Company: EVLVW
Filing Date: 2025-11-13
Form Type: 10-Q
Source: 0001805385-25-000017
Chunk: 34

Company: Evolv Technologies Holdings, Inc.
Filing Date: 2025-11-13
Form: 10-Q
Item: Part I, Item 3
Chunk 34
---
 data and confidential or proprietary information (our own or that of third parties, including personal data of our customers, our customers’ visitors and our employees) and the disruption of our business operations. 

In fact, we and our third-party vendors have experienced, and expect to continue to experience, cyber-attacks, such as through phishing scams and ransomware attempts. Although none of these actual or attempted cyber-attacks has had a material adverse impact on our operations or financial condition, we cannot guarantee that any such incidents will not have such an impact in the future. 

Due to concerns about data security and integrity, a growing number of legislative and regulatory bodies have adopted breach notification and other requirements in the event that information subject to such laws is accessed by unauthorized persons and may continue to adopt additional regulations regarding the use, access, accuracy, and security of such data. For example, in the United States, we are subject to laws in all states and numerous territories that require notification of a qualifying data breach. In addition, the SEC has recently adopted rules on the Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies that enhances and standardizes disclosures for public companies with regards to their cybersecurity risk strategy, management, and governance. Complying with such numerous and complex regulations in the event of unauthorized access would be expensive and difficult, and failure to comply with these regulations could subject us to regulatory scrutiny and additional liability. See – 

41

“We are subject to government regulation and other legal obligations, particularly related to privacy, data protection, information security, and product marketing and our actual or perceived failure to comply with such obligations could harm our business.”

In addition, any actual or alleged security breaches could result in mandated user notifications, litigation (including class actions), government investigations, regulatory action, significant fines, and expenditures; divert management’s attention from operations; deter people from using our platform; damage our brand and reputation; and materially and adversely affect our business, results of operations, and financial condition. Defending against claims or litigation based on any security breach or incident, regardless of their merit, would be costly and may cause reputational harm. In addition, we may incur significant costs for remediation that may include liability for stolen assets or information, repair of system damage, and compensation to customers, employees, and business partners. The successful assertion of one or more large claims against us that exceed available insurance coverage, denial of coverage as to any specific claim, or any change or cessation in our insurance policies and coverages, including premium increases or the