Company: GE
Filing Date: 2025-02-03
Form Type: 10-K
Source: 0000040545-25-000015
Chunk: 80

Company: GENERAL ELECTRIC CO
Filing Date: 2025-02-03
Form: 10-K
Item: Item 1A
Chunk 80
---
 risks or unavailability of equipment. In addition, given the nature of complex systems, software and services like ours, and the scanning tools that we deploy in relation to our networks, infrastructure and products, we regularly identify and track security vulnerabilities. We are not always able to comprehensively apply patches or mitigating measures or ensure that patches are applied before vulnerabilities can be exploited.  We also have access to sensitive, classified, confidential or personal data or information that is subject to privacy and security laws, regulations or customer-imposed controls. We are vulnerable to security breaches, theft, misplaced, lost or corrupted data, programming errors and misconfigurations, employee errors (including as a result of social engineering/phishing) and/or malfeasance (including misappropriation by insiders or departing employees) that may compromise sensitive, classified, confidential or personal data or information, improper use of our systems, software solutions or networks, unauthorized access, use, disclosure, modification or destruction of or denial of access to information, defective products, production downtimes and operational disruptions. In addition, a cybersecurity incident that impacts our partners, suppliers or customers could compromise our systems and impact our intellectual property, personal data or other confidential information, or result in production downtimes and operational disruptions that could cause us to breach our commitments to customers. Any security vulnerability or malicious software in a product used by a partner or supplier to deliver a service or embedded in a product that is later integrated into a GE Aerospace product could lead to a vulnerability in the security of GE Aerospace’s product or, if used internally in our network environment, to a compromise of the GE Aerospace network, which may lead to the loss of information or operational disruptions. 

Cybersecurity-related and data privacy and protection laws and regulatory regimes are evolving, can vary significantly by country and present increasing compliance challenges, and we from time to time receive, and in the future will likely receive, regulatory inquiries about specific incidents or aspects of our cybersecurity framework; these dynamics increase our costs, affect our competitiveness and can expose us to fines or other penalties and reputational risks. In addition, cybersecurity incidents can result in other negative consequences, regardless of whether the direct effects of an incident are significant, including damage to our reputation or competitiveness, restoration and remediation costs, increased digital infrastructure or related costs that are not covered by insurance, and costs or fines arising from litigation or regulatory investigations or actions. While we carry cyber insurance, we cannot be certain that our coverage will be adequate for liabilities actually incurred, that insurance will continue to be available to us