Genasys (GNSS) Risk Factors

In fiscal year 2024, direct and indirect sales to the U.S. government accounted for approximately 29% of our total net sales, compared with 59% of our total net sales in fiscal year 2023. Changes in defense spending could have an adverse effect on our current and future revenues. Sales of our products to U.S. government agencies and organizations are subject to the overall U.S. government budget and congressional appropriation decisions and processes which are driven by numerous factors, including geo-political events and macroeconomic conditions, and are beyond our control. Even awards granted may not result in orders due to spending constraints. Similar issues apply to sales to international governments. We have no assurance that military interest in communication devices to minimize unnecessary use of force will continue or will provide future growth opportunities for our business.

Our sales to government customers have involved, and are expected in the future to involve, providing products and services under contracts or subcontracts with U.S. federal, state, local, and foreign government agencies. Obtaining contracts and subcontracts from government agencies is challenging, and contracts often include provisions that are not standard in private commercial transactions. For example, government contracts may: - include provisions that allow the government agency to terminate the contract without penalty under some circumstances;- be subject to purchasing decisions of agencies that are subject to political influence;- contain onerous procurement procedures; and - be subject to cancellation if government funding becomes unavailable. Securing government contracts can be a protracted process involving competitive bidding. In many cases, unsuccessful bidders may challenge contract awards, which can lead to increased costs, delays, and possible loss of the contract for the winning bidder.

Our products are substantially different from proven, mass produced sound transducer designs and are often employed in harsh environments. We may incur substantial and unpredictable warranty costs from post-production product or component failures. We generally warrant our products to be free from defects in materials and workmanship for a period up to one year from the date of purchase. We also sell extended repair and maintenance contracts with terms ranging from one to several years, which provide repair and maintenance services after expiration of the original limited warranty. As of September 30, 2024, we had a warranty reserve of $76 thousand. While our warranty experience with our product line has been favorable, as we build more complexity into the product, and as we expand our supplier base, issues could arise that could affect future warranty costs, which could adversely affect our financial position, results of operations and business prospects.

While our products have been engineered to reduce the risk of damage to human hearing or human health, we could be exposed to claims of hearing damage if the product is not properly operated. A person injured in connection with the use of our products may bring legal action against us to recover damages on the basis of theories, including personal injury, negligent design, dangerous product or inadequate warning. We may also be subject to lawsuits involving allegations of misuse of our products. Our product liability insurance coverage may be insufficient to pay all such claims. Product liability insurance may also become too costly for us or may become unavailable to us in the future. We may not have sufficient resources to satisfy any product liability claims not covered by insurance, which would materially and adversely affect our operating results and financial condition. Significant litigation could also result in negative publicity and a diversion of management's attention and resources.

We are subject to laws, rules and regulations in the United States and other countries relating to the collection, use, transmission, processing and security of user and other data. Our ability to execute transactions and to possess, process, transmit and use personal information and data in conducting our business, for example with respect to our marketing efforts, which include email marketing and telemarketing, subjects us to legislative and regulatory obligations that, among other things, may require us to expend time, financial and other resources to monitor and interpret ever-evolving and complex data privacy and security laws. In particular, certain states have adopted new or modified privacy and security laws and regulations that may apply to our business, for example, the California Consumer Privacy Act ("CCPA") imposes obligations on businesses that process personal information of California residents. Among other things, the CCPA: requires disclosures to such residents about the data collection, use and disclosure practices of covered businesses; provides such individuals expanded rights to access, delete and correct their personal information and opt-out of certain transfers of personal information; and provides such individuals with a private right of action and statutory damages for data breaches. The enactment of the CCPA has prompted a wave of similar laws being passed in the United States, which creates the potential for a patchwork of overlapping but different state laws. For example, since the CCPA went into effect, other states, including Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, Nevada, New Hampshire, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, have all enacted comprehensive data privacy legislation. We cannot predict the full impact of these laws on our business or operations. Many other states are currently reviewing or proposing the need for greater regulation of the collection, sharing, use and other processing of information related to individuals for marketing purposes or otherwise, and there remains increased interest at the federal level as well. Additionally, other jurisdictions outside of the United States have or have recently enacted privacy and cybersecurity laws, such as the EU and the European Union where the General Data Protection Regulation ("GDPR") took effect in 2018, creating the potential for a patchwork of overlapping but different laws. We have incurred, and will continue to incur, significant expenses to comply with mandatory privacy and security standards and protocols under applicable laws, regulations, industry standards and contractual obligations. Despite such expenditures, we may face regulatory and other legal actions in the event of perceived or actual non-compliance with such applicable obligations. Many of these laws would also require us to notify regulators and customers, employees or other individuals of any data security breach as described above. The various data privacy enactments impose significant obligations and compliance with these requirements depends in part on how particular regulators apply and interpret them. Even though we believe we are generally in compliance with applicable laws, rules and regulations relating to privacy and data security, these laws are in some cases relatively new and the interpretation and application of these laws are uncertain. Any failure or perceived failure by us to comply with data privacy laws, rules, regulations, industry standards and other requirements could result in proceedings or actions against us by individuals, consumer rights groups, government agencies or others. We could incur significant costs in investigating and defending such claims and, if found liable, pay significant damages or fines or be required to make changes to our business. Further, these proceedings and any subsequent adverse outcomes may subject us to significant negative publicity and an erosion of trust. If any of these events were to occur, our business, results of operations and financial condition could be materially adversely affected.

We sell our products worldwide. In fiscal years 2024 and 2023, revenues outside of the U.S. accounted for approximately 30% and 22% of net revenues, respectively. The risks inherent in international trade may reduce our international sales and harm our business and the businesses of our customers and our suppliers. These risks include: - changes in tariff regulations;- political instability, war, terrorism, and other political risks;- foreign currency exchange rate fluctuations;- establishing and maintaining relationships with local distributors and dealers;- lengthy shipping times and accounts receivable payment cycles;- import and export control and licensing requirements, particularly in connection with sales and licensing to foreign governments and other customers;- compliance with a variety of U.S. laws, including the Foreign Corrupt Practices Act, by us or key subcontractors;- compliance with a variety of foreign laws and regulations, including unexpected changes in taxation and regulatory requirements;- greater difficulty in safeguarding our technology, proprietary data, and intellectual property in international jurisdictions than in the U.S.; and - difficulty in staffing and managing geographically diverse operations. These and other risks may preclude or curtail international sales or increase the relative price of our products compared to those manufactured in other countries, reducing the demand for our products. Failure to comply with U.S. and foreign governmental laws and regulations applicable to international business, such as the Foreign Corrupt Practices Act or U.S. export control regulations, could have an adverse impact on our business with the U.S. and foreign governments.

Our sales strategy for fiscal year 2025 and beyond is to increase our share of the growing emergency response and mass notification market with our Protective Communications solutions. A number of large companies currently have a substantial share of the market. While we believe we have a strong product platform that can successfully compete against these larger players, given the highly competitive environment, we expect to confront pricing pressures, which may negatively impact our overall margins.

We rely on computer systems, hardware, software, technology infrastructure and online sites and networks (collectively, "IT Systems") for both internal and external operations that are critical to our business. We own and manage some of these IT Systems but also rely on third parties for a range of IT Systems and related products and services. We have experienced cybersecurity incidents in the past, though none have materially impacted our Company, including our operations or financial condition. There can be no guarantee that future cyberattacks or incidents will not materially impact our Company generally or our IT Systems or data or that of critical service providers specifically. We face numerous and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our IT Systems and data. Those risks include data security incidents, cybersecurity events, data breaches, ransomware attacks or other compromises of the IT Systems that we or our vendors use to provide services or process data on our behalf, which may lead to compromised network security and misappropriation or compromise of our information, our customer's information or that of third parties, to system disruptions or to shutdowns. Cyberattack actors include criminal hackers, hacktivists, state-sponsored intrusions, and may involve industrial espionage, employee malfeasance and human or technological error. Computer hackers and others routinely attempt to breach the security of technology products, services and systems, and to fraudulently induce employees, customers and other third parties to disclose information or unwittingly provide access to systems or data. The risk of such attacks includes attempted breaches not only of our own products, services and systems, but also those of customers, contractors, business partners, vendors and other third parties. Our products, services and systems may be used in critical company, customer, government or other third-party operations, or involve the storage, processing and transmission of sensitive data, including valuable intellectual property, classified information, other proprietary or confidential data, regulated data and personal information of employees, customers and others. In our command-and-control software systems, we process, store and transmit data provided by our customers, which is vital to our customer's businesses and operations and may include sensitive and personal data. We also manage, store, transmit and otherwise process various sensitive personal or confidential data related to our company and our employees in the regular course of business. Successful breaches, employee malfeasance or human or technological error could result in, for example, unauthorized access to, disclosure, modification, misuse, loss or destruction of company, customer, government or other third party data or systems; theft of sensitive, regulated, classified or confidential data including personal information and intellectual property; the loss of access to critical data or systems through distributed denial-of-service attacks, denial-of-service attacks, ransomware attacks, supply chain attacks, destructive attacks or other means; and business delays, service or system disruptions or denials of service. Further, hardware and operating system software and applications that we produce or procure from third parties may contain defects in design or manufacture, including "bugs" and other problems that could interfere with the operation of such systems. Given the nature of complex systems, software and services like ours, and the scanning tools that we deploy across our networks, infrastructure and products, we regularly identify and track security vulnerabilities. We are unable to comprehensively guarantee patches or confirm that measures are in place to mitigate all such vulnerabilities, or that patches will be applied before vulnerabilities are exploited by a threat actor. If attackers are able to exploit critical vulnerabilities before patches are installed or mitigating measures are implemented, significant compromises could impact our and our customers' systems and data. The information technology systems we and our vendors use are vulnerable to outages, breakdowns or other damage or interruption from service interruptions, system malfunction, natural disasters, terrorism, war, and telecommunication and electrical failures. For example, in July 2024, a software update by CrowdStrike Holdings, Inc. ("CrowdStrike"), a cybersecurity technology company, caused widespread crashes of Windows systems into which it was integrated. Although we have not experienced any material impacts as a result of the CrowdStrike software update, we could in the future experience similar third-party software-induced interruptions to our operations, which would adversely affect our business, results of operations and financial condition. Cyberattacks are expected to accelerate on a global basis in both frequency and magnitude as threat actors are becoming increasingly sophisticated in using techniques and tools (including AI) that circumvent controls, evade detection and even remove forensic evidence. Further, the use of AI by us, our customers, suppliers, and third-party service providers, among others, may also introduce unique vulnerabilities. As a result, there can be no assurance that the systems we have designed to protect against cyberattacks, or our cybersecurity risk management program and processes, will be fully implemented, complied with or sufficient to identify, detect or prevent material consequences arising from such attacks in the future. In addition, we have acquired and continue to acquire companies that may have cybersecurity vulnerabilities and/or unsophisticated security measures, which could expose us to significant cybersecurity, operational, and financial risks. The costs to address product defects or any of the foregoing security problems and security vulnerabilities before or after a cyber incident could be significant. Remediation efforts may not be successful and could result in interruptions, delays or cessation of service and loss of existing or potential customers that may impede our sales, manufacturing, distribution or other critical functions. We could lose existing or potential customers for outsourcing services or other information technology solutions in connection with any actual or perceived security vulnerabilities in our products. In addition, breaches of our IT Systems or security measures and the unapproved dissemination of proprietary information or sensitive or confidential data about us or our customers or other third parties could expose us, our customers or other third parties affected to a risk of loss or misuse of this information, result in regulatory enforcement, litigation and potential liability, damage our brand and reputation or otherwise harm our business. Further, we rely in certain limited capacities on third-party data management providers and other vendors whose own security vulnerabilities or problems may have similar detrimental effects on us.