Company: AX
Filing Date: 2025-08-21
Form Type: 10-K
Source: 0001299709-25-000125
Chunk: 110

Company: Axos Financial, Inc.
Filing Date: 2025-08-21
Form: 10-K
Item: Item 1A
Chunk 110
---
 risks associated with implementing new systems and integrating them with existing ones. Due to the complexity and interconnectedness of information technology systems, the process of enhancing our technical layers of defense can create a risk of systems disruptions and security issues. In addition, addressing certain information security vulnerabilities, such as hardware-based vulnerabilities, may affect the performance of our information technology systems. The ability of our hardware and software providers to deliver patches and updates to mitigate vulnerabilities in a timely manner can introduce additional risks, particularly when a vulnerability is being actively exploited by threat actors. 

The risk that these types of events could seriously harm our business is likely to increase as we add more customers and expand the number of smartphone and internet-based products and services we offer.

We have risks of systems failure and disruptions to operations.

The computer systems, internet connectivity and network infrastructure utilized by us and others could be vulnerable to unforeseen problems. This is true of both our internally developed systems and the systems of our third-party service providers. Our operations are dependent upon our ability to protect critical infrastructure against damage from fire, power loss, telecommunication failure, or other catastrophic events.

25

Any damage or failure that causes an interruption in our operations could adversely affect our business, prospects, financial condition and results of operations.

If our security measures are breached, or if our services are subject to information security incidents that degrade or deny the ability of customers to access our products and services, our products and services may be perceived as not being secure, customers may curtail or stop using our products and services, and we may incur significant legal and financial exposure.

Our products and services involve the storage and transmission of customers’ proprietary information, and security breaches could expose us to a risk of loss of this information, litigation, and potential liability. Through our cybersecurity risk management program, we employ cybersecurity measures that are designed to prevent, detect, and respond to cybersecurity incidents, including management-level engagement and corporate governance, formalized risk management processes, advanced technical controls, incident response planning, frequent vulnerability testing, vendor management, intrusion monitoring, the maintenance of a security awareness program, and established partnerships with appropriate government and law enforcement agencies. These procedures cannot assure we will be fully protected from a cybersecurity incident. Our security measures may be breached due to the actions of organized crime, hackers, terrorists, nation-states, activists and other outside parties, employee error, failure to follow security procedures, malfeasance, or otherwise. As a result, an unauthorized party may obtain access to our data or our customers’ data. In addition, to access our