Roper Technologies (ROP) Risk Analysis

Our business operations are dependent upon information technology networks and systems to securely transmit, process, and store information and to communicate among our locations around the world and with clients, suppliers, and business partners. A shutdown of, or inability to access, one or more of our facilities, a power outage, or a failure of one or more of our information technology, telecommunications, or other systems could significantly impair our ability to perform such functions on a timely basis. Our compliance, cybersecurity and data privacy programs, cybersecurity technology, and risk management cannot eliminate all system risk. Credential compromise and identity-based attacks represent risks, and while we deploy identity threat protection and multi-factor authentication across our enterprise systems, determined attackers may still gain unauthorized access through sophisticated credential theft, session hijacking, social engineering, or privilege escalation techniques. Cybersecurity incidents including ransomware attacks, insider threats, system disruptions, and configuration errors could result in the misappropriation or corruption of data and assets, or disruptions to our business strategy, results of operations, and financial condition, and may require notification to customers and regulators with associated investigation, remediation, and monitoring obligations. These disruptions may include, but are not limited to, interruptions to business operations, loss of intellectual property, release of confidential or other sensitive information, alteration or corruption of data or systems, costs related to remediation or the payment of ransom, litigation (including individual claims, consumer class actions, or commercial litigation), administrative, civil, or criminal investigations or actions, regulatory intervention and sanctions or fines, investigation and remediation costs, and prolonged negative publicity. While we have experienced disruptions, and our Vertafore business was previously subject to litigation regarding the exposure of data which was dismissed, to date, management has not identified any material impact on the Company from these disruptions. We rely on business partners such as third-party data centers and cloud platforms, such as Amazon Web Services, Google Cloud Platform, Microsoft Azure, and Oracle Cloud to host certain enterprise and customer systems. Our software development and business operations rely on open-source components, third-party software libraries, and vendor dependencies that could contain undisclosed vulnerabilities, be subject to supply chain attacks, or become unavailable, potentially affecting our products, hosted services, and internal systems. Our software development lifecycle and deployment infrastructure, including source code repositories, continuous integration and continuous deployment ("CI/CD") systems, build pipelines, code-signing processes, developer tools (including AI coding tools), automated testing environments, and other software development infrastructure, may be targeted by threat actors seeking to compromise software integrity, gain unauthorized access to credentials or cloud environments, introduce malicious code, exfiltrate sensitive information, or disrupt operations. Because these systems often integrate with third-party platforms, open-source components, cloud-based development tools, and trusted vendor ecosystems, vulnerabilities or compromises affecting software suppliers, developer environments, automated workflows, or software supply chains could propagate across internal systems, hosted services, or customer-facing products before detection. We have limited ability to monitor these third parties' security measures or the full impact of the systemic risk, and concentration with a limited number of providers increases our exposure to outages and pricing changes. If any third-party system or cloud platform that we use is unavailable to us for any reason, our customers may experience service interruptions, which could significantly impact our operations, reputation, business, and financial results. Failure of our systems or those of our third-party service providers, may result in interruptions in our service and loss of data or processing capabilities, all of which may cause a loss in customers, refunds to be sought with respect to product fees, and/or material harm to our reputation and operating results. While certain of our businesses have experienced temporary disruptions, management has not identified any material impact on the Company from such disruptions to date. Global cybersecurity threats are rapidly evolving and attacks to identities, networks, platforms, systems, and endpoints can range from uncoordinated individual attempts to sophisticated and targeted measures known as advanced persistent threats, directed at the Company, its businesses, its customers, and/or its third-party service providers, including, but not limited to, cloud providers and providers of network management services. These may include such things as unauthorized access, phishing attacks, denial of service, insider threats, data exfiltration and extortion, introduction of malware or ransomware, and other disruptive problems caused by threat actors. Threat actors are increasingly targeting trusted software providers, managed service providers, cloud platforms, software repositories, identity providers, developer tools, and other third-party technology ecosystems used by enterprises to develop, host, authenticate, and deploy software and services. Threat actors are also increasingly using AI to automate cyberattacks, enhance phishing and business email compromise campaigns, create convincing synthetic media, accelerate malware development, identify software vulnerabilities, and evade traditional security controls. As these capabilities continue to evolve, they may increase the frequency, sophistication, and effectiveness of attacks directed at the Company, its customers, and its third-party service providers. We face emerging risks from AI-powered attacks, including deepfakes used to impersonate employees or customers, AI-assisted social engineering and hacking activity, prompt injection attempts against AI systems, and data poisoning targeting machine learning models. These sophisticated attack techniques may bypass traditional security controls. Additionally, zero-day vulnerabilities, which are previously unknown security flaws with no available patches, pose risks that cannot be fully mitigated through our standard vulnerability management processes, requiring rapid detection and response capabilities to minimize potential damage. While we have experienced and expect to continue to experience these types of cybersecurity threats and incidents, management has not identified any cybersecurity incidents that have been material to the Company to date. We seek to deploy measures to protect, detect, respond, and recover from cybersecurity threats and incidents, including identity and access controls, employee training, data protection, vulnerability management, incident response, secure product development, continuous monitoring of our networks, platforms, endpoints, systems, and software development environments, and maintenance of ransomware resilient backup and recovery capabilities. Our customers are increasingly requiring cybersecurity protections and mandating cybersecurity standards in our products and services, and we may incur additional costs to comply with such demands. Despite these efforts, we can make no assurances that we will be able to mitigate, detect, prevent, timely and adequately respond, or fully recover from the negative effects of cybersecurity incidents, and such cybersecurity incidents, depending on their nature and scope, could potentially result in the misappropriation, destruction, corruption, or unavailability of critical data and confidential or proprietary information (our own or that of third parties) and the disruption of business operations. The potential consequences of a material cybersecurity incident include financial loss, reputational damage, damage to our IT systems, data loss, litigation, theft of intellectual property, regulatory fines, customer attrition, diminution in the value of our investments in research and development, and increased cybersecurity protection and remediation costs, which may not be fully covered by insurance and could adversely affect our competitiveness and results of operations. Any imposition of liability, particularly liability that is not covered by insurance or is in excess of insurance coverage, could materially harm our operating results and financial condition.