Company: PCOR
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001628280-25-008121
Chunk: 48

Company: PROCORE TECHNOLOGIES, INC.
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 48
---
including our customers). A security incident or other interruption could disrupt our ability, and that of third parties with which we work, to provide our products, services, and platform. Our current security measures may be insufficient to prevent or deter such incidents or interruptions. We expend significant resources and have modified our business activities to try to protect against security incidents. Certain data privacy and security obligations have required us to implement and maintain security measures or industry-standard or reasonable security measures to protect our IT systems and sensitive information.

In addition, business transactions, such as acquisitions or integrations, have exposed us to these same or additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. Furthermore, we have discovered security issues that were not found during due diligence of such acquired or integrated entities, and it has been and may continue to be difficult to integrate companies into our IT environment and security program.

Applicable data privacy and security obligations, including data breach laws and contractual obligations to various customers, may require us to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents. For example, SEC rules require disclosure on Form 8-K of the material aspects of the nature, scope, and timing of any material cybersecurity incident and the material impact or reasonably likely material impact of such incident. Determining whether a cybersecurity incident is notifiable or material may not be straightforward, and any such disclosures could be costly and could lead to negative publicity, loss of customer or partner confidence in the effectiveness of our security measures, diversion of management’s attention, governmental investigations, and the expenditure of significant capital and other resources to respond to or alleviate problems caused by the actual or perceived security breach.

If we or third parties with which we work experience a security incident or are perceived to have experienced a security incident, we could experience significant consequences, including, but not limited to, government enforcement actions (e.g., investigations, audits, inspections, fines, and penalties), litigation (including class-related claims), additional reporting requirements and oversight, restrictions or bans on processing sensitive information (including personal data and sensitive third-party and customer data), loss of revenue or profits, loss of customers or sales, interruptions or stoppages in or modifications to our operations (including availability of data), indemnification obligations, negative publicity, and reputational harm. Security incidents and attendant consequences may also cause customers to stop using our products, services, and platform (including by declining to renew their subscriptions), deter new customers from using our products, services