Brand Engagement Network Inc

Except as provided below, there were no material changes to the Risk Factors disclosed in “Item 1A. Risk Factors” in our Annual Report on Form 10-K for the year ended December 31, 2023. For more information concerning our risk factors, please see “Item 1A. Risk Factors” in our Annual Report on Form 10-K for the year ended December 31, 2023.

If our information technology systems or those of third parties upon which we rely, or our data is or was compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences.

In the ordinary course of our business, we and the third parties upon which we rely, collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, “process”) proprietary, confidential, and sensitive data, including personal data (such as health-related data), intellectual property and trade secrets (collectively, “sensitive information”).

Our and our third-party vendors’ and business partners’ information technology systems may be damaged or compromised by malicious events, such as cyberattacks, physical or electronic security breaches, malicious internet-based activity, online and offline fraud, natural disasters, fire, power loss, telecommunications failures, personnel misconduct and human error.

Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including internal bad actors, such as employees or contractors (through theft or misuse), or third parties (including traditional computer hackers, “hacktivists,” persons involved with organized crime, or sophisticated foreign state or foreign state-supported actors).

Cybersecurity threats can employ a wide variety of methods and techniques, which are constantly evolving, and have become increasingly complex and sophisticated; all of which increase the difficulty of detecting and successfully defending against them. We and the third parties upon which we rely are subject to a variety of these evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, floods, and other similar threats. In particular, severe ransomware attacks are becoming increasingly prevalent - particularly for companies like ours that are engaged in critical infrastructure or manufacturing - and can lead to significant interruptions in our operations, loss of sensitive data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Furthermore, because the techniques used to obtain unauthorized access or sabotage systems change frequently and generally are not identified until after they are launched against a target, we and our third-party vendors and business partners may be unable to anticipate these techniques or implement adequate preventative measures.

We rely on third-party service providers and technologies to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, and other functions. We also rely on third-party service providers to provide other products, services, parts, or otherwise to operate our business. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. Certain of the third parties on which we rely have experienced cybersecurity incidents in the past and may again in the future. We could experience adverse consequences resulting from any security incidents or other interruptions experienced by third-party service providers. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award and our reputation could be harmed. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised.

We, and the third-party business partners and vendors upon which we rely, have experienced, and may in the future experience, cybersecurity threats, including threats or attempts to disrupt our information technology infrastructure and unauthorized attempts to gain access to sensitive or confidential information. In April 2024, our primary commercial partner and exclusive reseller for the automotive industry, AFG, publicly disclosed that it was the victim of a ransomware attack in the Fall of 2023 prior to entering into the Reseller Agreement. To the extent negative publicity AFG receives from the incident has, or the incident otherwise causes, a material adverse effect on AFG’s business or AFG’s ability to resell our products, our results of operations and financial condition could suffer.

Although prior cyberattacks directed at us have not had a material impact on our financial results, and we are continuing to bolster our threat detection and mitigation processes and procedures, we cannot guarantee that future cyberattacks, if successful, will not have a material impact on our business or financial results. While we have security measures in place designed to protect our information and our customers’ information and to prevent data loss and other security incidents, we have not always been able to do so, and there can be no assurance that in the future these measures will be successful. Security incidents could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or our information technology systems, or those of the third parties upon whom we rely. A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely) to provide our platform and services.

We take steps to detect and remediate vulnerabilities, but we may not be able to detect and remediate all vulnerabilities because the threats and techniques used to exploit the vulnerability change frequently and are often sophisticated in nature. Therefore, such vulnerabilities could be exploited but may not be detected until after a security incident has occurred. These vulnerabilities pose material risks to our business. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities.

Applicable data privacy and security obligations may require us to provide notice of data security incidents involving certain types of data, including personal data. Such disclosures are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences.

Actual or perceived breaches of security measures, unauthorized access to our system or the systems of the third-party vendors that we rely upon, or any other cybersecurity threats may cause us to experience adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; interruptions in our operations (including availability of data); financial loss; and other similar harms. Security incidents and attendant consequences may cause customers to stop using our platform and services, deter new customers from using our platform and services, and negatively impact our ability to grow and operate our business.

In addition, our reliance on third-party service providers and business partners could introduce new cybersecurity risks and vulnerabilities, including supply-chain attacks, and other threats to our business operations. We rely on third-party service providers and technologies to operate critical business systems to process sensitive data in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology and other functions. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. Our contracts may not contain limitations on liability. There can be no assurance that any limitations of liability provisions in our contracts or license arrangements with customers or in our agreements with vendors, partners, or others would be enforceable, applicable, or adequate or would otherwise protect us from any such liabilities or damages with respect to any claim.

Any or all of the above issues, or the perception that any of them have occurred, could result in adverse consequences including, but not limited to, business interruptions and diversions of funds, decreased ability to attract new customers, existing customers deciding to terminate or not renew their agreements, reduced ability to obtain and maintain required or desirable cybersecurity certifications, reputational damage, government enforcement actions (for example, investigations, fines, penalties, audits, and inspections), and private litigation (including class claims), any of which could materially adversely affect our results of operations, financial condition, and future prospects. There can be no assurance that any limitations of liability provisions in our license arrangements with customers or in our agreements with vendors, partners, or others would be enforceable, applicable, or adequate or would otherwise protect us from any such liabilities or damages with respect to any claim.