Company: CALX
Filing Date: 2025-10-30
Form Type: 10-Q
Source: 0001406666-25-000045
Chunk: 84

Company: CALIX, INC
Filing Date: 2025-10-30
Form: 10-Q
Item: Part I, Item 8
Chunk 84
---
 exploited vulnerabilities in software or hardware that is integrated into our (or our suppliers’ or service providers’) IT Systems, products or services. Threat actors could steal Confidential Information related to our business, products, employees, customers and our customers’ subscribers; hold data ransom; and/or disrupt our systems and services or those of our supply chain partners, vendors, customers or others. We expect cybersecurity attacks and security breaches to accelerate in the future, including sophisticated supply chain attacks. As we and our third-party providers continue to increase our reliance on virtual environments and communications systems and cloud-based solutions to support our work-from-anywhere culture and overall business needs, our exposures to third-party vulnerabilities and security risks also increase. Because threat actors are increasingly sophisticated and aggressive, our efforts may be inadequate to prevent, detect or recover from future attacks due, for example, to the increased use by attackers of tools and techniques (including artificial intelligence) that are specifically designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic evidence. We may also experience security breaches that may remain undetected for an extended period.

We and certain of our third-party providers have been subject to cyberattacks and other security incidents, and we expect such attacks and incidents to continue in varying degrees. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our IT Systems and Confidential Information. Accordingly, while to date no cybersecurity incidents have had a material impact on our operations or financial results, we cannot guarantee that material incidents will not occur in the future. A cyberattack or incident that affects the confidentiality, integrity or availability of our IT Systems or Confidential Information could result in legal claims or proceedings (such as class actions), regulatory investigations and enforcement actions, fines and penalties, negative reputational impacts that cause us to lose existing or future customers, and/or significant incident response, system restoration or remediation and future compliance costs. Even if we and our third-party providers allocate, implement and manage reasonable security and data protection measures, we could still experience significant data loss, unauthorized data disclosure or a breach of our IT Systems, products or those of our third-party providers (for example, data centers) that materially impact our business. The continued growth of our cloud-based platform and managed services portfolio and increased reliance on third-party development partners and third-party software and cloud-based solutions increases the likely risks arising from security breaches or data loss. Any data loss or compromise of our systems that collect and