Company: BL
Filing Date: 2025-11-07
Form Type: 10-Q
Source: 0001628280-25-050628
Chunk: 113

Company: BLACKLINE, INC.
Filing Date: 2025-11-07
Form: 10-Q
Item: Part II, Item 1A
Chunk 113
---
 Such a breach or incident, or series of breaches or incidents, could also result in regulatory or contractual security requirements that could make compliance challenging. Even in the absence of any actual or perceived security breach or incident, customer concerns about privacy, security, or data protection may deter them from using our platform for activities that involve personal or other sensitive information. 

Because the techniques used to obtain unauthorized access or to sabotage systems change frequently, and often are not identified until they are launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative measures. We may also experience security breaches and incidents that may remain undetected for an extended period of time. Periodically, we experience cyber security events including phishing attacks targeting our employees, web application and infrastructure attacks, and other information technology incidents. These threats continue to evolve in sophistication and volume and are difficult to detect and predict due to advances in electronic warfare techniques, advances in cryptography and other technologies including AI/ML, and new and sophisticated methods used by criminals including phishing, social engineering or other illicit acts. We have and may experience security breaches or incidents introduced through the tools and services we use. We continuously monitor our infrastructure, adjust our intrusion detection capabilities, and practice security-by-design principles in our software development lifecycle to help prevent and detect security breaches and incidents, including those relating to tools and services provided by third parties. However, there can be no assurance that our defensive measures will prevent cyber attacks or other security breaches or incidents, or allow us to identify, remediate, or otherwise respond to them in a timely or effective manner. Any such attacks, breaches or incidents, or perception that any have occurred, could damage our brand and reputation and negatively impact our business.

Our customers upload sensitive data to our platform, and data security is therefore a critical competitive factor in our industry. We make numerous statements in our privacy policy and customer agreements, through our certifications to standards and in our marketing materials, providing assurances about the security of our platform, including descriptions of security measures we employ. Should any of these statements be untrue, be perceived to be untrue, or become untrue, even through circumstances beyond our reasonable control, we may face claims of misrepresentation or deceptiveness by the U.S. Federal Trade Commission, state and foreign regulators and private litigants. Our errors and omissions insurance policies covering certain security and privacy damages and claim expenses may not be sufficient to compensate for all potential liability. Although we maintain cyber liability insurance, we cannot be certain that our coverage will be adequate for liabilities actually