Company: ZM
Filing Date: 2025-11-25
Form Type: 10-Q
Source: 0001585521-25-000202
Chunk: 23

Company: Zoom Communications, Inc.
Filing Date: 2025-11-25
Form: 10-Q
Item: Part I, Item 3
Chunk 23
---
  In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or that of the third      parties with whom we work supply chains have not been compromised.

If our security measures are compromised, as has occurred in the past, our reputation could be damaged; our data, information or intellectual property, or that of our customers, may be destroyed, stolen, or otherwise compromised; our business may be harmed; and we could incur significant liability. We take steps designed to detect and remediate vulnerabilities in our information systems and those of third parties with whom we work, but we may not detect or remediate all such vulnerabilities or do so in a timely manner. The threats and techniques used to exploit vulnerabilities change frequently and are often sophisticated in nature, and may be difficult to detect by security tools. Vulnerabilities could be exploited and result in a security incident.  We have limited budgetary and human resources for detecting and remediating vulnerabilities and have 

47

experienced difficulties in hiring and retaining qualified security personnel, especially after our recent restructuring actions.  We may experience delays in developing and deploying remedial measures, including patches, designed to address identified vulnerabilities, and our remedial measures may require action by our customers such as installing patches or updates, which may increase the amount of time a vulnerability remains unremediated. We have not always been able in the past and may be unable in the future to anticipate or prevent threats or techniques used to detect or exploit vulnerabilities in our information systems or third-party software, or obtain unauthorized access to or compromise our systems. 

In addition, security researchers and other individuals have in the past and will continue in the future to actively search for and exploit actual and potential vulnerabilities in our software or services. This activity may increase because of increased demand for our services and increased media scrutiny of our unified communications and collaboration platform, and can lead to additional adverse publicity, reputational harm, extortion threats, business and operational interruptions, security incidents, additional expenses, litigation, regulatory investigations and actions, and substantial harm to our business, some of which we have experienced. For example, in July 2019, a security researcher published a blog highlighting concerns with the Zoom Meeting platform, including certain video-on features. We were able to release updates to the software addressing these vulnerabilities, and we are not aware of any customers being affected or meetings compromised by these vulnerabilities. In most cases, customers are responsible for installing this update to the software, and their software is subject to these