CYREN (CYRNQ) Risk Factors

Our ability to attract new customers and increase revenue from existing customers will depend in large part on our ability to enhance and improve our existing products and to introduce new products. The success of any enhancement or new product depends on several factors, including the timely completion, introduction and market acceptance of the enhancement or new product. Any enhancement or new product we develop or acquire may not be introduced in a timely or cost-effective manner and may not achieve the broad market acceptance necessary to generate significant revenue. If we are unable to successfully develop or acquire new products or enhance our existing products to meet customer requirements, we may not grow as expected. We cannot be certain that our development activities will be successful or that we will not incur delays or cost overruns. Furthermore, we may not have sufficient financial resources to identify and develop new technologies and bring enhancements or new products to market in a timely and cost-effective manner. New technologies and enhancements could be delayed or cost more than we expect, and we cannot ensure that any of these products will be commercially successful if and when they are introduced.

We regard our patented and patent pending technology, copyrights, service marks, trademarks, trade secrets and similar intellectual property as critical to our success, and rely on patent, trademark and copyright law, trade secret protection and confidentiality or license agreements with our employees and customers to protect our proprietary rights. See Item 1. Business, Intellectual Property for information pertaining to our patent activities. We may seek to patent certain additional software or other technology in the future. Any such patent applications might not result in patents issued within the scope of the claims we seek, or at all. Despite our precautions, unauthorized third parties may copy certain portions of our technology, reverse engineer or obtain and use information that we regard as proprietary or otherwise infringe or misappropriate our patent or our patent pending technology, trade secrets, copyrights, trademarks, and similar proprietary rights. In addition, the laws of some foreign countries do not protect proprietary rights to the same extent as do the laws of the United States. Thus, our means of protecting our proprietary rights in the United States or abroad, as well as our financial resources, may not be adequate, and competitors may independently develop similar technology. Given the cost, effort, risks, and downside of obtaining patent protection, including the requirement to ultimately disclose the invention to the public, we may not choose to seek patent protection for certain innovations. However, such patent protection could later prove to be important to our business. Even if issued, there can be no assurance that any patents will have the coverage originally sought or adequately protect our intellectual property, as the legal standards relating to the validity, enforceability, and scope of protection of patent and other intellectual property rights are uncertain. Any patents that are issued may be invalidated or otherwise limited, or may lapse or may be abandoned, enabling other companies to better develop products that compete with our solutions, which could adversely affect our competitive business position, business prospects and financial condition. Similarly, it may not always be feasible to enforce our trademark rights, should these be infringed. We cannot be certain that our security solutions do not infringe issued patents in certain parts of the world. Therefore, other parties, whether in the United States or elsewhere, may assert infringement claims against us. We may also be subject to legal proceedings and claims from time to time in the ordinary course of our business, including claims of alleged infringement of copyrights, trademarks, and other intellectual property rights of third parties by ourselves and our customers. Our customer agreements typically include indemnity provisions, so we may be obligated to defend against third party intellectual property rights infringement claims on behalf of our customers. Such claims, even if not meritorious, could result in the expenditure of significant financial and managerial resources. We may not have the proper resources in order to adequately defend against such claims.

We market and sell our products worldwide and have personnel in many parts of the world. In addition, we have sales offices and research and development facilities outside the United States, and we conduct, and expect to continue to conduct, a significant amount of our business with companies that are located outside the United States, particularly in Europe, Israel, and Asia. We also enter into strategic distributor and reseller relationships with companies in certain international markets where we do not have a local presence. If we are not able to maintain successful strategic distributor relationships internationally or recruit additional companies to enter into strategic distributor relationships, our future success in these international markets could be limited. Business practices and regulations in the international markets that we serve differ from those in the United States and Israel and periodically require us to include terms other than our standard terms in customer contracts. To the extent that we enter into customer contracts that include non-standard terms related to payment, warranties, or performance obligations, our operating results may be adversely impacted. Additionally, our international sales and operations are subject to a number of risks, including the following: - greater difficulty in enforcing contracts and accounts receivable collection and longer collection periods;- the uncertainty of protection for intellectual property rights in some countries;- greater risk of changes in regulatory practices, tariffs, and tax laws and treaties;- risks associated with trade restrictions and foreign legal requirements, including the importation, certification, and localization of our products required in foreign countries;- the potential that our operations in Israel and the U.S. may limit the acceptability of our products to some foreign governments, and vice versa;- greater risk of a failure of foreign employees, partners, distributors, and resellers to comply with both U.S. and foreign laws, including antitrust regulations, and any trade regulations ensuring fair trade practices;- heightened risk of unfair or corrupt business practices in certain geographies and of improper or fraudulent sales arrangements that may impact financial results and result in restatements of, or irregularities in, financial statements;- the potential for acts of terrorism, hostilities, or war;- the impact of COVID-19 on the economic conditions in these foreign markets and the travel restrictions in and between various geographic regions;- increased expenses incurred in establishing and maintaining office space and equipment for our multinational operations;- greater difficulty in recruiting local experienced personnel, and the costs and expenses associated with such activities;- management communication and integration problems resulting from cultural and geographic dispersion;- fluctuations in exchange rates between the U.S. Dollar, Shekel, Euro, Pound, and other foreign currencies in markets where we do business; and - general economic and political conditions and uncertainties in these foreign markets. In addition, following Russia's military invasion of Ukraine in February 2022, NATO deployed additional military forces to Eastern Europe, and the United States, European Union, and other nations announced various sanctions against Russia. The invasion of Ukraine and the retaliatory measures and sanctions that have been taken, and could be taken in future, by the U.S., NATO, and other countries have created global security concerns that could result in a regional conflict and otherwise have a lasting impact on regional and global economies, any or all of which could adversely affect our business. These factors and other factors could harm our ability to gain future international revenues and, consequently, materially impact our business, operating results, and financial condition. The expansion of our existing international operations and entry into additional international markets will require significant management attention and financial resources.

The market for security products and services is intensely competitive and characterized by rapid changes in technology, customer requirements, industry standards and frequent new product introductions and improvements. We anticipate continued challenges from current competitors as well as by new entrants into the industry. If we are unable to anticipate or effectively react to these competitive challenges, our competitive position could weaken, and we could experience a decline in our revenue that could adversely affect our business and results of operations. Many of our existing competitors have, and some of our potential competitors could have, substantial competitive advantages such as: - greater name recognition and larger customer bases;- larger sales and marketing budgets and resources;- broader distribution and established relationships with channel and distribution partners and customers;- greater customer support resources;- lower labor and research and development costs; and - substantially greater financial, technical, and other resources. In addition, some of our larger competitors have substantially broader product offerings and may be able to leverage their relationships with distribution partners and customers based on other products or incorporate functionality into existing products to gain business in a manner that may discourage users from purchasing our products, subscriptions and services, including by selling at zero or negative margins, product bundling or offering closed technology platforms. Potential customers may also prefer to purchase from their existing suppliers rather than a new supplier regardless of product performance or features. As a result, even if the features of our offerings are superior, customers may not purchase our services or products. In addition, innovative start-up companies, and larger companies that are making significant investments in research and development, may invent similar or superior products and technologies that compete with our product and services. Our current and potential competitors may also establish cooperative relationships among themselves or with third parties that may further enhance their resources. If we are unable to compete successfully, or if competing successfully requires us to take costly actions in response to the actions of our competitors, our business, financial condition, and results of operations could be adversely affected. Some of our competitors have acquired businesses that may allow them to offer more directly competitive and comprehensive solutions than they had previously offered. As a result of such acquisitions, our current or potential competitors might be able to adapt more quickly to new technologies and end user needs, devote greater resources to the promotion or sale of their products and services, initiate or withstand substantial price competition, take advantage of acquisitions or other opportunities more readily, or develop and expand their product and service offerings more quickly than we can. Due to various reasons, organizations may be more willing to incrementally add solutions to their existing security infrastructure from competitors than to replace it with our solutions. These competitive pressures in our market or our failure to compete effectively may result in price reductions, fewer orders, reduced revenue and gross margins, and loss of market share. Any failure to meet and address these factors could seriously harm our business and operating results. Also, many of our smaller competitors that specialize in providing protection from a single type of business security threat may deliver these specialized business security products to the market more quickly than we can or may introduce innovative new products or enhancements before we do. Conditions in our markets could change rapidly and significantly as a result of technological advancements.

The complexity of the underlying technological base of email, antivirus and web security solutions, and the current landscape of the markets, require highly trained sales and marketing personnel to educate prospective distributors, resellers, OEM and service provider partners and customers regarding the use and benefits of our solutions. We continue to be substantially dependent on our sales force to obtain new customers and to drive additional use cases and adoption among our existing customers. We believe that there is significant competition for sales personnel with the skills and technical knowledge that we require. Our ability to achieve significant revenue growth will depend, in large part, on our success in recruiting, training, and retaining sufficient numbers of sales personnel to support our growth. New hires require significant training and may take significant time before they achieve full productivity. Our recent hires and planned hires may not become productive as quickly as we expect, and we may be unable to hire or retain sufficient numbers of qualified individuals in the markets where we do business or plan to do business. Our future success depends on our ability to sell additional products to our customers, such as Cyren Inbox Security, which was made generally available for purchase in the second quarter of 2020. This may require increasingly sophisticated and costly sales efforts and may not result in additional sales. In addition, the rate at which our customers purchase additional solutions depends on a number of factors, including the perceived need for additional solutions, growth in the number of end users, and general economic conditions. If our efforts to sell additional solutions to our customers are not successful, our business, financial condition and/or results of operations may suffer.

Developing and maintaining awareness and integrity of our company and our new brand are important to achieving widespread acceptance of our existing and future offerings and are important elements in attracting new customers. The importance of brand recognition will increase as competition in our market further intensifies. Successful promotion of our brand will depend on the effectiveness of our marketing efforts and on our ability to provide reliable and useful solutions at competitive prices. We plan to continue investing substantial resources to promote our brand, both domestically and internationally, but there is no guarantee that our brand development strategies will enhance the recognition of our brand. Some of our existing and potential competitors have well-established brands with greater recognition than we have. If our efforts to promote and maintain our brand are not successful, our operating results and our ability to attract and retain customers may be adversely affected. In addition, even if our brand recognition and loyalty increases, this may not result in increased use of our solutions or higher revenue.

We received grants from the Government of Israel through a program with the Israel Innovation Authority, or the IIA (formerly known as the Office of the Chief Scientist of the Israeli Ministry of Economy and Industry), pursuant to the Israeli Law for the Encouragement of Industrial Research Development and Technological Innovation, 1984, and related regulations (the "R&D Law"), to finance a significant portion of our research and development expenditures in Israel. In order to meet specified conditions in connection with grants and programs of the IIA, we have made representations to the Israel government about our Israeli operations. One of the grants requires a minimum commitment of three years and we are required to share information with other companies and academics. From time to time, the conduct of our Israeli operations has deviated from our forecasts. If we fail to meet the conditions of the grants, including the maintenance of a material presence in Israel, or if there is any material deviation from the representations made by us to the Israeli government, we could be required to refund the grants previously received (together with an adjustment based on the Israeli consumer price index and an interest factor) and would likely be ineligible to receive IIA grants in the future. In addition, the terms of our IIA grants and programs prohibit the manufacture outside of Israel of the product developed in accordance with the program without the prior consent of the Research Committee. Such approval is generally subject to an increase in the total amount to be repaid to the IIA to between 120% and 300% of the amount granted, depending on the extent of the manufacturing that is conducted outside of Israel. In addition, the R&D Law provides that know-how from the research and development and any derivatives thereof, cannot be transferred or licensed to Israeli third parties without the approval of the Research Committee. The R&D Law stresses that it is not just transfer of know-how that is prohibited, but also transfer of any rights in such know-how. Approval of the transfer and/or license may be granted only if the Israeli transferee undertakes to abide by all of the provisions of the R&D Law and regulations promulgated thereunder, including the restrictions on the transfer of know-how and the obligation to pay royalties, if applicable. The know-how from the research and development and any derivatives thereof, cannot be transferred or licensed to non-Israeli third parties without the approval of the Research Committee, which approval is generally contingent on payment of a significant penalty of up to six times the grant amount plus LIBOR and minus any royalties paid. The total amount of grants received as of December 31, 2021 (none received since 2018) is approximately $6.4 million.

Many federal, state, and foreign government bodies and agencies have adopted, or are adopting, laws and regulations regarding the collection, use, and disclosure of personal information. Some of our solutions process customer data which may contain the personal information of end users, and any failure to adequately address privacy concerns, or to otherwise comply with applicable privacy laws and regulations could result in liability, damage to our reputation, loss of sales, or further harm our business. Privacy concerns, whether or not valid, may inhibit market adoption of our solutions. The costs of compliance with such laws and regulations that apply to our customers' business may in turn limit their use and adoption of our products and services and therefore reduce overall demand for them. We are subject to the privacy and data protection laws and regulations adopted by Israel, Europe and the United States and potentially other jurisdictions. Where the local data protection and privacy laws of a jurisdiction apply, we may be required to register our operations in that jurisdiction or make changes to our business so that registered users' data is only collected and processed in accordance with applicable local law. The proliferation of such laws within the jurisdictions in which we operate may result in conflicting and contradictory requirements, particularly in relation to evolving technologies such as cloud computing. Any failure to successfully navigate the changing regulatory landscape could result in legal liability or impairment to our reputation in the marketplace, which could have a material adverse effect on our business, results of operations and financial condition. In particular, the European Union has imposed greater obligations under their privacy and data protection laws. For example, the European Union adopted the General Data Protection Regulation (GDPR) which took effect on May 25, 2018 and is wide ranging in scope. GDPR replaced, to a large extent, the data protection laws of each European Union member state and imposed stringent requirements for data processors and controllers. Such requirements include more fulsome disclosures about the processing of personal information, data retention limits and deletion requirements, mandatory notification in the case of a data breach and heightened standards regarding valid consent in some specific cases of data processing. The GDPR also includes substantially higher penalties for failure to comply (a fine up to 20 million Euro or up to 4% of the annual worldwide turnover, whichever is greater, can be imposed). Given the breadth of the GDPR, compliance with its requirements is likely to continue to require significant expenditure of resources on an ongoing basis, and there can be no assurance that the measures we have taken for the purposes of compliance will be successful in preventing a violation of the GDPR. Given the potential fines, liabilities, and damage to our reputation in the event of an actual or perceived violation of the GDPR, such a violation may have an adverse effect on our business and operations. Similarly, California recently enacted the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA"), which, among other things, requires covered companies to provide new disclosures to California consumers and afford such consumers new rights to opt-out of the sale of their personal information and provides a private right of action for consumers to bring litigation in the event of certain data breaches. The CCPA provides that any consumer whose nonenecrypted and nonredacted personal information is subject to an unauthorized access and exfiltration, theft, or disclosure due to a business violating its duty to implement and maintain reasonable security procedures and practices can bring a cause of action and is entitled to statutory damages between $100 and $750 per consumer per incident. In addition, other states (e.g., Virginia, Colorado and Utah) have enacted legislation that regulates the collection, use, and sale of personal information. These laws go into effect in 2023, and many other states have similar proposed legislation pending. Such regimes might not be compatible with either the GDPR or the CCPA or may require us to undertake additional practices. In connection with the CCPA/CPRA, we experienced increased customer attention to data privacy. As state regulators continue to issue guidance on these state laws, we cannot yet fully predict the impact of these privacy laws on our business or operations, but we expect they will require us to further modify our data processing practices and policies and incur substantial costs and expenses in an effort to comply; non-compliance could potentially subject us to regulatory fines and/or civil lawsuits. Further, the United Kingdom Data Protection Act that substantially implements the GDPR became law in May 2018 and was subject to statutory amendments in 2019 that further align it with the GDPR. Post-Brexit, the United Kingdom has enacted its own version of the GDPR. On June 28, 2021, the European Commission announced that the UK was an adequate country for the purpose of permitting international data transfers of EU data. Accordingly, there remains little operational risk of transfers of data between the UK and EU. On February 2, 2022, the UK Secretary of State proposed the UK International Data Transfer Agreement (ITDA) addendum to the European Commission's Standard Contractual Clauses, and a document setting out transitional provisions. The ITDA addendum has not yet been approved by UK lawmakers, and the development of United Kingdom data protection laws or regulations and regulation of data transfers to and from the United Kingdom in the medium to longer term remains unclear. Even the perception of privacy, data protection or information security concerns, whether or not valid, may harm our reputation, inhibit adoption of our products by current and future customers, or adversely impact our ability to hire and retain workforce talent. If our security measures are or are believed to be inadequate or breached as a result of third-party action, employee negligence, error or malfeasance, product defects, social engineering techniques or otherwise, and this results in, or is believed to result in, the disruption of the confidentiality, integrity or availability of our systems or networks or any data we process or maintain, or the loss, destruction or corruption of such data, or our privacy practices are or are perceived to be inadequate, we could incur significant liability, we could face a loss of revenues, and our business may suffer and our reputation and competitive position may be damaged. If any of our customers or prospective customers decide not to purchase our products or services because of regulatory uncertainty, our revenues could decline and our business could suffer. Any inability by us, or a third-party contractor, to adequately address privacy concerns, whether valid or not, or to comply with applicable privacy or data protection laws, regulations and privacy standards, could result in additional cost and liability to us, damage our reputation, inhibit sales of our solutions and harm our business.

Any interruption or delay in the delivery of our services will negatively impact our customers. Our solutions are deployed via the internet, and our customers' internet traffic is routed through our cloud platform. Our customers depend on the continuous availability of our services, and our services are designed to operate in accordance with applicable service level commitments. The adverse effects of any service interruptions on our reputation and financial condition may be disproportionately heightened due to the nature of our business and the fact that our customers expect continuous and uninterrupted service and have a low tolerance for interruptions of any duration. The following factors, many of which are beyond our control, can affect the delivery and availability of our services and the performance of our cloud: - the development and maintenance of the infrastructure of the internet;- the performance and availability of third-party telecommunications services with the necessary speed, data capacity and security for providing reliable internet access and services;- decisions by the owners and operators of the data centers where our cloud infrastructure is deployed or by global telecommunications service provider partners who provide us with network bandwidth to terminate our contracts, discontinue services to us, shut down operations or facilities, increase prices, change service levels, limit bandwidth, declare bankruptcy or prioritize the traffic of other parties;- the occurrence of earthquakes, floods, fires, power loss, system failures, physical or electronic break-ins, acts of war or terrorism, human error, or interference (including by disgruntled employees, former employees, or contractors) and other catastrophic events;- failure by us to maintain and update our cloud infrastructure to meet our traffic capacity requirements;- errors, defects, or performance problems in our software, including third-party software incorporated in our software;- improper deployment or configuration of our services; and - the failure of our redundancy systems, in the event of a service disruption at one of our data centers, to provide failover to other data centers in our data center network. The occurrence of any of these factors, or if we are unable to efficiently and cost-effectively fix such errors or other problems that may be identified, could damage our reputation, negatively impact our relationship with our customers or otherwise materially harm our business, results of operations and financial condition.

Our success is substantially dependent on our ability to attract, retain and motivate the members of our management team and other key employees throughout our organization. Competition for highly skilled personnel is intense in Israel, Germany, Iceland, the United Kingdom, and the United States, where we have offices and a need for highly skilled personnel. We may not be successful in attracting qualified personnel to fulfill our current or future needs. Our competitors may be successful in recruiting and hiring members of our management team or other key employees, and it may be difficult for us to find suitable replacements on a timely basis, on competitive terms, or at all. Also, to the extent we hire employees from mature public companies with significant financial resources, we may be subject to allegations that such employees have been improperly solicited, that they have divulged proprietary or other confidential information or that their former employers own such employees' inventions or other work product. In addition, we believe that it is important to establish and maintain a corporate culture that facilitates the maintenance and transfer of institutional knowledge within our organization and also fosters innovation, teamwork, a passion for customers and a focus on execution. The loss of our software developers or senior operations personnel may also adversely affect the continued development and support of both our current messaging, antivirus and web security solutions and future solutions presently included in our roadmap for development, thereby causing our operating results to suffer and the value of your investment to decline. We do not have employment agreements inclusive of set periods of employment with any of our key personnel. We cannot prevent them from leaving at any time. We do not maintain key-person life insurance policies, listing us as a beneficiary, on any of our employees. If one or more of our key employees resigns or otherwise ceases to provide us with their service, our business, financial condition and/or results of operations could be harmed.