We and our tenants rely extensively on information technology ("IT") systems to process transactions and manage our businesses; as a result, we are at risk from, and may be impacted by, cybersecurity incidents. These incidents include unintentional or malicious attempts by individuals, including employees or contractors, or sophisticated organizations using advanced hacking tools and techniques that leverage artificial intelligence ("AI"), to gain unauthorized access to our data and IT systems. Cybersecurity incidents may involve social engineering/phishing, cyber attacks (including ransomware, malware attacks, unauthorized access attempts, and denial of service and other unintentional intrusions or malicious cyber attacks), cyber extortion or other fraudulent schemes, or attempts to exploit vulnerabilities, or may be predicated by geopolitical events, natural disasters, failures or impairments of telecommunications networks, or other catastrophic events. Further, new technologies such as AI may be more capable of evading these safeguards, and threat actors may use AI tools to automate and enhance cybersecurity attacks against us. If we, our vendors, or third parties experience an actual or perceived privacy or security incident because of the use of AI, we could lose valuable intellectual property and confidential information, and our reputation and the public perception of the effectiveness of our security measures could be harmed.
A cybersecurity incident could compromise the confidential information of our employees, tenants, and vendors; disrupt the proper functioning of our networks; result in misstated financial reports, violations of loan covenants, or missed reporting deadlines; impede our ability to maintain the building systems that our tenants rely on for the efficient use of their leased space; require significant management attention to remedy any damages; result in reputational damage to ourselves or our tenants; or lead to potential litigation or regulatory investigation, increased oversight, fines, or other penalties.
We employ a variety of measures to prevent, detect, respond to, and recover from cybersecurity threats, including through the use of AI-based tools; however, there is no guarantee such efforts will be successful in preventing or responding to a cybersecurity incident. The interpretation and application of cybersecurity and data protection laws and regulations are often uncertain and evolving. As a result, there can be no assurance that our security measures will be deemed adequate, appropriate, or reasonable by a regulator or court. Moreover, even security measures that are deemed appropriate, reasonable, or in accordance with applicable legal requirements may be unable to protect our IT systems or the information we maintain. Additionally, as increased regulatory compliance for cybersecurity protocols and disclosures are required by state or federal authorities, there is no guarantee that the increased amount of resources, both time and expense, will not adversely affect our business.
In addition, we rely on a number of service providers and vendors to provide important software, tools, and services, and operational functions, including payroll, accounting, budgeting, and lease management. As a result, cybersecurity risks at these service providers and vendors create additional risks for our information and business. While we may be entitled to damages if our service providers and vendors fail to satisfy their security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such an award. A cybersecurity incident impacting us directly or through third parties may result in the disruption of our operations, material harm to our financial condition, cash flows, and the market price of our common shares; misappropriation of our assets; liability for information or assets that were inappropriately accessed, stolen, altered, or made unavailable; compromise of confidential information collected while conducting our business; increased cybersecurity protection and insurance costs; regulatory scrutiny or action; litigation; and damage to our stakeholder relationships and reputation. Despite our efforts to secure our IT networks and related systems, there can be no assurance that our efforts and measures or those of our third-party service providers will be effective or that attempted cyber attacks or disruptions will not be successful or damaging.
While we have obtained cybersecurity insurance, there are no assurances that the coverage would be adequate in relation to any incurred losses. Moreover, as cyber attacks increase in frequency and magnitude, we may be unable to obtain cybersecurity insurance in amounts and on terms we view as adequate for our operations in the future.