Spok Holdings (SPOK) Risk Analysis

We have significant deferred income tax assets, including net operating loss ("NOL") carryforwards, that are available to offset future taxable income and increase cash flows from operations. Our ability to realize these benefits depends on generating sufficient taxable income before expiration and avoiding limitations under Section 382 of the Internal Revenue Code ("IRC"). The availability of future taxable income is dependent on our ability to profitably manage our operations to support a growing base of software revenue offset by declining wireless subscribers and revenue. To the extent that anticipated reductions in wireless operating expenses do not occur or sufficient revenue is not generated, we may not achieve sufficient taxable income to allow for use of our deferred income tax assets before they expire. The accounting for deferred income tax assets is based upon an estimate of future results, and any valuation allowance we may apply to our deferred tax assets may be increased or decreased as conditions change, tax laws or interpretations change, or if we are unable to implement certain tax planning strategies. If we are unable to use these deferred income tax assets, our financial condition and results of operations may be materially affected. In addition, a significant portion of our deferred income tax assets relate to NOLs. For example, we had a valuation allowance of $1.9 million and $2.3 million at December 31, 2025 and 2024, respectively, to reduce net deferred income tax assets as their realization did not meet the applicable more-likely-than-not criterion. In addition, if we use all of our deferred income tax assets, those benefits will not be available for future periods, which would negatively impact our financial condition and results of operations in such future periods.

In connection with running our business, we receive, store, use and otherwise process information that relates to individuals and/or constitutes "personal data," "personal information," "personally identifiable information," "protected health information" or similar terms under applicable data privacy laws (collectively, "Personal Information"), including from and about actual and prospective customers, as well as our employees and business contacts. As such, our business is subject to a variety of federal, state and international laws and regulations that apply to the collection, use, retention, protection, disclosure, transfer and processing of Personal Information. A substantial portion of our revenue comes from healthcare customers. Our software solutions may therefore handle or have access to personal health information subject in the United States to HIPAA, HITECH and related regulations as well as legislation and regulations in foreign countries. These statutes and related regulations impose numerous requirements regarding the use and disclosure of personal health information with which we and our software solutions must comply. Our failure to accurately anticipate or interpret these complex and technical laws and regulations could subject us to civil and/or criminal liability. Such failure could adversely impact our ability to market and sell our software solutions to healthcare customers and have a material adverse impact on our software sales. In addition, customers may use our wireless services to transmit protected health information subject to HIPAA and other regulatory requirements. While we offer encrypted pagers to our customers, many customers use wireless devices provided by us that do not encrypt text messages. While we disclaim liability for customer non-compliance with HIPAA and other privacy requirements, there remains some risk we could be held responsible for privacy violations by our customers. In addition to protected health information, the Company may handle or have access to Personal Information in the European Union or United Kingdom subject to the General Data Protection Regulation or its United Kingdom equivalent (together, the "GDPR"). The GDPR imposes several stringent requirements for controllers and processors of Personal Information and increases our obligations, including, for example, by requiring more robust disclosures to individuals, strengthening the individual data rights regime, shortening timelines for data breach notifications, limiting retention periods and secondary use of information, and imposing additional obligations when we contract third-party processors in connection with the processing of personal data. In addition, the GDPR restricts transfers of personal data outside of the European Economic Area and the United Kingdom, including to the United States, under certain scenarios. While lawful data transfer mechanisms exist, there remains uncertainty, and we are exposed to potential investigations and enforcement in this area. We are subject to existing privacy-related laws and regulations in the United States and other countries, which are evolving and are subject to potentially differing interpretations, and various federal and state or other international legislative and regulatory bodies may expand or enact laws regarding privacy and data security-related matters that impact our business. For example, in the United States, we are subject to the California Consumer Privacy Act ("CCPA"), which requires covered businesses to, among other things, provide certain disclosures to California consumers and afford such consumers certain privacy rights. The CCPA provides for civil penalties for violations, as well as a private right of action for certain security breaches that may increase security breach litigation. The CCPA has spurred similar legislation in many other states, and we expect this trend to continue. There can be no assurance that the security and testing measures we take relating to our offerings and operations will prevent all security breaches and data loss that could harm our business or the businesses of our customers and partners or otherwise expose us to privacy-related liability. These risks may increase as we continue to grow our services and offerings and as we receive, store and process more of our customers' data. Actual or perceived vulnerabilities may lead to regulatory investigations, claims against us by customers, partners or other third parties, or costs, such as those related to providing customer notifications and fraud monitoring. There can be no assurance that any provisions in our customer agreements limiting our liability will be enforceable or effective under applicable law. In addition, the cost and operational consequences of implementing further data protection measures could be significant. The data privacy and protection-related laws and regulations to which we are subject are evolving, with new or modified laws and regulations proposed and implemented frequently, and existing laws and regulations subject to new or different interpretations. Any failure by us to comply with data privacy- and protection-related laws and regulations could result in enforcement actions, significant penalties or fines or other legal actions (including class action lawsuits) against us or our customers or suppliers. An actual or alleged failure to comply, which could result in negative publicity, reduce demand for our offerings, increase the cost of compliance, require changes in business practices that result in reduced revenue, restrict our ability to provide our offerings in certain locations, result in our customers' inability to use our offerings and prohibit data transfers or result in other claims, liabilities or sanctions, including fines, and could have an adverse effect on our business, financial condition, operating results and cash flows.

Software products, such as those we offer, may contain defects, vulnerabilities and bugs when they are first introduced or as new versions are released, or their release may be delayed due to unforeseen difficulties during product development. If any of our products, including products of companies we have acquired, or third-party components used in our products, contain defects, vulnerabilities or bugs, or have reliability, quality or compatibility problems, we may not be able to successfully design workarounds or resolve these issues. Any defects or vulnerabilities we do not detect and fix in pre-release testing could result in reduced sales and revenue, damage to our reputation, repair or remediation costs, delays in the release of new products or versions or legal liability. In addition, we do not control the quality, security or testing of various third-party software, hardware or infrastructure products that are utilized in our business. There can be no assurance that provisions in our license agreements that limit our exposure to liability will be sufficient or withstand legal challenge. Computer programmers and hackers also may be able to develop and deploy, including through technologies such as artificial intelligence, viruses, worms, and other malicious software programs that attack our or a critical third party's products or otherwise exploit any security vulnerabilities of such products.

To execute our growth plan and achieve our strategic objectives, we must continue to attract, hire and retain highly qualified and motivated personnel across our organization. In particular, to continue to enhance our software solutions, add new and innovative core functionality and services and develop new products, it is critical for us to maintain a strong research and development organization, including hiring and retaining highly skilled software engineers. Competition for talent is intense within our industry, and there continues to be upward pressure on compensation, especially as a result of higher inflation. In addition, for us to achieve broader market acceptance of our software solutions, grow our customer base, and pursue adjacent markets, we will need to continue to develop and maintain our sales and marketing and customer support organizations. Identifying and recruiting qualified personnel, training them in the use of our software solutions and ensuring they are well-equipped to serve our customers requires a significant investment of time and resources, and it can be particularly difficult to retain these individuals. We face significant competition for experienced personnel, and many of our competitors for talent have greater name recognition and financial resources than we have. If we hire employees from competitors or other companies, former employers may assert claims against us for breach of legal obligations to the former employer, resulting in a diversion of our time and resources. In addition, the job market for technology roles has historically been very competitive. While we are able to expand our candidate pool by opening our opportunities nationwide, allowing us to be more competitive, the job market continues to be a challenge everywhere, making it vitally important to retain our current team members. When considering employment opportunities, candidates and existing employees often consider the value of equity awards. If the actual or perceived value of our equity awards declines, or if the price of our common stock experiences significant volatility, this may adversely affect our ability to recruit and retain highly skilled employees. As a result, we may have greater difficulty hiring and retaining skilled personnel than some of our competitors. If we are unable to attract and retain the personnel necessary to execute our growth plan, we may be unable to achieve our strategic objectives, and our business, financial condition, operating results and ability to pay cash dividends to stockholders may be adversely affected.

We generate more than 75% of our revenue from sales to hospitals and other healthcare provider organizations in the United States. These customers, both non-profit and for-profit, are greatly affected by macroeconomic conditions, pandemics or other public health emergencies, healthcare reform legislation and the reimbursement policies of federal and state governments and health insurance companies, and any decline in revenue received by our customers due to adverse economic conditions, pandemics or other public health emergencies, or legislative or regulatory changes could significantly affect the type and amount of services and products they order from us.

Our business is sensitive to recessionary economic cycles, the impact of trade disputes, tariffs and other trade protection measures, higher interest rates, inflation and higher levels of unemployment, higher tax rates and other changes in tax laws, or other economic factors that may affect business spending or buying habits that could adversely affect the demand for our services. Adverse economic conditions could increase the rate of gross subscriber cancellations and/or the level of revenue erosion for our wireless business and could cause delays in or the loss of software revenue or bookings, which impacts license, professional services, hardware and subscription revenues. A significant portion of our revenue is derived from healthcare customers, and we are impacted by changes in the healthcare economic environment. The healthcare industry is highly regulated and is subject to changing political, legislative, regulatory, and other economic developments. These developments can have a dramatic effect on the decision-making and spending by our customers for information technology and software, including our ability to increase prices. This economic uncertainty can add to the unpredictability of decision-making and lengthen our sales cycle. We are unable to predict the full consequences of this uncertainty on our operations. Adverse changes in the economic environment could adversely impact our ability to increase the prices we charge for our offerings, while effectively managing customer churn, or to successfully market and sell our wireless and software solutions to healthcare customers.