Company: TFC
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0000092230-25-000020
Chunk: 90

Company: TRUIST FINANCIAL CORP
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1A
Chunk 90
---
, proprietary, or other sensitive information, including personal information. Such incidents could also damage the Company’s systems and networks by introducing material disruptions to the network access or business operations of the Company, its clients, or other third parties.

In addition, Truist’s clients, regulators, and other third parties, including other financial services institutions and companies engaged in data processing, have been subject to and will continue to be the target of cyberattacks and other similar incidents. The Company also faces cybersecurity risks relating to partners and other third parties that the Company relies upon to facilitate or enable business activities, including vendors, service providers, and providers of critical infrastructure such as internet access and electrical power. While the Company performs cybersecurity due diligence on its vendors and service providers, the Company does not control its vendors or service providers and its ability to monitor their cybersecurity is limited. Therefore, the Company cannot ensure that the cybersecurity measures they take will be sufficient to protect information the Company shares with them or prevent disruption arising from a cyberattack. In addition, the existence of cyberattacks or security breaches at third-party vendors and service providers with access to the Company’s data and systems may not be disclosed to the Company in a timely manner.

Cybersecurity risks for financial institutions have significantly increased in recent years and will likely continue to increase, in part because of the proliferation of new technologies to facilitate and conduct financial transactions. In addition, cybersecurity risks have significantly increased in recent years in part due to the increased sophistication and activities of organized crime affiliates, terrorist organizations, hostile foreign governments, state-sponsored actors, disgruntled teammates or vendors, hackers, activists, and other external parties, including those involved in corporate espionage, any of which may see their effectiveness enhanced by the use of AI, including the use of generative AI to conduct more sophisticated social engineering attacks on the Company or its clients. Even the most advanced internal control environment may be vulnerable to compromise. Persistent attackers may succeed in penetrating defenses given enough resources, time, and motive. The techniques used by cybersecurity threat actors change frequently and may not be recognized until launched or well after a breach has occurred. 

A successful penetration or circumvention of system or network security could cause serious negative consequences, including loss of clients and business opportunities; costs associated with maintaining business relationships after a cyberattack or security breach; significant disruption to the Company’s operations and business; misappropriation, exposure or destruction of the Company’s confidential, proprietary, and other sensitive information, including personal information, and funds and those of the Company’s clients; damage to the