Our business is reliant upon internal and third-party-controlled, developed and operated software (which includes opensource software), technology systems and networks to process, transmit and store information, including our current, potential and former clients', employees' and advisors' personal information, as well as our proprietary information, and to conduct many of our business activities and transactions. Maintaining the security and integrity of our software, information and these systems and networks, and appropriately responding to any cybersecurity and privacy incidents (including attempts), is critical to the success of our business operations, including our reputation, the retention of our advisors and clients, and to the protection of our proprietary information and our clients' personal information.
We rely on the third parties with whom we do business to identify and remediate software and other vulnerabilities before they can be exploited by bad actors, but they cannot always do so. For example, zero-day vulnerabilities in software and other technology solutions are immediately exploitable by bad actors as occasionally happens with certain of our vendors in the industry. We routinely face attacks and seek to address evolving threats of which we become aware. We have been able to identify, protect, detect, respond to and recover from these attacks to date without a material loss of client financial assets or information through the use of ongoing internal and external threat monitoring and by making continual adjustments to our security and incident response capabilities.
We and our advisors, as well as our service providers and clients, have also been threatened by, among others, phishing, vishing, and spear phishing scams, social engineering attacks (such as direct voice contact and any technology or communication mechanism to contact a person), account takeovers, introductions of malware, attempts at electronic break-ins, and the submission of fraudulent payment requests. The number of threats and events has increased substantially every year, which is expected to continue, particularly as the use of artificial intelligence makes these attempts look more legitimate. Attempted or successful breaches or interference by third parties or by insiders that may occur in the future could have a material adverse impact on our business, reputation, financial condition or results of operations.
On a corporate basis, various laws and regulations, and in some cases contractual obligations, require us to establish and maintain corporate policies and technical and operational measures designed to protect sensitive client, employee, contractor and vendor information, and to respond to cybersecurity incidents in certain ways and timeframes. We have established policies and implemented such technical and operational measures ourselves and have in place policies that require our service providers and franchisee advisors, each of which control locally their own technology operations, to do the same. The increase in hybrid working among our employees adds complexity to monitoring and processing procedures. Changes in our business or technological advancements may also require corresponding changes in our systems, networks and data security and response measures. While accessing our products and services, our customers may use computers and other devices that sit outside of our security control environment. In addition, the ever-increasing reliance on technology systems and networks and the occurrence and potential adverse impact of attacks on such systems and networks (including in recent well-publicized security breaches at other companies), both generally and in the financial services industry, have enhanced government and regulatory scrutiny of the measures taken by companies to protect against cybersecurity threats and report incidents they suffer. As these threats, and government and regulatory oversight of associated risks, continue to evolve, we may be required to expend additional resources (both direct financial resources and indirect costs like people) to enhance or expand upon the technical and operational security and response measures we currently maintain or that we allow franchise advisors to maintain and control locally. These regulator-driven changes may adversely impact the client experience by, for example, requiring multiple means of verifying the identity of a client before they can interact with us.
Despite the measures we have taken and may in the future take to address and mitigate cybersecurity, privacy and technology risks, we cannot be certain that our systems and networks, or those used by our vendors, will not be subject to successful attacks, breaches or interference. Nor can we guarantee that franchise advisors will comply with our policies and procedures in this regard, or that clients will engage in safe and secure online practices. Furthermore, human error occurs from time to time and such mistakes can lead to the inadvertent disclosure of sensitive information. We have a vendor management process, but at times our software or service providers could push through updates that are not fully disclosed to us (or tested by them) and that could alter the control posture of their products. Any such event may result in operational disruptions, as well as unauthorized access to or the disclosure or loss of, our proprietary information or client, employee, vendor, or advisor personal information, which in turn may result in legal claims, regulatory scrutiny and liability, reputational damage, the incurrence of costs to respond to, eliminate, or mitigate further exposure, the loss of clients or advisors, or other damage to our business. While we maintain cyber liability insurance that provides both third-party liability and first-party liability coverages, it may not protect us against all cybersecurity- or privacy-related losses. Furthermore, we may be subject to indemnification costs and liability to third parties if we breach any confidentiality or security obligations regarding vendor data or for losses related to the data. In addition, the trend toward broad consumer and general-public notification of such incidents, including those where our vendors are the party being breached, could exacerbate the harm to our business, reputation, financial condition or results of operations in the event of a breach. Even if we successfully protect our technology infrastructure and the confidentiality of sensitive data and conduct appropriate incident response, we may incur significant expenses in connection with our responses to any such attacks, as well as the adoption, implementation and maintenance of appropriate security measures. In addition, our regulators may seek to hold our company responsible for the acts, mistakes or omissions of our vendors or franchise advisors even where they procure and control much of the physical office space and technology infrastructure they use to operate their businesses locally.