Disclosure · Form 10-K · fiscal 2025
Alphabet 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed February 5, 2026· period ended December 31, 2025· GOOG· CIK 1652044· Updated · filing on sec.gov ↗· company page
Alphabet's Form 10-K for fiscal 2025, filed February 5, 2026, names the Vice President of Privacy, Safety, and Security as its top security role, with oversight by the Risk and Compliance Committee.
- Alphabet: who leads security, and the seat's history
- How other services-computer programming, data processing, etc. filers describe the seat
What Alphabet's Item 1C says
Alphabet's Form 10-K for fiscal 2025 places oversight of cybersecurity risk with the Risk and Compliance Committee. In management, teams of professionals with cybersecurity expertise across multiple industries are led by the Vice President of Privacy, Safety, and Security.
Board and management oversight
The Risk and Compliance Committee's oversight covers compliance with disclosure requirements and cooperation with law enforcement, and it reports findings and recommendations to the full Board for consideration. Senior management regularly discusses cybersecurity risks and trends and, should they arise, any material incidents with the Risk and Compliance Committee. Internal Audit maintains a dedicated cybersecurity auditing team that independently tests the company's cybersecurity controls.
Who leads security
The Vice President of Privacy, Safety, and Security has more than 20 years of experience, including roles in technology infrastructure for two other large public companies.
How the company manages cyber risk
The company says it has a process for identifying, assessing, and managing material risks from cybersecurity threats as part of its broader risk management system and processes. The executive leadership team is responsible for the overall enterprise risk management system and processes. A cross-functional working group regularly reviews significant incidents to determine whether further escalation is appropriate.
Third parties and incidents
Incident management teams track and log privacy and security incidents across Alphabet, its vendors, and other third-party service providers. The company consults with outside counsel as appropriate, including on materiality analysis and disclosure matters. The company states its business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats.
What the section does not state
The section does not name the person who holds the top security role. The section does not name a specific security framework or standard.
Read from the Form 10-K filed February 5, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Vice President of Privacy, Safety, and Security
Reports to
not identified
Board oversight
Risk and Compliance Committee
“The Risk and Compliance Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration.”
CISO or other person named
not identified
Frameworks and standards named
not identified
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
Stated
“These teams comprise professionals with deep cybersecurity expertise across multiple industries and are led by our Vice President of Privacy, Safety, and Security, who has more than 20 years of experience, including roles in technology infrastructure for two other large public companies.”
Material incident
The filing states none
“Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents .”
The section
461 words, Form 10-K filed February 5, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on October 16, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Alphabet standard industrial classification 7370, Services-computer programming, data processing, etc. (SEC SIC list). 8 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Intelligent Protection Management Corp.FY 2025, filed March 17, 2026 | Chief Information Security Officer | the President | Audit Committee |
| Teads Holding Co.FY 2025, filed March 16, 2026 | Chief Information Security Officer | not identified | Audit Committee |
| Health Catalyst, Inc.FY 2025, filed March 12, 2026 | Chief Information Security Officer | not identified | Audit Committee |
| Rackspace TechnologyFY 2025, filed March 6, 2026 | Chief Information Security Officer | not identified | Audit Committee |
| NIQ Global Intelligence plcFY 2025, filed February 27, 2026 | Chief Security Officer | not identified | Audit Committee |
| DoubleVerify Holdings, Inc.FY 2025, filed February 26, 2026 | Chief Information Security Officer | Chief Information Officer | Audit Committee |
| Pinterest, Inc.FY 2025, filed February 12, 2026 | Chief Security Officer | Chief Technology Officer | Audit and Risk Committee |
| MetaFY 2025, filed January 29, 2026 | Chief Information Security Officer | not identified | Audit & Privacy Committee |
More disclosures from filers CISO Tribune files under Technology: Amazon, Apple, Astera Labs, Atlassian, Autodesk, Booking Holdings, Box, CoreWeave.
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Alphabet's Form 10-K as filed with the SEC on February 5, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
ITEM 1C. CYBERSECURITY
23.
Alphabet Inc.
We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. For example, some risks include our software supply chain and other third-party dependencies, vulnerabilities in our products and services, theft of our intellectual property, and attempts to compromise our infrastructure. We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from multiple external experts and internal threat intelligence teams. Teams of dedicated privacy, safety, and security professionals oversee cybersecurity risk management and mitigation, incident prevention, detection, and remediation. These teams comprise professionals with deep cybersecurity expertise across multiple industries and are led by our Vice President of Privacy, Safety, and Security, who has more than 20 years of experience, including roles in technology infrastructure for two other large public companies. Our executive leadership team, along with input from the above teams, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the company.
As part of our cybersecurity risk management process, our incident management teams track and log privacy and security incidents across Alphabet, our vendors, and other third-party service providers to remediate and resolve any such incidents. Significant incidents are reviewed regularly by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is promptly escalated for further assessment, and then reported to designated members of our senior management. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions. Our management apprises Alphabet's independent public accounting firm of relevant matters and developments.
The Risk and Compliance Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration. Senior management regularly discusses cybersecurity risks and trends and, should they arise, any material incidents with the Risk and Compliance Committee. Internal Audit maintains a dedicated cybersecurity auditing team that independently tests our cybersecurity controls.
Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents . For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.
Earlier filings on record
Fiscal 2024 Form 10-K, filed February 5, 2025 sec.gov ↗
Top security role, as the filing names it
Vice President of Privacy, Safety, and Security Engineering
Reports to, as the filing names it
not identified
Board oversight
Audit and Compliance Committee
“The Audit and Compliance Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration.”
Person named in the filing
not identified
Experience, as stated
Stated
“These teams comprise professionals with deep cybersecurity expertise across multiple industries and are led by our Vice President of Privacy, Safety, and Security Engineering, who has 20 years of experience, including roles in technology infrastructure for two other large public companies.”
Material incident
The filing states none
“Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents .”
Read by claude-sonnet-5-5 on October 16, 2026; every quote verified in the stored text by code.
ITEM 1C. CYBERSECURITY
We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. For example, some risks include our software supply chain and other third-party dependencies, vulnerabilities in our products and services, theft of our intellectual property, and attempts to compromise our infrastructure. We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from multiple external experts and internal threat intelligence teams. Teams of dedicated privacy, safety, and security professionals oversee cybersecurity risk management and mitigation, incident prevention, detection, and remediation. These teams comprise professionals with deep cybersecurity expertise across multiple industries and are led by our Vice President of Privacy, Safety, and Security Engineering, who has 20 years of experience, including roles in technology infrastructure for two other large public companies. Our executive leadership team, along with input from the above teams, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the company.
As part of our cybersecurity risk management system, our incident management teams track and log privacy and security incidents across Alphabet, our vendors, and other third-party service providers to remediate and resolve any such incidents. Significant incidents are reviewed regularly by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is promptly escalated for further assessment, and then reported to designated members of our senior management. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior
25.
Alphabet Inc.
management makes the final materiality determinations and disclosure and other compliance decisions. Our management apprises Alphabet's independent public accounting firm of matters and any relevant developments.
The Audit and Compliance Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Audit and Compliance Committee. Internal Audit maintains a dedicated cybersecurity auditing team that independently tests our cybersecurity controls.
Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents . For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.
Fiscal 2023 Form 10-K, filed January 31, 2024 sec.gov ↗
Top security role, as the filing names it
Vice President of Privacy, Safety, and Security Engineering
Reports to, as the filing names it
not identified
Board oversight
Audit and Compliance Committee
“The Audit and Compliance Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration.”
Person named in the filing
not identified
Experience, as stated
Stated
“Leadership for these teams are professionals with deep cybersecurity expertise across multiple industries, including our Vice President of Privacy, Safety, and Security Engineering.”
Material incident
The filing states none
“Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents.”
Read by claude-sonnet-5-5 on October 16, 2026; every quote verified in the stored text by code.
ITEM 1C. CYBERSECURITY
We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from multiple external experts and internal threat intelligence teams. Teams of dedicated privacy, safety, and security professionals oversee cybersecurity risk management and mitigation, incident prevention, detection, and remediation. Leadership for these teams are professionals with deep cybersecurity expertise across multiple industries, including our Vice President of Privacy, Safety, and Security Engineering. Our executive leadership team, along with input from the above teams, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the company.
As part of our cybersecurity risk management system, our incident management teams track and log privacy and security incidents across Alphabet, our vendors, and other third-party service providers to remediate and resolve any such incidents. Significant incidents are reviewed regularly by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to designated members of our senior management. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our
24.
Alphabet Inc.
senior management makes the final materiality determinations and disclosure and other compliance decisions. Our management apprises Alphabet's independent public accounting firm of matters and any relevant developments.
The Audit and Compliance Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Audit and Compliance Committee. Internal Audit maintains a dedicated cybersecurity auditing team that independently tests our cybersecurity controls.
Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.