Company: CTTRF
Filing Date: 2025-04-30
Form Type: 20-F
Source: 0001292814-25-001765
Chunk: 44

Company: Controladora Vuela Compania de Aviacion, S.A.B. de C.V.
Filing Date: 2025-04-30
Form: 20-F
Item: Item 3
Chunk 44
---
, and process data about customers, employees,
business partners and others, including Personal Information, as well as proprietary information belonging to our business such as trade
secrets (collectively, “ Confidential Information”). We face constants cybersecurity threats he confidentiality, integrity
and availability of our IT Systems and Confidential Information, which could impose material financial losses and reputational harm due
to equipment failures and operational disruptions, among other things.

The continued spread, sophistication and destructiveness of
cyberattacks involving critical infrastructure, particularly as remote working and automation increase, may affect our ability to operate
our networks and as a result of such events, even for a limited period of time, may result in significant expenses or loss of market share
to other airlines. The increasing reliance on remote work, automation, and artificial intelligence further introduces new cybersecurity
risks, some of which may not yet be fully understood or mitigated. Moreover, any integration of artificial intelligence in our or any
service providers’ operations, products or services is expected to pose new or unknown cybersecurity risks and challenges.

Cyber threats - including malware, ransomware, computer
viruses, phishing denial-of-service attacks, and other advanced techniques - have grown in frequency, sophistication, and severity.
Threat actors are increasingly leveraging artificial intelligence and other evolving technologies to bypass security controls, evade detection,
and erase forensic evidence, making it more challenging to identify, investigate, and remediate cyber incidents. Additionally, cyber risks
arise from vulnerabilities in open-source or commercial software integrated into our IT Systems or those of our suppliers and service
providers. Despite ongoing efforts to monitor, identify, and remediate security vulnerabilities, the complexity and scale of modern IT
environments make it impractical to eliminate all risks. While we constantly experience cyber threats, attacks, and incidents (such as
phishing and social engineering attacks, denial-of-service attacks, ransomware attempts, and attacks and breaches experienced by our third-party
services providers), to date, no incidents have had a material impact on our operations or financial results; however, we cannot guarantee
that future cyber threats and incidents will not result in material adverse effects on our operation or financial results.

  34  

  Table of Contents  

As a result, we may be unable to detect, investigate, remediate
or recover from future attacks or incidents, or to avoid a material adverse impact to our IT Systems, Confidential Information or business.
We implement cybersecurity measures, policies, and controls designed to mitigate these risks and protect our IT Systems and Confidential
Information