BP PLC

Hostile acts such as terrorism, civil unrest,

armed conflict, sabotage, activism, piracy,

insider threats, workplace violence, cyber-

enabled physical attacks, or threats to

personnel security such as kidnapping or

detention could harm our people, disrupt

operations, compromise critical assets, or

damage our reputation.

Security threats may emerge or intensify in

response to geopolitical instability, conflict, or

state-linked activity that could target critical

infrastructure or supply chains. They may also

be politically, ideologically, or financially

motivated and influenced by regional

instability, activism, social unrest, or bp’s

presence in higher-risk geographies.

Increasing interdependence between cyber,

information, and physical domains may create

additional vulnerabilities across operational

technology, logistics, and data-driven systems.

Assets such as pipelines, terminals,

transportation routes, offshore platforms, and

operational-technology systems could be

particularly exposed. The risk of insider activity

– including unauthorized data access,

sabotage, or information leakage – is also a

continuing concern, particularly in complex

joint ventures or politically sensitive

environments.

The consequences of a major security incident

could include operational shutdown, financial

loss, workforce harm, legal costs and liabilities

or reputational damage. More broadly, a

significant incident could disrupt supply

chains, invite regulatory scrutiny, or adversely

affect confidence in bp’s ability to operate

safely and reliably in challenging

environments.