사이버 보안

Customer trends toward vendor consolidation in cybersecurity may favor competitors offering broader platforms.

•the occurrence of an actual or perceived data or security breach;

•intensified cyber attacks

We expect that we and our third-party service providers and strategic partners will continue to experience cybersecurity attacks and incidents in the future.

AI also amplifies cybersecurity threats.

Threat actors may actively seek to exploit third-party security and cybersecurity weaknesses.

Risk Factors— Risk Related to Cybersecurity, Privacy, and Regulatory Requirements” heading.

•investor and market perceptions regarding AI-related disruption to software companies and the cybersecurity industry;

•increased cybersecurity, technology and physical security risks to the data, systems, facilities, and people supporting the operation of the Platform;

For example, governments around the world have recently passed or are considering new critical infrastructure cybersecurity laws and regulations, some of which may apply to Visa.

Possessing client assets and sensitive personal information exposes us to cybersecurity threats and data privacy obligations.

For example, code generated by AI could include errors, deficiencies, or vulnerabilities that increase our exposure to cyberattacks.

Data Privacy, Cybersecurity and Intellectual Property Risks

The types of threats also continue to evolve, and may include social engineering attacks using AI tools, ransomware, and supply-chain attacks.

We may incur liability or suffer reputational harm for cybersecurity even if we do not control the applicable security measures or if we are not at fault.

The rapid advancement and widespread dissemination of artificial intelligence technologies significantly increases the risks associated with cyberattacks.

See our risk factor on data privacy and cybersecurity compliance for more details.

We have also acquired and in the future may acquire companies with vulnerabilities or unsophisticated security measures, which exposes us to potentially significant cybersecurity risks.

Additionally, cybersecurity and data security and protection laws and regulations are evolving and present increasing compliance challenges, which may increase our costs, affect our competitiveness, cause reputational harm and expose us to substantial fines or other penalties.

Furthermore, from time to time, U.S. presidential administrations have issued, and may in the future issue, Executive Orders related to cybersecurity practices that may affect our business.

We manage AI-related risks through our existing cybersecurity, privacy, legal, compliance, information governance, and enterprise risk management processes.

Our IT Systems and those of our contractors and consultants also face numerous and evolving cybersecurity risks from diverse threats.

RISKS RELATED TO CYBERSECURITY OR MISAPPROPRIATION OF OUR CRITICAL INFORMATION

•actual or perceived significant data privacy or cybersecurity incidents involving our advertising solutions;

Our acquisition of Calpine in January 2026 introduces expanded cybersecurity and physical security risks.

Digital Operational Resilience Act and other E.U. and U.K. laws that regulate personal data, non-personal data, and cybersecurity operations.

Further discussion of the risks associated with operational information systems and our cybersecurity posture is provided elsewhere herein.

For a discussion of our management of cybersecurity risks, see Item 1C, "Cybersecurity—Risk Management and Strategy" and "Cybersecurity—Governance."

We or our third-party product and service providers may not be able to anticipate, identify, or implement effective preventive measures against cyberattacks or data security incidents and, even if timely identified, we or our third-party product and service providers may not be able to remediate such attacks or incidents in a timely and effective manner, or to mitigate or avoid adverse impacts resulting from any such

If one of our service providers fails to provide the communications capacity or services we require, as a result of natural disasters, operational disruptions, cybersecurity-related disruptions or failures, terrorism, hacking or any other reason, the failure could interrupt our services.

The regulations also restrict certain investment agreements, employment agreements and vendor agreements involving such data and countries of concern, absent specified cybersecurity controls.

Emerging technologies, such as AI-driven cyberattacks and the potential for quantum computing, could introduce new vulnerabilities in our systems, potentially rendering traditional cryptographic techniques less effective and exposing us to more sophisticated forms of cyberattacks.

These technologies may be more costly than we currently anticipate, may not perform as expected, may require more time or expense to implement effectively than anticipated, may introduce operational or cybersecurity risks, or may fail to enhance productivity and maintain operational efficiency as expected.

In addition, threat actors may use AI to increase the speed, scale and sophistication of cyberattacks, including phishing, impersonation, credential theft, exploitation of known or previously unknown software vulnerabilities and other automated, targeted or coordinated attacks against our systems or those of our vendors and other third parties.

Trends, Risks and Uncertainties Related to Cybersecurity and Data Privacy

We use generative AI tools in limited and controlled contexts and prohibit the use of AI technologies in areas that we deem to create high risks that cannot be mitigated related to cybersecurity, confidentiality, privacy, intellectual property, legal compliance, and/or ethical standards.

Additionally, the integration of artificial intelligence in our or any suppliers’ operations, products or services is expected to pose new or unknown cybersecurity risks and challenges.

of security breaches involving certain types of data.

The emergence and maturation of AI capabilities, including ones involving large language models, may enable new or more effective methods of cyberattacks, including deepfake impersonation, phishing, social engineering or the automated detection and exploitation of previously unknown vulnerabilities.

These systems are increasingly vulnerable to cybersecurity threats, which can significantly impact data security.

The failure to adequately adapt to this new environment or timely procure and deploy necessary mitigation may increase the risk of cybersecurity incidents, which may materially affect our business operations or our financial results.

The rapid evolution of AI has automated and accelerated the scale of cybersecurity threats, potentially reducing the time for us to detect and mitigate potential information security incidents.

As data protection, cybersecurity, and privacy laws continue to evolve, we may face additional reporting requirements to regulatory authorities.

•If we or our third-party service providers experience, or are unable to protect against cyber-attacks, ransomware, security incidents, or security breaches, or if unauthorized parties otherwise obtain access to our customers’ data, our data, or our platform and information technology systems, then our solution may be perceived as not being secure, our reputation may be harmed, demand for our platform and products ma

Such data and systems are subject to the risk of compromise and other cyberattacks, including unauthorized access, modification, exfiltration, destruction or denial of access, which also can result in disruptions in service.

In addition to the GDPR, the EU has also enacted legislation that would regulate non-personal data and establish new cybersecurity standards, and other countries, including the U.K., may similarly do so in the future.

There are inherent costs and risks associated with upgrading and implementing changes to any one of these systems, including potential disruption of our operations and internal control structure, greater than budgeted capital expenditures or administration and operating expenses, demands on management time, securing our systems along with dependent processes from cybersecurity threats and other costs and risks, and t

Increasing use of such products and services in our vehicles, including with our partnerships with Nuro and Uber for AV capabilities, heightens the risk and potential impacts of a cybersecurity breach of our or our third-party partners’ systems.

As a result, we are exposed to heightened risks of cyber-attacks or other security incidents.

See also, “Costs related to defective products could have a material adverse effect on us” and “Cybersecurity risks could adversely affect our business and disrupt our operations” for additional information.

They may also arise from incidents outside of our control, including third-party incidents, denial of service or ransomware attacks, as well as from our efforts to address vulnerabilities and security incidents.

INFORMATION TECHNOLOGY AND CYBERSECURITY

For example, the recent escalation of hostilities in Iran has demonstrated the intent to target Western technology infrastructure and companies, including us, and has increased the risk that our systems, facilities, or third-party providers could be subject to physical or cyber attack.

Cybersecurity threats may also be enhanced, accelerated or facilitated by artificial intelligence, including through more sophisticated phishing, malware, social engineering, vulnerability discovery, credential attacks, deepfakes, automated intrusion attempts and other techniques.

These cyberattacks are becoming increasingly sophisticated and dynamic, including as a result of artificial intelligence and machine learning capabilities.

They may access, misappropriate or otherwise compromise protected personal information or our proprietary or confidential information or that of third parties, and may develop and deploy malicious code (including viruses, ransomware and malware, among others) that can attack our systems, exploit security vulnerabilities, and disrupt or shut down our systems and operations.

Continued advancements and increased use of AI have intensified existing cybersecurity risks by enabling faster and more automated attack techniques, lowering the barrier to creating sophisticated threats, and further compressing the time in which we must detect and respond to potential threats.

See Item 1C, “Cybersecurity” of this Annual Report on Form 10-K for additional information about our cybersecurity processes.

As a cybersecurity provider, we have been, and expect to continue to be, a target of cyberattacks.

Cybersecurity risk to the company and its customers also depends on factors such as the actions, practices and investments of customers, contractors, business partners, vendors, the open source community and other third parties, including, for example, providing and implementing patches to address vulnerabilities.

EU Cybersecurity (NIS2),