N-able (NABL) Risk Analysis

Our business is subject to a wide variety of local, state, national and international laws, directives and regulations that apply to the collection, use, retention, protection, disclosure, transfer and other processing of personal data. Moreover, because many of the features of our offerings use, store and report on SMB data, which may contain personal data, any inability to adequately address privacy concerns, to honor a data subject request, to delete stored data at the relevant times, or to comply with applicable privacy laws, regulations and policies could, even if unfounded, result in liability to us and, damage to our reputation, loss of sales and harm to our business. These data protection and privacy-related laws and regulations continue to evolve and are expected to result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions and increased costs of compliance. In the United States, these include rules and regulations promulgated under the authority of the Federal Trade Commission, and state privacy and breach notification laws, and in the European Economic Area ("EEA") and the UK, include such data privacy laws and regulations as the European Union General Data Protection Regulation and United Kingdom General Data Protection Regulation and Data Protection Act 2018. Certain of these laws created a range of new compliance obligations, and significantly increased financial penalties for noncompliance. We expect that there will continue to be new proposed laws, regulations and industry standards concerning privacy, data protection and information security in the United States, the European Union and other jurisdictions, and we cannot yet determine the impact such future laws, regulations and standards will have on our business or the businesses of our customers. We continue to assess the impact of existing and emerging laws, monitor relevant guidance, and refine our processes accordingly. In addition, global privacy and data protection legislation, enforcement and policy activity are rapidly expanding and evolving, and may be inconsistent from jurisdiction to jurisdiction. We may, in addition to other impacts, experience additional costs associated with increased compliance burdens relative to transfers of personal data from the European Union to the United States, and we, our customers and their SMB and mid-market customers face the potential for regulators in the EEA to apply different standards to the transfer of personal data from the EEA to the United States, and to block, or require ad hoc verification of measures taken with respect to, certain data flows from the EEA to the United States. In response to the Court of Justice of the European Union invalidating the EU-U.S. Privacy Shield Framework, one of the mechanisms that allowed companies to transfer personal data from the EEA to the United States, in 2020, the EU and United States governments adopted the EU-U.S. Data Privacy Framework (the "DPF") in 2023. While the General Court of the European Union upheld the validity of the DPF in 2025, that decision may still be appealed. Failure to comply with laws concerning privacy, data protection and information security could result in enforcement action against us, including fines, imprisonment of company officials and public censure, claims for damages by our customers, their end-customers, and other affected individuals, damage to our reputation and loss of goodwill (both in relation to existing IT services provider customers and their end-customers and prospective IT services provider customers and their end-customers), any of which could have a material adverse effect on our operations, financial performance and business. In addition, we could suffer adverse publicity and loss of customer confidence were it alleged or found that we did not take adequate measures to assure the confidentiality of the personal data that our customers had given to us. This could result in a loss of customers and revenue that could jeopardize our success. We may not be successful in avoiding potential liability or disruption of business resulting from the failure to comply with these laws and, even if we comply with laws, may be subject to liability because of a security incident. If we were required to pay any significant amount of money in satisfaction of claims under these laws, or any similar laws enacted by other jurisdictions, or if we were forced to cease our business operations for any length of time as a result of our inability to comply fully with any of these laws, our business, operating results and financial condition could be adversely affected. Further, complying with the applicable notice requirements in the event of a security breach could result in significant costs. Additionally, our business efficiencies and economies of scale depend on generally uniform solutions offerings and uniform treatment of customers across all jurisdictions in which we operate. Compliance requirements that vary significantly from jurisdiction to jurisdiction impose added costs on our business and can increase liability for compliance deficiencies.

Our success depends, in part, on our ability to protect proprietary methods and technologies that we develop or license so that we can prevent others from using our inventions and proprietary information. If we fail to protect our intellectual property rights adequately, our competitors might gain access to our technology and our business might be adversely affected. However, protecting and enforcing our intellectual property rights might entail significant expenses. Any of our intellectual property rights may be challenged by others, weakened or invalidated through administrative process or litigation. We rely primarily on a combination of patent, copyright, trademark, trade dress, unfair competition and trade secret laws, as well as confidentiality procedures and contractual restrictions, to establish and protect our proprietary rights. These laws, procedures and restrictions provide only limited protection. As of December 31, 2025, we had ten issued patents. The process of obtaining patent protection is expensive and time-consuming and we may not be able to prosecute all necessary or desirable patent applications at a reasonable cost or in a timely manner. Even if issued, there can be no assurance that these patents, or our existing patents, will adequately protect our intellectual property, as the legal standards relating to the validity, enforceability and scope of protection of patent and other intellectual property rights are uncertain. Our patents and any future patents issued to us may be challenged, invalidated or circumvented, and may not provide sufficiently broad protection or may not prove to be enforceable in actions against alleged infringers. Any patents that are issued may subsequently be invalidated or otherwise limited, allowing other companies to develop offerings that compete with ours, which could adversely affect our competitive business position, business prospects and financial condition. In addition, issuance of a patent does not guarantee that we have a right to practice the patented invention. Patent applications in the United States are typically not published until 18 months after filing or, in some cases, not at all, and publications of discoveries in industry-related literature lag behind actual discoveries. We cannot be certain that third parties do not have blocking patents that could be used to prevent us from marketing or practicing our patented software or technology. We endeavor to enter into agreements with our employees and contractors and with parties with which we do business in order to limit access to and disclosure of our trade secrets and other proprietary information. We cannot be certain that the steps we have taken will prevent unauthorized use, misappropriation or reverse engineering of our technology. Moreover, others may independently develop technologies that are competitive to ours and may infringe our intellectual property. The enforcement of our intellectual property rights also depends on our legal actions against these infringers being successful, but these actions may not be successful, even when our rights have been infringed. Further, any litigation, whether or not resolved in our favor, could be costly and time-consuming. Our exposure to risks related to the protection of intellectual property may be increased in the context of acquired technologies as we have a lower level of visibility into the development process and the actions taken to establish and protect proprietary rights in the acquired technology. In connection with past acquisitions, we have found that some associated intellectual property rights, such as domain names and trademarks in certain jurisdictions, are owned by resellers, distributors or other third parties. In the past, we have experienced difficulties in obtaining assignments of these associated intellectual property rights from third parties. Furthermore, effective patent, trademark, trade dress, copyright and trade secret protection may not be available in every country in which our solutions are available. The laws of some foreign countries may not be as protective of intellectual property rights as those in the United States (in particular, some foreign jurisdictions do not permit patent protection for software), and mechanisms for enforcement of intellectual property rights may be inadequate. In addition, the legal standards, both in the United States and in foreign countries, relating to the validity, enforceability and scope of protection of intellectual property rights are uncertain and still evolving. Accordingly, despite our efforts, we may be unable to prevent third parties from infringing upon or misappropriating our intellectual property. We might be required to spend significant resources to monitor and protect our intellectual property rights. We may initiate claims or litigation against third parties for infringement of our proprietary rights or to establish the validity of our proprietary rights. Litigation also puts our patents at risk of being invalidated or interpreted narrowly and our patent applications at risk of not issuing. Additionally, we may provoke third parties to assert counterclaims against us. We may not prevail in any lawsuits that we initiate, and the damages or other remedies awarded, if any, may not be commercially viable. Any litigation, whether or not resolved in our favor, could result in significant expense to us and divert the efforts of our technical and management personnel, which may adversely affect our business, results of operations, financial condition and cash flows.

We are heavily dependent on our technology infrastructure to operate our business, and our customers rely on our solutions to help manage and secure their IT infrastructure and environments, and that of their end-customers, including the protection of confidential information. Despite our implementation of security measures and controls, our systems, the systems of our third-party service providers upon which we rely, the systems of our customers and the virtualized systems of our customers, as well as the information that those systems store and process are vulnerable to attack from numerous threat actors, including sophisticated nation-state and nation-state-supported actors (including advanced persistent threat intrusions). Threat actors have been, and may in the future be, able to compromise our security measures or otherwise exploit vulnerabilities in our systems, including vulnerabilities that may have been introduced through the actions of our employees or contractors or defects in design or manufacture of our products and systems or the products and systems that we procure from third parties. In doing so, they have been, and may in the future be, able to breach or compromise our IT systems, including those which we use to design, develop, deploy and support our products, and access and misappropriate our, our current and former employees' and our customers' proprietary and confidential information, including our software source code, introduce malware, ransomware or vulnerabilities into our products and systems and create system disruptions or shutdowns. By virtue of the role our products play in helping to manage and secure the environments and systems of our customers and their end customers, attacks on our systems and products can result in similar impacts on our customers' and their customers' systems and data. Cybersecurity has become increasingly important to our customers as their end customers experience increased security threats while more of their workforce works remotely. Larger volumes of remote devices are connecting to networks driving increased vulnerability and incidences of ransomware and phishing attacks are growing, making security a high priority for businesses. The potential impact of cybersecurity breaches or incidents affecting customers' remote monitoring of multiple businesses' networks and devices is significant. Moreover, the number and scale of cyberattacks have continued to increase and the methods and techniques used by threat actors, including sophisticated "supply-chain" attacks continue to evolve at a rapid pace, particularly through the use of AI by threat actors. In addition, the democratization of coding is contributing to an increase in the scale, speed, and sophistication of attacks. As a result, we may be unable to identify current attacks, anticipate these attacks or implement adequate security measures. We have experienced, and may in the future experience, security breaches that may remain undetected for an extended period and, therefore, have a greater impact on our solutions, our proprietary data or the data of our IT services provider customers or their end-customers, and ultimately on our business. In addition, our ability to defend against and mitigate cyberattacks depends in part on prioritization decisions that we and third parties upon whom we rely make to address vulnerabilities and security defects. While we endeavor to address all identified vulnerabilities in our products, we must make determinations as to how we prioritize developing and deploying the respective fixes and we may be unable to do so prior to an attack. Likewise, even once a vulnerability has been addressed, for certain of our products, the fix will only be effective once a customer has updated the impacted product with the latest release, and customers that do not install and run the remediated versions of our products, and their end-customers, may remain vulnerable to attack. Cyberattacks and other security incidents have resulted, and in the future may result, in numerous risks and adverse consequences to our business, including that (a) our prevention, mitigation and remediation efforts may not be successful or sufficient, (b) our confidential and proprietary information, including our source code, as well as personal information related to current or former employees and customers, may be accessed, exfiltrated, misappropriated, compromised or corrupted, (c) we incur significant financial, legal, reputational and other harms to our business, including, loss of business, decreased sales, severe reputational damage adversely affecting current and prospective customer, employee or vendor relations and investor confidence, U.S. or foreign regulatory investigations and enforcement actions, litigation, indemnity obligations, damages for contractual breach, penalties for violation of applicable laws or regulations, including laws and regulations in the United States and other jurisdictions relating to the collection, use and security of user and other personally identifiable information and data, significant costs for remediation, impairment of our ability to protect our intellectual property, stock price volatility and other significant liabilities, (d) our insurance coverage, including coverage relating to certain security and privacy damages and claim expenses, may not be available or sufficient to compensate for all liabilities we incur related to these matters or that we may face increased costs to obtain and maintain insurance in the future, and (e) our steps to secure our internal environment, adapt and enhance our software development and build environments and ensure the security and integrity of the solutions that we deliver to our customers may not be successful or sufficient to protect against future threat actors or cyberattacks. We have incurred and expect to continue to incur significant expenses related to our cybersecurity initiatives.