Company: EVLVW
Filing Date: 2025-08-14
Form Type: 10-Q
Source: 0001805385-25-000009
Chunk: 142

Company: Evolv Technologies Holdings, Inc.
Filing Date: 2025-08-14
Form: 10-Q
Item: Part II, Item 1A
Chunk 142
---
including AI) used to breach security safeguards, circumvent security controls, evade detection, and remove forensic evidence, are constantly evolving and may originate from remote areas increasing the difficulty of detecting and successfully defending against them. For instance, cyber criminals or insiders may target us or third parties with which we have business relationships to gain access to data, or in a manner that disrupts our operations or compromises our products or the systems into which our products are integrated.  Protecting against such threats may require us to spend additional resources to further strengthen our defenses. In addition, events such as power losses, telecommunications failures, earthquakes, fires and other natural disasters could result in failures of our, or our third-party vendors’, systems.

Cybersecurity incidents affecting us or our third-party vendors can vary widely, from errors on the part of our personnel, to uncoordinated individual attempts to gain unauthorized access to IT systems, to sophisticated and targeted 

40

measures known as advanced persistent threats. These incidents could be caused by insiders (acting inadvertently or maliciously) or malicious third parties (including nation-states or nation-state supported actors). Attack methods can include sophisticated, targeted methods to circumvent firewalls, encryption, and other security defenses, including hacking, fraud, trickery (such as phishing or social engineering), or other forms of deception. 

Despite measures designed to prevent, detect, address, and mitigate cybersecurity incidents (including our cybersecurity risk management program and processes, such as our policies, controls, or procedures), we cannot guarantee that such measures will be implemented, complied with or effective in protecting our systems and information. Incidents such as spam, spyware, ransomware, viruses, worms, malware, DDoS attacks, password attacks, impersonation of employees or officers, and other threats may nevertheless occur to us or our third-party providers and, depending on their nature and scope, could potentially result in the misappropriation, destruction, corruption or unavailability of critical data and confidential or proprietary information (our own or that of third parties, including personal data of our customers, our customers’ visitors and our employees) and the disruption of our business operations. 

In fact, we and our third-party vendors have experienced, and expect to continue to experience, cyber-attacks, such as through phishing scams and ransomware attempts. Although none of these actual or attempted cyber-attacks has had a material adverse impact on our operations or financial condition, we cannot guarantee that any such incidents will not have such an impact in the future. 

Due to concerns about data