Company: CALX
Filing Date: 2025-07-22
Form Type: 10-Q
Source: 0001406666-25-000035
Chunk: 135

Company: CALIX, INC
Filing Date: 2025-07-22
Form: 10-Q
Item: Part I, Item 2
Chunk 135
---
 of our cloud services and by relying on our and our providers’ IT Systems. We also engage third-party providers to support various internal functions, such as human resources, finance, information technology and electronic communications, as well as the development and delivery of our customer-facing products and cloud services, which includes collecting, handling, processing and/or storage of data on our behalf. These internal and external functions involve an array of software and systems, including cloud-based, that enable us to conduct, monitor and/or protect our business, operations, systems and information technology assets. Our cloud-based solutions enable us to host our customers’ subscriber data in third-party data centers.

We face numerous and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our IT Systems and Confidential Information, including from diverse threat actors such as state-sponsored organizations, opportunistic hackers and hacktivists, as well as through diverse attack vectors such as social engineering/phishing, malware (including ransomware), 

31

Table of Contents

malfeasance by insiders, human or technological error and, as a result of malicious code embedded in open-source software, bugs, misconfigurations or exploited vulnerabilities in software or hardware that is integrated into our (or our suppliers’ or service providers’) IT Systems, products or services. Threat actors could steal Confidential Information related to our business, products, employees, customers and our customers’ subscribers; hold data ransom; and/or disrupt our systems and services or those of our supply chain partners, vendors, customers or others. We expect cybersecurity attacks and security breaches to accelerate in the future, including sophisticated supply chain attacks. As we and our third-party providers continue to increase our reliance on virtual environments and communications systems and cloud-based solutions to support our work-from-anywhere culture and overall business needs, our exposures to third-party vulnerabilities and security risks also increase. Because threat actors are increasingly sophisticated and aggressive, our efforts may be inadequate to prevent, detect or recover from future attacks due, for example, to the increased use by attackers of tools and techniques (including artificial intelligence) that are specifically designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic evidence. We may also experience security breaches that may remain undetected for an extended period.

We and certain of our third-party providers have been subject to cyberattacks and other security incidents, and we expect such attacks and incidents to continue in varying degrees. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented,