Company: INFY
Filing Date: 2025-07-01
Form Type: 20-F
Source: 0000950170-25-091925
Chunk: 29

Company: Infosys Ltd
Filing Date: 2025-07-01
Form: 20-F
Item: Item 3
Chunk 29
---
 of certain applications and systems.

Cyber threats evolve rapidly, and there have in the past and could in the future be a scenario where we are unable to adapt our threat detection and prevention measures to detect or prevent new, modified, or evolving threats on an ongoing basis.

We and our third-party service providers have in the past and may in the future suffer cybersecurity breaches and other information security incidents due to a multitude of factors, including one or more of the following:
•insider threats;
•hackers and other state or non-state actors with an intent to cause harm to us or our clients 

 

(including, for example, our government clients and our clients in sensitive industry segments such as financial services, insurance, energy, utilities or healthcare);
•technological error or human error and inadvertent actions by our employees and contractors;
•malware, ransomware, viruses, worms, and similar threats, including the potential for infection spreading between environments;
•increased threat and attack surface due to a hybrid work model and emergence of the metaverse;
•vulnerability of the security automation system to attacks; and
•malicious use of AI leading to the industrialization of tailored, high volume, high-impact cyberattacks, leaving organizations overwhelmed and unable to operate effectively.

We believe the risks presented by cybersecurity breaches and other information security incidents will increase as we scale, grow our cloud-based offerings and services and AI-powered enterprise transformation, store and process increasingly large amounts of our clients’ data and host or manage parts of our clients’ businesses, especially in industries involving sensitive data such as the financial services, energy, utilities and healthcare industries. In addition, with increased dependence on cloud vendors, any consequential large-scale failure in their security, coupled with difficulties of porting data from one vendor to another, may jeopardize our and our clients’ business continuity. By virtue of our business presence across continents, any alleged or actual non-compliance with our obligations relating to cybersecurity and information security in any applicable jurisdictions could lead to regulatory investigations, claims, litigation, and significant damages, fines, penalties, and other liability.
Cybersecurity breaches and other data security incidents have in the past and could in the future have an adverse impact on our business, operations, financial performance, and reputation especially in cases where critical systems, or numerous systems, are unavailable or otherwise impacted, resulting in partial to complete disruption of intended business delivery, or due to unauthorized access to, or the loss, corruption, or theft of, intellectual property, personal data, or sensitive information.