Company: SFB
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0000950170-25-027702
Chunk: 60

Company: STIFEL FINANCIAL CORP
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 60
---
 sophisticated, change frequently and are often not recognized until launched. Although we seek to maintain a robust suite of layered information security controls, including our cyber threat analytics, data encryption, and monitoring technologies, anti-malware defenses, and vulnerability management programs, any one or combination of these controls could fail to detect, mitigate, or remediate these risks in a timely manner. Despite our implementation of protective measures and endeavoring to modify them as circumstances warrant, our computer systems, software, and networks may be vulnerable to human error, equipment failure, natural disasters, power loss, unauthorized access, supply chain attacks, distributed denial of service attacks, zero-day vulnerabilities, computer viruses and other malicious code, and other events that could result in significant liability and damage to our reputation, and have an ongoing impact on the security and stability of our operations. In addition, although we maintain insurance coverage that may, subject to terms and conditions, cover certain aspects of cyber and information security risks, such insurance coverage may be insufficient to cover all losses, such as litigation costs or financial losses that exceed our policy limits or are not covered under any of our current insurance policies. 

We also rely on numerous third-party service providers to conduct other aspects of our business operations, and we face similar risks relating to them. While we regularly conduct security assessments and external scans on these third-party vendors, we cannot be certain that their information security protocols are sufficient to withstand a cyber attack or other security breach. We also cannot be certain that we will receive timely notification of such cyber attacks or other security breaches. In addition, in order to access our products and services, our customers may use computers and other devices that are beyond our security control systems.

Notwithstanding the precautions we take, if a cyber attack or other information security breach were to occur, this could jeopardize the information we confidentially maintain, or otherwise cause interruptions in our operations or those of our clients and counterparties, exposing us to liability. As attempted attacks continue to evolve in scope and sophistication, we may be required to expend substantial additional resources to modify or enhance our protective measures, to investigate and remediate vulnerabilities or other exposures or to communicate about cyber attacks to our customers and regulators. A technological breakdown could also interfere with our ability to comply with financial reporting and other regulatory requirements, exposing us to potential disciplinary action by regulators. Further, successful cyber attacks at other large financial institutions or other market participants, whether or not we are affected, could lead to a 

18

general loss of confidence in financial institutions that could negatively affect us,