Comcast (CMCSA) Risk Analysis

Network and information systems and other technologies, including those that are related to our network management, customer service operations and programming delivery and are embedded in our products and services, are critical to our business activities. In the ordinary course of our business, there are constant attempts by unauthorized parties to cause systems-related events and security incidents and to identify and exploit vulnerabilities in security architecture and system design. These incidents include computer hacking, cyber attacks, computer viruses, worms or other destructive or disruptive software, denial of service attacks, phishing attacks, malware, ransomware, malicious social engineering, theft, misconduct, fraud and other malicious activities. Incidents can be caused inadvertently by us or our third-party vendors due to factors such as process breakdowns, human error, software or hardware failures or vulnerabilities in security architecture or system design. Cyber threats and attacks are constantly evolving and are growing in sophistication and frequency, which increases the difficulty of detecting and successfully defending against them. For example, we expect threat actors will continue to gain sophistication by using tools and techniques, such as AI, that are specifically designed to circumvent security controls. Some cyber attacks have had, and in the future can have, cascading impacts that unfold with increasing speed across networks, information systems and other technologies across the world and create latent vulnerabilities in our and third-party vendors' systems and other technologies. We also obtain certain confidential, proprietary and personal information about our customers, personnel and vendors, that in many cases is provided or made available to third-party vendors who agree to protect it, which has in the past, and may in the future, become compromised through a cyber attack or data breach, misappropriation, misuse, leakage, falsification or accidental release or loss of information by us or a third party. Due to the nature of our businesses, we may be at a disproportionately heightened risk of these types of incidents occurring because we maintain certain information necessary to conduct our business in digital form. We also incorporate third-party software (including extensive open-source software), applications, and data hosting and cloud-based services into many aspects of our products, services and operations, as well as rely on service providers to help us perform our business operations, all of which expose us to cyber attacks with respect to such third-party suppliers and service providers and their products and services. Due to applicable laws, regulations and contractual obligations, we may be held responsible for cybersecurity breaches or incidents experienced by such third parties in relation to the information we share with them. Due to the complexity and interconnectedness of our systems and those of our third-party vendors, the process of enhancing our protective measures can itself create a risk of systems disruptions and security issues. While we develop and maintain systems, and operate programs that seek to prevent security incidents from occurring, these efforts are costly and must be constantly monitored and updated in the face of sophisticated and rapidly evolving attempts to overcome our security measures and protections. The occurrence of both intentional and unintentional incidents has caused, and may from time to time in the future cause, a variety of business impacts. These include degradation or disruption of our network, products and services, excessive call volume to call centers, theft or misuse of our intellectual property or other assets, disruption of the security of our internal systems, products, services or satellite transmission signals, power outages, and the compromise or exfiltration of sensitive, personal, proprietary, confidential or technical business information and customer or vendor data, and reputational impacts. In addition, despite efforts to detect unlawful intrusions, attacks can persist for an extended period of time before being detected, and following detection, it may take considerable time to understand the nature, scope, impact and timing of the incident. Moreover, the amount and scope of insurance we maintain against losses resulting from any of the foregoing events likely would not be sufficient to fully cover our losses or otherwise adequately compensate us for disruptions to our business that may result. Repercussions of these incidents have in the past included and may in the future include legal proceedings or significant regulatory fines, oversight or other remedial measures, including with respect to relevant consumer privacy rules, or otherwise have an adverse effect on our company. Despite our efforts, we expect that we will continue to experience such incidents in the future, and there can be no assurance that any such incident will not have an adverse effect on our business, reputation or results of operations. Refer to Item 1C: Cybersecurity for additional information.