Company: KEY-PI
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000091576-25-000038
Chunk: 182

Company: KEYCORP /NEW/
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1A
Chunk 182
---
 of one or more financial parties or service providers in the financial system could have a material impact on counterparties or market participants, including us. Such incidents could also lead to widespread technology outages, interruptions or other failures of operational, communication, or other systems globally and across companies and industries. Any third-party technology failure, cyberattack, or security breach could adversely affect our ability to effect transactions, service clients, or otherwise operate our business and could result in legal liability, remediation costs, regulatory action, or reputational harm. Additionally, the increasing use of third-party financial data aggregators and emerging technologies, including the use of automation, artificial intelligence and robotics, introduces new information security risks and exposure for us and for our third party service providers, and, additionally, such technologies may be used to identify vulnerabilities; such technologies have resulted in a substantial increase in the volume and sophistication of cyberattacks against financial and other institutions, including the use of generative artificial intelligence to conduct more sophisticated social engineering attacks.  Such security attacks can originate from a wide variety of sources/malicious actors, including, but not limited to, persons who constitute an insider threat, who are involved with organized crime, or who may be linked to terrorist organizations or hostile foreign governments. Those same parties may also attempt to fraudulently induce employees, customers, or other users of our systems to disclose sensitive information in order to gain access to our data or that of our customers or clients through social engineering, phishing, mobile phone malware and SIM card swapping, and other methods. Our security systems, and those of the third-party service providers on which we rely, 

33

may not be able to protect our information systems or data from similar attacks due to the rapid evolution and creation of sophisticated cyberattacks. We are also subject to the risk that a malicious actor or our employees may intercept and/or transmit or otherwise misuse unauthorized personal, confidential, or proprietary information or intellectual property. An interception, misuse, or mishandling of personal, confidential, or proprietary information or intellectual property being sent to or received from a customer or third party could result in legal liability, remediation costs, regulatory action, and reputational harm.

We have incurred and will continue to incur significant expense in an effort to improve the reliability and resilience of our systems and their security against internal and external threats. Nonetheless, we cannot guarantee our measures will be effective or sufficient to prevent a cyber incident, and there remains the risk that one or more adverse events might occur. If one does occur, it could go undet