Company: PENG
Filing Date: 2025-10-21
Form Type: 10-K
Source: 0001616533-25-000061
Chunk: 40

Company: Penguin Solutions, Inc.
Filing Date: 2025-10-21
Form: 10-K
Item: Item 1A
Chunk 40
---
 cybersecurity technology company, caused widespread crashes of Windows systems into which it was integrated. Although we have not experienced any material impacts as a result of the CrowdStrike software update, we have and expect to continue in the future to experience other third-party software- and service-related incidents and/or operational disruptions, which may materially affect our business, results of operations and financial condition.

Cyberattacks are expected to accelerate on a global basis in both frequency and magnitude as threat actors are becoming increasingly sophisticated in using techniques and tools (including AI) that circumvent controls, evade detection and even remove forensic evidence. Further, the use of AI technologies by us, our customers, suppliers, and third-party service providers, among others, introduces unique and/or unknown vulnerabilities. As a result, there can be no assurance that the systems we have designed to protect against cyberattacks, or our cybersecurity risk management program and processes, will be fully implemented, complied with or sufficient to identify, detect or prevent material consequences arising from such attacks in the future. In addition, we have acquired and continue to acquire companies with cybersecurity vulnerabilities and/or unsophisticated security measures, which exposes us to significant cybersecurity, operational, and financial risks.

The costs to address product defects or any of the foregoing security problems and security vulnerabilities before or after a cyber incident could be significant. Remediation efforts may not be successful and could result in interruptions, delays or cessation of service and loss of existing or potential customers that may impede our sales, manufacturing, distribution or other critical functions. We could lose existing or potential customers for outsourcing services or other information technology solutions in connection with any actual or perceived security vulnerabilities in our products. In addition, breaches of our IT Systems or security measures and the unapproved dissemination of proprietary information or sensitive or confidential data about us or our customers or other third parties could expose us, our customers or other third parties affected to a risk of loss or misuse of this 

27

information, result in regulatory enforcement, litigation and potential liability, damage our brand and reputation or otherwise harm our business. Further, we rely in certain limited capacities on third-party data management providers and other vendors whose own security vulnerabilities or problems may have similar detrimental effects on us.

Actual or perceived non-compliance with applicable data privacy and security laws, or that of our customers, suppliers or business partners, could expose us to losses.

We are subject to laws, rules and regulations in the United States and other countries relating to the collection, use, transmission, processing and security of user and other data. Our ability to