Company: CVLT
Filing Date: 2025-05-05
Form Type: 10-K
Source: 0001169561-25-000034
Chunk: 24

Company: COMMVAULT SYSTEMS INC
Filing Date: 2025-05-05
Form: 10-K
Item: Item 1A
Chunk 24
---
 there is an omnipresent need to enhance security measures to protect our systems and data.

Third-party service providers that we may rely on to back up and process our confidential information may also be subject to similar threats. Such threats could result in the misappropriation, theft, misuse, disclosure, loss or destruction of the technology, intellectual property, or the proprietary, confidential or personal information, of us or our employees, customers, licensees, suppliers or partners, as well as damage to or disruptions in our IT systems. These threats are constantly evolving, increasing the difficulty of successfully defending against them or implementing adequate preventative measures. We seek to detect and investigate all cybersecurity breaches or incidents and to prevent their recurrence, but attempts to gain unauthorized access to our IT systems or other attacks may be successful, and in some cases, we might be unaware of an incident or its magnitude and effects.

 Additionally, due to political uncertainty,  our third-party service providers are vulnerable to heightened risks of cybersecurity incidents and security and privacy breaches and incidents caused or initiated by nation-state or affiliated actors, including attacks that could materially disrupt our systems, operations and services, or impact our customers systems, operations, and services. For example, in February and April 2025, Microsoft notified the Company about unauthorized activity within our Azure environment by a suspected nation-state threat actor. As part of the ongoing investigation regarding this activity, the Company immediately activated its incident response plan, issued security advisories, and implemented several advanced security measures, including enhanced rotation of credentials and strengthened security monitoring, among other proactive measures. Similarly, supply chain attacks have increased in frequency and severity, and there have been high-profile incidents of third-party service providers causing widespread disruptions to their customers’ infrastructure due to errors in their SaaS offerings. We cannot guarantee that third parties and infrastructure in our supply chain have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our Commvault Cloud platform, systems and network or the systems and networks of third parties that support us and our business. Moreover, we may have limited remedies against third-party providers in the event of a service disruption.

In addition, any failure to successfully implement new information systems and technologies, or improvements or upgrades to existing information systems and technologies in a timely manner could adversely impact our business, internal controls, results of operations, reputation, and financial condition.

19

We may not be successful in our initiatives that utilize AI, which could adversely affect our business, reputation, or financial results.

There are significant