Telos (TLS) Risk Analysis

We routinely experience cybersecurity threats, threats to our information technology infrastructure and attempts to gain access to our sensitive information, as do our customers, suppliers, prime and subcontractors, and strategic partners. We experience similar security threats at customer sites that we operate and manage as a contractual requirement. The threats we face vary from attacks common to most industries to more advanced and persistent, highly organized adversaries who target us because we protect national security information. While we have security measures in place to protect our data and the data of our customers or end-users of our services, our services and underlying infrastructure may in the future be materially breached or compromised as a result of the following: - Third-party attempts to fraudulently induce employees, contractors or customers into disclosing sensitive information such as user names, passwords or other information to gain access to our customers' data, our data or our IT systems;- Efforts by individuals or groups of hackers and sophisticated organizations, including state-sponsored organizations or nation-states;- Cyberattacks on our internally built infrastructure;- Vulnerabilities resulting from enhancements and updates to our existing solutions;- Vulnerabilities in the products or components across the broad ecosystem that our services operate in or are dependent on;- Vulnerabilities existing within newly acquired or integrated technologies and infrastructures;- Vulnerabilities existing within third-party software or services that we employ;- Attacks on, or vulnerabilities in, the many different underlying networks and services that power the Internet that our products depend on, most of which are not under our control or the control of our vendors, partners, or customers; and - Employee or contractor errors or intentional acts that compromise our security systems. Although we have developed systems and processes designed to assess, identify, and manage material cybersecurity risks, we can provide no assurances that such systems and processes will provide absolute security. In the normal course of business, we are the target of malicious cyberattack attempts. A security breach or incident could result in unauthorized parties obtaining access to, or the denial of authorized access to, our IT systems or data, or our customers' systems or data, including intellectual property, proprietary, sensitive, or other confidential information. A security breach or incident could result in the unauthorized disclosure of large quantities of our customers' personally identifiable information. A security breach could also result in a loss of confidence in the security of our services, damage our reputation, negatively impact our future sales, disrupt our business and lead to increases in insurance premiums and legal and financial exposure and liability. Finally, the detection, prevention and remediation of known or potential security vulnerabilities, including those arising from third-party hardware or software, may result in additional financial burdens due to additional direct and indirect costs, such as additional infrastructure capacity spending to mitigate any system degradation.