Company: AXS-PE
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001214816-25-000056
Chunk: 248

Company: AXIS CAPITAL HOLDINGS LTD
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 248
---
 other data security breaches to our systems or networks. Moreover, we may be unable to anticipate these threats or react in a timely manner. As these threats continually evolve, we may be required to devote substantial additional resources to modify or enhance our information security systems and networks and our cybersecurity program.

While we generally perform cybersecurity diligence on our key service providers, we do not control our service providers and our ability to monitor their cybersecurity is limited. Some of our service providers may store or have access to our data and may not have effective controls, processes, or practices to protect our information from loss, unauthorized disclosure, unauthorized use or misappropriation. A vulnerability in our service providers’ software or systems, a failure of our service providers’ safeguards, policies or procedures, could result in a cyberattack or other data security incident which could harm our business.

While we have not experienced a material cybersecurity incident, to the extent any such incident results in a loss or damage to our data, or inappropriate disclosure of our confidential, personal, proprietary or other information or that of others, it could impact our operations, cause significant damage to our reputation, affect our relationships with our customers and clients, lead to claims against us under various data privacy laws, result in regulatory action, fines, damages, injunctions, or penalties and ultimately have a material adverse effect on our business or operations. 

We also operate in a number of jurisdictions with strict data protection privacy, cybersecurity and other related laws, which could be violated in the event of a cybersecurity incident, or by personnel. Failure to comply with these obligations, including a failure to make adequate or timely disclosure to the public, regulators, or law enforcement agencies following any such incident, can give rise to monetary fines and other penalties that could be material.

Our business may be adversely affected if third-party service providers fail to satisfactorily perform certain technology and business process functions.

We outsource certain technology and business process functions to third parties. If we do not effectively develop and implement our outsourcing strategy, or if third-party service providers do not perform as anticipated or we experience technological or other problems with a transition to a third-party service provider, we may not realize productivity improvements or cost efficiencies and may experience operational difficulties, increased costs and a loss of business. In addition, our outsourcing of certain technology and business process functions to third parties may expose us to enhanced risk related to data security, which could result in monetary and reputational damages. In addition, our ability to receive services from third-party providers could be impacted by political instability or unanticipated regulatory