Company: WSBC
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0000950170-25-030795
Chunk: 153

Company: WESBANCO INC
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1C
Chunk 153
---
Risk Management & Strategy​Wesbanco generally approaches cybersecurity threats through a cross-functional, multi-layered approach, with the specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to Wesbanco; (ii) maintaining the confidence of its customers and business partners; and (iii) preserving the confidentiality of its customers’ and employees’ information.  Wesbanco’s Information Security and Cybersecurity program is integrated into its overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, 

23

compliance, strategic, operational and financial risk areas. The bank also partners with trusted security vendors to enhance incident response capabilities, evaluate framework and compliance assessments, provide continuous monitoring, provide guidance on strategies, evaluate compliance with existing laws and regulations, design and implement cyber policies and procedures, and provide threat intelligence services.   As detailed in Item 1A "Risk Factors - Risks Related to the Use of Technology", third-party technology relationships pose a risk to the organization.  As such, third-party risk management processes are aligned with regulatory requirements and are another key focus area within the bank's enterprise risk management framework. Wesbanco employs a third-party risk management program that includes a systematic evaluation of potential risks associated with engaging third-party vendors, suppliers or partners that may have access to Wesbanco’s sensitive information, systems or networks.  This process is also intended to provide for the security and integrity of Wesbanco’s data that may be stored on third-party systems.  The process identifies and addresses potential security vulnerabilities, safeguarding Wesbanco’s information assets and reducing the overall risk of cyber threats.   Third-party providers are evaluated during onboarding and throughout the ongoing relationship based on the level of risk that the service being provided presents to the organization.  The evaluation process includes a thorough review of operational practices related to cybersecurity and considers factors that impact the protection of bank and customer data.Wesbanco continues to foster a risk averse focus and leverages various threat intelligence sources to continually evaluate current and future risks to the organization.  The bank invests in continuing education of the security team and in technologies that help protect its systems and data. Required security awareness training is provided to all employees to ensure that corporate policies are understood and followed. The bank's cybersecurity strategy and roadmap are frequently evaluated and updated according to multiple inputs including any tangible cybersecurity incidents.  Incident Management and Response is led by a cross functional incident response team that handles critical incidents inclusive of cybersecurity