Company: PENG
Filing Date: 2025-10-21
Form Type: 10-K
Source: 0001616533-25-000061
Chunk: 39

Company: Penguin Solutions, Inc.
Filing Date: 2025-10-21
Form: 10-K
Item: Item 1A
Chunk 39
---
 and to fraudulently induce employees, customers and other third parties to disclose information or unwittingly provide access to systems or data. The risk of such attacks includes attempted breaches not only of our own products, services and systems, but also those of customers, contractors, business partners, vendors and other third parties.

Our products, services and systems may be used in critical company, customer, government or other third-party operations, or involve the storage, processing and transmission of sensitive data, including valuable intellectual property, classified information, other proprietary or confidential data, regulated data and personal information of employees, customers and others. In our on-demand and hosted solutions, we process, store and transmit data provided by our customers, which may include sensitive and personal data. We also manage, store, transmit and otherwise process various sensitive personal or confidential data related to our company and our employees in the regular course of business. Successful breaches, employee malfeasance or human or technological error could materially impact our business due to, for example, unauthorized access to, disclosure, modification, misuse, loss or destruction of company, customer, government or other third party data or systems; theft of sensitive, regulated, classified or confidential data including personal information and intellectual property; the loss of access to critical data or systems through distributed denial-of-service attacks, denial-of-service attacks, ransomware attacks, supply chain attacks, destructive attacks or other means; and business delays, service or system disruptions or denials of service. Further, hardware and operating system software and applications that we produce or procure from third parties may contain significant defects in design or manufacture, including “bugs” and other problems that could materially disrupt the operation of such systems. Given the nature of complex systems, software and services like ours, and the scanning tools that we deploy across our networks, infrastructure and products, we regularly identify and track security vulnerabilities. We are unable to comprehensively guarantee patches or confirm that measures are in place to mitigate all such vulnerabilities, or that patches will be applied before vulnerabilities are exploited by a threat actor. If attackers are able to exploit critical vulnerabilities before patches are installed or mitigating measures are implemented, significant compromises could materially impact our and our customers’ systems and data.

The information technology systems we and our vendors use are vulnerable to outages, breakdowns or other damage or interruption from service interruptions, system malfunction, natural disasters, terrorism, war, and telecommunication and electrical failures. For example, in July 2024, a software update by CrowdStrike Holdings, Inc. (“CrowdStrike”), a