Company: BA
Filing Date: 2025-02-03
Form Type: 10-K
Source: 0000012927-25-000015
Chunk: 371

Company: BOEING CO
Filing Date: 2025-02-03
Form: 10-K
Item: Item 1A
Chunk 371
---
 and managed by different parts of the business. This decentralized model exposes us to a variety of risks. For example, integrating and maintaining interoperability across numerous, geographically dispersed systems may result in inefficiencies, increased costs, and operational disruptions. Further, ineffective monitoring or inconsistent policies across systems may result in errors, fraud, or noncompliance with regulatory requirements. Decentralized systems also may increase the risk of unauthorized access, data breaches, or 

14

noncompliance with data privacy laws and other regulatory requirements governing the handling and control of sensitive data.

Compromised or unauthorized access of our, our customers’ and/or our suppliers’ systems or data could negatively impact our business.

We face various cybersecurity threats, including attempts to gain unauthorized access to our systems and networks, denial-of-service attacks, threats to our information technology infrastructure, ransomware and phishing attacks, and attempts to gain unauthorized access to our company-, customer- and employee-sensitive information. These threats come from a variety of actors some of which are highly organized and sophisticated such as nation-state actors and criminal enterprises. In addition, the techniques used in cyberattacks evolve rapidly, including from emerging technologies, such as advanced forms of automation and artificial intelligence. As cyber threats increase in volume and sophistication, the risk to the security of these systems and networks – and to the confidentiality, integrity, and availability of the data they house – continues to evolve, requiring constant vigilance and concerted, company-wide risk management efforts.

A cyber-related attack or security breach, whether experienced directly or through our supply chain or third party-service providers, could, among other serious consequences, result in loss of intellectual property; allow unauthorized access to or cause the publication of various categories of sensitive, proprietary or customer data; cause disruption or degradation of our business operations; compromise our products or services; and/or result in reputational harm. There is no guarantee that our controls, policy enforcement mechanisms, monitoring systems or contractual arrangements will be sufficient to prevent or mitigate the risk of cyber-related attack or incident, or allow us to detect, report or respond adequately in a timely manner.

We have experienced, and may in the future experience, whether directly or through our supply chain, third-party service providers or other channels, cyber-related incidents. While prior cyber-related attacks and incidents (including those at our wholly-owned subsidiaries Boeing Distribution, Inc. in 2023 and Jeppesen, Inc. in 2022) have not materially affected our business strategy, results of operations or financial condition, there is no guarantee that a future cyber-related