Company: TENB
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0001660280-25-000034
Chunk: 26

Company: Tenable Holdings, Inc.
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1A
Chunk 26
---
 cause a significant or prolonged outage or security incident, our business could be adversely affected. We may expend significant resources or modify our business activities to try to protect against or recover from security incidents. Certain data privacy and security obligations may require us to implement and maintain specific security measures, industry-standard or reasonable security measures to protect our information technology systems and proprietary, confidential, and sensitive information, including personal data.

Data protection requirements may also require us or we may voluntarily choose to notify relevant stakeholders of security incidents, including affected individuals, partners, collaborators, customers, regulators, law enforcement agencies and others, or take other actions, such as providing credit monitoring and identity theft protection services. Such disclosures and related actions can be costly, and the disclosures or failure to comply with such applicable requirements could lead to adverse consequences.

Additionally, even if we have issued or otherwise made patches or information for vulnerabilities in our software applications, products or services, our customers may be unwilling or unable to deploy such patches and use such information effectively and in a timely manner. Vulnerabilities could be exploited and result in a security incident.

If we, our customers, or a third party upon which we rely, experience or cause a security incident or other interruption, or are perceived to have experienced or caused a security incident or other interruption, we may experience material adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting obligations and/or oversight; restrictions on processing information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; interruptions of our operations (including availability of data); financial loss (including by issuing credits to our customers); diversion of management attention; and other similar harm. Security incidents or other disruptions and attendant material consequences may cause customers to stop using our solutions (including by not renewing their purchases of our solutions), deter new customers from using our solutions, and negatively impact our ability to grow and operate our business.

There can be no assurance that any limitations or exclusions of liabilities in our contracts would be enforceable or adequate or would otherwise protect us from liabilities or damages if we fail to comply with data protection requirements related to information security or security incidents. We cannot be sure that our insurance coverage will be adequate or otherwise protect us from or adequately mitigate liabilities or damages with respect to claims, costs, expenses, litigation, fines, penalties, business loss, data loss, regulatory actions or other impacts arising out of security incidents.

In addition, we face unique risks