Disclosure · Form 10-K · fiscal 2025
Pinterest, Inc. 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed February 12, 2026· period ended December 31, 2025· PINS· CIK 1506293· Updated · filing on sec.gov ↗
Pinterest, Inc.'s Form 10-K for fiscal 2025, filed February 12, 2026, names the Chief Security Officer as its top security role, reporting to the Chief Technology Officer, with oversight by the Audit and Risk Committee.
What Pinterest's Item 1C says
Pinterest's Form 10-K for fiscal 2025 places oversight of cybersecurity risk with the Audit and Risk Committee. The program is led in management by the Chief Security Officer, who heads the security team that manages and monitors it.
Board and management oversight
The Audit and Risk Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from the Chief Security Officer and other members of the senior leadership team. The Board also receives periodic updates from management and the Audit and Risk Committee on cybersecurity risks.
Who leads security
The Chief Security Officer reports directly to the Chief Technology Officer and has over 25 years of experience managing information technology and cybersecurity matters, including more than six years at Pinterest.
How the company manages cyber risk
The company says its cybersecurity program is informed in part by industry standards and best practice, such as the NIST Cybersecurity Framework. The company conducts risk-based penetration and vulnerability testing and ongoing risk assessments. The company also conducts employee trainings on cyber and information security, among other topics. The company considers cybersecurity, along with other significant risks, within its overall enterprise risk management framework.
Third parties and incidents
The company consults with outside advisors and experts to assist with assessing, identifying and managing cybersecurity risks. The company conducts due diligence prior to engagement on its key technology vendors and other contractors and suppliers, and risk-based periodic audits of them. Since the beginning of the last fiscal year, the company has not identified any prior cybersecurity incidents that have materially affected it.
What the section does not state
The section does not name the person who holds the top security role.
Read from the Form 10-K filed February 12, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Chief Security Officer
Reports to
Chief Technology Officer
“Our Chief Security Officer, who reports directly to the Chief Technology Officer and has over 25 years of experience managing information technology and cybersecurity matters, including more than six years at Pinterest, together with our Privacy and Data Protection Team, are responsible for assessing and managing cybersecurity risks.”
Board oversight
Audit and Risk Committee
“The Audit and Risk Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks.”
CISO or other person named
not identified
Frameworks and standards named
NIST Cybersecurity Framework
Where the filing names it
- NIST Cybersecurity Framework: “Our cybersecurity program is informed in part by industry standards and best practice, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.”
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
Stated
“Our Chief Security Officer, who reports directly to the Chief Technology Officer and has over 25 years of experience managing information technology and cybersecurity matters, including more than six years at Pinterest, together with our Privacy and Data Protection Team, are responsible for assessing and managing cybersecurity risks.”
Material incident
The filing states none
“Since the beginning of the last fiscal year, we have not identified any prior cybersecurity incidents that have materially affected us, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us.”
The section
515 words, Form 10-K filed February 12, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on October 21, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Pinterest, Inc. standard industrial classification 7370, Services-computer programming, data processing, etc. (SEC SIC list). 8 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Intelligent Protection Management Corp.FY 2025, filed March 17, 2026 | Chief Information Security Officer | the President | Audit Committee |
| Teads Holding Co.FY 2025, filed March 16, 2026 | Chief Information Security Officer | not identified | Audit Committee |
| Health Catalyst, Inc.FY 2025, filed March 12, 2026 | Chief Information Security Officer | not identified | Audit Committee |
| Rackspace TechnologyFY 2025, filed March 6, 2026 | Chief Information Security Officer | not identified | Audit Committee |
| NIQ Global Intelligence plcFY 2025, filed February 27, 2026 | Chief Security Officer | not identified | Audit Committee |
| DoubleVerify Holdings, Inc.FY 2025, filed February 26, 2026 | Chief Information Security Officer | Chief Information Officer | Audit Committee |
| AlphabetFY 2025, filed February 5, 2026 | Vice President of Privacy, Safety, and Security | not identified | Risk and Compliance Committee |
| MetaFY 2025, filed January 29, 2026 | Chief Information Security Officer | not identified | Audit & Privacy Committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Pinterest, Inc.'s Form 10-K as filed with the SEC on February 12, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item 1C. Cybersecurity
Item 1C: Cybersecurity
In the ordinary course of our business, we receive, process, use, store, and share digitally large amounts of data, including user data as well as confidential, sensitive, proprietary, and personal information. Maintaining the integrity and availability of our information technology systems and this information, as well as appropriate limitations on access and confidentiality of such information, is important to our operations and business strategy. To this end, we have implemented a program designed to assess, identify and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing in them. Our cybersecurity program is informed in part by industry standards and best practice, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.
The program is managed and monitored by a dedicated security team, which is led by our Chief Security Officer and includes mechanisms, controls, technologies, systems, policies and other processes designed to prevent or mitigate data loss, theft, misuse or other security incidents or vulnerabilities affecting the systems and data residing in them. For example, we conduct risk-based penetration and vulnerability testing and ongoing risk assessments, including due diligence prior to engagement on and ongoing risk-based periodic audits of our key technology vendors and other contractors and suppliers. We also conduct employee trainings on cyber and information security, among other topics. In addition, we consult with outside advisors and experts to assist with assessing, identifying and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.
Our Chief Security Officer, who reports directly to the Chief Technology Officer and has over 25 years of experience managing information technology and cybersecurity matters, including more than six years at Pinterest, together with our Privacy and Data Protection Team, are responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Since the beginning of the last fiscal year, we have not identified any prior cybersecurity incidents that have materially affected us, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Risks Related to Data, Security and Privacy."
The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit and Risk Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit and Risk Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our Chief Security Officer as well as other members of the senior leadership team. The Board also receives periodic updates from management and the Audit and Risk Committee on cybersecurity risks.
Part I
Earlier filings on record
Fiscal 2024 Form 10-K, filed February 6, 2025 sec.gov ↗
Top security role, as the filing names it
Chief Security Officer
Reports to, as the filing names it
Chief Technology Officer
“Our Chief Security Officer, who reports directly to the Chief Technology Officer and has over 25 years of experience managing information technology and cybersecurity matters, including more than six years at Pinterest, together with our Privacy and Data Protection Team, are responsible for assessing and managing cybersecurity risks.”
Board oversight
Audit and Risk Committee
“The Audit and Risk Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks.”
Person named in the filing
not identified
Experience, as stated
Stated
“Our Chief Security Officer, who reports directly to the Chief Technology Officer and has over 25 years of experience managing information technology and cybersecurity matters, including more than six years at Pinterest, together with our Privacy and Data Protection Team, are responsible for assessing and managing cybersecurity risks.”
Material incident
The filing states none
“Since the beginning of the last fiscal year, we have not identified any prior cybersecurity incidents that have materially affected us, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us.”
Read by claude-sonnet-5-5 on October 21, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity
Item 1C: Cybersecurity
In the ordinary course of our business, we receive, process, use, store, and share digitally large amounts of data, including user data as well as confidential, sensitive, proprietary, and personal information. Maintaining the integrity and availability of our information technology systems and this information, as well as appropriate limitations on access and confidentiality of such information, is important to our operations and business strategy. To this end, we have implemented a program designed to assess, identify and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing in them. Our cybersecurity program is informed in part by industry standards and best practice, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.
The program is managed and monitored by a dedicated security team, which is led by our Chief Security Officer and includes mechanisms, controls, technologies, systems, policies and other processes designed to prevent or mitigate data loss, theft, misuse or other security incidents or vulnerabilities affecting the systems and data residing in them. For example, we conduct risk-based penetration and vulnerability testing and ongoing risk assessments, including due diligence prior to engagement on and ongoing risk-based periodic audits of our key technology vendors and other contractors and suppliers. We also conduct employee trainings on cyber and information security, among other topics. In addition, we consult with outside advisors and experts to assist with assessing, identifying and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.
Our Chief Security Officer, who reports directly to the Chief Technology Officer and has over 25 years of experience managing information technology and cybersecurity matters, including more than six years at Pinterest, together with our Privacy and Data Protection Team, are responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Since the beginning of the last fiscal year, we have not identified any prior cybersecurity incidents that have materially affected us, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Risks related to Data, Security and Privacy."
The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit and Risk Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit and Risk Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our Chief Security Officer as well as other members of the senior leadership team. The Board also receives periodic updates from management and the Audit and Risk Committee on cybersecurity risks.
Part I
Fiscal 2023 Form 10-K, filed February 8, 2024 sec.gov ↗
Top security role, as the filing names it
Chief Security Officer
Reports to, as the filing names it
Chief Technology Officer
“Our Chief Security Officer, who reports directly to the Chief Technology Officer and has over 25 years of experience managing information technology and cybersecurity matters, including more than five years at Pinterest, together with our Privacy and Data Protection Team, are responsible for assessing and managing cybersecurity risks.”
Board oversight
Audit and Risk Committee
“The Audit and Risk Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks.”
Person named in the filing
not identified
Experience, as stated
Stated
“Our Chief Security Officer, who reports directly to the Chief Technology Officer and has over 25 years of experience managing information technology and cybersecurity matters, including more than five years at Pinterest, together with our Privacy and Data Protection Team, are responsible for assessing and managing cybersecurity risks.”
Material incident
The filing states none
“In the last fiscal year, we have not identified any prior cybersecurity incidents that have materially affected us, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us.”
Read by claude-sonnet-5-5 on October 21, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity
Item 1C: Cybersecurity
In the ordinary course of our business, we receive, process, use, store, and share digitally large amounts of data, including user data as well as confidential, sensitive, proprietary, and personal information. Maintaining the integrity and availability of our information technology systems and this information, as well as appropriate limitations on access and confidentiality of such information, is important to our operations and business strategy. To this end, we have implemented a program designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing in them.
The program is managed and monitored by a dedicated security team, which is led by our Chief Security Officer and includes mechanisms, controls, technologies, systems, policies and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the systems and data residing in them. For example, we conduct risk-based penetration and vulnerability testing and ongoing risk assessments, including due diligence on our key technology vendors and other contractors and suppliers. We also conduct employee trainings on cyber and information security, among other topics. In addition, we consult with outside advisors and experts to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.
Our Chief Security Officer, who reports directly to the Chief Technology Officer and has over 25 years of experience managing information technology and cybersecurity matters, including more than five years at Pinterest, together with our Privacy and Data Protection Team, are responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified any prior cybersecurity incidents that have materially affected us, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Risks related to Data, Security and Privacy."
The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit and Risk Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit and Risk Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our Chief Security Officer as well as other members of the senior leadership team. The Board also receives periodic updates from management and the Audit and Risk Committee on cybersecurity risks.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.