Immersion (IMMR) Risk Factors

Our business involves the storage and transmission of customers' proprietary and confidential information, including information that may be personal information, and other data. In addition, we collect, use and maintain our own confidential and proprietary business information, including information that may be personal information, and maintain intellectual property internally on our systems. Computer malware, ransomware, cyberattacks and other threats and methods used to gain unauthorized access to our information technology networks and systems have become more prevalent and sophisticated. These threats and attempts, which may be related to industrial or other espionage, could include covertly introducing malware such as viruses, worms and other malicious software programs to our computers and networks, impersonating authorized users, and fraudulently inducing employees or customers into disclosing sensitive information such as user names, passwords or other information in order to gain access to our data or our customers' data, among other possible methods of security breach. These threats are constantly evolving, making it increasingly difficult to successfully defend against them or implement adequate protective measures. Because the techniques used to obtain unauthorized access or to sabotage systems change frequently and generally are not recognized until launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative measures. There can be no assurance that any security measures that we or our third-party service providers have implemented will be effective against current or future security threats. Our security measures or those of our third-party service providers could fail, whether as a result of third-party action, employee error, malfeasance or otherwise, and could result in unauthorized access to or use of our systems or unauthorized, accidental, or unlawful access to, or disclosure, modification, misuse, loss or destruction of, our intellectual property and data and data of our customers. In addition, our customers may authorize third party technology providers to access their customer data. Because we do not control the transmissions between our customers and third-party technology providers or the processing of such data by third-party technology providers, we cannot ensure the integrity or security of such transmissions or processing. We might be unaware of any actual or potential security breach or be delayed in detecting a security breach, or, even if we are able to identify a breach, we may be unaware of its magnitude and effects. Actual or perceived security breaches could result in unauthorized use of or access to our systems, system interruptions or shutdowns, unauthorized, accidental, or unlawful access to, or disclosure, modification, misuse, loss or destruction of, our or our customers' data or intellectual property, may lead to litigation, indemnity obligations, regulatory investigations and other proceedings, severe reputational damage adversely affecting customer or investor confidence and causing damage to our brand, indemnity obligations, disruption to our operations, damages for contract breach, and other liability, reduction in the value of our investment in research and development and other strategic initiatives, and adverse effects upon our revenues and operating results. Additionally, our service providers may suffer, or be perceived to suffer, data security breaches or other incidents that may compromise data stored or processed for us that may give rise to any of the foregoing. More generally, any of the foregoing types of security breaches, or the perception that any of them have occurred, may lead to the expenditure of significant financial and other resources in efforts to investigate or correct a breach or incident and to address and eliminate vulnerabilities and to prevent future security breaches, as well as significant costs for remediation that may include liability for stolen intellectual property or other assets or information and repair of system damage that may have been caused, incentives offered to customers in an effort to maintain business relationships, and other liabilities. We have incurred and expect to incur significant expenses in an effort to prevent security breaches and other security incidents. We cannot be certain that our insurance coverage will be adequate for data security liabilities actually incurred, will cover any indemnification claims against us relating to any incident, that insurance will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could have a material adverse effect on our business, including our financial condition, operating results, and reputation.