Company: PGYWW
Filing Date: 2025-03-12
Form Type: 10-K
Source: 0001883085-25-000050
Chunk: 169

Company: Pagaya Technologies Ltd.
Filing Date: 2025-03-12
Form: 10-K
Item: Item 1A
Chunk 169
---
 to make such payments due to, for example, applicable laws or regulations prohibiting such payments.

Further, an increase in employees working remotely could increase the risk of a security breach as more of our employees utilize network connections, computers, and devices outside our premises or network, including working at home, while in transit and in public locations. Additionally, future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.

While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. Significant disruptions of our, our Partners’ and third-party service providers’ and/or other business partners’ information technology systems or other similar data security incidents could adversely affect our business operations and result in the loss, misappropriation, or unauthorized access, use or disclosure of, or the prevention of access to, sensitive information, which could result in financial, legal, regulatory, business and reputational harm to us. We take steps designed to detect, mitigate, and remediate vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties upon which we rely). We may not, however, detect and remediate all such vulnerabilities including on a timely basis. Further, we may experience delays in deploying remedial measures and patches designed to address identified vulnerabilities. Vulnerabilities could be exploited and result in a security incident.

We may expend significant resources or modify our business activities to try to protect against security incidents, but our systems, policies and procedures may not be able to adequately keep up with our rapid expansion and may not be adequate or sufficient to mitigate risks. Certain data privacy and security obligations may require us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and sensitive information. In addition, many governments have enacted laws requiring companies to notify individuals of data security breaches involving their personal data. These mandatory disclosures regarding a security breach are costly to implement and often lead to widespread negative publicity following a breach, which may cause our Partners’ customers and potential customers to lose confidence in the effectiveness of our data security measures related to our AI technology and business. Any security breach, whether actual or perceived, would harm our reputation and ability to