Search every filing
2,477,667 paragraphs from 10-Ks, 10-Qs and 8-Ks with press releases.
Matching paragraphs
• A cybersecurity incident response plan and scenario-specific playbooks for responding to various types of cybersecurity incidents;
Read in the filing ↗ Also in 10-K of Sep 9, 2026
As part of management oversight, our CEO receives monthly updates from the CISO and representatives from CyberCRAFT. These updates provide a recurring overview of cybersecurity trends and status updates (e.g., security events, fraud detection, IT roadmap progress, follow-up from prior assessments, security awareness exercise results), as well as a more focused analysis on select cybersecurity topics for the month. Examples of prior topics include recent cybersecurity legislation, cybersecurity incidents affecting external entities, and trends in cybersecurity controls and adoption. As part of our incident response processes, incidents are classified based on the incident’s characteristics. For certain risk-based classifications of incidents, the CEO and other members of the executive leadership team are also informed and contribute as part of our incident response processes.
Read in the filing ↗
As part of management oversight, our Chief Executive Officer (CEO) receives monthly updates from the CISO and representatives from CyberCRAFT. These updates provide a recurring overview of cybersecurity trends and status updates (e.g., security events, fraud detection, IT roadmap progress, follow-up from prior assessments, security awareness exercise results), as well as a more focused analysis on select cybersecurity topics for the month. Examples of prior topics include: recent cybersecurity legislation, cybersecurity incidents affecting external entities, and trends in cybersecurity controls and adoption. As part of our incident response processes, incidents are classified based on the incident’s characteristics. For certain risk-based classifications of incidents, the CEO and other members of the executive leadership team are also informed and contribute as part of our incident response processes.
Read in the filing ↗
Additionally, we maintain cybersecurity insurance which may cover some or all of the potential losses from a cybersecurity incident. During the last fiscal year, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that materially affected Intuit, including its business strategy, results of operations, or financial condition. However, we continue to face ongoing and increasing cybersecurity risks which may materially affect us in the
Read in the filing ↗ Also in 10-K of Sep 9, 2026
The continued occurrence of cybersecurity incidents affecting governments, businesses and consumers in general indicates that we operate in an external environment where cybersecurity incidents are becoming increasingly common. If the global cybersecurity environment worsens, and there are increased instances of security breaches of third-party offerings where consumers’ data and sensitive information is compromised, consumers may be less willing to use online offerings, particularly offerings like ours in which customers often share sensitive financial data. Additionally, political uncertainty and military actions may subject us and our service providers to heightened risks of security incidents. In addition, the increased availability of data obtained as a result of cybersecurity incidents affecting third-party offerings could make our own products more vulnerable to fraudulent activity. Even if our products are not affected directly by such incidents, any such incident could damage our reputation and deter current and potential customers from adopting our products and services or lead customers to cease using online and connected software products to transact financial business altogether.
Read in the filing ↗ Also in 10-K of Sep 3, 2025, 10-Q of Nov 20, 2025, 10-Q of Feb 26, 2026, 10-Q of May 20, 2026, 10-K of Sep 9, 2026
• Business continuity and disaster recovery plans to support more effective response and recovery efforts in the event of a significant cybersecurity incident or disruption;
Read in the filing ↗ Also in 10-K of Sep 9, 2026
A cybersecurity incident affecting the third parties we rely on could expose us or our customers to a risk of loss or misuse of confidential information and significantly damage our reputation.
Read in the filing ↗ Also in 10-K of Sep 3, 2025, 10-Q of Nov 20, 2025, 10-Q of Feb 26, 2026, 10-Q of May 20, 2026, 10-K of Sep 9, 2026
Our full Board of Directors provides ultimate oversight for the cybersecurity program, in addition to other significant risks of Intuit. The Board of Directors has delegated primary oversight of cybersecurity risks to the Audit and Risk Committee. On a quarterly basis, the CISO and CyberCRAFT specialists provide the Audit and Risk Committee with updates, metrics, and trends, such as the status of prior security events, existing and emerging threat landscapes, the results of audits or assessments, fraud prevention efforts, vulnerability detection and disclosure changes, and the status of projects to strengthen our security systems and improve incident readiness, and how these may affect broader enterprise risk management. Under our incident response processes’ risk-based escalation protocols, the CISO, or other management, escalates certain incidents to the chair of the Audit and Risk Committee, who may then involve the broader committee or the full Board of Directors, as appropriate.
Read in the filing ↗ Also in 10-K of Sep 9, 2026
future. Additional information on the cybersecurity risks is discussed in “Risk Factors” in Item 1A of Part I of this Annual Report, including without limitation the risk that “Security incidents, improper access to or disclosure of our data or customers’ data, or other cyberattacks on our systems could harm our reputation, business, and financial condition. ”
Read in the filing ↗ Also in 10-K of Sep 9, 2026
We host, collect, process, use, and retain large amounts of sensitive and personal data across an array of our own and third-party information systems. To help protect these systems and data, we have implemented a robust information security program that includes numerous administrative, technical, and physical safeguards. We strive to evolve our cyber defenses to help minimize impacts from cyber threats. In general, we seek to address cybersecurity risks through a cross-functional approach. This approach focuses on protecting business operations and preserving the confidentiality, integrity, and availability of systems and data by preventing and mitigating cybersecurity threats, as well as effectively responding to cybersecurity incidents when they occur.
Read in the filing ↗
We host, collect, process, use, and retain large amounts of sensitive and personal information across an array of our own and third-party information systems. To help protect these systems and data, we have implemented a robust information security program that includes numerous administrative, technical, and physical safeguards. We strive to advance our cyber defenses with evolving technology and utilize a combination of purchased and internally developed tools, including AI-powered security tools, to help minimize impacts from cyber threats. In general, we seek to address cybersecurity risks through a cross-functional approach. This approach focuses on protecting business operations and preserving the confidentiality, integrity, and availability of systems and data by preventing and mitigating cybersecurity threats, as well as effectively responding to cybersecurity incidents when they occur.
Read in the filing ↗
… acquisition and divestiture activity; the issuance of equity or incurrence of debt to fund acquisitions or for general business purposes; cybersecurity incidents (including those affecting the third parties we rely on); customer or regulator concerns about privacy and cybersecurity incidents; fraudulent activities by third parties using our offerings; our failure to process transactions effectively; interruption or failure of our information …
Read in the filing ↗ Also in 8-K of Nov 28, 2023, 8-K of Feb 22, 2024, 8-K of May 23, 2024, 8-K of Mar 16, 2026, 8-K of Nov 20, 2025, 8-K of Feb 26, 2026, 8-K of Nov 21, 2024, 8-K of Feb 25, 2025, 8-K of May 22, 2025, 8-K of May 20, 2026
property; our ability to protect our intellectual property rights; any harm to our reputation; risks associated with our environmental, social, and governance efforts; risks associated with acquisition and divestiture activity; the issuance of equity or incurrence of debt to fund acquisitions or for general business purposes; cybersecurity incidents (including those affecting the third parties we rely on); customer or regulator …
Read in the filing ↗
… acquisition and divestiture activity; the issuance of equity or incurrence of debt to fund acquisitions or for general business purposes; cybersecurity incidents (including those affecting the third parties we rely on); customer or regulator concerns about privacy and cybersecurity incidents; fraudulent activities by third parties, including through the use of AI; our failure to process transactions effectively; interruption or failure …
Read in the filing ↗
… Cybersecurity incidents can be caused by malicious third parties, acting alone or in groups, or more sophisticated organizations, including nation-states or state-sponsored organizations, and the risks could be elevated in connection with significant armed conflicts, acts of war or terrorism. Customers who fail to update their systems, continue to run software that we no longer support, fail to …
Read in the filing ↗ Also in 10-K of Sep 3, 2025, 10-Q of Nov 20, 2025, 10-Q of Feb 26, 2026, 10-Q of May 20, 2026, 10-K of Sep 9, 2026
… acquisition and divestiture activity; the issuance of equity or incurrence of debt to fund an acquisition or for general business purposes; cybersecurity incidents (including those affecting the third parties we rely on); customer concerns about privacy and cybersecurity incidents; fraudulent activities by third parties using our offerings; our failure to process transactions effectively; interruption or failure of our information technology …
Read in the filing ↗