Stifel Financial (SF) Risk Analysis

Our operations rely heavily on the secure processing, storage, and transmission of sensitive and confidential financial, personal, and other information in our computer systems and networks. There have been numerous highly publicized cases involving financial services companies reporting the unauthorized disclosure of client or other confidential information in recent years, as well as cyber attacks involving the theft, dissemination, and destruction of corporate information or other assets, in some cases as a result of failure to follow procedures by employees or contractors or as a result of actions by third parties. There have also been numerous highly publicized cases where hackers have requested "ransom" payments in exchange for not disclosing customer information or for restoring access to information or systems. Like other financial services firms, we experience malicious cyber activity directed at our computer systems, software, networks, and its users on a daily basis. This malicious activity includes attempts at unauthorized access, implantation of computer viruses or malware, and denial-of-service attacks. We also experience large volumes of phishing and other forms of social engineering attempted for the purpose of perpetrating fraud against our company, our associates, our advisors, or our clients. Additionally, like many large enterprises, we provide secure remote work capabilities, which can introduce potential cyber vulnerabilities as well. We also face increased cybersecurity risk for a period of time after acquisitions as we transition the acquired entity's historical systems and networks to our standards. We also face additional cybersecurity risk related to an increased focus on mobile and cloud technologies and reliance on external service providers. Our reliance on public cloud services introduces cybersecurity risks, including potential data breaches, unauthorized access, and compromised application programming interfaces (APIs) which could impact the confidentiality, integrity, or availability of our systems and data. Cloud-related risks may also arise from misconfiguration, weaknesses in identity and access controls, vulnerabilities in cloud workloads, and failures or outages at cloud service providers. Likewise, our mobile and web-facing technologies expose us to risks such as data leakage, malicious applications, phishing attacks, and network level threats which pose similar risks. We seek to continuously monitor for and nimbly react to malicious cyber activity, and we develop our systems to protect the confidentiality, integrity, and availability of our data and technology infrastructure from misuse, misappropriation, or corruption. We also rely on numerous third-party service providers to conduct aspects of our business operations and face similar risks relating to those third parties, including operational disruptions, security weaknesses, delayed incident notification, and supply chain risks. Cyber attacks can originate from a variety of sources, including threat actors affiliated with foreign governments, organized crime, or terrorist organizations. Threat actors may also attempt to place individuals within our company or induce associates, clients, or other users of our systems to disclose sensitive information or provide access to our data, and these types of risks may be difficult to detect or prevent. Cybersecurity incidents among financial services firms are on the rise, and the techniques used in these attacks are increasingly sophisticated, change frequently, and are often not recognized until launched. To date, we have not experienced any cybersecurity incidents that we have determined to be material to our business, financial condition, or results of operations. We maintain a suite of layered information security controls, including cyber threat analytics, data encryption and monitoring technologies, anti-malware defenses, and vulnerability management programs. However, any one or combination of these controls could fail to detect, mitigate, or remediate these risks in a timely manner. Despite our implementation of protective measures and our efforts to modify them as circumstances warrant, our computer systems, software, and networks may remain vulnerable to human error, equipment failure, natural disasters, power loss, unauthorized access, supply-chain attacks, distributed denial-of-service (DDoS) attacks, zero-day vulnerabilities, computer viruses and other malicious code, and other events that could result in significant liability, reputational harm, and ongoing disruption to our operations. In addition, although we maintain cybersecurity insurance as one component of our broader risk-mitigation strategy, coverage is subject to policy terms, exclusions, and limits and may be insufficient to cover all losses, including litigation costs or losses that exceed policy limits or are otherwise excluded. Notwithstanding the precautions we take, a cyber attack or other information security breach could jeopardize confidential information we maintain and could cause interruptions in our operations or those of our clients and counterparties, exposing us to liability. As attempted attacks continue to evolve in scope and sophistication, we may be required to expend substantial additional resources to enhance protective measures, investigate and remediate vulnerabilities or other exposures, or communicate about cyber attacks to our customers and regulators. A technological breakdown could interfere with our ability to comply with financial reporting and other regulatory requirements, potentially resulting in disciplinary action by regulators. In addition, successful cyber attacks at other large financial institutions or market participants, whether or not we are directly affected, could erode confidence in financial institutions generally and in our firm specifically, including perceptions of the effectiveness of our security measures, which could reduce demand for our financial products and services. We maintain incident response, business continuity, and remediation programs designed to mitigate these impacts and to support timely regulatory reporting and recovery. Given our high transaction volumes, remote-work environment, and the large number of clients, partners, and counterparties we serve, a cyber attack could occur. Such an attack may persist for an extended period without detection. Investigations can require substantial time and resources, and there may be significant delays before we obtain complete and reliable information. During an extended investigation, we may not know the full extent of the harm or the optimal remediation path, and certain errors or malicious actions could be repeated or compounded before they are identified and remediated, which could significantly increase the costs and consequences of such an attack. Our Security Operations Center is designed to contain attacks and to support incident investigation and remediation, but notwithstanding these capabilities, detection or remediation may be delayed in some circumstances. We may be subject to liability under various data protection and privacy laws. In providing services to clients, we collect, use, store, and transmit sensitive client and associate information, including personal data, and are subject to an evolving matrix of U.S. federal, state, and international privacy and data-protection laws and regulations, including, where applicable, the Gramm-Leach-Bliley Act (GLBA), the EU General Data Protection Regulation (GDPR), and state consumer privacy laws such as the CCPA/CPRA. These laws and regulations are increasing in complexity and may impose obligations related to data security, breach notification, cross-border data transfers, data subject rights, and recordkeeping. If any person, including an associate or a third-party service provider, negligently disregards or intentionally breaches our controls or otherwise mismanages or misappropriates such data, we could incur significant monetary damages, regulatory enforcement actions, fines, and criminal penalties. Unauthorized disclosure of sensitive or confidential client or associate data, whether through system failure, human error, fraud, or third-party compromise, could damage our reputation, cause loss of clients and related revenue, and expose us to substantial liability. Depending on the circumstances giving rise to a breach, this liability may not be subject to contractual limits or exclusions for consequential or indirect damages. Lapses in our cybersecurity or privacy controls, or regulatory findings that our controls are inadequate, could lead to fines, penalties, or other remediation obligations that would compound monetary losses. We maintain a privacy governance framework that includes a designated privacy lead, a documented data inventory and mapping process, privacy impact assessments for high-risk processing, technical controls, such as encryption and data-loss prevention, and contractual requirements for processors and other third parties to meet our security and privacy obligations. Our incident response and escalation procedures incorporate regulatory notification requirements and roles to support timely reporting and cooperation with regulators. The development and use of AI present risks and challenges that could adversely impact our business, financial condition, and results of operations. We, and our third-party service providers, may develop or incorporate AI technology in certain business processes, products, or services. AI-based technology may produce output that is incorrect, biased, infringes on the intellectual property rights of others, or is otherwise harmful; the complexity of AI can make it challenging to explain why particular outputs occur. In addition, others may use AI to increase the frequency or severity of cybersecurity attacks against us or our service providers, which could adversely affect our business and results of operations. We seek to maintain an AI risk management framework that provides a centralized inventory of AI technologies, risk-based classification, security guardrails, and operational requirements prior to deployment. These frameworks seek to include documented requirements for ongoing monitoring, technical and security controls for AI-enabled capabilities, access and privilege controls, and controls to protect the confidentiality, integrity, and availability of systems and data used to develop, deploy, and operate AI. The Written Information Security Program ("WISP") incorporates AI governance and risk management and is subject to periodic independent assessment. For third-party AI technologies, we seek to require appropriate contractual and assurance measures, including data-handling obligations, intellectual property protections, explainability and validation rights, and incident-notification obligations. AI-related risks are evaluated within our broader cybersecurity, operational resilience, and vendor risk programs. The legal and regulatory environment for AI is evolving and could require changes to our use of AI, limiting our ability to integrate AI or increasing compliance costs. While we maintain policies and governance processes for AI, we cannot guarantee that they will be followed in all cases or that they will prevent all liability or harm arising from AI use. We also rely on numerous third parties, including service providers that utilize cloud technologies to conduct other aspects of our business operations, and we face similar risks relating to them. While we conduct security assessments on these third-party service providers, we cannot be certain that their information security protocols are sufficient to withstand a cyber attack or other security breach. We also cannot be certain that we will receive timely notification of such cyber attacks or other security breaches. In addition, in order to access our products and services, our customers may use computers and other devices that are beyond our security control systems.