Janus International Group (JBI) Risk Analysis

An increasing number of our products are delivered with Internet of Things ("IoT") capabilities and the accompanying interconnected device networks, which include sensors, data, and advanced computing capabilities. We have developed product software designs that we believe are less susceptible to cyber-attacks, but despite these efforts, if our products and services that include IoT solutions, artificial intelligence, or other technologies do not work as intended or are compromised, the possible consequences include, among other things, financial loss, reputational damage, exposure to legal claims or enforcement actions, theft of intellectual property, and diminution in the value of our investment in research, development, and engineering, which in turn could adversely affect our competitiveness and results of operations.

Our success is dependent, in part, upon protecting our proprietary information and technology. We may be unsuccessful in adequately protecting our intellectual property. No assurance can be given that confidentiality, non-disclosure, or invention assignment agreements with employees, consultants, or other parties will not be breached and will otherwise be effective in controlling access to and distribution of our platform or solutions, or certain aspects of our platform or solutions, and proprietary information. Further, these agreements do not prevent our competitors from independently developing technologies that are substantially equivalent or superior to our platform or solutions. Additionally, certain unauthorized use of our intellectual property may go undetected, or we may face legal or practical barriers to enforcing our legal rights even where unauthorized use is detected. Current law may not provide for adequate protection of our platform or data. Further, the laws of some countries do not protect proprietary rights to the same extent as the laws of the United States, and mechanisms for enforcement of intellectual property rights in some foreign countries may be inadequate. To the extent we expand our international activities, our exposure to unauthorized copying and use of our data, intellectual property, or certain aspects of our platform or our data may increase. Competitors, foreign governments, foreign government-backed actors, criminals, or other third parties may gain unauthorized access to our proprietary information and technology. Accordingly, despite our efforts, we may be unable to prevent third parties from infringing upon or misappropriating our technology and intellectual property. To protect our intellectual property rights, we may be required to spend significant resources to monitor and protect these rights, and we may or may not be able to detect infringement by our customers or third parties. Litigation has been and may be necessary in the future to enforce our intellectual property rights and to protect our trade secrets. Such litigation could be costly, time consuming, and distracting to management and could result in the impairment or loss of portions of our intellectual property. Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims, and counter suits attacking the validity and enforceability of our intellectual property rights. Our inability to protect our proprietary technology against unauthorized copying or use, as well as any costly litigation or diversion of our management's attention and resources, could delay further sales or the implementation of our platform or solutions, impair the functionality of our platform or solutions, delay introductions of new features, integrations, and capabilities, result in our substituting inferior or more costly technologies into our platform or solutions, or injure our reputation. In addition, we may be required to license additional technology from third parties to develop and market new features, integrations, and capabilities, and we cannot be certain that we could license that technology on commercially reasonable terms or at all, and our inability to license this technology could harm our ability to compete.

Our reputation and ability to attract, retain, and serve our users is dependent upon the reliable performance and security of our computer systems, mobile and other user applications, and those of third parties that we utilize in our operations. Although we employ comprehensive measures to prevent, detect, address, and mitigate cybersecurity threats, a cybersecurity incident could potentially result in the misappropriation, destruction, corruption, or unavailability of critical data, personal identifiable information, and other confidential or proprietary data (our own or that of third parties) and the disruption of business operations. Our ability to keep our business operating is highly dependent on the proper and efficient operation of IT service providers. Our systems and those of third parties that we utilize may be subject to cyber incident, damage or interruption from earthquakes, adverse weather conditions, lack of maintenance due to a pandemic, other natural disasters, terrorist attacks, security breach, power loss or telecommunications failures. Additionally, threats to network and data security are constantly evolving and becoming increasingly diverse and sophisticated. Interruptions in, destruction or manipulation of these systems, or with the internet in general, could make our service unavailable or degraded or otherwise hinder our ability to deliver our services. Service interruptions, errors in our software or the unavailability of computer systems used in our operations, delivery or user interface could diminish the overall attractiveness of our user service to existing and potential users. Our computer systems, mobile and other applications and systems of third parties we use in our operations are vulnerable to cybersecurity risks, including cyber-attacks and loss of confidentiality, integrity or availability, both from state-sponsored and individual activity, such as hacks, unauthorized access, computer viruses, denial of service attacks, physical or electronic break-ins and similar disruptions and destruction, and such unauthorized access to systems of third parties that we use has occurred in the past. Such systems may periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of data or intellectual property. Any attempt by hackers to obtain our data (including customer and corporate information) or intellectual property, disrupt our service, or otherwise access our systems, or those of third parties we use, if successful, could harm our business, be expensive to remedy and damage our reputation. We have implemented certain systems and processes to thwart hackers and protect our data and systems. There is no assurance that cybersecurity threats may not have a material impact on our Company or our service or systems in the future. Although we have cybersecurity insurance (subject to specified retentions or deductibles), such insurance may not fully cover all damages, fines, and claims arising from cybersecurity incidents or the damages, fines, and claims may exceed the amount of any insurance available or may not be insurable. Any significant disruption to our service or access to our systems could result in a loss of users, liability, and adversely affect our business and results of operation. We utilize our own communications and computer hardware systems located either in our facilities or in that of a third-party provider. In addition, we utilize third-party "cloud" computing services in connection with our business operations. Problems faced by us or our third-party web hosting, "cloud" computing, or other network providers, including technological or business-related disruptions, as well as cybersecurity threats, could adversely impact the experience of our users. While we perform cybersecurity due diligence on our key vendors and service providers, because we do not control such third parties and our ability to monitor their cybersecurity is limited, we cannot ensure the cybersecurity measures they take will be sufficient to protect any information we share with them or prevent any disruption arising from a technology failure, cyber-attack, or other information or security breach. We depend on such parties to implement adequate controls and safeguards to protect against and report cyber incidents. If such parties fail to deter, detect, or report cybersecurity incidents in a timely manner, we may suffer from financial and other harm, including to our information, operations, performance, employees, and reputation. We have experienced cybersecurity incidents previously; however, for the fiscal year ended December 28, 2024, no cybersecurity incident has had a material adverse effect on our business, strategy, results of operations, financial condition or reputation.

Our business continues to demand the use of sophisticated systems and technologies, including digital tools, SaaS offerings and cloud computing. As a result, we devote significant time and resources in maintaining, upgrading or replacing our systems and technologies in order to meet customers' demands and expectations. These types of activities subject us to additional costs and inherent risks associated with maintaining, upgrading, replacing, and changing these systems and technologies, including impairment of our ability to manage our business, loss of customer confidence and business, potential disruption of our internal control structure, substantial capital expenditures, additional administration and operating expenses, demands on management time, training our employees to operate the systems, and other risks and costs of delays or difficulties in transitioning to, or integrating, new systems and technologies into our current business. We rely on certain third-party providers to maintain and periodically upgrade many of these systems and technologies so that they can continue to support our business. Further, the software programs supporting our business are licensed to us by independent software developers. The inability of these developers or us to continue to maintain and upgrade our systems and technologies would disrupt or reduce the efficiency of our operations if we were unable to convert to alternate systems in an efficient and timely manner. In addition, costs and potential problems and interruptions associated with the implementation of new or upgraded systems and technologies, maintenance or adequate support of outdated or other existing systems and technologies could disrupt or reduce the efficiency of our business operations and could have an adverse effect on our operations if not anticipated and appropriately mitigated. Our competitive position may be adversely affected if we are unable to maintain, upgrade or replace systems and technologies that allow us to manage our business in a competitive manner. We also may not achieve the benefits that we anticipate from an upgraded or replaced system and technology. Additionally, any failure of a system or technology could impede our ability to timely collect and report financial results in accordance with applicable laws and regulations.

We are subject to various anti-corruption laws that prohibit improper payments or offers of payments to foreign governments and their officials by a U.S. person for the purpose of obtaining or retaining business. We operate in countries that may present a more corruptible business environment than the U.S. Such activities create the risk of unauthorized payments or offers of payments by one of our employees or agents that could be in violation of various laws, including the Foreign Corrupt Practices Act of 1977 ("FCPA"). We have implemented policies to discourage these practices by our employees and agents. However, existing safeguards and any future improvements may prove to be ineffective and employees or agents may engage in conduct for which we might be held responsible. If employees violate our policies or we fail to maintain adequate record-keeping and internal accounting practices to accurately record our transactions, we may be subject to regulatory sanctions. Violations of the FCPA or other anti-corruption laws may result in severe criminal or civil sanctions and penalties, and we may be subject to other liabilities which could materially adversely affect our business, results of operations and financial condition. We are also subject to similar anti-corruption laws in other jurisdictions.

Our customers' self-storage and commercial market facilities and any other facilities they acquire or develop in the future are and will be subject to operating risks common to real estate in general, any or all of which may negatively affect our customers, and in turn, negatively affect us. Our customers' self-storage and commercial market facilities are subject to increases in operating expenses such as real estate and other taxes, personnel costs including the cost of providing specific medical coverage to their employees, utilities, insurance, administrative expenses, and costs for repairs and maintenance. If our customers' operating expenses increase without a corresponding increase in revenues, they may decrease discretionary spending, which could diminish our profitability and limit our ability to make distributions to our stockholders.

We are a U.S.-based company potentially subject to tax in multiple U.S. and non-U.S. tax jurisdictions. Significant judgment is required in determining our global provision for income taxes, deferred tax assets or liabilities and in evaluating our tax positions on a worldwide basis. While we understand our tax positions to be consistent with the tax laws in the jurisdictions in which we conduct our business, it is possible that these positions may be overturned by jurisdictional tax authorities, which may have a significant impact on our global provision for income taxes. Tax laws are dynamic and subject to change as new laws are passed and new interpretations of the law are issued or applied. In December 2017, President Trump signed into law the Tax Cuts and Jobs Act (the "Tax Act"), which significantly revised the Internal Revenue Code of 1986, as amended (the "Code"). On March 27, 2020, the Tax Act was amended by the Coronavirus Aid, Relief, and Economic Security (CARES) Act. Certain provisions of the Tax Act, as amended by the CARES Act, may adversely affect us. The Tax Act requires complex computations that were not previously provided for under U.S. tax law. Furthermore, the Tax Act requires significant judgments to be made in interpretation of the law and significant estimates in the calculation of the provision for income taxes. Additional interpretive guidance may be issued by the U.S. Internal Revenue Service, the U.S. Department of the Treasury or another governing body that may significantly differ from our interpretation of the Tax Act, which may result in a material adverse effect on our business, cash flow, results of operations or financial condition. In August 2022, legislation commonly known as the Inflation Reduction Act (the "IRA") was signed into law. Among other things, the IRA includes a 1% excise tax on corporate stock repurchases, applicable to repurchases after December 31, 2022, and also a new minimum tax based on book income. Our analysis of the effect of the IRA on us is ongoing. It is possible that the IRA (or implementing regulations or other guidance) could adversely impact our current and deferred federal tax liability. Furthermore, other changes that may be enacted in the future, including changes to tax laws enacted by state or local governments in jurisdictions in which we operate, could materially increase the amount of taxes, including state and local taxes, we would be required to pay and could materially adversely affect our financial position and results of operations. Governmental tax authorities are increasingly scrutinizing the tax positions of companies. Many countries in the EU, as well as a number of other countries and organizations such as the Organization for Economic Cooperation and Development, are actively considering changes to existing tax laws that, if enacted, could increase our tax obligations in countries where we do business. If U.S. federal, state or local or non-U.S. tax authorities change applicable tax laws, our overall taxes could increase, and our business, financial condition or results of operations may be adversely impacted. In January 2025, President Trump issued an executive order directing the heads of all federal agencies to identify and begin the processes to suspend, revise, or rescind all agency actions that are unduly burdensome on the identification, development, or use of domestic energy resources. The Inflation Reduction Act may be subject to amendment or repeal through Congressional budget reconciliation. Consequently, future implementation and enforcement of these rules remains uncertain at this time.

The regulatory environment surrounding data privacy and protection is constantly evolving and can be subject to significant change. Outside of the U.S., data protection laws, including the U.K. and E.U. General Data Protection Regulation (the "GDPR"), also apply to some of our operations. Legal requirements in these countries relating to the collection, storage, processing, and transfer of personal data continue to evolve. The GDPR imposes, among other things, strict obligations and restrictions on the collection and use of U.K. and E.U. personal data, a requirement for prompt notice of data breaches in certain circumstances, a requirement for implementation of certain approved safeguards (such as the use of approved "standard contractual clauses" and the performance of appropriate data transfer impact assessments, as applicable) for transfers of personal data to other countries that have not been determined by the E.U. or the U.K. to provide adequate data privacy protections, and possible substantial fines for any violations. Numerous other countries, including those in which we operate, have introduced and, in some cases, enacted, similar data privacy and cyber and data security laws. The interpretation and enforcement of the laws and regulations described above are uncertain and subject to change and may require substantial costs to monitor and implement compliance with any additional requirements. Failure to comply with U.S. and international data protection laws and regulations could result in government enforcement actions (which could include substantial civil and/or criminal penalties), private litigation and/or adverse publicity, and could negatively affect our operating results and business.

The global economy can be negatively impacted by a variety of factors such as the spread of fear, the occurrence of man-made or natural disasters, severe weather, actual or threatened hostilities or war, terrorist activity, political unrest, civil strife, and other geopolitical events of uncertainty. Such adverse and uncertain economic conditions may impact demand for our products generally and may cause disruptions in our supply chain. Furthermore, in connection with continued tensions related to the ongoing conflict between Russia and Ukraine, governments in the U.S., U.K., and the E.U. have each imposed export controls on certain products as well as financial and economic sanctions on certain industry sectors and parties within Russia. Further escalation of geopolitical tensions (such as those between Israel and Gaza and between Taiwan and China) could generate a broader impact, which could expand into other markets where we do business and could adversely affect our business and/or our supply chain, our international subsidiaries, business partners, or customers in the broader region. This could include potentially destabilizing effects for the European continent or the global oil and natural gas markets. Additionally, increases in inflation, along with the uncertainties surrounding geopolitical developments and global supply chain disruptions, have caused, and may in the future cause, global economic uncertainty and uncertainty about the interest rate environment. A failure to adequately respond to these risks could have a material adverse impact on our financial condition, results of operations, or cash flows. In response to high levels of inflation and recession fears, the U.S. Federal Reserve, the European Central Bank, and the Bank of England have raised, and may continue to raise, interest rates and implement fiscal policy interventions. Even if these interventions lower inflation, they may also reduce economic growth rates, create a recession, and have other similar effects. The U.S. debt ceiling and budget deficit concerns have increased the possibility of credit-rating downgrades and economic slowdowns, or a recession in the United States. In addition, our ability to manage normal commercial relationships with our suppliers, distributors, and customers may suffer. As a result, certain customers may shift purchases to lower-priced or other perceived value-offerings during economic downturns as a result of various factors, including: job losses, inflation, higher taxes, reduced access to credit, change in federal economic policy, and recent international trade disputes. Our suppliers and distributors may become more conservative in response to these conditions and seek to reduce their inventories. Changes to trade policy, import laws, and tariffs may also have a material adverse effect on our business, financial condition and results of operations. The effects of current and future economic and political conditions and other events beyond our control on us, our suppliers, distributors, and customers could severely disrupt our operations and have a material adverse effect on our business, results of operations, financial condition, and prospects. Our results of operations depend upon, among other things, our ability to maintain and increase sales volumes with our existing customers, our ability to attract new consumers, the financial condition of our customers, and our ability to provide products that appeal to customers at the right price. Decreases in demand for our products without a corresponding decrease in costs would put downward pressure on margins and would negatively impact our financial results. Prolonged unfavorable economic conditions or uncertainty may have an adverse effect on our revenues and profitability and may result in customers making long-lasting changes to their discretionary spending behavior on a more permanent basis.

Our business is dependent upon the availability of raw materials and components for assembly. U.S. relations with the rest of the world remains uncertain with respect to taxes, trade policies, and tariffs, especially as the political landscape changes due to the recent U.S. presidential and congressional elections. Changes in U.S. administrative policy may lead to significant increases in tariffs for imported goods among other possible changes, and the current administration has indicated that it is likely to impose significant tariffs on imported goods. The imposition of such tariffs may strain international trade relations and increase the risk that foreign governments implement retaliatory tariffs on goods imported from the United States. These political and economic changes could have a material effect on global economic conditions and the stability of financial markets and could significantly reduce global trade. The imposition and continuation of tariffs and other potential changes in U.S. trade policy could increase the cost and/or limit the availability of raw materials, which could hurt our competitive position and adversely impact our business, financial condition, and results of operations. Additionally, challenging current and future global economic conditions, including inflation and supply chain disruptions may negatively impact our business operations and financial results.