Company: PCOR
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001628280-25-008121
Chunk: 47

Company: PROCORE TECHNOLOGIES, INC.
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 47
---
 attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our IT systems (including our products, services, and platform) or the third-party IT systems that support us and our services. 

While we have implemented security measures designed to help protect against security incidents, there can be no assurance that these measures are or will be effective. Although we take certain steps to detect, mitigate, and remediate various vulnerabilities in our IT systems (such as our hardware and/or software, including that of third parties with which we work, and those used to operate our products), doing so takes significant time and resources and we are not able to detect, and have not been able to remediate, all vulnerabilities in our IT systems (including those that operate our products and those that are used to provide our services). 

Additionally, our business depends upon the appropriate and successful implementation of our services by our customers. If our customers fail to use our service according to our specifications, our customers may suffer a security incident on their own systems or other adverse consequences. Even if such an incident is unrelated to our security practices, it could result in our incurring significant economic and operational costs in investigating, remediating, and implementing additional measures to further protect our customers from their own vulnerabilities, as well as in reputational harm.

For several reasons, including the introduction of new vulnerabilities, resource constraints, competing business demands, dependence on third parties, and technological challenges, a large number of high and critical unremediated vulnerabilities exist in our IT systems and will exist until our remediation efforts are completed. We have taken, and are taking, steps designed to mitigate these vulnerabilities in a prioritized manner based on our assessment of the risk posed by such vulnerabilities. Despite our efforts, there can be no assurance that these vulnerability mitigation measures will be effective. Moreover, we have experienced delays 

27

in developing and deploying remedial measures and patches designed to address any identified vulnerabilities. Vulnerabilities could be exploited and result in a security incident.

Any of the previously identified or similar threats could cause a security incident or other interruption. A security incident or other interruption could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or IT systems, or those of the third parties with which we work (