We collect, maintain and use information, including proprietary and personally identifiable information ("PII"), of our applicants, policyholders, independent agents and others. As part of our normal business operations, we engage third-party providers, such as companies who print and mail our policies and premium notices, data programmers, marketing companies, and agents, who may also collect, store, access, process, and transmit this PII. Various federal and state laws, as well as laws of the countries in which our policyholders reside, address the use and disclosure of PII.
We devote significant resources and employ security measures to help protect our information technology systems and confidential information, including PII, and we have programs in place to detect, contain, and respond to cyber security incidents. We also have a stringent process to analyze the systems of our third-party vendors and partners who may collect and/or have access to our PII. However, because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and may be difficult to detect for long periods of time, we and our third-party providers may be unable to anticipate these techniques or implement adequate preventative measures. In addition, hardware, software, or applications we develop or procure from third parties or through open source solutions may contain defects in design or manufacture or other problems that could unexpectedly compromise our information security. Unauthorized parties, whether within or outside our company, may disrupt or gain access to our systems, or those of third parties with whom we do business, through human error, misfeasance, fraud, trickery, or other forms of deceit, including break-ins, use of stolen credentials, social engineering, phishing, or other cyber attacks, computer viruses, malicious codes, and similar means of unauthorized and destructive tampering.
We and our third-party providers may experience information security incidents from time to time. There is no assurance that our security systems and measures will be able to prevent, mitigate, or remediate cyber attacks. A successful penetration or circumvention of the security of our information technology systems, or those of third parties with whom we do business, could cause serious negative consequences for us, including significant disruption of our operations, unauthorized disclosure or loss of confidential information, harm to our brand or reputation, loss of customers and revenues, violations of privacy and other laws, exposure to litigation, monetary damages, regulatory enforcement proceedings, fines, and potentially criminal proceedings and penalties. If we are unaware of the incident for some time after it occurs, our exposure could increase. In addition, the costs to address or remediate systems disruptions or security threats or vulnerabilities, whether before or after an incident, could be significant. As we continue to build our digital capabilities and focus on enhancing the customer experience, the amount of information that we retain and share with third parties is likely to grow, increasing the cost to prevent data security breaches and the cost and potential consequences of such breaches.
Although we have insurance against some cyber risks and attacks, we may be subject to litigation and financial losses that exceed our policy limits, are subject to deductibles or are not covered under any of our current insurance policies.