Infosys (INFY) Risk Analysis

Maintaining a hybrid working model may continue to expose us to various risks. We continue to operate under a hybrid model of work for our employees and service providers. As we hire, train, and deploy talent remotely in this hybrid working model, we may experience the following risks: - While we have adopted a hybrid hiring process in India where the majority of our employees are hired, virtual hiring continues to be utilized in locations outside India.  Our ability to assess the candidates effectively through virtual hiring processes may be adversely affected by risks such as fake profiles, candidates employing fraudulent mechanisms to respond to virtual interview questions, limited in-person interaction with the candidate, and technical infrastructure issues. This may lead to the hiring of unqualified or unsuitable candidates and lead to service delivery disruptions impacting our business operations. Increased potential for fraud with virtual hiring processes could delay completion of background verification, impacting our ability to deploy talent in a timely manner, as well as our client satisfaction and reputation. - If we are not able to effectively train our employees in the hybrid working model due to a lack of physical training sessions and personal connects, it may impact our ability to deploy talent on projects to meet our business requirements which could lead to service delivery disruptions, productivity loss, adverse client sentiments and additional costs. - We may have difficulty integrating employees working out of remote locations on a long-term basis into our existing corporate culture and build social capital, which may impact our ability to engage with and retain our high performing employees. - We may have greater exposure to cybersecurity and data privacy breach incidents with a large number of employees working remotely, which could hinder our ability to continue services and operations, impacting revenue, profitability and reputation. - Continued remote working exposes the company to the risk of some employees working for multiple employers simultaneously (moonlighting) without obtaining required prior approvals and this may result in potential conflict of interests, confidentiality breach, and reduced productivity. - Continued employee preferences to work out of remote locations, on a long-term basis, together with expectations from clients to return to office, if not managed adequately, may impact attrition, client satisfaction, and our ability to grow profitably. In addition, while working remotely in the hybrid work model, if any of our employees change their locations without informing us, it may impact our ability to comply with local tax laws and other regulatory requirements. Our reputation could be at risk and we may be liable to our clients or to regulators for damages caused by unauthorized disclosure of confidential information and sensitive data. We are dependent on our information technology networks and systems to process, transmit, host and securely store electronic information and to communicate among our locations around the world and with our clients, suppliers and partners. We are often required to collect and store sensitive or confidential client data. Security breaches, employee misappropriation, unauthorized access, human or technological error could lead, and in some cases has led, to unauthorized disclosure of sensitive data. Any such events could jeopardize projects that are critical to the operations of our clients' businesses. The theft and/or unauthorized use or publication of our, or our clients, confidential information or other proprietary business information as a result of such an incident could adversely affect our reputation and competitive position. Any failure in the networks or computer systems used by us or our clients could result in a claim for substantial damages against us and significant reputational harm. Many of our client agreements do not limit our potential liability for breaches of confidentiality. As a global service provider with clients in a broad range of industries, we often have access to or are required to manage, utilize, collect and store sensitive data subject to various regulatory regimes, including but not limited to U.S. federal and state laws governing the protection of personal financial and health data and the General Data Protection Regulation ("GDPR") . These laws and regulations are increasing in complexity and number and change frequently. Scope and coverage of these regulations are vast and include various stakeholders that do not necessarily restrict applicability to a certain geography in which we operate, which may result in greater compliance risk and cost. If any person, including any of our employees, negligently disregards or intentionally breaches our established controls with respect to our data or client data, or otherwise mismanages or misappropriates that data, we could be subject to significant litigation, monetary damages, regulatory enforcement actions, fines and/or criminal prosecution in one or more jurisdictions in addition to significant damage to our reputation. The monetary damages might not be subject to a contractual limit of liability or an exclusion of consequential or indirect damages and could be significant. In addition,our liability insurance, which includes cyber insurance, might not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other related breaches. Similarly, many of our contracts involve projects that are critical to the operation of our clients' businesses and provide benefits which may be difficult to quantify. Any failure in a client's system or breaches of security, regardless of our responsibility for such failure or breach, could result in a claim for substantial damages against us and force us to incur significant expenses for our defense or could require that we pay large sums in settlement. If unauthorized access to or disclosure of such data in our possession or control occurs or we otherwise fail to comply with applicable laws and regulations in this regard, we could be exposed to civil or criminal enforcement actions and penalties in connection with any violation of applicable data protection laws, as well as lawsuits brought by our clients, our clients' clients, their clients or others for breaching contractual confidentiality and security provisions or data protection laws. Laws and expectations relating to data protection continue to evolve in ways that may limit our access, use and disclosure of sensitive data, and may require increased expenditures by us or may dictate that we do not offer certain types of services. Given the hybrid working model, there is relatively higher potential for confidential data being exposed. We endeavor to strengthen and automate controls and educate our employees on how to secure the data and follow the best security practices, but non-material data breaches have occurred and the possibility of future data breaches (material or non-material) cannot be completely ruled out. This may lead to an adverse impact on our brand and financial condition and results of operations. Our reputation could be at risk and we may be liable to our clients for damages caused by cybersecurity incidents. AI-led cyber attacks represent a new frontier in digital threats where artificial intelligence is leveraged to enhance the sophistication and effectiveness of malicious campaigns. These attacks can automate the identification of vulnerabilities, craft convincing phishing messages, and adapt in real time to bypass security measures. The increase in sophistication and complexity of cyber-attacks, cybercrime and cyber insecurity have made the global cyber threat landscape highly volatile. Organizations across the world need to be vigilant to shield themselves from cybersecurity risks and the associated perils and challenges. We and our third-party service providers have in the past and may in the future be targets of cybersecurity attacks. Cyber threats evolve rapidly, and there have in the past and could in the future be a scenario where we are unable to adapt our threat detection and prevention measures to detect or prevent new, modified, or evolving threats to our solutions or product offerings. We and our third-party service providers have in the past and may in the future suffer cybersecurity breaches and other information security incidents due to a multitude of factors, including one or more of the following: - insider threats;- hackers and other state or non-state actors with an intent to cause harm to us or our clients (including, for example, our government clients and our clients in sensitive industry segments such as financial services, insurance, energy, utilities or healthcare);- technological error or human error and inadvertent actions by our employees and contractors;- malware, ransomware, viruses, worms, and similar threats, including the potential for infection spreading between environments;- increased threat and attack surface due to a hybrid work model and emergence of the metaverse;- vulnerability of the security automation system to attacks;- unintended data leakage and security vulnerabilities arising due to use of AI;- vulnerability of the supply chain (including software supply chain) to attacks; and - malicious use of AI leading to the industrialization of tailored, high volume, high-impact cyberattacks, leaving organizations overwhelmed and unable to operate effectively. We believe the risks presented by cybersecurity breaches and other information security incidents will increase as we scale, grow our cloud-based offerings and services and AI-powered enterprise transformation, store and process increasingly large amounts of our clients' data and host or manage parts of our clients' businesses, especially in industries involving sensitive data such as the financial services, energy, utilities and healthcare industries. In addition, with increased dependence on cloud vendors, any consequential large-scale failure in their security, coupled with difficulties of porting data from one vendor to another, may jeopardize our and our clients' business continuity. By virtue of our business presence across continents, any alleged or actual non-compliance with our obligations relating to cybersecurity and information security in any applicable jurisdictions could lead to regulatory investigations, claims, litigation, and significant damages, fines, penalties, and other liability. Cybersecurity breaches and other data security incidents have in the past and could in the future have an adverse impact on our business, operations, financial performance, and reputation especially in cases where critical systems, or numerous systems, are unavailable or otherwise impacted, resulting in partial to complete disruption of intended business delivery, or due to unauthorized access to, or the loss, corruption, or theft of, intellectual property, personal data, or sensitive information. If we or any of our third-party service providers suffer a cybersecurity breach or other data security incident, or if any such breach or incident is believed to have occurred, we have in the past and could in future face potential claims and litigation, regulatory investigations and inquiries, damages, fines, penalties, and other liability, substantial harm to our reputation, a loss of business, and significant costs to investigate, remediate, and otherwise address the breach or other incident. In addition, we have in the past and expect in the future to incur increased costs in preventing cybersecurity breaches or other information security incidents in the future. Furthermore, as there is increased focus on ESG concerns, our failure to demonstrate strong corporate governance around cybersecurity in the event of a breach could impact our reputation. Our cybersecurity insurance covers first party losses that occur due to a cybersecurity-incident wherein losses include cost of forensics, appointing a crisis consultant and data restoration. The insurance also provides for business interruption losses that we might have to incur as a result of a system shutdown due to a cyber-incident. Our insurance may not be adequate to cover all losses in connection with any cybersecurity breach or other incident, and we cannot be certain that our present coverage, or any future coverage we may obtain, will remain available to us on commercially reasonable terms or at all. Our reputation may be impacted, and we may incur financial liabilities if privacy breaches and incidents under General Data Protection Regulation ("GDPR") or other data privacy regulations across the globe are attributed to us or if we are not able to take necessary steps to report such breaches and incidents to regulators and data subjects, wherever applicable, within the stipulated time or if we are unable to respond on data subject requests on timely manner. Further, any claim from our clients for losses suffered by them due to privacy breaches caused by our employees may impact us financially and affect our reputation. The GDPR and similar data privacy laws in other jurisdictions impose additional obligations and increase risk exposure upon our business and increase substantially the penalties to which we could be subject to. For example, because the GDPR's enforcement history on our industry sector is limited, we are unable to predict how certain obligations under the GDPR may be applied to us. Despite our efforts to comply with various data privacy laws applicable to us, a regulator may determine that what we have done is not sufficient and subject us to fines and public censure, which could harm our business and reputation. We may see an increase in the number of data privacy incidents arising from our operations with the scale of our business, and our move to a hybrid working model. Further, more of our work may come under the ambit of privacy regulations as more countries have adopted new regulations or strengthened their existing privacy laws similar to the GDPR. We constituted our data privacy function over a decade ago, which operates as an independent business enabling function, reporting to the top management and using the globally recognized Privacy Information Management System ("PIMS") framework. We assess our liabilities as processors and controllers and implementing controls where required to mitigate the risks. We have formulated and implemented policies and procedures for identifying and reporting privacy breaches, to affected data subjects and/or regulators (as required) within the stipulated time. In addition to implementing and monitoring various controls, we are covered by insurance to some extent in the case of any eventuality. Despite these efforts and insurance, we continue to be at risk of experiencing a data privacy breach, and any such breach could adversely impact our financial results and reputation. Recently and increasingly, AI-based tools and technologies have proliferated across the digital industry and our business, introducing newer privacy threats, the understanding of which is at early stages both for the industry and regulators. We may not be able to anticipate or adequately manage the privacy threats that may emerge in connection with greater adoption of AI. We may be the subject of litigation which, if adversely determined, could harm our business and impact reputation, growth, profitability, and results of operations. In the normal course of business, we are, and may in the future be, subject to legal disputes or claims. An unfavorable outcome on any litigation matter could require that we pay substantial damages, or, in connection with any intellectual property infringement claims, could require that we pay ongoing royalty payments or prevent us from selling certain of our products. In addition, we may decide to settle any litigation, which could cause us to incur significant costs. A settlement or an unfavorable outcome on any litigation matter could materially adversely affect our business, results of operations, reputation, financial position or cash flows. For example, Cognizant TriZetto Software Group, Inc. ("TriZetto") has filed a lawsuit against Infosys asserting claims for misappropriation of TriZetto trade secrets relating to its Facets and QNXT software products, breach of contract, and unfair competition. The lawsuit seeks unspecified damages, as well as, among other things, an injunction against us to stop us from using any of TriZetto's trade secrets. We filed counterclaims against TriZetto and its parent company, Cognizant Technology Services (collectively "Cognizant") alleging that Cognizant has monopolized, and restrained trade in, the markets for U.S. healthcare payor software products and related IT support for those products in violation of federal and state antitrust laws. We seek treble damages, attorneys' fees, and an injunction to stop the alleged anticompetitive conduct. Discovery is ongoing and the trial is set to occur in near future. Any prolonged economic downturn, changes in tariffs or trade restrictions and geopolitical conflicts and the resulting financial impact to our clients, vendors and other stakeholders along with other situations like cybersecurity threats, data breaches, contractual suspensions, delayed payments and similar other incidents may give rise to more litigation and disputes with our stakeholders resulting in additional cost, or loss of reputation if the same surfaces in the media. Our insurance coverage may not be adequate to protect us against all potential losses to which we may be subject, which could adversely affect our business. Our insurance policies generally cover loss or damage to insured property and loss due to business interruption following loss or damage to property. These policies cover our property and assets around the world, including all leased property. We also maintain insurance coverage for damage caused by disclosure of employee and client-related personally identifiable confidential information, system failures, errors or unsatisfactory performance of services to our clients in the event of a third-party claim citing damages or financial loss. We believe we have taken sufficient insurance policies to cover ourselves from potential losses that we may be subject to. However, this coverage may not continue to be available on reasonable terms and may be unavailable in sufficient amounts to cover one or more large claims. Also, an insurer might disclaim coverage as to any future claim. For example, certain insurers have indicated that they may disclaim coverage for claims arising from business interruption due to geopolitical conflicts. A successful assertion of one or more large claims against us that exceed our available insurance coverage or that cause changes in our insurance policies, including premium increases or the imposition of a large deductible or co-insurance requirement, could adversely affect our results of operations. In addition, our hybrid working model increases the risk of claims arising out of various situations like errors and omissions and data breaches, which could render the coverage taken inadequate. Increased claims could cause the insurance premium on our regular policies to be increased which could adversely affect our profitability. In addition, losses arising from events not covered by our insurance policies could adversely affect our financial condition and results of operations. There can be no assurance that any claims filed under our insurance policies will be honored fully or in a timely manner. Our financial condition may be adversely affected to the extent we suffer any loss or damage that is not covered by insurance, or which exceeds our insurance coverage. The markets in which we operate are subject to the risk of earthquakes, floods, tsunamis, storms, pandemics and other disasters. Some of the regions that we operate in are prone to earthquakes, floods, tsunamis, storms, pandemics and other disasters. In the event that any of our business centers or the telecommunications networks that our business depends on are affected by any such disasters, we may incur costs in redeploying personnel and property, sustain damage to our operations and properties, suffer significant financial losses or be unable to complete our client engagements in a timely manner, if at all. In addition, if such disasters occur in any of the locations in which our significant clients are located, we face the risk that our clients may incur losses or sustain business interruption, which may materially impair our ability to provide services to our clients and may limit their ability to continue their purchase of products or services from us. This could adversely affect our business, financial condition, results of operations and cash flows. Additionally, a prolonged disruption of our operations due to such disasters may impact our business continuity and employee productivity. The safety of our employees, assets and infrastructure may be affected by untoward incidents beyond our control, impacting business continuity or reputation. The health and safety of our employees or those working on our behalf or those present in our offices, and the security of our physical infrastructure may be affected due to acts of violence or vandalism by anti-social elements or the emergence of a disease pandemic or geopolitical conflicts. Although we take protective measures to ensure the safety of our employees at our global locations of work and transit, incidents of organized political demonstrations, civil unrest, random acts of rage or a public health crisis can affect the safety of our assets and employees, impacting business continuity or reputation or exposing us to lawsuits from employees. Currently, we operate in 290 locations across 59 countries. Our global development centers are linked with a telecommunications network architecture that uses multiple service providers and various satellite and optical links with alternate routing. While we believe we have put in place adequate infrastructure and business continuity plans to handle disruption in services due to failure in our communication network, our operations and service delivery may be impacted if such networks are affected by disasters. As an international company, our offshore and onsite operations may also be impacted by disease, epidemics, war, conflicts and local social instability, which could adversely affect our revenues and profitability. Terrorist attacks or a war could adversely affect our business, results of operations and financial condition. Terrorist attacks and other acts of violence or war have the potential to directly impact our clients or us. To the extent that such events affect or involve the United States or Europe (including the current geopolitical conflicts in Eastern Europe and the Middle East), our business may be significantly impacted, as a majority of our revenues are derived from clients located in the United States and Europe. In addition, events of terrorism, military coup or threat of warfare in other parts of the world, could cause geopolitical instability, which in turn may impact our clients or impact our ability to execute projects. Such attacks may destabilize the economic and political situation in India and other countries where we have large operations making it more difficult to obtain work visas and plan travel for many of our technology professionals who are required to work in the United States or Europe. Such obstacles to business may increase our expenses and negatively affect the results of our operations. Furthermore, any attacks in India could cause a disruption in the delivery of our services to our clients, and could have a negative impact on our business, personnel, assets, results of operations and could cause our clients or potential clients to choose other vendors for the services we provide. Regional conflicts in South Asia could adversely affect the Indian economy, disrupt our operations and cause our business to suffer. South Asia has, from time to time, experienced instances of civil unrest and hostilities among neighboring countries, including China and Pakistan. There have been military confrontations between India and Pakistan that have occurred in the region of Kashmir and along the India-Pakistan border including as recently as May 2025. Continued conflict in South Asia, Eastern Europe and Middle East may impact the safety of our employees and development centers in affected locations and increase cybersecurity threats. It may further impact our ability to service our global clients if we are unable to move our operations out of conflict zones in a timely manner or our cost of operations increases as our work is moved to an alternate location. Military activity or terrorist attacks in the future could hurt the Indian economy by disrupting communications and making travel more difficult and such political tensions could create a greater perception that investments in Indian companies involve higher degrees of risk. Further, such warfare may also potentially increase the risk of cyber-attacks on us as we are a leading Indian IT service provider. This, in turn, could adversely affect the market for securities of Indian companies, including our equity shares and our ADSs, and the market for our services. Heightened geopolitical conflicts may affect our ability to operate in these geographies. In addition, any prolonged conflict may delay the economic recovery from the pandemic, compounding any adverse impact to our business. Climate change risks are increasingly manifesting in our business as strategic, physical and transitional (market and compliance) risks, which if not managed adequately, can affect our operations, reputation and profitability. There is increased focus by organizations to plan for ESG risks arising out of climate change, environmental management practices and duty of care, work and safety conditions, respect for human rights, anti-bribery and anti-corruption practices, and compliance to relevant laws and regulations. Risks related to these factors, except those related to climate change, are covered elsewhere in this document. Climate change related risks are discussed in this section. Strategic climate change risks: In a market with increased awareness of climate change, aligning business with the evolving trends is an important factor affecting the success of the Company. As a member of the global IT/digital supply chain ecosystem, we are prone to strategic risks if our climate action goals are not aligned to global treaties like the Paris Agreement on climate change. Physical climate change risks: Extreme weather events due to climate change may cause (1) physical damage to our building infrastructure and other physical assets that cause disruptions in business continuity (2) disruption of the city's functional continuity such as the transport network and utilities in the cities that we operate that can severely hamper business continuity, and (3) a decrease in morale of employees due to extreme weather events. Extreme weather events also bring in unique problems depending on the type of calamity. For example, drought can bring increases in food prices, or shortages of certain food items, while events like flooding can cause diseases and epidemics. It can also lead to loss of productivity and increased operational costs. Changes in the availability of essential natural resources like water, in regions where we operate could directly impact our operations and employee livelihood, which will impact our ability to do business and ensure business continuity. With large operating campuses in major urban cities, operating risks include disruption of power and water supply to our campuses due to extreme weather events, affecting business continuity. Climate related market risks: In response to increasing awareness on climate change and other related socio- environmental issues, clients increasingly insist on climate action updates, including emission performance disclosures such as Carbon Disclosure Project ("CDP") score (globally renowned for climate disclosure) during the evaluation stage. A number of clients and potential clients have enquired about Infosys' Net Zero commitment, commitment to Science Based Targets, and supply chain emission reduction initiatives, and responses to such enquiries may become an important factor in clients' overall decision-making process. If performance is not managed in these areas, it may adversely impact our ability to compete and win/renew contracts. Climate related regulatory risks: Countries that have agreed to the 2015 Paris Agreement on climate change have made specific promises or plans , known as "Intended Nationally Determined Contributions", to reduce their greenhouse gas emissions and address climate change. This has translated into emission reduction goals and other environmental targets, disclosures and increased compliance mandated to businesses in different geographies. In many regions, regulations requiring detailed disclosures on climate action, performance, risk and opportunities already exist or are being developed. New and emerging regulations may result in increased cost of compliance. Further, any gaps due to incorrect reporting of environmental data /metrics, including misinterpretation of evolving global standards may attract penalties, impact reputation and may lead to other consequences. Risks resulting from potential violations or non-conformance with climate laws and regulations could impact our reputation and profitability through the incurrence of penalties or by limiting our ability to operate in certain geographies and could adversely impact our business performance. Our reputation, access to capital and longer-term financial stability could be at risk if we are unable to meet our stated goals under our ESG 2030 vision. Infosys is among the early signatories to the United Nations Global compact. In 2020, when we became carbon neutral, we published our ESG Vision and Ambitions 2030, articulating our roadmap to responsible/sustainable business. Our annual ESG publications provide a report of our performance on our ESG Ambitions and are mapped to the United Nations Sustainable Development Goals. In 2025, at the mid-point of our journey towards our ESG Vision 2030, we had an opportunity to refresh our ESG ambitions to address the changing priorities of our stakeholders and reinforce our commitment to responsible business. Our ESG performance and leadership is monitored internally as well as by external agencies including global ESG assessments. If we are unable to meet our goals or if we are not assessed favorably on ESG measures by external agencies, our reputation, access to capital and longer-term financial stability may be adversely impacted including our brand reputation which could impact the share price. Conversely, a number of regulators, lawmakers and stakeholders have increasingly expressed or pursued contrary views, legislation and investment expectations with respect to ESG ambitions and measures, including proposing or enacting "anti-ESG" legislation, regulation or policies, which may expose us to additional legal, financial or reputational risks based upon our ESG Ambitions and disclosures. Negative media coverage and public scrutiny may divert the time and attention of our board and management and adversely affect our reputation and the prices of our equity shares and ADSs. There is media coverage and public scrutiny of our business practices, policies and actions including negative, and in some cases, inaccurate posts or comments. Any future negative media coverage in relation to our business, our Board or senior management, regardless of the factual basis for the assertions being made, may adversely impact our reputation. In addition, responding to allegations made in the media can significantly divert the time and attention of our Board and senior management away from our business and disrupt our operations. We may not be able to respond publicly to certain comments in the media due to the obligations we have with our employees, clients and other stakeholders. Any unfavorable publicity may also adversely impact investor confidence and directly or indirectly cause the price of our equity shares and ADSs to decline. If any of our employees, as independent individuals, engage in any acts that are perceived to be against the interests of the communities we operate in or that violate local regulations, and if such acts become the subject of mainstream and social media attention or regulatory scrutiny, our reputation may be negatively impacted. Regulatory requirements that obligate our management to respond to rumors within a specified time may put strain on board and management bandwidth, digress their attention from business-critical strategic work and can also adversely impact our reputation.