Company: BBVXF
Filing Date: 2025-02-21
Form Type: 20-F
Source: 0000842180-25-000010
Chunk: 313

Company: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Filing Date: 2025-02-21
Form: 20-F
Item: Item 16K
Chunk 313
---
, improved analytical capabilities and automated platforms, improving information security management from a preventive and proactive approach. 
Additionally, and with the aim to ensure that security is embedded in business processes, the security management model has been reinforced in the software development lifecycle process and in infrastructure, architecture and operations management.
The Global Computer Emergency Response Team (“CERT”) is the Group’s first line of detection and response to cyberattacks aimed at global users and the Group’s infrastructure. The Global CERT, which is based in Madrid, operates 24x7 and provides services in all countries where the Group operates, with operation lines dedicated to fraud and cybersecurity. The Global CERT receives information on cybersecurity threats from our Threat Intelligence Unit. Both of them are part of the Corporate Security Area.
BBVA routinely reviews, reinforces and tests its security processes and procedures through simulation exercises in the areas of physical security and digital security. Specialized teams periodically perform security technical tests in order to detect and correct possible security vulnerabilities. These tests include technical tests of technological platforms as well as malicious users’ simulated attacks performed by the “red team”. The outcome of such exercises is a fundamental part of a feedback process designed to improve the Group’s cybersecurity strategies. Both the Corporate Security Area and the Risk Control Area engage third-party security experts for risk assessments and system enhancements. 
BBVA is working on the development of new artificial-intelligence and machine-learning models that enable the prediction and prevention of cyberattacks on financial infrastructure, providing a more secure client experience. BBVA’s Threat Intelligence Area has been reinforced in 2023 and 2024, adopting measures directed at transforming detailed technical information into actionable intelligence information that can be used to make decisions related to risk management. The Threat Intelligence Area continuously monitors threats that affect the financial sector and analyses risk trends with the aim to implement measures to minimize the risks the Group is exposed to. Analysis performed includes not only security trends but also the type, frequency and origin of attacks on systems and information.
In addition, BBVA continuously carries out training and awareness initiatives related to security and privacy, promoting training and awareness campaigns for BBVA’s employees, clients and society, through the BBVA app, online channels and social networks. Some of the topics covered include protection of personal information, secure password management, device protection (laptops, smartphones, etc.), social engineering (phishing, smishing, vishing), malware and other technical attacks detection, detection of scams, security on online purchases and how to react if there is a security incident. 
BBVA’s cybersecurity strategy is based on internationally