Company: EME
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0000105634-25-000015
Chunk: 40

Company: EMCOR Group, Inc.
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 40
---
 policies may not completely provide coverage for, or completely offset, the costs associated with such incidents, including losses from delays in our ability to provide services to our customers, reputational harm, or the costs to improve security against future similar threats. We are continuously developing and enhancing our controls, processes, and practices designed to protect our systems, computers, software, data, and networks from attack, damage, or unauthorized access. This continued development and enhancement requires us to expend additional resources. However, we may not anticipate or combat all types of potential disruptions or breaches. Threats are continually evolving and threat actors may adopt new or different means of breaching our information technology systems and data, including the potential use of artificial intelligence (“AI”) tools to engage in automated, targeted, and coordinated attacks. As cybersecurity threats become more sophisticated and difficult to detect, our ability to promptly prevent, detect and mitigate the effects of cybersecurity incidents may be impacted, potentially resulting in more material adverse effects. As such threats increase in frequency and sophistication, we could be required to expend additional capital and other resources, including costs to deploy additional personnel and protection technologies, train employees, and engage third-party experts and consultants. Additionally, as many of our employees use our information technology systems to collaborate with colleagues in different geographic locations and access our systems and those of our customers remotely, we and our customers may be subject to heightened security risks, including the risks of cyber-attacks. For additional information on our strategy and processes for assessing, identifying, and managing the risks posed by cybersecurity threats, and the management and oversight of such efforts, refer to Part I, Item 1C. Cybersecurity.

The proper functioning of our information technology systems could also be impacted by other causes and circumstances beyond our control, including malware embedded in third-party applications, the decision by software vendors to discontinue further development, integration, or long-term software maintenance support for our information systems, or hardware interruption, damage or disruption as a result of power outages, natural disasters, or computer network failures. Errors or other defects in the design or implementation of hardware or software applications by our employees or third-party providers could also disrupt our networks, information systems or data. System redundancy may be ineffective or inadequate, and the Company’s disaster recovery and business continuity planning may not be sufficient to address all potential cybersecurity incidents or other disruptions. We may also utilize new information technology tools, including AI tools, in certain business functions, and such tools could be subject to malfunction, security vulnerabilities, or algorithmic flaws (including AI generation of false