Search every filing
2,476,630 paragraphs from 10-Ks, 10-Qs and 8-Ks with press releases.
Matching paragraphs
Axon has implemented our cybersecurity and information security program and cybersecurity incident response plan to protect our and our customers’ data from, and mitigate the effects of, unintentional disclosure as well as cybersecurity threats and incidents of all severity levels. Our program and response plan outline actions to be taken after identifying a suspected cybersecurity threat or incident and the people responsible for managing those actions. We have also implemented disclosure controls and procedures for determining the materiality of a cybersecurity incident to outline disclosure and communications responsibilities during cybersecurity incidents of all severity levels.
Read in the filing ↗
The CISO, together with the Information Security team, leads the Security Incident Response Team, which investigates suspected cybersecurity threats and incidents. In the event of a potentially material cybersecurity incident, senior leadership, including the Chief Legal Officer, Chief Accounting Officer, Chief Operating Officer, Chief Financial Officer, and other appropriate members of management, participate in the response and assessment process.
Read in the filing ↗
• carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.
Read in the filing ↗
In the event of a possibly material cyber incident, the Security Incident Response Team, under the direction of the Corporate General Counsel and/or the Chief Legal Officer, would collect and document information relevant to materiality and make a threshold determination as to whether such cybersecurity incident (including those occurring on the information systems of third parties) is potentially material. The Security Incident Response Team would meet with the Chair of the ERC Committee to review the preliminary findings of the Security Incident Response Team, including the possible factors in determining materiality. If the Security Incident Response Team and the Chair of the ERC Committee determine that the cybersecurity incident warrants further review after consideration of such findings and factors, the Audit Committee would be convened for a meeting (to which all members of the ERC Committee would be invited) to review the cybersecurity incident and the findings of the Security Incident Response Team and the Chair of the ERC Committee. The Audit Committee would then make a materiality determination consistent with SEC guidance and by considering relevant quantitative and qualitative factors, informed by any recommendations of the ERC Committee and/or its Chair.
Read in the filing ↗
• run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our technologies, methods and processes;
Read in the filing ↗
The Company maintains an incident response plan that establishes defined roles and responsibilities and includes disclosure controls and procedures for assessing the materiality of cybersecurity events.
Read in the filing ↗
We maintain a formal cybersecurity and information security program that incorporates recommendations from recognized frameworks and standards, including ISO, SOC 2, CJIS, FedRAMP, and NIST. The Information Security team oversees the program, which is designed to identify, prevent, detect, respond to, and remediate cybersecurity vulnerabilities and incidents.
Read in the filing ↗
Our CISO attends quarterly meetings of our Disclosure Committee and provides input on disclosures in our Quarterly Reports on Form 10-Q and Annual Reports on Form 10-K, including the relevant risk factors set forth therein. Our CISO, along with the Information Security Team, also leads our Security Incident Response Team, which is responsible for investigating suspected cybersecurity threats and incidents. In the event of a possibly material cybersecurity incident, the Information Security Team also includes the following executive team members: Corporate General Counsel, Chief Legal Officer, Chief Accounting Officer, Chief Operating Officer & Chief Financial Officer and, to the extent practicable or relevant, other senior executives.
Read in the filing ↗
Our cybersecurity and information security programs are designed to comply with key global financial regulations and cybersecurity laws in the jurisdictions in which we operate. The program includes taking several proactive steps to prepare for attempts to compromise our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material cybersecurity risks, and protect against, detect and respond to cybersecurity threats and incidents, we undertake the below listed activities:
Read in the filing ↗
Axon utilizes the assistance of third-party technology and providers to support our objective of protecting our information, information systems and network. Services provided by third parties to assess the performance of our cybersecurity risk management systems and procedures and to identify cybersecurity risks to the Company include assessing products and internal systems for vulnerabilities, incident response services such as computer forensics, internal and external audits for security certifications globally and overall security program maturity evaluations. Axon and our service providers have also developed systems and processes that are designed to protect our and our customers’ data, to prevent data loss, and to prevent or detect cybersecurity threats and incidents.
Read in the filing ↗
In the event of a potentially material cybersecurity incident, the Security Incident Response Team, under the direction of the Chief Legal Officer, evaluates relevant quantitative and qualitative factors, including incidents affecting third-party systems. The Team reports its findings to the Chair of the ERC Committee. If further review is warranted, the Audit Committee is convened, with members of the ERC Committee invited, to determine materiality consistent with SEC guidance. Incidents determined not to be material are reported to the ERC Committee at its next scheduled meeting.
Read in the filing ↗
Any materiality assessment that results in a determination that a cybersecurity incident is not material would be reported by the Information Security Team, or appropriate members of management, to the ERC Committee at its next scheduled meeting.
Read in the filing ↗
To date, the Company has not identified risks from known cybersecurity threats, including prior incidents, that have materially affected its operations, business strategy, results of operations, or financial condition. The Company faces ongoing cybersecurity risks that, if realized, could materially affect the Company. Additional information is provided in Item 1A of Part I of this Annual Report on Form 10-K.
Read in the filing ↗
At this time, we have not identified any risks from known cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial conditions. However, we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. For additional details, refer to Item 1A in Part I of this Annual Report on Form 10-K.
Read in the filing ↗
We also face increasing and evolving disclosure obligations related to cyber and other security events. Despite rigorous processes, we risk failing to meet existing or future disclosure obligations or having our disclosures misinterpreted. National security or public safety considerations may also affect, or in limited instances prevent, public disclosure of a cybersecurity incident.
Read in the filing ↗ Also in 10-K of Feb 28, 2025, 10-Q of Aug 5, 2025, 10-Q of Nov 5, 2025
As part of our company-wide culture of security, we maintain a formal cybersecurity and information security program that is aligned with the standards set forth by the International Organization for Standardization (“ISO”), the American Institute of Certified Public Accountants in Systems and Organization Controls 2, the Criminal Justice Information Services, the Federal Risk and Authorization Management Program and the National Institute of Standards and Technology. Our Information Security Team maintains the program, which is designed to ensure proper monitoring, prevention, detection, mitigation and remediation of cybersecurity vulnerabilities, including the prompt investigation and management of all reported or discovered security events, including cybersecurity threats and incidents, in our ordinary course of business.
Read in the filing ↗
Our reputation and our brands have in the past been, and could in the future be, damaged by negative publicity, whether or not merited. Negative publicity could relate to our company, our brands, our products, or other aspects of our business. We could experience negative publicity (which may be raised by consumer advocacy groups, third party interest groups, investors, employees or other stakeholders) for a variety of reasons, including product safety issues, threatened or pending legal or regulatory proceedings, product claims, advertising and promotional practices, sustainability or policy issues, materials sourcing or cybersecurity incidents. Negative publicity that damages one of our brands could be compounded by having an adverse effect on our other brands or our company as a whole.
Read in the filing ↗ Also in 10-K of Feb 28, 2025, 10-Q of Aug 5, 2025, 10-Q of Nov 5, 2025
Our business is highly dependent on our information systems, including our ability to operate them effectively and to successfully implement new technologies, methods and processes, as well as adequate controls and cybersecurity incident recovery plans. We rely on our information systems to manage our business, data, communications, supply chain, ordering, pricing, billing, inventory replenishment, accounting functions and other processes. In addition, we must protect the confidentiality and integrity of the data of our business, employees, customers and other third parties. Our business involves the collection, processing, storage and transmission of personally identifiable information and other sensitive and confidential information. This data is wide ranging and relates to our employees, customers and third parties, including the subjects of law enforcement. Our compliance obligations include those prescribed under the laws and regulations that dictate whether, how and under what circumstances we can receive, process, hold and/or transfer certain data that is critical to our operations, including data shared between countries or regions in which we operate and data shared among our products and services.
Read in the filing ↗