, patching, maintenance and backup of systems and data), its information technology networks and infrastructure are still potentially susceptible to attack, compromise, damage, disruption or shutdown, including as a result of the exploitation of known or unknown hardware or software vulnerabilities in its systems, the introduction of computer viruses or ransomware, service or cloud provider disruptions or security breaches, phishing attempts, employee error or malfeasance, power outages, telecommunication or utility failures, systems failures, natural disasters or other catastrophic events. Furthermore, Solventum relies on third-party vendors to supply and/or support certain aspects of its information technology systems and resulting products. These third-party systems could also become vulnerable to cyber-attack, malicious intrusions, breakdowns, interference or other significant disruptions, and may contain defects in design or manufacture or other problems that could result in system disruption or compromise the information security of Solventum’s own systems. Solventum’s increased adoption of remote working, initially driven by the COVID 19 pandemic, working also introduces additional threats and risk of disruptions to its information technology networks and infrastructure. Geopolitical conflict may increase cybersecurity risks on a global basis.

Item 1A, Risk Factors, 10-K Feb 27, 2026open_in_new

… Use of these technology solutions could result in Solventum’s increased vulnerability to cyber-attack, malicious intrusions, breakdowns, interference or other significant disruptions, exposure to penalties from non-compliance with emerging regulations, and may result in defects in design or …

Marked against last year's 10-K

In addition, As noted elsewhere in these Risk Factors, Solventum intends to devote significant resources to develop is using AI, machine learning, cloud, edge, and deploy cloud, edge other emerging technologies in its products and software solutions in healthcare, which must comply with stringent regulations, including certification requirements, in many of the countries in which Solventum’s customers are located, particularly in relation to obtaining, using, storing and transferring personal data. Ensuring such regulatory compliance may take longer or cost more than expected or require that design changes be incorporated into Solventum’s offerings. Solventum also intends to build artificial intelligence (“AI”) into many of its digital offerings, which presents risks and challenges that could affect its acceptance, including flawed AI algorithms, insufficient or biased datasets, malfunctions or manipulations, lack of acceptance from its customers or failure to deliver positive outcomes. services. Use of these software technology solutions could result in Solventum’s increased vulnerability to cyber-attack, malicious intrusions, breakdowns, interference or other significant disruptions, exposure to penalties from non-compliance with emerging regulations, and may result in defects in design or manufacture or other problems that could result in system disruption or compromise the information security of Solventum’s other systems.

Item 1A, Risk Factors, 10-K Feb 27, 2026open_in_new

… errors or other technical malfunctions, hacking attacks, phishing, vishing, deepfakes, and other social engineering attacks, malware, ransomware, employee noncompliance, error or malfeasance, cybersecurity attacks, malicious code, and other breaches of, or incidents impacting, IT systems or similar malicious or otherwise …

Marked against last year's 10-K

We retain confidential Our IT systems, policies and contracts and the policies of our third-party vendors, and their IT systems safeguard employee, applicant and customer personal, health and financial, and our own proprietary information and data essential to our operations. We rely on the effectiveness of our IT systems, policies and contracts and the policies of our third-party vendors, and their IT systems to safeguard information and data. Additionally, our Our cybersecurity controls also depend on our customers, many of whom are individual or small healthcare providers with limited IT experience and inadequate or untested security protocols, to successfully manage data privacy and security requirements. It is critical that the facilities, infrastructure and IT systems on which we depend and the products and services we develop remain secure and be perceived as secure. Despite the implementation of security features in our products and services and security measures in our IT systems, we We and our service providers, third-party vendors and other third parties could be targeted by or subject to physical break-ins, computer viruses and other malicious code, unauthorized or fraudulent access, programming errors or other technical malfunctions, hacking attacks, phishing phishing, vishing, deepfakes, and other social engineering attacks, malware, ransomware, employee noncompliance, error or malfeasance, cybersecurity attacks, malicious code, and other breaches of, or incidents impacting, IT systems or similar malicious or otherwise disruptive actions, including by organized groups and nation-state actors, which may disrupt or limit the availability of, or result in damage to, our IT systems and result in loss or unavailability of, damage to, or the unauthorized acquisition, use, disclosure, or other processing of confidential information. For example, we We have experienced, and may again experience in the future, cybersecurity incidents, data incidents, and unauthorized internal employee exfiltration of information. This risk is exacerbated with the advancement of technologies like AI, which malicious third parties can use to create new, more sophisticated and more frequent or other attacks. There can be no assurance our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information or any other information we maintain or otherwise process.

Item 1A, Risk Factors, 10-K Feb 27, 2026open_in_new

Security breaches, data breaches, cybersecurity attacks, or other cybersecurity incidents could materially adversely impact our operations and patient care, and our reputation, business, financial condition and results of operations could be harmed.

Marked against last year's 10-K

Security breaches, data breaches, cybersecurity attacks, or other cybersecurity incidents, or the failure to comply with privacy, security and data protection laws incidents could materially adversely impact our operations and patient care, and we could be liable for damages, and our reputation, business, financial condition and results of operations could be harmed.

Item 1A, Risk Factors, 10-K Feb 27, 2026open_in_new

… and international privacy and cybersecurity laws and regulations impacting our operations are described in "Item 1. Business" - Other Factors Impacting Our Operations - Data Privacy and Security Laws and Regulations. Any data security breaches, cyber-attacks, malicious intrusions or significant disruptions …

Marked against last year's 10-K

Our worldwide operations subject us to laws and regulations in many jurisdictions, including data protection and cybersecurity laws and regulations. The variety of U.S. and international privacy and cybersecurity laws and regulations impacting our operations are described in “Item "Item 1. Business" - Other Factors Impacting Our Operations - Data Privacy and Security Laws and Regulations. Any data security breaches, cyber-attacks, malicious intrusions or significant disruptions could result in actions by regulatory bodies and/or civil litigation, any of which could materially and adversely affect our business, results of operations, financial condition, cash flows, reputation, or competitive position.

Item 1A, Risk Factors, 10-K Jun 18, 2026open_in_new

… One of the most prevalent attacks on large organizations has been ransomware, which can have a devastating impact on an organization’s operations. Our ransomware readiness program has required and will continue to require investment and will not guarantee that …

Marked against last year's 10-K

We are increasingly dependent on sophisticated information technology systems to operate our business. That technology includes systems that could be used to process, transmit and store sensitive data. Additionally, many of our products and services include integrated software and information technology that collects data regarding patients or connects to other internal systems. One of the most prevalent attacks on large organizations has been ransomware ransomware, which can have a devastating impact on an organization’s operations. Our ransomware readiness program has required and will continue to require investment and will not guarantee that we will be immune from an incident or be able to respond rapidly enough to prevent a negative impact on our business. Like all organizations, we routinely experience attempted interference with the integrity of, and interruptions in, our technology systems via events such as cyber-attacks, malicious intrusions, or other breakdowns. The consequences could mean data breaches, interference with the integrity of our products and data, compromise of intellectual property or other proprietary information, or other significant disruptions. Furthermore, we rely on third-party vendors to supply and/or support certain aspects of our information technology systems and resulting products, and customers and payors use information technology systems to process payments relating to our products and services. These third-party systems could also become vulnerable to cyber-attack, malicious intrusions, breakdowns, interference, or other significant disruptions, and may contain defects in design or manufacture or other problems that could result in system disruption or compromise the information security of our own systems. In addition, our global profile and international operations expose us to geopolitical events or issues which may increase cybersecurity risks on a global basis. Lastly, we continue to grow in part through new business acquisitions and, as a result, may face risks associated with defects and vulnerabilities in acquired businesses’ systems, or difficulties or other breakdowns or disruptions in connection with the integration of the acquisitions into our information technology systems.

Item 1A, Risk Factors, 10-K Jun 18, 2026open_in_new

See Item 1C of this 10-K, “Cybersecurity,” for more information on the Company’s cybersecurity risk management and governance.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 10, 2026open_in_new

See Item 1C of this 10-K, “Cybersecurity,” for more information on the Company’s cybersecurity risk management and governance.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 10, 2026open_in_new

… However, as cyber threats continue to evolve, along with their increased volume and sophistication, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any cybersecurity vulnerabilities …

Marked against last year's 10-K

Cybersecurity, privacy, physical security security, operational resiliency and the continued development and enhancement of our controls, processes and practices designed to protect our facilities, information systems and data from attack, damage or unauthorized access remain a priority for us. As However, as cyber threats continue to evolve, along with their increased volume and sophistication, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any cybersecurity vulnerabilities or incidents, and such measures may decrease the efficiency of our operations. We may also be required to expend additional resources to comply with evolving federal federal, state and state industry requirements related to cybersecurity and information security, including those focused on health care providers. Although, to date, no cyberattack or other information or security breach has resulted in material losses or other material consequences to us, there can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cyber threats, including the remediation of critical cybersecurity, information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Additionally, while we have in place insurance coverage designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover our losses in excess of what we self-insure, or all types of claims that may arise. The occurrence of any of these events could result in (i) harm to patients; (ii) business interruptions and delays; (iii) the loss, misappropriation, corruption or unauthorized access of data; (iv) litigation and potential liability under privacy, security, breach notification and consumer protection laws, common law theories or other applicable laws; (v) reputational damage; and (vi) foreign, federal and state governmental inquiries, any of which could have a material, adverse effect on our financial position and results of operations and harm our business reputation.

Item 1A, Risk Factors, 10-K Feb 10, 2026open_in_new

• the confidentiality, maintenance, interoperability, exchange and security of health-related and personal information and medical records, including data breach, ransomware and identity theft issues;

Word for word as last year Item 1A, Risk Factors, 10-K Feb 10, 2026open_in_new

… These attacks may include phishing, state-sponsored cyber attacks, industrial espionage, insider threats, computer denial-of-service attacks, computer viruses, ransomware and other malware, payment fraud or other cyber incidents. Evolving artificial intelligence and machine learning tools continue to improve …

Marked against last year's 10-K

Like other large multi-national corporations, we and the third parties with whom we contract regularly experience cyber attacks, certain of which (including email phishing attacks on our email systems) have been successful, and we expect to continue to be subject to such attacks. These attacks may include phishing, state-sponsored cyber attacks, industrial espionage, insider threats, computer denial-of-service attacks, computer viruses, ransomware and other malware, payment fraud or other cyber incidents. Evolving artificial intelligence and machine learning tools continue to improve the capabilities of cyber attackers. In addition, as a result of our adoption of remote work arrangements in many positions, a significant number of our employees who are able to work remotely are doing so, and malicious cyber actors may increase efforts targeting remote workers, which exposes us to additional cybersecurity risks. Our cybersecurity program, incident response efforts, business continuity procedures and disaster recovery planning may not be sufficient for all eventualities. If we (or third parties with whom we contract) fail to maintain or protect our information systems and data integrity effectively, we could:

Item 1A, Risk Factors, 10-K Feb 20, 2026open_in_new

Cyber attacks are becoming more sophisticated, frequent and adaptive, and therefore, despite our efforts, we cannot assure that cybersecurity incidents or data breaches will not occur or that technology or information system issues will not arise in the future. Any …

Marked against last year's 10-K

We will continue to dedicate significant resources to protect against unauthorized access to our systems and work with government authorities to detect and reduce the risk of future cyber incidents; however, cyber Cyber attacks are becoming more sophisticated, frequent and adaptive. Therefore, adaptive, and therefore, despite our efforts, we cannot assure that cybersecurity incidents or data breaches will not occur or that technology or information system issues will not arise in the future. Any significant breakdown, intrusion, breach, interruption, corruption or destruction of these systems could have a material adverse effect on our business and reputation and could materially adversely affect our results of operations and financial condition.

Item 1A, Risk Factors, 10-K Feb 20, 2026open_in_new

… by failures during system upgrades or implementations, user error, network or hardware failure, malicious intrusion and ransomware attack. Likewise, data privacy or cybersecurity incidents or breaches by employees or others, including the unauthorized use of AI tools, can result in …

Marked against last year's 10-K

We are dependent upon information technology systems, infrastructure and data. For example, our Kite Konnect platform is critical to maintain chain of identity and chain of custody for our cell therapies. The multitude and complexity of our computer systems make them inherently vulnerable to service interruption or destruction, including those caused by failures during system upgrades or implementations, user error, network or hardware failure, malicious intrusion and ransomware attack. Likewise, data privacy or cybersecurity incidents or breaches by employees or others, including the unauthorized use of artificial intelligence AI tools, can result in the exposure of or misuse of sensitive data, including our intellectual property or trade secrets or the personal information of our employees, patients, customers or other business partners to unauthorized persons or to the public. Additionally, businesses which we have acquired, or may in the future acquire, may have undiscovered vulnerabilities in their information technology systems, which could increase our risk of cybersecurity incidents. If our information systems or third-party information systems on which we rely suffer severe damage, disruption or shutdown, including during upgrades or new implementations, and our business continuity plans do not effectively resolve the issues in a timely manner, we could experience delays in reporting our financial results, and we may lose revenue and profits as a result of our inability to timely manufacture, distribute, invoice and collect payments.

Item 1A, Risk Factors, 10-K Feb 24, 2026open_in_new

Like many companies, we have experienced and expect to continue to be the target of cybersecurity incidents, including data breaches and temporary service interruptions. When cybersecurity incidents occur, our policy is to respond and address them in accordance with applicable …

Marked against last year's 10-K

Like many companies, we have experienced and expect to continue to be the target of cybersecurity incidents, including data breaches and temporary service interruptions. When cybersecurity incidents occur, our policy is to respond and address them in accordance with applicable governmental regulations and other legal requirements, including our cybersecurity protocols. There can be no assurance that our efforts in response to cybersecurity incidents, as well as our investments to protect our information technology infrastructure and data, will shield us from significant losses, brand and reputational harm and potential liability or prevent any future interruption or breach of our systems. Additionally, it may take considerable time for us to investigate and evaluate the full impact of cybersecurity incidents, particularly for sophisticated attacks, which may inhibit our ability to provide prompt, full and reliable information about cybersecurity incidents to our customers, regulators and the public. Such cybersecurity incidents can cause the loss of critical or sensitive information, including personal information, and could give rise to legal liability and regulatory action under data protection and privacy laws. Financial, legal, business, or reputational losses may result from a cybersecurity incident or breach of our information technology systems.

Item 1A, Risk Factors, 10-K Feb 24, 2026open_in_new

We, and some of our third-party vendors, have experienced cybersecurity attacks by threat actors (which may include state-sponsored organizations or nation state actors) and other cybersecurity breaches and incidents in the past, including, among other things, computer viruses and malware, ransomware, denial of service actions, phishing schemes, social engineering, the compromise, misappropriation and/or unauthorized access to (or acquisition or disclosure of) confidential or

New this year Item 1A, Risk Factors, 10-K Feb 20, 2026open_in_new

… While we maintain a cyber risk insurance policy, it may not cover any or all claims, costs or losses associated with all cybersecurity events. For more information regarding personal data and information privacy and data protection risks, refer to “Our …

Marked against last year's 10-K

We, otherwise protected information, and some of our third-party vendors, have experienced cybersecurity attacks and incidents in the past similar events, and will likely experience further attacks attacks, breaches and incidents in the future, potentially with more frequency. To our knowledge, none have resulted in any material adverse impact to the Company, our business strategy, results of operations or financial condition. We have adopted measures to mitigate potential risks associated with information technology disruptions and cybersecurity threats; however, given the unpredictability of the timing, nature nature, and scope of such disruptions and the evolving nature of cybersecurity threats, which vary in technique and sources, if we or our business partners or suppliers were to experience a system disruption, attack or security breach or incident that impacts any of our critical functions, or our customers were to experience a system disruption, attack or security breach or incident via any of our software or connected IoT products and services, we could potentially be subject to production downtimes, operational and/or productivity delays, other detrimental impacts on our operations or ability to provide products and services to our customers, the compromise, misappropriation and/or unauthorized access to (or acquisition or disclosure of of) confidential or otherwise protected information, destruction or corruption of data, security breaches, other manipulation or misuse of our systems or networks, financial losses and additional costs from remedial actions, repairs to infrastructure, physical systems or data processing systems, increased cybersecurity and information technology protection costs, loss of business or potential liability, and/or damage to our reputation, any of which could have a material adverse effect on our business strategy, competitive position, results of operations, cash flows, financial condition, or prospects. We, our customers, and other users of our products and services also may not promptly learn of or have the ability to fully assess the magnitude or effects of a security vulnerability in connected IoT devices and networks, including the extent, if any, to which a vulnerability has been exploited. Additionally, we have acquired, and in the post-acquisition integration process of acquired future may acquire, companies or assets that may have less sophisticated information systems, cybersecurity practices, or training, which may result in an increased risk of cybersecurity attacks, breaches, or incidents. Our customers and/or employees could also face negative consequences such as the compromise of sensitive or critical information or systems. Furthermore, access to, public disclosure of, or other loss of data or information (including any of our confidential or proprietary information or personal data or information) as a result of an attack or security breach or incident has given, and in the future may give, rise to notification obligations to individuals, regulators, customers, employees, and others, and could result in governmental actions or private claims or proceedings, any of which could damage our reputation, cause a loss of confidence in our products and services, damage our ability to develop (and protect our rights to) our differentiated technologies technologies, and have a material adverse effect on the Company, our business strategy, financial condition, results of operations operations, or prospects. While we maintain a cyber risk insurance policy intended to address risk of loss due to certain types of cybersecurity events, policy, it may not cover any or all claims, costs or losses associated with such all cybersecurity events. For more information regarding personal data and information privacy and data protection risks, refer to “Our operations and reputation may be impaired if we, our products, or our services do not comply with our global privacy policy or evolving laws laws, regulations, and regulations industry standards regarding data privacy and protection” below.

Item 1A, Risk Factors, 10-K Feb 20, 2026open_in_new

… ransomware, cyber-attacks, or other compromises of our systems. Any of these events could result in material financial, operational, legal, business, or reputational harm to our business. For a discussion of our management of cybersecurity risks, see Item 1C, "Cybersecurity …

Marked against last year's 10-K

To date, system inadequacies, inadequate controls or procedures, operating failures, unauthorized access, service interruptions or failures, security breaches, malicious intrusions, theft, exfiltration, ransomware, cyber-attacks, and the compromise, disruption, degradation, manipulation, loss, theft, exfiltration, destruction, or unauthorized disclosure or use of confidential information, or the unauthorized access to, disruption of, interference with, or attack of, our IT systems, products and services that we have encountered have not had a material impact on our business strategy, results of operations or financial condition. We maintain cyber liability insurance; however, this insurance may not be sufficient to cover the financial, operational, legal, business, or reputational losses that may result from an interruption or breach of our IT systems. We continue to implement measures in an effort to protect, detect, respond to, remediate, and minimize or prevent these risks and to enhance the resiliency of our IT systems; however, these measures may not be successful, and we may fail to detect or remediate system inadequacies, inadequate controls or procedures, operating failures, unauthorized access, service interruptions or failures, security breaches, malicious intrusions, theft, exfiltration, ransomware, cyber-attacks, or other compromises of our systems. Any of these events could result in material financial, operational, legal, business, or reputational harm to our business. For a discussion of our management of cybersecurity risks, see Item 1C, "Cybersecurity - Risk Management and Strategy" and " "Cybersecurity - Governance."

Item 1A, Risk Factors, 10-K Feb 12, 2026open_in_new

To date, system inadequacies, inadequate controls or procedures, operating failures, unauthorized access, service interruptions or failures, security breaches, malicious intrusions, theft, exfiltration, ransomware, cyber-attacks, and the compromise, disruption, degradation, manipulation, loss, theft, exfiltration, destruction, or unauthorized disclosure or use …

Marked against last year's 10-K

To date, system inadequacies, inadequate controls or procedures, operating failures, unauthorized access, service interruptions or failures, security breaches, malicious intrusions, theft, exfiltration, ransomware, cyber-attacks, and the compromise, disruption, degradation, manipulation, loss, theft, exfiltration, destruction, or unauthorized disclosure or use of confidential information, or the unauthorized access to, disruption of, interference with, or attack of, our IT systems, products and services that we have encountered have not had a material impact on our business strategy, results of operations or financial condition. We maintain cyber liability insurance; however, this insurance may not be sufficient to cover the financial, operational, legal, business, or reputational losses that may result from an interruption or breach of our IT systems. We continue to implement measures in an effort to protect, detect, respond to, remediate, and minimize or prevent these risks and to enhance the resiliency of our IT systems; however, these measures may not be successful, and we may fail to detect or remediate system inadequacies, inadequate controls or procedures, operating failures, unauthorized access, service interruptions or failures, security breaches, malicious intrusions, theft, exfiltration, ransomware, cyber-attacks, or other compromises of our systems. Any of these events could result in material financial, operational, legal, business, or reputational harm to our business. For a discussion of our management of cybersecurity risks, see Item 1C, "Cybersecurity - Risk Management and Strategy" and " - Governance."

Item 1A, Risk Factors, 10-K Feb 12, 2026open_in_new

… In addition, we collaborate with government agencies regarding potential cybersecurity threats and have worked with firms that have cyber security expertise to evaluate our systems and the attacks we experience and strengthen our systems. There can be no assurances that …

Word for word as last year Item 1A, Risk Factors, 10-K Feb 26, 2026open_in_new

service, generate insights from lab and other data and stimulate innovation to improve operational efficiency, including the expanded use of AI, may further expose our IT systems to the risk of cyberattacks and may create the need for rapid modifications to our cybersecurity program. Also, an increasing risk of civil unrest, political tensions, wars or other military conflicts may also impact the cybersecurity threat risk landscape.

Marked against last year's 10-K

External actors may develop and deploy viruses, other malicious software programs, ransomware attacks, distributed denial of service attacks or other attempts to harm or obtain unauthorized access to our systems, including through the use of AI and other emerging technologies. External actors may also deploy programs targeting our employees which are designed to attack our IT systems or otherwise exploit security vulnerabilities through programs such as electronic spamming, phishing, smishing, spear phishing or similar tactics. As a result of the difficulty in detecting many of these attacks, intrusions and breaches, failures or losses may be repeated or compounded before they are discovered or rectified, which could further increase these costs and consequences. Additionally, new technology that we deploy to automate processes, improve customer service, generate insights from lab and other data and stimulate innovation to improve operational efficiency, including the expanded use of AI, may further expose our IT systems to the risk of cyberattacks and may create the need for rapid modifications to our cybersecurity program. Also, an increasing risk of civil unrest, political tensions, wars or other military conflicts may also impact the cybersecurity threat risk landscape.

Item 1A, Risk Factors, 10-K Feb 26, 2026open_in_new

In addition, our information technology infrastructure and products are vulnerable to cybersecurity attacks. Cybersecurity attacks can include, but are not limited to, computer viruses, denial-of-service attacks, phishing attacks, ransomware attacks, and other introduction of malware to computers and …

Marked against last year's 10-K

In addition, our information technology infrastructure and products are vulnerable to cybersecurity attacks. Cybersecurity attacks can include, but are not limited to, computer viruses, denial-of-service attacks, phishing attacks, ransomware attacks, and other introduction of malware to computers and networks; social engineering or other unauthorized access through the use of compromised credentials; exploitation of design flaws, bugs, or security vulnerabilities; intentional or unintentional acts by employees or other insiders with access privileges; and intentional acts of vandalism by third parties and sabotage. Further, cybersecurity threats and the techniques used in cybersecurity attacks change, develop, and evolve rapidly, including from emerging technologies, such as advanced forms of artificial intelligence ("AI") AI and quantum computing. In addition, we rely upon technology suppliers, including cloud‑based data management applications hosted by third‑party service providers, whose cybersecurity and information technology systems are subject to similar risks. While we are not aware of any cybersecurity attacks that have materially affected our business, financial condition, or operations, the preventative measures we have implemented to date may not be sufficient to prevent, mitigate, or offset a future incident that may materially and adversely impact us.

Item 1A, Risk Factors, 10-K Feb 25, 2026open_in_new

Our inability to protect our intellectual property or failure to maintain the confidentiality and integrity of data or other sensitive company information, by cyber-attack or other event, could have a material adverse effect on our business.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 25, 2026open_in_new

… Cybersecurity incidents include unauthorized occurrences on or conducted through our or our third parties’ information systems, such as tampering, malware insertion, ransomware attacks, or other system integrity events. The risk and efficacy of cyberattacks increases from time to time due …

Marked against last year's 10-K

We, our external service providers, vendors, and other third parties with which we do business, use technology and systems to perform our business operations, such as the secure electronic transmission, processing, storage, and hosting of sensitive information, including protected health information and other types of personal information, confidential financial information, proprietary information, and other sensitive information relating to our customers, company, and workforce. Despite our physical, technical, and administrative security measures as well as third party risk management processes as discussed in “Cybersecurity” in Item 1C of Part I below, technology systems and operations of the Company and third parties, including our external service providers and vendors, with which we do business, have experienced cybersecurity incidents and are subject to future cyberattacks and cybersecurity incidents. Companies in the healthcare industry are increasingly targeted for cyberattacks. Cybersecurity incidents include unauthorized occurrences on or conducted through our or our third parties’ information systems, such as tampering, malware insertion, ransomware attacks, or other system integrity events. The risk and efficacy of cyberattacks increases from time to time due to a variety of internal and external factors, including, but not limited to, the adoption use by threat actors of sophisticated and rapidly evolving techniques, such as adversarial AI, AI (which makes cyberattacks more likely and during may make them more difficult to detect, contain, or mitigate), and the existence of political or military unrest. Our own adoption and use of AI also may create new attack surfaces or methods and generally increase cybersecurity and data protection risks and costs. A cybersecurity incident might involve a material data breach or other material impact to the confidentiality, integrity, availability, and or operations of our technology systems or data, data (including the misuse, loss, disclosure, or corruption of proprietary or personal information), which might result in harm to patients, consumers, or employees; litigation or regulatory action; disruption of our business operations; loss of customers or revenue; cash flow impacts; and increased expense. Additionally, it may take considerable time for us to investigate and evaluate the full impact of incidents, particularly for sophisticated attacks. These factors may inhibit our ability to provide prompt, full, and reliable information about the incident to our customers, regulators, and the public. Any cybersecurity incident might have a materially adverse impact on our business, our operations, our reputation, and our financial position or results of operations.

Item 1A, Risk Factors, 10-K May 8, 2026open_in_new

Privacy, cybersecurity, data protection, and AI laws and guidance increase our compliance burden and expose us to risks.

Marked against last year's 10-K

Privacy, cybersecurity, data protection, and AI laws and guidance increase our compliance burden. burden and expose us to risks.

Item 1A, Risk Factors, 10-K May 8, 2026open_in_new

… Further, although we maintain cyber liability insurance, this insurance may not provide adequate coverage against potential liabilities related to any experienced cybersecurity incident or breach.

Marked against last year's 10-K

Our and intellectual property. In addition, the use of generative AI models in our internal computer or third-party systems may create new attack surfaces or methods for adversaries, which could impact us and infrastructure our vendors. Any of these effects could damage our reputation, result in the loss of valuable property and those of information, cause us to breach applicable laws and regulations, and adversely impact our strategic collaborators, vendors, contractors, consultants or regulators with whom we share confidential, protected or sensitive data or information, or upon which our business relies, are vulnerable to damage from computer viruses, unauthorized access, misuse, natural disasters, terrorism, cybersecurity threats, war and telecommunication and electrical failures, as well as security compromises or breaches, which may compromise our systems, infrastructure, data or that of those with whom we share such data or information or upon which our business relies, or lead to data compromise, misuse, misappropriation or leakage. We have experienced, and may experience additional, cyber-attacks on our information technology systems and infrastructure by threat actors of all types (including nation states, criminal enterprises, individual actors or advanced persistent threat groups). business. In addition, we may experience intrusions on our physical premises by these threat actors. In addition to extracting sensitive information, such attacks could include the deployment of harmful malware, ransomware, digital extortion, business email compromises and denial-of-service attacks, social engineering (including phishing attacks) and other means to affect server reliability and threaten the confidentiality, integrity and availability of information, systems or infrastructure. If any such cyber-attack or physical intrusion against us or those with whom we share confidential, protected or sensitive data or information, or upon which our business relies, were to result in a loss of or damage to our data, systems or infrastructure, or interrupt our operations, such as a material disruption of our development programs or our manufacturing operations, or due to a loss of any of our proprietary or confidential information, it would have a material adverse effect on us. For example, the loss of clinical trial data could delay our regulatory approval efforts and increase our costs to recover or reproduce the data. In addition, because we run multiple clinical trials in parallel, any breach or compromise of our computer systems or infrastructure or physical premises may result in a loss of data or compromised data integrity across multiple programs in many stages of development. While we seek to take steps to address cybersecurity risks, our efforts may not wholly mitigate such risks. Further, our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages or claims related to our privacy and data security obligations. Further, although we maintain cyber liability insurance, this insurance may not provide adequate coverage against potential liabilities related to any experienced cybersecurity incident or breach.

Item 1A, Risk Factors, 10-K Feb 20, 2026open_in_new

… We have experienced, and may experience additional, cyber-attacks on our information technology systems and infrastructure by threat actors of all types (including nation states, criminal enterprises, individual actors or advanced persistent threat groups). Bad actors around the world use …

Marked against last year's 10-K

Our internal computer systems and infrastructure and those of our strategic collaborators, vendors, contractors, consultants or regulators with whom we share confidential, protected or sensitive data or information, or upon which our business relies, are vulnerable to damage from computer viruses, unauthorized access, misuse, natural disasters, terrorism, cybersecurity threats, war and telecommunication and electrical failures, as well as security compromises or data breaches, which may compromise our systems, infrastructure, data or that of those with whom we share such data or information or upon which our business relies, or lead to data compromise, misuse, misappropriation or leakage. We have experienced, and may experience additional, cyber-attacks on our information technology systems and infrastructure by threat actors of all types (including nation states, criminal enterprises, individual actors or advanced persistent threat groups). In addition, we may experience intrusions on our physical premises by these threat actors. In addition Bad actors around the world use increasingly sophisticated methods, including the use of artificial intelligence, to extracting sensitive engage in illegal activities involving the theft and misuse of personal information, such attacks could include the deployment of harmful malware, ransomware, digital extortion, business email compromises and denial-of-service attacks, social engineering (including phishing attacks) and other means to affect server reliability and threaten the confidentiality, integrity and availability of information, systems or infrastructure. If any such cyber-attack or physical intrusion against us or those with whom we share confidential, protected or sensitive data or information, or upon which our business relies, were to result in a loss of or damage to our data, systems or infrastructure, or interrupt our operations, such as a material disruption of our development programs or our manufacturing operations, or due to a loss of any of our proprietary or confidential information, it would have a material adverse effect on us. For example, the loss of clinical trial data could delay our regulatory approval efforts and increase our costs to recover or reproduce the data. In addition, because we run multiple clinical trials in parallel, any breach or compromise of our computer systems or infrastructure or physical premises may result in a loss of data or compromised data integrity across multiple programs in many stages of development. While we seek to take steps to address cybersecurity risks, our efforts may not wholly mitigate such risks. Further, our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages or claims related to our privacy and data security obligations. Further, although we maintain cyber liability insurance, this insurance may not provide adequate coverage against potential liabilities related to any experienced cybersecurity incident or breach. information

Item 1A, Risk Factors, 10-K Feb 20, 2026open_in_new

Our business and results of operations could be adversely affected if we experience a material cyber-attack or other systems breach.

Word for word as last year Item 1A, Risk Factors, 10-K Aug 11, 2026open_in_new

MSO businesses are subject to cybersecurity risks that are, while similar in many respects, incremental to the cybersecurity risks experienced by our legacy businesses. If we are not able to adapt our systems and processes to mitigate these risks, we could

Marked against last year's 10-K

Unauthorized parties have gained access in the past, and will continue to attempt to gain access, to our (including our recently acquired entities) or a service provider's systems or facilities through fraud, social engineering, or other forms of deception. The sophistication of cybersecurity threats and AI-powered cyber-attacks such as deep fakes and force attacks continues to increase. Additionally, our recently acquired MSO businesses are subject to cybersecurity-related cybersecurity risks which that are, while similar in many respects, incremental to the cybersecurity risks experienced by our legacy businesses. If we are not able to adapt our systems and processes to mitigate these risks, we could experience additional financial losses, including as a result of class action lawsuits.

Item 1A, Risk Factors, 10-K Aug 11, 2026open_in_new

For information regarding our processes and practices related to information and cybersecurity, please see Section 1C of this report, “Cybersecurity”.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 18, 2026open_in_new

Additionally, the rapid ongoing evolution and increased adoption of emerging technologies such as artificial intelligence and machine learning may make it more difficult to anticipate and implement protective measures to recognize, detect, and prevent the occurrence of any of the cyber events described above.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 18, 2026open_in_new

We and our third-party providers experience cyber-attacks and other attempts to gain unauthorized access to our products, services, and systems and data on a regular basis, and we anticipate continuing to be subject to such attempts as cyber-attacks

New this year Item 1A, Risk Factors, 10-K Feb 26, 2026open_in_new

… macroeconomic trends, sanctions and trade restrictions, natural disasters, pandemic health issues, geopolitical developments, war, terrorist actions, cybersecurity incidents including but not limited to ransomware attacks, misuse of AI and machine learning technologies, governmental actions and legislative or regulatory changes. Any …

Marked against last year's 10-K

Our reliance upon sole or limited sources of supply for certain materials or components could cause production interruptions, delays and inefficiencies. Some of our businesses purchase certain materials from sole or limited source suppliers for reasons of quality assurance, regulatory requirements, cost effectiveness, availability or uniqueness of design. If these or other suppliers encounter financial, operating or other difficulties, or if our relationship with them changes, we might not be able to quickly establish or qualify replacement sources of supply. The supply chains for our businesses could also be disrupted by supplier capacity constraints, bankruptcy or exiting of the business for other reasons, decreased availability or increased cost of key raw materials or commodities, such as energy, and external events such as global economic downturns and macroeconomic trends, sanctions and trade restrictions, natural disasters, pandemic health issues, geopolitical developments, war, terrorist actions, cybersecurity incidents including but not limited to ransomware attacks, misuse of AI and machine learning technologies, governmental actions and legislative or regulatory changes. Any of these factors could result in production interruptions, delays, extended lead times and inefficiencies.

Item 1A, Risk Factors, 10-K Feb 26, 2026open_in_new

… The costs imposed on us because of a cyberattack, ransomware attacks, phishing attempts, social engineering schemes, and other technology enabled threats or network disruption could be significant. Among others, such costs could include increased expenditures on cybersecurity measures, insurance premiums …

Marked against last year's 10-K

The security measures we implement may not always be effective, and our assessment of and response to security events may be inadequate. The costs imposed on us as a result because of a cyberattack cyberattack, ransomware attacks, phishing attempts, social engineering schemes, and other technology enabled threats or network disruption could be significant. Among others, such costs could include increased expenditures on cybersecurity measures, insurance premiums, litigation, regulatory investigations, ransomware payments, penalties, fines, and sanctions, lost revenues from business interruption, damage to the public’s perception regarding our ability to keep our information secure and significant remediation costs. As a result, a cyberattack cyberattacks, ransomware attacks, phishing attempts, social engineering schemes, and other technology enabled threats, or network disruption could have a material adverse effect on our business, financial condition, and operating results.

Item 1A, Risk Factors, 10-K Feb 12, 2026open_in_new

Our reputation as a global leader in animal health and our reliance on complex information systems and digital solutions make us inherently vulnerable to malicious cyber intrusion and attack, which have evolved in frequency and sophistication. In addition, we have …

Marked against last year's 10-K

Our reputation as a global leader in animal health and our reliance on complex information systems and digital solutions make us inherently vulnerable to malicious cyber intrusion and attack. attack, which have evolved in frequency and sophistication. In addition, we have been investing in data and digital capabilities, including incorporating the use of certain AI capabilities into the development of new technologies and products, and have expanded our diagnostics portfolio, and as a result, there could be an increased likelihood of a cyberattack or breach of security cyberattack, ransomware attacks, phishing attempts, social engineering schemes and other technology enabled threats, that could negatively impact us us, our third-party partners or our customers. Cyberattacks Cyberattacks, ransomware attacks, phishing attempts, social engineering schemes and other technology enabled threats are increasing in their frequency, sophistication and intensity, including through the use of AI and have become increasingly difficult to detect. Cyberattacks detect; and could include wrongful conduct by hostile foreign governments, industrial espionage, the deployment of harmful malware, ransomware, denial-of-service attacks, and other means to threaten data confidentiality, integrity and availability. In addition, despite our efforts to protect sensitive, confidential or personal data or information, we (or our third-party partners) may be vulnerable to material security breaches, theft, misplaced or lost data, programming errors, employee errors and/or malfeasance that could potentially lead to the compromise of sensitive, proprietary, confidential or personal data or information, improper use of our systems or networks, unauthorized access, theft, use, disclosure, modification or destruction of information (including confidential business information, proprietary information, trade secrets, intellectual property and corporate strategic plans), defective products, production downtimes and operational disruptions.

Item 1A, Risk Factors, 10-K Feb 12, 2026open_in_new

… A cybersecurity incident would harm our reputation and financial condition and cause us to incur legal liability and increased costs to respond to such events. Our cyber liability insurance may not be sufficient to compensate us for losses that may …

Marked against last year's 10-K

Our mitigation measures reduce, but cannot eliminate, the risk of a cybersecurity incident, and our systems remain potentially vulnerable to cybersecurity threats. A cybersecurity incident would harm our reputation and financial condition and cause us to incur legal liability and increased costs to respond to such events. Our cyber liability insurance may not be sufficient to compensate us for losses that may result from interruptions in our services or asset or data loss as a result of cybersecurity incidents.

Item 1A, Risk Factors, 10-K Feb 6, 2026open_in_new

… Our internally developed system and processes, as well as those provided by third-party vendors, may be susceptible to damage or interruption from cybersecurity incidents, such as terrorist or hacker attacks, the introduction of malicious computer viruses, ransomware, falsification of …

Word for word as last year Item 1A, Risk Factors, 10-K Feb 6, 2026open_in_new

… In the past, our Customers and resellers of our products have experienced cybersecurity attacks and incidents that have impacted their ability to do business, process payments and sell products, and there can be no assurance that future cybersecurity attacks and …

Word for word as last year Item 1A, Risk Factors, 10-K May 29, 2026open_in_new

… We maintain cyber liability insurance with terms, conditions, and limits believed to be adequate. However, cybersecurity-related liability or other claims may exceed insurance coverage limits, fines, penalties and regulatory sanctions may not be covered by insurance, or insurance may …

Word for word as last year Item 1A, Risk Factors, 10-K May 29, 2026open_in_new

… The healthcare and biopharmaceutical industries remain targets of cybersecurity threats due to the value and sensitivity of the data they hold. Cybersecurity attacks and incidents are increasing in their frequency, sophistication and intensity and, due to the nature of some …

Marked against last year's 10-K

AbbVie relies on sophisticated software applications and complex information technology systems (including cloud services) to operate its business, which are inherently vulnerable to malicious intrusion, random attack, loss of data privacy, disruption, degradation or breakdown. Certain of these applications and systems are managed, hosted, provided or used by third parties. Data privacy or security breaches of our internal systems or those of our information technology vendors may in the future result in the failure of critical business operations. Such breaches may cause sensitive data, including intellectual property, trade secrets or personal information belonging to AbbVie, its patients, customers, employees or business partners, to be exposed to unauthorized persons or to the public. To date, neither AbbVie’s business nor operations have been materially impacted by such incidents, however, The healthcare and biopharmaceutical industries remain targets of cybersecurity threats due to the healthcare industry remains a target value and sensitivity of cyber-attacks. the data they hold. Cybersecurity attacks and incidents are increasing in their frequency, sophistication and intensity and, due to the nature of some of these attacks, there is a risk that they may remain undetected for a period of time. AbbVie’s investments in the protection of its data and information technology and its efforts to monitor its systems on an ongoing basis may be insufficient to prevent compromises in AbbVie's information technology systems that could have a material adverse effect on AbbVie's business. Such adverse consequences could include loss of revenue or the loss of critical or sensitive information from AbbVie’s or third-party providers’ databases or information technology systems and could also result in legal, financial, reputational or business harm to AbbVie and potentially substantial remediation costs. In addition, AbbVie’s cyber insurance may not be sufficient to cover the financial, legal, business or reputational losses that may result from an interruption or breach of AbbVie systems or those of our third-party vendors.

Item 1A, Risk Factors, 10-K Feb 20, 2026open_in_new

… These technologies may present opportunities for AbbVie's business but may also entail risks, including that AI-generated analyses utilized by AbbVie could be deficient or exacerbate regulatory, cybersecurity or other significant risks. Further, our failure to effectively implement these …

Marked against last year's 10-K

Additionally, AbbVie utilizes artificial intelligence (AI) AI and other emerging technologies in select applications to support its operations. These technologies may present opportunities for AbbVie's business but may also entail risks, including that AI-generated analyses utilized by AbbVie could be deficient or exacerbate regulatory, cybersecurity or other significant risks. Further, our failure to effectively implement these technologies could hinder our ability to compete, as competitors' advancements in AI may lead to more efficient operations.

Item 1A, Risk Factors, 10-K Feb 20, 2026open_in_new

… We have faced, and will continue to face, risks of incidents, whether through cyber attacks or cyber intrusions through the Cloud, the Internet, phishing attempts, ransomware and other forms of malware, computer viruses, email attachments, extortion, exfiltration and other scams …

Marked against last year's 10-K

We rely extensively on information technology systems, networks and services, including internet sites, data hosting and processing facilities and tools, physical security systems and other hardware, software and technical applications and platforms, some of which are managed, hosted, provided by and/or used for third parties or their vendors, to assist in conducting our business. We have faced, and will continue to face, risks of incidents, whether through cyber attacks or cyber intrusions through the Cloud, the Internet, phishing attempts, ransomware and other forms of malware, computer viruses, email attachments, extortion, exfiltration and other scams. Although we make efforts to maintain the security and integrity of our information technology systems and data, these systems and the proprietary, confidential and personal information that resides on or is transmitted through them, are subject to the risk of a cybersecurity incident or disruption, and there can be no assurance that our security efforts and measures, and those of our third-party vendors, will prevent breakdowns or incidents to our or our third-party vendors’ systems, which could adversely affect our business strategy, results of operations, or financial condition. Cybersecurity risks continue to develop, including as a result of threat actors increasingly targeting employees and supply chains and geopolitical tensions leading to an increase in sabotage, espionage and cyber attacks. As the cyber-threat landscape evolves, these attacks are growing in frequency, sophistication and intensity, and due to the nature of some of these attacks, there is also a risk that they may remain undetected for a period of time. A significant breakdown, invasion, corruption, destruction or interruption of critical information technology systems, including artificial intelligence programs that we utilize, or leak, theft or misuse of proprietary, confidential or personal information could negatively impact operations. There can be no assurance that our continuing efforts will prevent breakdowns or incidents to our or our third-party providers’ systems or databases that could adversely affect our business. Under certain circumstances, such incidents when detected could require disclosure to government authorities and/or regulators and could require notification to impacted individuals, and any such incident could result in material financial, legal, business and reputational harm to us. Further, although we maintain insurance coverage designed to transfer certain cybersecurity incident costs, there is a risk this insurance would be insufficient to cover the costs of the incident, including due to coverage limits or insurance exclusions.

Item 1A, Risk Factors, 10-K Feb 11, 2026open_in_new

We are dependent on information technology systems, including artificial intelligence programs, and face risk of cybersecurity incidents that could disrupt our business and result in theft of proprietary, confidential and personal information.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 11, 2026open_in_new

… This includes emerging technologies which increase our threat landscape, such as generative AI and quantum computing, which are evolving rapidly in their practicality and use for cyber-attacks including through enhanced social engineering, and for cyber-attacks on industry standard …

Marked against last year's 10-K

Our information systems require an ongoing commitment of significant resources to maintain, protect and enhance existing systems and develop new systems to keep pace with continuing changes in information processing technology, evolving systems and regulatory standards, the increasing need to protect patient and customer information and changing customer patterns. This includes opportunities as well as risks associated with the integration of AI into our or our suppliers' or customers' operations. While AI presents significant opportunities for innovation and efficiency, it could introduce new risks in managing information systems and in the cybersecurity threat landscape. In addition, third parties have and may continue to attempt to hack into our products to obtain data relating to patients, or alter the intended functionality of our medical devices, or disrupt performance of our products, or access our proprietary information and the technology from third party vendors that we rely upon may have defects or vulnerabilities which, in turn, create vulnerabilities or disruptions in our system. Cyber-attacks continue to evolve in complexity and scope, and inherently may be difficult to detect. This includes emerging technologies which increase our threat landscape, such as generative AI and quantum computing, which are evolving rapidly in their practicality and use for cyber-attacks including through enhanced social engineering, and for cyber-attacks on industry standard data protections through increased computing capabilities. We have seen, and could continue to see, software and supply-chain vulnerabilities and malware, which could affect our systems and the systems of our third-party vendors and business partners. Some of our IT and OT systems contain legacy third-party software components for which we depend on a layered security approach to protect against exploitation, and such layered security approach may not be effective. Any failure by us to maintain

Item 1A, Risk Factors, 10-K Feb 17, 2026open_in_new

We rely on the proper function, availability and security of information technology systems to operate our business and a cyber-attack or other breach of these systems could have a material adverse effect on our business, financial condition or results of operations.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 17, 2026open_in_new

… Cyberattacks could include the deployment of harmful malware, ransomware, denial-of-service attacks, social engineering and other means to affect service reliability and threaten the confidentiality, integrity and availability of information. Such cyberattacks increasingly exploit AI and machine-learning techniques …

Marked against last year's 10-K

Actual or attempted breaches of security, unauthorized disclosure of information, attacks which reduce availability of systems such as denial of service, or the perception that personal and/or other sensitive or confidential information in our possession is not secure, could result in a material loss of business, substantial legal liability or significant harm to our reputation. Despite the implementation of security measures, our internal computer and information technology systems and those of our vendors and customers are vulnerable to attack and damage from computer viruses, malware, denial of service attacks, unauthorized access, or other harm, including from threat actors seeking to cause disruption to our business. We face risks related to the protection of information that we maintain - or a third-party engaged to maintain information security on our behalf - including unauthorized access, acquisition, use, disclosure, or modification of such information. Cyberattacks are increasing in frequency, sophistication and intensity and have become increasingly difficult to detect and respond to. Cyberattacks could include the deployment of harmful malware, ransomware, denial-of-service attacks, social engineering and other means to affect service reliability and threaten the confidentiality, integrity and availability of information. Such cyberattacks increasingly exploit AI and machine-learning techniques - ranging from generative-AI phishing and deep-fake impersonations to automated vulnerability discovery, adaptive malware and large-scale credential-stuffing campaigns - each of which can evolve rapidly to evade traditional security controls. A material cyberattack or security incident could cause interruptions in our operations and could result in a material disruption of our business operations, damage to our reputation, financial condition, results of operations, cash flows and prospects.

Item 1A, Risk Factors, 10-K Aug 13, 2026open_in_new

… training, there can be no assurance that our efforts will prevent significant breakdowns, breaches in our systems or other cyber incidents that could have a material adverse effect upon the reputation, business, operations or financial condition of the company. In …

Marked against last year's 10-K

We are increasingly dependent on information technology systems and infrastructure. Failed, substandard or delayed efforts to improve our IT System infrastructure may result in disruption to our business or materially increased costs. We rely on information technology systems and infrastructure, including technologies and services provided by third parties, to support our business processes and activities, products and customers. Our business therefore depends on effective, reliable and secure operation of our technology systems and related infrastructure. These technology systems are potentially vulnerable to obsolescence, breakdown or other interruption by fire, power loss, system malfunction, unauthorized access, migration or updates, and other events. Likewise, data privacy breaches by employees and others with both permitted and unauthorized access to our systems may pose a risk that sensitive data may be exposed to unauthorized persons or to the public, or may be permanently lost. While we have invested heavily in upgrading our systems, as well as the protection of data and information technology and related training, there can be no assurance that our efforts will prevent significant breakdowns, breaches in our systems or other cyber incidents that could have a material adverse effect upon the reputation, business, operations or financial condition of the company. In addition, significant implementation issues may arise as we continue to upgrade, consolidate and outsource certain computer operations and application support activities.

Item 1A, Risk Factors, 10-K Aug 13, 2026open_in_new

• there is a heightened risk of future cybersecurity threats, including ransomware attacks targeting healthcare providers. If successful, future cyberattacks could have a material adverse effect on our business. Any costs that we incur as a result of a data security …

Word for word as last year Item 7, MD&A, 10-K Feb 25, 2026open_in_new

… breaches, vandalism, theft, natural disasters, catastrophic events, human error and potential cyber threats, including malicious codes, worms, phishing attacks, denial of service attacks, ransomware and other sophisticated cyber-attacks, and our disaster recovery planning cannot account for all eventualities. Our …

Word for word as last year Item 1A, Risk Factors, 10-K Feb 25, 2026open_in_new

… Our systems, products and services (including those we acquire through business acquisitions) are susceptible to being damaged, disrupted or shut down due to attacks by computer hackers, computer viruses, ransomware, human error or malfeasance (including by employees), power outages, hardware …

Marked against last year's 10-K

We rely on information technology systems, some of which are provided and/or managed by third-parties, to process, transmit and store electronic information (including sensitive data such as confidential business information and personal data relating to employees, customers, other business partners and patients), and to manage or support a variety of critical business processes and activities (such as receiving and fulfilling orders, billing, collecting and making payments, shipping products, providing services and support to customers and fulfilling contractual obligations). Errors, defects, security issues or other vulnerabilities in third-party technology or in the integration of third-party technology with our systems or products could result in errors that could harm our business. In addition, some of our remote monitoring products and services services, including those related to remote monitoring, incorporate software and information technology IT that house personal data and some products or software we sell to customers connect to our systems for maintenance or other purposes. These We also have products and systems that connect to the internet, hospital networks, electronic medical record systems or electronic health record systems. Our systems, products and services (including those we acquire through business acquisitions) are susceptible to being damaged, disrupted or shut down due to attacks by computer hackers, computer viruses, ransomware, human error or malfeasance (including by employees), power outages, hardware failures, telecommunication or utility failures, catastrophes, war, conflicts or other unforeseen events, and in any such circumstances our system redundancy and other disaster recovery planning may be ineffective or inadequate. Certain attacks also target hardware, software and information installed, stored or transmitted in our products after such products have been purchased and incorporated into third-party products, facilities or infrastructure. Security breaches of systems provided or enabled by us, regardless of whether the breach is attributable to a vulnerability in our products or services, or security breaches of third-party suppliers we rely on to process, store or transmit electronic information, can result in the misappropriation, destruction or unauthorized disclosure of confidential information or personal data belonging to us or to our employees, partners, customers, patients or suppliers. In some cases, we may address software and hardware vulnerabilities through security updates and patches we make available to customers, and such vulnerabilities may persist if customers do not promptly install (or promptly schedule service in connection with) such updates and patches. Like most multinational corporations, our information technology IT systems and data have been subject to computer viruses, malicious codes, unauthorized access and other cyber-attacks and we expect the sophistication and frequency of such attacks to continue to increase. Unauthorized tampering, adulteration or interference with our products may also adversely affect product functionality and result in loss of data, risk to patient safety and product recalls or field actions. In addition, the rapid evolution and increased adoption of artificial intelligence technologies AI, including adopted by computer hackers or other malicious actors, may intensify our cybersecurity risks. The attacks, breaches, misappropriations and other disruptions and damage described above have the ability to interrupt our operations or the operations of our customers and partners, delay production and shipments, result in theft of our and our customers’ intellectual property and trade secrets, result in disclosure of personal data, damage customer, patient, business partner and employee relationships and our reputation and result in defective products or services, legal claims and proceedings, liability and penalties under privacy and other laws and increased costs for security and remediation, in each case resulting in an adverse effect on our business and financial statements. Our liability insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches. In addition, any businesses that we acquire may further expose us to the risks set forth above.

Item 1A, Risk Factors, 10-K Feb 24, 2026open_in_new

… Problems can arise during manufacturing for a variety of reasons, including equipment malfunction, contamination, failure to follow specific protocols and procedures, problems with raw materials or components, cyber-attacks, natural disasters and environmental factors, and if not discovered before the …

Word for word as last year Item 1A, Risk Factors, 10-K Feb 24, 2026open_in_new

… A cybersecurity attack may penetrate our layered security controls and lead to the misappropriation of or compromise of protected personal information or proprietary or confidential information, create system disruptions, cause shutdowns, or deploy viruses, ransomware, and other malicious software programs …

Marked against last year's 10-K

In the ordinary course of our business, we process, store and transmit large amounts of data, and rely on third-party service providers to do the same, including protected personal information subject to privacy, security or data breach notification laws, as well as proprietary or confidential information relating to our business or a third-party with which we do business. We have been, and will likely continue to be, regular targets of attempted cybersecurity attacks and other security threats and may be, and have been, subject to breaches of our information technology systems, including breaches of the information technology systems of third-party service providers. For example, in February 2024, Change Healthcare experienced a significant cybersecurity incident that disrupted its ability to provide services, impacting payers, providers and pharmacies nationwide, including us. Although the impact of such attacks has not been material to our operations or results of operations, financial position, or cash flow through December 31, 2024, 2025, we can provide no assurance that we will be able to detect, prevent, or contain the effects of such cybersecurity attacks or other information security risks or threats, or that such an attack will not be material to our business, in the future. Further, because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and are increasing in sophistication, in part due to use of evolving AI/ML technologies (including generative AI), and because our businesses are changing as well, we may be unable to anticipate these techniques and threats, detect data security incidents or implement adequate preventive measures. A cybersecurity attack may penetrate our layered security controls and lead to the misappropriation of or compromise of protected personal information or proprietary or confidential information, create system disruptions, cause shutdowns, or deploy viruses, ransomware, and other malicious software programs that attack our systems or those of our third-party service providers. A cybersecurity attack that bypasses our information technology systems, or the security of our third-party service providers, could materially affect us due to the theft, destruction, loss, misappropriation or release of confidential information or intellectual property, operational or business delays resulting from the disruption of our IT systems, extortion attempts, or negative publicity resulting in reputation or brand damage with our members, customers, providers, and other stakeholders.

Item 1A, Risk Factors, 10-K Feb 19, 2026open_in_new

If we, and the third-party service providers on whom we rely, are unable to defend our information technology systems against cybersecurity attacks, contain such attacks when they occur, or prevent other privacy or data security incidents that result in …

Word for word as last year Item 1A, Risk Factors, 10-K Feb 19, 2026open_in_new

Increasingly complex regulations relating to privacy, data protection, and cybersecurity are burdensome, may reduce demand for our solutions, and non-compliance may impose significant liabilities.

Word for word as last year Item 1A, Risk Factors, 10-K Mar 20, 2026open_in_new

Unauthorized access or other security breaches or incidents, as a result of third-party action (e.g., cyberattacks, or the introduction into our networks or systems of ransomware or other malware), employee or contractor error or malfeasance, product defect, or …

Marked against last year's 10-K

Unauthorized access or other security breaches or incidents, as a result of third-party action (e.g., cyberattacks, or the introduction into our networks or systems of ransomware or other malware), employee or contractor error or malfeasance, product defect, or otherwise, have resulted in and could in the future result in the loss of information or intellectual property, inappropriate access to or use, disclosure, unavailability, modification, destruction, or other processing of information, service interruption, degradation, disruption, and outages, service level credits, claims, demands, litigation, regulatory investigations and other proceedings, indemnity obligations, damage to our reputation, and other liability. It is possible that our risk of cyberattacks and other sources of security breaches and incidents may be elevated as a result of Russia’s invasion of Ukraine, the regional conflict in the Middle East, or other geopolitical tensions or conflicts, due to an increase in cyberattack attempts on us, our customers, our partners, or our technology infrastructure providers.

Item 1A, Risk Factors, 10-K Mar 20, 2026open_in_new

While we have programs in place to detect, contain and respond to data security incidents and provide employees with awareness training regarding phishing, malware and other cyber threats as a protection against cybersecurity risks and incidents, we expect that we …

Marked against last year's 10-K

While we have programs in place to detect, contain and respond to data security incidents and provide employees with awareness training regarding phishing, malware and other cyber threats as a protection against cybersecurity risks and incidents, we expect that we will continue to experience incidents, some of which may negatively affect our business. Further, because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and are increasing in sophistication, in part due to use of evolving AI technologies (including generative AI), and because our businesses are changing as well, we may be unable to anticipate these techniques and threats, timely detect data security incidents or implement adequate preventive measures. Threat actors and hackers have previously been, and may in the future be, able to negatively affect our operations by penetrating our security controls and causing system and operational disruptions or shutdowns, accessing, misappropriating shutdowns. They may access, misappropriate or otherwise compromising compromise protected personal information or our proprietary or confidential information or that of third parties, and developing may develop and deploying deploy malicious code (including viruses, ransomware and other malware malware, among others) that can attack our systems, exploit any security vulnerabilities, and disrupt or shutdown shut down our systems and operations. In addition, hardware, software, or applications we develop or procure from third parties may contain defects or other problems which could unexpectedly compromise our information security controls. technology ecosystem. Our systems may also be vulnerable to financial fraud schemes, misplaced or lost data, human error, insider threat, malicious social engineering, or other events which could negatively affect the data or financial accounts, proprietary or confidential information relating to our business or third parties, or our operations. There have previously been and may be in the future heightened vulnerabilities due to recently-acquired or non-integrated businesses. We rely in some circumstances on third-party vendors to process, store and transmit large amounts of data for our business. The operations of these vendors are subject to similar risks, but are outside our direct oversight and control.

Item 1A, Risk Factors, 10-K Mar 2, 2026open_in_new

The costs to eliminate or address these threats and vulnerabilities before or after a cybersecurity incident could be material. We have business continuity and resiliency plans which we maintain, update and test regularly in an effort to contain and remediate …

Marked against last year's 10-K

The costs to eliminate or address the foregoing security these threats and vulnerabilities before or after a cybersecurity incident could be material. We have business continuation continuity and resiliency plans which we maintain, update and test regularly in an effort to contain and remediate potential disruptions or from cybersecurity events. If our prevention and remediation efforts are not successful, we may experience operational interruptions, delays, or cessation of service and loss of existing or potential customers. In addition, compromises of our security measures or the unauthorized dissemination of sensitive personal information, proprietary information or confidential information about us, our customers or other third parties, previously and in the future, could expose us or them to the risk of financial or medical identity theft, negative operational impacts, and loss or misuse of this information, result in litigation and liability, including regulatory penalties, for us, damage our brand and reputation, or otherwise harm our business.

Item 1A, Risk Factors, 10-K Mar 2, 2026open_in_new

… The risk of damage or interruption to technology infrastructure as a result of cyber-attacks has generally increased as the number, intensity and sophistication of attempted attacks from around the world have increased, including through state-sponsored actors and/or …

Word for word as last year Item 1A, Risk Factors, 10-K Feb 23, 2026open_in_new

Disruption, cyber-attack or unforeseen problems with the security, maintenance or upgrade of the Company’s information and web-based systems could have an adverse effect on the Company’s business strategy, results of operations and financial condition.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 23, 2026open_in_new

We and users of our products may face, and in the past have faced, cyber-attacks, including from nation state actors or advanced persistent threats who attempt to penetrate our or our customers’ network security, including our data centers; sabotage …

Marked against last year's 10-K

We and users of our products may face, and in the past have faced, cyber-attacks, including from nation state actors or advanced persistent threats who attempt to penetrate our or our customers’ network security, including our data centers; sabotage or otherwise disable our research, products, and services, including instruments at our customers’ sites; misappropriate our or our customers' and partners' proprietary information, which may include personally identifiable information; or cause interruptions of our or our customers’ internal operations, systems and services, including through ransomware attacks. Any such resulting breach could compromise our or our customers’ networks and the information stored there could be accessed, publicly disclosed, lost, or exfiltrated. Any such access, disruption, disclosure, or other loss of information could result in an adverse impact on our or our customers’ business, legal claims or proceedings, liability under laws that protect the privacy of personal information, and damage to our reputation.

Item 1A, Risk Factors, 10-K Feb 12, 2026open_in_new

Despite using commercially reasonable measures to secure our systems, networks, and products, security breaches, including with respect to cybersecurity, and other disruptions could compromise our information, products, and services, disrupt our or our customers’ operations, and expose us to liability, which could cause our business and reputation to suffer.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 12, 2026open_in_new

An information security incident, including a cybersecurity breach, could have a negative impact on the Company’s business or reputation.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 11, 2026open_in_new

… The Company maintains cybersecurity insurance in the event of an information security or cyber incident; however, the coverage may not be sufficient to cover all financial, legal, business or reputational losses.

Marked against last year's 10-K

To meet business objectives, the Company relies on both internal information technology (IT) systems and networks, and those of third parties and their vendors, to process and store sensitive data (including confidential research, business plans, financial information, intellectual property, and personal data that may be subject to legal protection) to ensure the continuity of the Company’s supply chain and operations, and as part of many of the products we deliver to customers. The extensive range of information security and cybersecurity threats, which affect companies globally, pose a persistent risk to the security and availability of these systems and networks, including to customer products that are connected to or rely on such systems and networks, and the confidentiality, integrity, and availability of the Company’s sensitive data. The Company assesses these threats, responds to attacks and breaches that it has experienced, and makes investments to increase internal protection, detection, and response capabilities, as well as ensure the Company’s third-party providers have required capabilities and controls, to address this risk. Because of the frequently changing attack techniques, along with the increased volume and sophistication of the attacks and increasing use and reliance on third parties, there is the potential for the Company to be adversely impacted. This impact could result in reputational, competitive, operational or other business harm as well as financial costs and regulatory action. The increasing use of AI and other emerging technology could also increase these risks. The Company maintains cybersecurity insurance in the event of an information security or cyber incident; however, the coverage may not be sufficient to cover all financial, legal, business or reputational losses.

Item 1A, Risk Factors, 10-K Feb 11, 2026open_in_new

• Cyber-attacks on the Company’s or third-party providers’ IT systems, which could disrupt the Company’s operations.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 24, 2026open_in_new

• The Company is increasingly dependent on sophisticated software applications and computing infrastructure, including the use of cloud-based applications and environments. The Company continues to be a target of cyber-attacks that could lead to a disruption of its worldwide operations, including manufacturing, research and sales operations.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 24, 2026open_in_new

… These systems, products and services (including those we acquire through business acquisitions) can be damaged, disrupted or shut down due to attacks by computer hackers, computer viruses, ransomware, human error or malfeasance, power outages, hardware failures, telecommunication or utility failures …

Marked against last year's 10-K

The integrity and protection of our own data, and that of our customers and employees, is critical to our business. We rely on information technology systems, some of which are provided and/or managed by third parties, to process, transmit and store electronic information (including sensitive data such as confidential business information and personally identifiable data relating to employees, customers, other business partners and patients), and to manage or support a variety of critical business processes and activities (such as receiving and fulfilling orders, billing, collecting and making payments, shipping products, providing services and support to customers and fulfilling contractual obligations). These systems, products and services (including those we acquire through business acquisitions) can be damaged, disrupted or shut down due to attacks by computer hackers, computer viruses, ransomware, human error or malfeasance, power outages, hardware failures, telecommunication or utility failures, catastrophes or other unforeseen events, and in any such circumstances our system redundancy and other disaster recovery planning may be ineffective or inadequate. Attacks can also target hardware, software and information installed, stored or transmitted in our products after such products have been purchased and incorporated into third-party products, facilities or infrastructure. Security breaches of systems provided or enabled by us, regardless of whether the breach is attributable to a vulnerability in our products or services, or security breaches of third party systems we rely on to process, store or transmit electronic information, can result in the misappropriation, destruction or unauthorized disclosure of confidential information or personal data belonging to us or to our employees, partners, customers, patients or suppliers. These attacks, breaches, misappropriations and other disruptions and damage can interrupt our operations or the operations of our customers and partners, delay production and shipments, result in theft of our and our customers’ intellectual property and trade secrets, result in disclosure of personally identifiable information, damage customer, patient, business partner and employee relationships and our reputation and result in defective products or services, legal claims and proceedings, liability and penalties under privacy laws and increased costs for security and remediation, in each case resulting in an adverse effect on our business and financial results.

Item 1A, Risk Factors, 10-K Aug 24, 2026open_in_new

… Also, as part of our cybersecurity risk management program we maintain cyber insurance, with coverage amounts and terms that are typical and appropriate for a company of our size and type. This insurance may not be sufficient to cover us …

New this year 10-K, 10-K Aug 24, 2026open_in_new

… As cyber threats evolve and become more difficult to detect and successfully defend against, one or more cyber threats might defeat the measures that we or our vendors take to anticipate, detect, avoid or mitigate such threats. Certain techniques used …

Marked against last year's 10-K

We rely upon the security of our computer and communications systems infrastructure to protect us from cyberattacks and unauthorized access. Cyberattacks can include malware, computer viruses, hacking or other significant disruption of our computer, communications and related systems. Third parties may attempt to improperly persuade customers, suppliers, vendors, partners, employees or others to disclose sensitive information such as user names, passwords or other information that can be used to gain unauthorized access to systems or data. Cyber threats are rapidly evolving and are becoming increasingly sophisticated. sophisticated, including through the use of AI-supported attacks. As cyber threats evolve and become more difficult to detect and successfully defend against, one or more cyber threats might defeat the measures that we or our vendors take to anticipate, detect, avoid or mitigate such threats. Certain techniques used to obtain unauthorized access, introduce malicious software, disable or degrade service, or sabotage systems may be designed to remain dormant until a triggering event and we may be unable to anticipate these techniques or implement adequate preventative measures since techniques change frequently or are not recognized until launched, and because cyberattacks can originate from a wide variety of sources. Our preventive and remedial actions actions, including the activities described in Item 1C Cybersecurity in this Annual Report on Form 10-K, may not be successful. We have acquired various companies, products, services and technologies over the years. While we make significant efforts to identify and address IT security issues with respect to these acquisitions, we may still inherit security risks associated with these activities. The size and complexity of our IT and information security systems, and those of our vendors (and the large amounts of confidential information that is present on them), make such systems potentially vulnerable to service interruptions or to security breaches from inadvertent or intentional actions including, but not limited to, by our employees, contingent workers, service providers, business partners, customers or malicious attackers. Such attacks, whether successful or unsuccessful, could result in our incurring costs related to, for example, rebuilding internal systems, defending against litigation, responding to regulatory inquiries or actions, paying damages or fines, or taking other remedial steps with respect to third parties. Publicity about vulnerabilities and attempted or successful incursions could damage our reputation with clients and data suppliers and reduce demand for our services.

Item 1A, Risk Factors, 10-K Feb 17, 2026open_in_new

… These third parties face risks relating to cyber security similar to ours, which could disrupt their businesses and therefore materially impact ours. Accordingly, we are subject to any flaw in or breaches to their computer and communications systems or those …

Word for word as last year Item 1A, Risk Factors, 10-K Feb 17, 2026open_in_new

… The size and complexity of our IT systems make our IT systems and data vulnerable to risks and damages from a variety of sources, including malicious human acts, breaches of security, cyber-attacks, catastrophe or natural disaster, telecommunications or network …

Marked against last year's 10-K

Our business is increasingly dependent on critical, complex, and interdependent information technology (IT) (“IT”) systems, including Internet-based systems, some of which are managed or hosted by third parties, to support business processes as well as internal and external communications. The size and complexity of our IT systems make our IT systems and data vulnerable to risks and damages from a variety of sources, including malicious human acts, breaches of security, cyber-attacks, catastrophe or natural disaster, telecommunications or network failures, loss of power or other natural or man-made events. In addition, despite network security and back-up measures, we and our vendors frequently defend against and respond to data security attacks and incidents, and our servers and our vendors’ servers are potentially susceptible to physical or electronic break-ins, computer viruses, software vulnerabilities, ransomware attacks and similar disruptive problems. If our business continuity and disaster recovery plans and procedures or those of our vendors, including our CROs and contract manufacturers, were disrupted, inadequate or unsuccessful in the event of a problem, we could experience an interruption of all or a portion of our operations, which could result in significant harm to our business, financial results and reputation. In addition, having a portion of our employees work remotely can strain our IT infrastructure, which may affect our ability to operate effectively, may make us more susceptible to communications disruptions, and expose us to greater cybersecurity risks.

Item 1A, Risk Factors, 10-K Feb 10, 2026open_in_new

• the risk that acquired businesses may have differing or inadequate cybersecurity and data protection controls; and

Word for word as last year Item 1A, Risk Factors, 10-K Feb 10, 2026open_in_new

… For example, in the past we have experienced, and may experience in the future, various types of cybersecurity incidents, including unauthorized access to our IT systems, data security breaches, malware incursions, denial-of-service attacks, phishing campaigns, and other similar …

Marked against last year's 10-K

In addition, our systems are potentially vulnerable to data security breaches - whether by employees or others - which may expose sensitive data to unauthorized persons. Data security breaches could lead to the loss of trade secrets or other intellectual property, result in demands for ransom or other forms of blackmail, extortion, or lead to the public exposure of personal information (including sensitive personal information) of our employees, clinical trial patients, customers, and others. Such attacks are of ever-increasing levels of sophistication and are made by groups and individuals with a wide range of motives (including industrial espionage or extortion) and expertise, including by organized criminal groups, "hacktivists," nation states, and others. As a company with an increasingly global presence, our systems are subject to frequent attacks and incidents. For example, in the past we have experienced, and expect to continue to experience, may experience in the future, various types of cybersecurity incidents, including unauthorized access to our IT systems, data security breaches, malware incursions, denial-of-service attacks, phishing campaigns, and other similar disruptions. Similar incidents have been experienced and may in the future be experienced by certain third parties on which we rely. Although we believe, based on an assessment of the relevant facts available to us, that none of these incidents has had a material adverse impact on our operations, operations to date, there can be no assurance that a future incident would not result in material harm to our business, prospects, operating results, and financial condition. There is also the potential that our systems may be directly or indirectly affected as nation-states conduct global cyberwarfare, including in connection with the current Russia-Ukraine or Hamas-Israel armed conflict. cyberwarfare.

Item 1A, Risk Factors, 10-K Feb 4, 2026open_in_new

We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. These include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks, as …

New this year 10-K, 10-K Feb 4, 2026open_in_new

… The risk of a security breach or disruption through cyber-attacks has generally increased as the number, intensity and sophistication of attempted attacks from around the world have increased. For example, many companies have experienced an increase in phishing and …

Word for word as last year Item 1A, Risk Factors, 10-K Feb 24, 2026open_in_new

… There is uncertainty related to the legal and regulatory landscape surrounding rapidly evolving AI technologies, particularly in the areas of cybersecurity, intellectual property, and privacy and data protection. Failure to comply or appropriately respond to this developing landscape may result …

New this year Item 1A, Risk Factors, 10-K Feb 24, 2026open_in_new

… Securities and Exchange Commission Final Rule on Cybersecurity Risk Management, Strategy, Governance and Incident Disclosure which requires enhanced disclosure requirements for cybersecurity, with similar applicable requirements under the EU’s NIS2 Directive and China’s Data Security Law.

Word for word as last year Item 1A, Risk Factors, 10-K Dec 22, 2025open_in_new

Key Elements of Our Cybersecurity Program. We maintain cybersecurity policies that articulate Agilent's expectations and requirements regarding technology use, data privacy, risk management, and incident management. Regular exercises and assessments against recognized cybersecurity frameworks are conducted to improve the …

New this year 10-K, 10-K Dec 22, 2025open_in_new

… This plan covers various cyber incidents like ransomware attacks, cyber-intrusions, data loss, denial of service, insider threats, malware attacks, and others. In a material cybersecurity incident, our D&T team, inclusive of our Chief Digital Officer and our VP …

New this year 10-K, 10-K Feb 17, 2026open_in_new

The Company also educates and shares best practices globally with its employees to raise awareness of cybersecurity threats. As part of our onboarding process, we train all new employees on cybersecurity and conduct an annual retraining of all employees on …

New this year 10-K, 10-K Feb 17, 2026open_in_new

PART I Item 1. Business 1 Item 1A. Risk Factors 5 Item 1B. Unresolved Staff Comments 12 Item 1C. Cybersecurity 12 Item 2. Properties 12 Item 3. Legal Proceedings 12 Item 4. Mine Safety Disclosures 12 PART II Item 5 …

New this year 10-K, 10-K Feb 11, 2026open_in_new

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.