Company: BLND
Filing Date: 2025-03-13
Form Type: 10-K
Source: 0001855747-25-000017
Chunk: 119

Company: Blend Labs, Inc.
Filing Date: 2025-03-13
Form: 10-K
Item: Item 1C
Chunk 119
---
 defines key risk objectives and if cybersecurity risk exceeds defined thresholds, such risks are documented and escalated into the enterprise risk program and Blend’s internal audit team. We contractually obligate third-party service providers with access to our systems or processing sensitive data on our behalf to align with our cybersecurity objectives and adhere to industry best practices. We re-evaluate each such service provider at least annually and when the role or purpose of a service provider changes, and have processes to require service providers maintaining sensitive data on our behalf to delete such data upon contract termination.  We engage assessors or other third-party service providers in connection with our risk assessment and cybersecurity assessment or audit processes. These service providers assist us to evaluate risks and identify where our current security program may be improved.  We consult with these service providers as required to verify mitigation approaches, to compare Blend’s security posture against industry peers, and to provide overall feedback for the security program. Additionally, we utilize outside service providers, as well as a bug bounty program, to penetration test our network infrastructure and applications and provide prioritized security vulnerability findings reports. Some Blend customers also perform annual security testing on Blend’s infrastructure and applications.Like other technology companies, we have experienced cybersecurity incidents in the past. We have not, however, been materially impacted by any previous cybersecurity incidents. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, “Risk Factors,” in this Annual Report on Form 10-K,including the risk factors entitled “Risks Related to Our Business and Operations: A cyberattack, security breach, or incident affecting us or the third parties we rely on or partner with could expose us or our customers and consumers to a risk of loss or misuse of confidential information and have an adverse effect on our reputation, brand, business, financial condition, and results of operations.”

Governance

One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function through the Audit Committee.Our Information Security Officer and our cybersecurity team (which consists of our security policy manager, security operations manager, and red team lead) are primarily responsible for