Disclosure · Form 10-K · fiscal 2025
Evolv Technologies Holdings, Inc. 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed March 10, 2026· period ended December 31, 2025· EVLV· CIK 1805385· Updated · filing on sec.gov ↗
Evolv Technologies Holdings, Inc.'s Form 10-K for fiscal 2025, filed March 10, 2026, names the Vice President of Cybersecurity and Information Technology as its top security role, with oversight by the Audit Committee.
What the filing says, in plain English
Who leads security (the top role, as the filing names it)
Vice President of Cybersecurity and Information Technology
Reports to
not identified
Board oversight
Audit Committee
“Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Audit Committee") oversight of cybersecurity and other IT risks.”
CISO or other person named
not identified
Frameworks and standards named
NIST Cybersecurity Framework, SOC 2
Where the filing names them
- NIST Cybersecurity Framework: “We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and SOC 2 trust principles on security.”
- SOC 2: “We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and SOC 2 trust principles on security.”
Outside assessors, consultants or testers
Described
“Our Vice President of Cybersecurity and Information Technology is responsible for assessing and managing our material risks from cybersecurity threats and has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.”
Experience of the security leadership, as stated
Stated
“Our Vice President of Cybersecurity and Information Technology has served in that position since 2022, and has extensive experience assessing and managing cybersecurity programs and technology risk.”
Material incident
The filing states none
“We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition.”
The section
611 words, Form 10-K filed March 10, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on October 29, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Evolv Technologies Holdings, Inc. standard industrial classification 3577, Computer peripheral equipment, nec (SEC SIC list). 3 other filers in our library have the same code. Also shown: filers whose codes the SEC assigns to the same review office (Office of Technology).
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Palo Alto NetworksFY 2026, filed September 10, 2026 | chief information security officer | not identified | Security Committee |
| FortinetFY 2025, filed February 25, 2026 | Chief Information Security Officer | board Cybersecurity Committee | Cybersecurity Committee |
| Mitek Systems IncFY 2025, filed December 11, 2025 | VP of Technology Operations and Information Security | not identified | full board |
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| ReposiTrak, Inc.FY 2026, filed September 28, 2026 | not identified | not identified | Audit Committee |
| DONALDSON Co IncFY 2026, filed September 25, 2026 | Chief Information Officer | not identified | audit committee |
| EGAIN CorpFY 2026, filed September 10, 2026 | Chief Information Security Officer | Chief Financial Officer | Audit Committee |
| Twin Disc IncFY 2026, filed September 4, 2026 | not identified | not identified | Audit Committee of the Board of Directors |
| ZscalerFY 2026, filed September 3, 2026 | chief security officer | not identified | audit committee of the board of directors |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Evolv Technologies Holdings, Inc.'s Form 10-K as filed with the SEC on March 10, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
ITEM 1C. CYBERSECURITY
Cybersecurity Risk Management and Strategy
We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.
We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and SOC 2 trust principles on security. This does not imply that we meet any particular technical standards, specifications, or requirements, but only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.
Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.
Key elements of our cybersecurity risk management program include:
• risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;
• a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;
• the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls;
• cybersecurity awareness training of our employees, incident response personnel, and senior management;
• a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and
• a third-party risk management process for service providers that includes a diligence and contracting process depending on our assessment of each provider's respective criticality and risk profile.
We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Our products collect and store personal data about individuals, including our customers, their visitors, and our employees, as well as other proprietary business and confidential information."
Cybersecurity Governance
Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Audit Committee") oversight of cybersecurity and other IT risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.
The Audit Committee receives periodic reports from our Vice President of Cybersecurity and Information Technology on our cybersecurity risks, updates, as necessary, regarding any cybersecurity incidents, as well as any incidents with lesser impact potential.
The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.
Our Vice President of Cybersecurity and Information Technology is responsible for assessing and managing our material risks from cybersecurity threats and has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Vice President of Cybersecurity and Information Technology has served in that position since 2022, and has extensive experience assessing and managing cybersecurity programs and technology risk. Prior to joining Evolv, our Vice President of Cybersecurity and Information Technology was the Leader of Global Information Security for New Balance.
Our Vice President of Cybersecurity and Information Technology supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.
Earlier filings on record
Fiscal 2024 Form 10-K, filed April 28, 2025 sec.gov ↗
Top security role, as the filing names it
Vice President of Cybersecurity and Information Technology
Reports to, as the filing names it
not identified
Board oversight
Audit Committee
“Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Audit Committee") oversight of cybersecurity and other IT risks.”
Person named in the filing
not identified
Experience, as stated
Stated
“Our Vice President of Cybersecurity and Information Technology has served in that position since 2022, and has extensive experience assessing and managing cybersecurity programs and technology risk.”
Material incident
The filing states none
“We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition.”
Read by claude-sonnet-5-5 on October 29, 2026; every quote verified in the stored text by code.
ITEM 1C. CYBERSECURITY
Cybersecurity Risk Management and Strategy
We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.
We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and SOC 2 trust principles on security. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.
Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.
Key elements of our cybersecurity risk management program include:
• risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;
• a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;
• the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls;
• cybersecurity awareness training of our employees, incident response personnel, and senior management;
• a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and
• a third-party risk management process for service providers that includes a diligence and contracting process depending on our assessment of each provider's respective criticality and risk profile.
We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Because our products collect and store visitor and related information and images, domestic and international privacy and cybersecurity concerns, and other laws and regulations, could result in additional costs and liabilities to us or inhibit sales of our products."
Cybersecurity Governance
Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Audit Committee") oversight of cybersecurity and other IT risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.
The Audit Committee receives periodic reports from our Vice President of Cybersecurity and Information Technology on our cybersecurity risks, updates, as necessary, regarding any cybersecurity incidents, as well as any incidents with lesser impact potential.
The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.
Our Vice President of Cybersecurity and Information Technology is responsible for assessing and managing our material risks from cybersecurity threats and has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Vice President of Cybersecurity and Information Technology has served in that position since 2022, and has extensive experience assessing and managing cybersecurity programs and technology risk. Prior to joining Evolv, our Vice President of Cybersecurity and Information Technology was the Leader of Global Information Security for New Balance.
Our Vice President of Cybersecurity and Information Technology supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.
Fiscal 2023 Form 10-K, filed February 29, 2024 sec.gov ↗
Top security role, as the filing names it
Vice President of Cybersecurity and Information Technology
Reports to, as the filing names it
not identified
Board oversight
Audit Committee
“Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of cybersecurity and other information technology risks.”
Person named in the filing
not identified
Experience, as stated
Stated
“Our Vice President of Cybersecurity and IT has served in that position since 2022, and has extensive experience assessing and managing cybersecurity programs and technology risk.”
Material incident
The filing states none
“We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition.”
Read by claude-sonnet-5-5 on October 29, 2026; every quote verified in the stored text by code.
ITEM 1C. CYBERSECURITY
Cybersecurity Risk Management and Strategy
We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.
We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and SOC 2 trust principles on security. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.
Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.
Key elements of our cybersecurity risk management program include:
• risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;
• a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;
• the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls;
• cybersecurity awareness training of our employees, incident response personnel, and senior management;
• a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and
• a third-party risk management process for service providers that includes a diligence and contracting process depending on our assessment of each provider's respective criticality and risk profile.
We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Because our products collect and store visitor and related information and images, domestic and international privacy and cybersecurity concerns, and other laws and regulations, could result in additional costs and liabilities to us or inhibit sales of our products."
Cybersecurity Governance
Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.
The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.
The Committee reports to the full Board regarding its activities, including those related to cybersecurity.
Our management team, including our Vice President of Cybersecurity and Information Technology, is responsible for assessing and managing our material risks from cybersecurity threats. The management team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Vice President of Cybersecurity and IT has served in that position since 2022, and has extensive experience assessing and managing cybersecurity programs and technology risk. Prior to joining Evolv, our Vice President of Cybersecurity and IT was the Leader of Global Information Security for New Balance.
Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.