Company: BCS
Filing Date: 2025-02-13
Form Type: 20-F
Source: 0000312069-25-000114
Chunk: 386

Company: BARCLAYS PLC
Filing Date: 2025-02-13
Form: 20-F
Chunk 386
---
 adherence to, the Group's cybersecurity policies, procedures or controls; failure to keep pace with evolving technology; instances of employee negligence, recklessness, malfeasance, poor password management, or susceptibility to social engineering; misconfigurations in technology and security infrastructure; authentication and access management

| Strategy                                         | Shareholderinformation | Climate andsustainability report | Governance |     | Riskreview | Financialreview | Financialstatements |     | Barclays PLC 2024Annual Reporton Form 20-F | 203 |
| Material existing and emerging risks (continued) |                        |                                  |            |     |            |                 |                     |     |                                            |     |

lapses; imperfect control frameworks or operational effectiveness; and human, governance or technological error could also compromise the Group’s ability to successfully prevent and defend against cyberattacks. Furthermore, certain legacy technologies that are at or approaching end-of-life may not be able to maintain acceptable levels of security. The Group's assessment of its cybersecurity risk in 2024 highlighted an elevated cybersecurity risk profile due to factors such as the onset of AI, which may be used to facilitate increasingly sophisticated attacks including AI-enabled social engineering; ongoing work to address areas in need of enhancement identified through cybersecurity testing; bad actors’ increasing ability to elude our defences and take advantage of customer and employee behaviours in novel ways; and geopolitical turmoil that could impact the Group directly, or indirectly through its critical suppliers or national infrastructure including escalating conflicts in Eastern Europe and the Middle East. Certain cybersecurity risks to the Group may be unknown to management and therefore not fully accounted for in the Group's cybersecurity assessments, strategy and programme priorities. For example, we continue to implement enhancements identified through cybersecurity testing and reviews in 2024. Common types of cyberattacks include deployment of malware to obtain covert access to systems and data; ransomware attacks that render systems and data unavailable through encryption and attempts to leverage business interruption or stolen data for extortion; novel or zero- day exploits; denial of service and distributed denial of service attacks; infiltration via business email compromise; social engineering, including phishing, vishing and smishing; automated attacks using botnets; third-party customer, vendor, service provider and supplier account takeover; malicious activity facilitated by an insider; and credential validation or stuffing attacks using login and password pairs from unrelated breaches. A successful cyberattack of any type has the potential to cause serious harm to the Group or its clients and customers, including exposure to potential contractual liability, claims, litigation, regulatory or other government action, loss of existing or potential customers, damage