Penguin Solutions (PENG) Risk Factors

Sales outside of the United States accounted for 43%, 39% and 49% of our net sales in 2024, 2023 and 2022, respectively. In addition, a significant portion of our product design and manufacturing is performed at our facilities in Malaysia and China, and a significant amount of our product design activities are performed in Taiwan and India. As a result, our business is and will continue to be subject to the risks generally associated with international business operations in Malaysia, China, Taiwan, India and other foreign countries, including: - compliance with numerous changing, and sometimes conflicting legal regimes on matters as diverse as tax, anticorruption, import/export controls and quotas, local manufacturing requirements, trade restrictions, tariffs, taxation, sanctions, immigration, internal and disclosure control obligations, securities regulation, anti-competition, data privacy, employment regulations and labor relations, and labor and human rights laws and expectations;- changes in social, political and economic conditions, including as a result of changes of administration, political regimes or sentiment in countries in which we operate or with which we do business;- transportation delays;- power and other utility shutdowns or shortages;- limitations on foreign investment;- disruptions in or lack of adequate infrastructure;- challenges protecting intellectual property and trade secrets;- exchange or currency controls and fluctuations, restrictions on currency convertibility and volatility of foreign exchange markets;- increased trade wars;- corruption or adverse political situations;- governmental intervention in local economies, industries, or the operations of specific companies, including us or our competitors;- changes or instability in local labor conditions, including strikes, work stoppages, protests and changes in employment regulations, increases in wages and the conditions of collective bargaining agreements;- compliance with travel restrictions, stay-at-home or work location conditions or other government or voluntary restrictions relating to epidemics or pandemics;- difficulties recruiting, employing and retaining qualified personnel to manage and oversee our local operations, sales and other activities;- difficulties in managing and overseeing employees and operations in locations far from senior management, which could result in compliance, control or other issues;- difficulties in obtaining governmental approvals and extension of existing incentives;- difficulties in collecting accounts receivable;- expropriation and nationalization of our assets in a particular jurisdiction; and - restrictions, or increases in existing tax rates, on repatriation of cash, dividends or profits. Some of the foreign countries in which we do business or have operations have been subject to social and political instability in the past, and interruptions in operations could occur in the future. Our net sales, results of operations and financial condition could be adversely affected by any of the foregoing factors.

We rely on computer systems, hardware, software, technology infrastructure and online sites and networks for both internal and external operations that are critical to our business (collectively, "IT Systems"). We own and manage some of these IT Systems but also rely on third parties for a range of IT Systems and related products and services. We have experienced cybersecurity incidents in the past, though none have materially impacted our Company, including our operations or financial condition. There can be no guarantee that future cyberattacks or incidents will not materially impact our Company generally or our IT Systems or data or that of critical service providers specifically. We face numerous and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our IT Systems and data. Those risks include data security incidents, cybersecurity events, data breaches, ransomware attacks or other compromises of the IT Systems we or that our vendors use to provide services or process data on our behalf, which may lead to compromised network security and misappropriation or compromise of our information or that of third parties, system disruptions or lead to shutdowns. Cyberattack actors include criminal hackers, hacktivists, state-sponsored intrusions, and may involve industrial espionage, employee malfeasance and human or technological error. Computer hackers and others routinely attempt to breach the security of technology products, services and systems, and to fraudulently induce employees, customers and other third parties to disclose information or unwittingly provide access to systems or data. The risk of such attacks includes attempted breaches not only of our own products, services and systems, but also those of customers, contractors, business partners, vendors and other third parties. Our products, services and systems may be used in critical company, customer, government or other third-party operations, or involve the storage, processing and transmission of sensitive data, including valuable intellectual property, classified information, other proprietary or confidential data, regulated data and personal information of employees, customers and others. In our on-demand and hosted solutions, such as POD, we process, store and transmit data provided by our customers, which may include sensitive and personal data. We also manage, store, transmit and otherwise process various sensitive personal or confidential data related to our company and our employees in the regular course of business. Successful breaches, employee malfeasance or human or technological error could result in, for example, unauthorized access to, disclosure, modification, misuse, loss or destruction of company, customer, government or other third party data or systems; theft of sensitive, regulated, classified or confidential data including personal information and intellectual property; the loss of access to critical data or systems through distributed denial-of-service attacks, denial-of-service attacks, ransomware attacks, supply chain attacks, destructive attacks or other means; and business delays, service or system disruptions or denials of service. Further, hardware and operating system software and applications that we produce or procure from third parties may contain defects in design or manufacture, including "bugs" and other problems that could interfere with the operation of such systems. Given the nature of complex systems, software and services like ours, and the scanning tools that we deploy across our networks, infrastructure and products, we regularly identify and track security vulnerabilities. We are unable to comprehensively guarantee patches or confirm that measures are in place to mitigate all such vulnerabilities, or that patches will be applied before vulnerabilities are exploited by a threat actor. If attackers are able to exploit critical vulnerabilities before patches are installed or mitigating measures are implemented, significant compromises could impact our and our customers' systems and data. The information technology systems we and our vendors use are vulnerable to outages, breakdowns or other damage or interruption from service interruptions, system malfunction, natural disasters, terrorism, war, and telecommunication and electrical failures. For example, in July 2024, a software update by CrowdStrike Holdings, Inc. ("CrowdStrike"), a cybersecurity technology company, caused widespread crashes of Windows systems into which it was integrated. Although we have not experienced any material impacts as a result of the CrowdStrike software update, we could in the future experience similar third-party software-induced interruptions to our operations, which would adversely affect our business, results of operations and financial condition. Cyberattacks are expected to accelerate on a global basis in both frequency and magnitude as threat actors are becoming increasingly sophisticated in using techniques and tools (including AI) that circumvent controls, evade detection and even remove forensic evidence. Further, the use of AI by us, our customers, suppliers, and third-party service providers, among others, may also introduce unique vulnerabilities. As a result, there can be no assurance that the systems we have designed to protect against cyberattacks, or our cybersecurity risk management program and processes, will be fully implemented, complied with or sufficient to identify, detect or prevent material consequences arising from such attacks in the future. In addition, we have acquired and continue to acquire companies that may have cybersecurity vulnerabilities and/or unsophisticated security measures, which could expose us to significant cybersecurity, operational, and financial risks. The costs to address product defects or any of the foregoing security problems and security vulnerabilities before or after a cyber incident could be significant. Remediation efforts may not be successful and could result in interruptions, delays or cessation of service and loss of existing or potential customers that may impede our sales, manufacturing, distribution or other critical functions. We could lose existing or potential customers for outsourcing services or other information technology solutions in connection with any actual or perceived security vulnerabilities in our products. In addition, breaches of our IT Systems or security measures and the unapproved dissemination of proprietary information or sensitive or confidential data about us or our customers or other third parties could expose us, our customers or other third parties affected to a risk of loss or misuse of this information, result in regulatory enforcement, litigation and potential liability, damage our brand and reputation or otherwise harm our business. Further, we rely in certain limited capacities on third-party data management providers and other vendors whose own security vulnerabilities or problems may have similar detrimental effects on us.

We believe that maintaining, developing and enhancing our brand and our reputation is critical to our relationships with our existing customers, suppliers and business partners and our ability to attract new customers and business partners. The successful promotion of our business will depend on a number of factors, including our marketing efforts, and ultimately our ability to continue to develop attractive products and to continue to provide services valued by customers. Although we believe it is important for our growth, our brand promotion activities may not be successful or yield increased revenue. On October 15, 2024, we rebranded and changed our name from SMART Global Holdings, Inc. to Penguin Solutions, Inc. This rebranding is a continuation of our strategic transformation over the past several years and reflects our focus on delivering leading-edge solutions that seek to solve the complexity of AI. However, customers, suppliers and business partners may be confused by the name change and investors may not perceive the expected benefits of our rebranding or business strategic efforts, which could materially and adversely impact our business, results of operations, financial condition and trading price of our ordinary shares.

Our future operating results depend in significant part upon the continued contributions of our key senior management and technical personnel, many of whom hold critical institutional knowledge and expertise and would be difficult to replace. Our future operating results also depend in significant part upon our ability to attract, train and retain qualified management, including for manufacturing and quality assurance, engineering, design, finance, marketing, sales and support. We are continually recruiting such personnel in various parts of the world. However, competition for such personnel across all of our markets can be strong. Our ability to attract, retain and motivate such personnel depends in part on our ability to offer competitive compensation packages, including salary, cash incentive compensation and share-based compensation along with other benefits and workplace policies, and we can provide no assurance that we will be successful in attracting or retaining such personnel now or in the future. In addition, particularly in the high-technology industry, the value of stock options, restricted share unit awards or other share-based compensation is an important element in the retention of employees. Declines in the value of our ordinary shares could adversely affect our ability to retain employees and we may have to take additional steps to make the equity component of our compensation packages more attractive to attract and retain employees. These steps could result in dilution to shareholders. The loss of any key employee, the failure of any key employee to adequately perform in his or her current position, our inability to attract, train and retain skilled employees as needed or the inability of our key employees to expand, train and manage our employee base as needed, could have a material adverse effect on our business, results of operations and financial condition.