Cybersecurity Risk Management and Strategy Disclosure |
12 Months Ended |
|---|---|
Jul. 31, 2026 | |
| Cybersecurity Risk Management, Strategy, and Governance [Line Items] | |
| Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] |
Cybersecurity risk management and strategy
Our cybersecurity risk management is based on recognized cybersecurity industry frameworks and standards, including those of the National Institute of Standards and Technology, the Center for Internet Security Controls, and the International Organization for Standardization. We use these frameworks, together with information collected from internal assessments, to develop policies for the use of our information assets (for example, business information and information resources such as mobile phones, computers and workstations), access to specific intellectual property or technologies, and protection of personal information. We protect these information assets through industry-standard techniques, such as multifactor authentication, endpoint detection and response, network segmentation, email and web filtering, vulnerability and patch management, encryption, and centralized logging and monitoring of security events. We also work with internal stakeholders across the company to integrate foundational cybersecurity principles throughout our organization’s operations, including the employment of multiple layers of cybersecurity defenses, restricted access based on business needs, and integrity of our business information. We also regularly train our employees on cybersecurity awareness, confidential information protection and simulated phishing attacks.
We regularly engage -party assessors to conduct penetration testing and measure our program to industry standard frameworks. We also have standing engagements with incident response experts and external counsel. We frequently collaborate with industry experts and cybersecurity practitioners at other companies to exchange information about potential cybersecurity threats, best practices and trends.
Our cybersecurity risk management extends to risks associated with our use of third-party service providers. For instance, we conduct risk and compliance assessments of -party service providers that request access to our information assets. We also seek to include security, confidentiality and incident-notification requirements in our agreements with key providers, monitor our external attack surface and cloud environments for misconfigurations and exposures, and evaluate the security of the software and artificial intelligence tools we adopt.
Our cybersecurity risk management is an important part of our comprehensive business continuity program and enterprise risk management. Our global information security team periodically engages with a cross-functional group of subject matter experts and leaders to assess and refine our cybersecurity risk posture and preparedness. For example, we regularly evaluate and update contingency strategies for our business in the event that a portion of our information resources were to be unavailable due to a cybersecurity incident. We practice our response to potential cybersecurity incidents through regular tabletop exercises, threat hunting and red team exercises. We maintain a cybersecurity incident response plan that establishes procedures for detecting, containing, investigating and remediating incidents; for escalating incidents to senior management, the Audit Committee and, where appropriate, law enforcement; and for evaluating, together with our legal counsel and senior management, whether an incident is material and requires public disclosure or regulatory or customer notification.
|
| Cybersecurity Risk Management Processes Integrated [Flag] | false |
| Cybersecurity Risk Management Processes Integrated [Text Block] | Our cybersecurity risk management is based on recognized cybersecurity industry frameworks and standards, including those of the National Institute of Standards and Technology, the Center for Internet Security Controls, and the International Organization for Standardization. We use these frameworks, together with information collected from internal assessments, to develop policies for the use of our information assets (for example, business information and information resources such as mobile phones, computers and workstations), access to specific intellectual property or technologies, and protection of personal information. We protect these information assets through industry-standard techniques, such as multifactor authentication, endpoint detection and response, network segmentation, email and web filtering, vulnerability and patch management, encryption, and centralized logging and monitoring of security events. We also work with internal stakeholders across the company to integrate foundational cybersecurity principles throughout our organization’s operations, including the employment of multiple layers of cybersecurity defenses, restricted access based on business needs, and integrity of our business information. We also regularly train our employees on cybersecurity awareness, confidential information protection and simulated phishing attacks |
| Cybersecurity Risk Management Third Party Engaged [Flag] | true |
| Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true |
| Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false |
| Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block] | Our cybersecurity risk management is an important part of our comprehensive business continuity program and enterprise risk management. Our global information security team periodically engages with a cross-functional group of subject matter experts and leaders to assess and refine our cybersecurity risk posture and preparedness. For example, we regularly evaluate and update contingency strategies for our business in the event that a portion of our information resources were to be unavailable due to a cybersecurity incident. We practice our response to potential cybersecurity incidents through regular tabletop exercises, threat hunting and red team exercises. We maintain a cybersecurity incident response plan that establishes procedures for detecting, containing, investigating and remediating incidents; for escalating incidents to senior management, the Audit Committee and, where appropriate, law enforcement; and for evaluating, together with our legal counsel and senior management, whether an incident is material and requires public disclosure or regulatory or customer notification |
| Cybersecurity Risk Board of Directors Oversight [Text Block] |
Governance of cybersecurity risk management
.
As of the date of this Annual Report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incident, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.
|
| Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | Our Board of Directors, as a whole, has oversight responsibility for our strategic and operational risks. Our Audit Committee of our Board of Directors assists the Board of Directors with this responsibility by reviewing and discussing our risk assessment and risk management practices, including cybersecurity risks, with members of management. The Audit Committee, in turn, periodically reports on its review with the Board of Directors. Our Global Chief Information Officer and Chief Information Security Officer (“CIO/CISO”) reports to the Audit Committee at least quarterly on the state of our cybersecurity program, including significant threats and incidents, the results of internal and third-party assessments, and remediation efforts, and is expected to inform the Audit Committee and senior management promptly of any cybersecurity incident that could be significant to the Company |
| Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | Our Board of Directors, as a whole, has oversight responsibility for our strategic and operational risks. Our Audit Committee of our Board of Directors assists the Board of Directors with this responsibility by reviewing and discussing our risk assessment and risk management practices, including cybersecurity risks, with members of management. The Audit Committee, in turn, periodically reports on its review with the Board of Directors. Our Global Chief Information Officer and Chief Information Security Officer (“CIO/CISO”) reports to the Audit Committee at least quarterly on the state of our cybersecurity program, including significant threats and incidents, the results of internal and third-party assessments, and remediation efforts, and is expected to inform the Audit Committee and senior management promptly of any cybersecurity incident that could be significant to the Company |
| Cybersecurity Risk Role of Management [Text Block] | Management is responsible for the day-to-day assessment and management of cybersecurity risks. Our cybersecurity program is led by our CIO/CISO, who has served us for approximately 30 years and has approximately 30 years of experience in information security and information technology, including an offensive security background and extensive experience directing the investigation of, response to and remediation of cyberattacks and fraud schemes, coordinating with federal law enforcement and industry partners, and evaluating and deploying security technologies. The CIO/CISO oversees our global information security team, whose members hold relevant industry certifications and have experience in security operations, threat intelligence, incident response, penetration testing, cloud and network security, and governance, risk and compliance, and works closely with the technology and operational leaders of each of our business segments to address risks specific to their operations. The CIO/CISO and the information security team are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents through security monitoring and alerting, threat intelligence, internal and third-party assessments, and reports from our business units and service providers, and reports regularly to senior management and to the Audit Committee |
| Cybersecurity Risk Management Positions or Committees Responsible [Flag] | false |
| Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | Our Board of Directors, as a whole, has oversight responsibility for our strategic and operational risks. Our Audit Committee of our Board of Directors assists the Board of Directors with this responsibility by reviewing and discussing our risk assessment and risk management practices, including cybersecurity risks, with members of management. The Audit Committee, in turn, periodically reports on its review with the Board of Directors. Our Global Chief Information Officer and Chief Information Security Officer (“CIO/CISO”) reports to the Audit Committee at least quarterly on the state of our cybersecurity program, including significant threats and incidents, the results of internal and third-party assessments, and remediation efforts, and is expected to inform the Audit Committee and senior management promptly of any cybersecurity incident that could be significant to the Company |
| Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | Our Board of Directors, as a whole, has oversight responsibility for our strategic and operational risks. Our Audit Committee of our Board of Directors assists the Board of Directors with this responsibility by reviewing and discussing our risk assessment and risk management practices, including cybersecurity risks, with members of management. The Audit Committee, in turn, periodically reports on its review with the Board of Directors. Our Global Chief Information Officer and Chief Information Security Officer (“CIO/CISO”) reports to the Audit Committee at least quarterly on the state of our cybersecurity program, including significant threats and incidents, the results of internal and third-party assessments, and remediation efforts, and is expected to inform the Audit Committee and senior management promptly of any cybersecurity incident that could be significant to the Company |
| Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | Management is responsible for the day-to-day assessment and management of cybersecurity risks. Our cybersecurity program is led by our CIO/CISO, who has served us for approximately 30 years and has approximately 30 years of experience in information security and information technology, including an offensive security background and extensive experience directing the investigation of, response to and remediation of cyberattacks and fraud schemes, coordinating with federal law enforcement and industry partners, and evaluating and deploying security technologies. The CIO/CISO oversees our global information security team, whose members hold relevant industry certifications and have experience in security operations, threat intelligence, incident response, penetration testing, cloud and network security, and governance, risk and compliance, and works closely with the technology and operational leaders of each of our business segments to address risks specific to their operations. The CIO/CISO and the information security team are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents through security monitoring and alerting, threat intelligence, internal and third-party assessments, and reports from our business units and service providers, and reports regularly to senior management and to the Audit Committee |
| Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true |