Company: ISRG
Filing Date: 2025-01-31
Form Type: 10-K
Source: 0001035267-25-000017
Chunk: 200

Company: INTUITIVE SURGICAL INC
Filing Date: 2025-01-31
Form: 10-K
Item: Item 1A
Chunk 200
---
, especially as they relate to attacks on third-party providers or their vendors. Such attacks are often carried out by motivated and highly skilled actors, who are increasingly well-resourced. Techniques used to compromise or sabotage systems, including the use of advanced technologies, such as machine learning or generative artificial intelligence (“AI”), change frequently, may originate from less regulated and remote areas of the world, may be difficult to detect, and generally are not recognized until after they are launched against a target. As a result, we may be unable to anticipate these techniques or implement adequate preventative measures. If our information technology systems, or those of our critical third-party vendors, do not effectively and securely collect, store, process, and report relevant data for the operation of our business, our ability to effectively plan, forecast, and execute our business plan and comply with applicable laws and regulations could be impaired. Any such impairment could materially and adversely affect our financial condition, results of operations, and the timeliness with which we report our internal and external operating results.

Our business requires us to use and store customer, employee, and business partner personal information. This may include names, addresses, phone numbers, email addresses, contact preferences, tax identification numbers, and payment account information. We have implemented, and our critical third-party vendors may implement, various controls, systems, and processes intended to secure our information technology systems and the information on it. For example, we require usernames and passwords in order to access our information technology systems and use encryption and authentication technologies to secure the transmission and storage of data. We also have programs in place to detect, contain, and respond to data security incidents, and we make ongoing improvements to our information-sharing products in order to minimize vulnerabilities, in accordance with industry and regulatory standards. However, we cannot guarantee that these measures will be effective or that attempted security breaches or disruptions would not be successful or damaging. These security measures may be compromised as a result of security breaches by unauthorized persons, employee error, malfeasance, faulty password management, or other irregularity and result in persons obtaining unauthorized access to our data or accounts. Third parties may attempt to fraudulently induce employees or customers into disclosing usernames, passwords, or other sensitive information or otherwise attempt to hack into our information technology systems to obtain personal data relating to patients or employees, our confidential or proprietary information, or confidential information we hold on behalf of third parties. In addition, with the prolific use of AI technologies, there is an increased risk of unauthorized or accidental disclosure. For example, our employees,