We and our tenants rely extensively on information technology ("IT") systems to process transactions and manage our respective businesses, and as a result, we are at risk from, and may be impacted by, cybersecurity incidents. These cybersecurity incidents could include (i) unintentional or malicious attempts to gain unauthorized access to, or acquisition of, our data and/or IT systems by individuals, including employees or contractors, or sophisticated organizations using advanced hacking tools and techniques such as artificial intelligence ("AI"); (ii) failures during routine operations such as system upgrades or user errors; (iii) network or hardware failures; or (iv) the introduction of malicious or disruptive software. Such cybersecurity incidents may involve social engineering, business email compromise, cyber extortion, ransomware, denial of service, or attempts to exploit vulnerabilities, or may be predicated by geopolitical events, natural disasters, failures or impairments of telecommunications networks, or other catastrophic events.
A cybersecurity incident could compromise the confidential information of our employees, tenants, and vendors, disrupt the proper functioning of our networks, result in misstated financial reports, violations of loan covenants and/or missed reporting deadlines, impede our ability to maintain the building systems that our tenants rely on for the efficient use of their leased space, require significant management attention to remedy any damages, result in reputational damage to ourselves or our tenants, or lead to potential litigation or regulatory investigation, increased oversight, or fines. Increased regulation of data collection, use and retention practices, including self-regulation and industry standards, changes in existing laws and regulations, enactment of new laws and regulations, increased enforcement activity, and changes in the interpretation of laws, could increase our cost of compliance and operations, limit our ability to grow our business, or otherwise harm us.
We employ a variety of measures to prevent, detect, respond to, and recover from cybersecurity threats; however, there is no guarantee such efforts will be successful in preventing a cybersecurity incident. We have identified and expect to continue to identify cyberattacks and other cybersecurity incidents on our IT systems and those of third parties, including through e-mail phishing attempts and scams, but none of the cybersecurity incidents we have identified to date has had a material impact on our business or operations. The interpretation and application of cybersecurity and data protection laws and regulations are often uncertain and evolving. As a result, there can be no assurance that our security measures will be deemed adequate, appropriate, or reasonable by a regulator or court. Moreover, even security measures that are deemed appropriate, reasonable, and/or in accordance with applicable legal requirements may be unable to protect the information we maintain.
Additionally, we rely on a number of service providers and vendors to provide important software, tools and services and operational functions, including payroll, accounting, budgeting and lease management. As a result, cybersecurity risks at these service providers and vendors create additional risks for our information and business. While we may be entitled to damages if our service providers and vendors fail to satisfy their security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. A cybersecurity incident impacting us directly or through our third parties may result in the disruption of our operations, material harm to our financial condition, cash flows and the market price of our common shares, misappropriation of our assets, compromise or corruption of confidential information collected while conducting our business, liability for stolen information or assets, increased cybersecurity protection and insurance costs, regulatory enforcement, litigation, and damage to our stakeholder relationships and reputation. Although we make efforts to maintain the security and integrity of our IT networks and related systems on which we rely, there can be no assurance that our efforts and measures or those of our third-party service providers will be effective or that attempted cyberattacks or disruptions would not be successful or damaging.
While we have obtained cybersecurity insurance, there are no assurances that the coverage would be adequate in relation to any incurred losses. Moreover, as cyberattacks increase in frequency and magnitude, we may be unable to obtain cybersecurity insurance in amounts and on terms we view as adequate for our operations in the future.