Company: ROK
Filing Date: 2025-11-12
Form Type: 10-K
Source: 0001024478-25-000116
Chunk: 8

Company: ROCKWELL AUTOMATION, INC
Filing Date: 2025-11-12
Form: 10-K
Item: Item 1A
Chunk 8
---
 infrastructure. 

The current cyber threat environment indicates increased risk for all companies, including those in industrial automation and information technology, and the adoption of AI has resulted in more sophisticated attacks, increasing our risk exposure. Like other global companies, we have experienced cyber threats and incidents, although none have been material or had a material adverse effect on our business or financial condition. Our information security efforts include programs designed to address security governance, compliance, risk management, secure development and engineering, data protection, insider risk, third-party risk, security awareness, access management, incident response, and security operations in support of enterprise security and product security. We believe these measures reduce, but cannot eliminate, the risk of a cybersecurity incident internally or externally. Any significant security incidents could have an adverse impact on sales, harm our reputation, and cause us to incur legal liability and increased costs to address such events and related security concerns.

6

Product and Services Security

Our hardware and software products, services and solutions are used by our customers in applications that may be subject to information theft, tampering, sabotage, or cyber-attacks. Careless or malicious actors could cause a customer’s process to be disrupted or could cause equipment to operate in an improper manner, resulting in harm to people or property. To a significant extent, the security of our customers’ systems depends on how those systems are designed, installed, protected, configured, updated, and monitored, and much of this is typically outside our control. In addition, both software and hardware supply chains can introduce security vulnerabilities into many technologies across the industry. Past global cyber-attacks have also been perpetuated by compromising software updates in widely used software products, posing the risk that vulnerabilities or malicious content could be inserted into our products. In some cases, it is possible that malware attacks could spread throughout the supply chain, moving from one company to the next via authorized network connections. We have designed a Secure Development Lifecycle Program that incorporates appropriate security activities into the necessary development and support practices for our commercial product offerings. The Secure Development Lifecycle Program is audited annually by third-party firms. Our Third-Party Risk Program manages risk posed by our suppliers used in the development of our commercial product offerings. While we continue to improve the security attributes of our commercial product offerings, we can reduce risk, but not eliminate it.

Enterprise Security

Our business uses technology resources across a dispersed, global basis for a variety of functions including development, engineering, manufacturing, sales, accounting and financial reporting, and human resources. Our vendors, partners, employees, and customers have