Sallie Mae 2015 Annual Report Download - page 28

26
competitors introduce products, services, systems and processes that are better than ours or that gain greater market acceptance,
those we offer or use may become obsolete or noncompetitive. Any one of these circumstances could have a material adverse
effect on our business reputation and ability to obtain and retain clients.
We may be required to expend significant funds to develop or acquire new technologies. If we cannot offer new
technologies as quickly as our competitors, we could lose market share. We also could lose market share if our competitors
develop more cost effective technologies than those we offer or develop.
We depend on secure information technology and a breach of those systems or those of third-party vendors could result in
significant losses, unauthorized disclosure of confidential customer information and reputational damage, which could
materially adversely affect our business, financial condition or results of operations.
Our operations rely on the secure processing, storage and transmission of personal, confidential and other information in
a significant number of customer transactions on a continuous basis through our computer systems and networks and those of
our third-party service providers. To access our products and services, our customers may use smart phones, tablets and other
mobile devices that are beyond our security systems and those of our third-party service providers. Information security risks
for financial institutions and third-party service providers have increased in recent years and continue to evolve in part because
of the proliferation of new technologies, the use of the Internet and telecommunications technologies to conduct financial
transactions, and the increased sophistication and activities of organized crime, hackers, terrorists, activists and other external
parties, including foreign state-sponsored actors. These parties also may fraudulently induce employees, customers and other
users of our systems to gain access to our and our customers’ data. As a result, we continue to evolve our security controls to
effectively prevent, detect, and respond to the continually changing threats and we may be required to expend significant
additional resources in the future to modify and enhance our security controls in response to new or more sophisticated threats,
new regulations related to cybersecurity and other developments.
Despite the measures we and our third-party service providers implement to protect our systems and data, we may not be
able to anticipate, prevent or detect cyber-attacks given the unknown and evolving nature of cyber criminals and techniques. As
a result, our computer systems, software and networks, as well as those of third-party vendors we utilize, may be vulnerable to
unauthorized access, computer viruses, malicious attacks and other events that could have a security impact beyond our control.
Our staff, technologies, systems, networks and those of third-parties we utilize also may become the target of cyber-attacks,
unauthorized access, malicious code, computer viruses, denial of service attacks and physical attacks that could result in
information security breaches, the unauthorized release, gathering, monitoring, misuse, loss or destruction of our or our
customers’ confidential, proprietary and other information, or otherwise disrupt our or our customers’ or other third-parties’
business operations. We also routinely transmit and receive personal, confidential and proprietary information, some through
third-parties, which may be vulnerable to interception, misuse or mishandling.
If one or more of such events occur, personal, confidential and other information processed and stored in, and transmitted
through our computer systems and networks, or those of third-party vendors, could be compromised or could cause
interruptions or malfunctions in our or our customers’ operations that could result in significant losses, loss of confidence by
and business from customers, customer dissatisfaction, significant litigation, regulatory exposures and harm to our reputation
and brand.
In the event personal, confidential or other information is threatened, intercepted, misused, mishandled or compromised,
we may be required to expend significant additional resources to modify our protective measures, to investigate the
circumstances surrounding the event and implement mitigation and remediation measures. We also may be subject to fines,
penalties, litigation and regulatory investigation costs and settlements and financial losses that are either not insured against or
not fully covered through any insurance maintained by us. If one or more of such events occur, our business, financial condition
or results of operations could be significantly and adversely affected.