SoundThinking Inc (SSTI) Risk Factors

Our operations involve the collection, receipt, storage, storage processing, generation, use, transfer, disclosure, protection, disposal of, transmission, and sharing (collectively, "processing") of proprietary, confidential, and sensitive data, including personal information, intellectual property, trade secrets and other sensitive information such as gunfire incident data, including date, time, address and GPS coordinates, occurring in our customer's coverage area (collectively, "sensitive information"). Additionally, our systems read, write, store and transfer information from third parties including criminal justice information. Cyber-attacks, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our sensitive information and information technology systems, and those of the third parties upon which we rely. Such threats are prevalent and continue to increase generally, and are increasingly difficult to detect, and come from a variety of sources, including traditional computer "hackers," threat actors, "hacktivists," organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we, the third parties upon which we rely, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our goods and services. We and the third parties upon which we rely may be subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing, credential harvesting, personnel misconduct or error, and supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, attacks enhanced or facilitated by artificial intelligence ("AI"), telecommunications failures, earthquakes, fires, floods, and other similar threats. For example, in November 2023, we discovered that a recently terminated employee logged on to an employee resource, obtained our confidential information, and began posting some of the information publicly on social media. We took steps to remove the information and prevent the former employee from posting the information again, but we are uncertain to what extent this will reoccur and the postings will affect our business or operations. In particular, ransomware attacks are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, ability to provide our products or services, loss of data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Remote work has become more common and has increased risks to our information technology systems and data, as more of our employees utilize network connections, computers and devices outside our premises or network, including working at home, while in transit and in public locations. We may be unable to anticipate or prevent techniques used to obtain unauthorized access or to sabotage systems because such techniques change frequently and often are not detected until after an incident has occurred. As we increase our customer base and our brand becomes more widely known and recognized, third parties may increasingly seek to compromise our security controls or gain unauthorized access to customer data or other sensitive information. Further, because of the nature of the services that we provide to our customers, we may be a unique target for attacks. Future or past business transactions (such as acquisitions or integrations, including of Forensic Logic, LLC and SafePointe, LLC) expose us to additional cybersecurity risks and vulnerabilities, as we and our systems are negatively affected by vulnerabilities and weaker security controls present in acquired or integrated entities' systems, products, processes and technologies. Furthermore, we may not have adequate visibility into security issues of such acquired or integrated entities, may discover security issues that were not found during due diligence of such entities, and it may be difficult to integrate companies and their products into our information technology environment and security program. We rely on third-party service providers and technologies to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, content delivery to customers, and other functions. We also rely on third-party service providers to provide other products, services, parts, or otherwise to operate our business. Our ability to monitor these third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. If third parties with whom we work, such as vendors or developers, violate applicable laws or our security policies, such violations may also put our systems and data at risk and could in turn have an adverse effect on our business. In addition, such a violation could expose sensitive data including; criminal justice information, and other data we are contractually obliged to keep confidential. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We take steps to detect and remediate vulnerabilities, but we may not be able to detect and remediate all vulnerabilities because the threats and techniques used to exploit the vulnerability change frequently and are often sophisticated in nature. Therefore, such vulnerabilities could be exploited but may not be detected until after a security incident has occurred. Unremediated high risk or critical vulnerabilities pose material risks to our business. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities. Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or our information technology systems, or those of the third parties upon whom we rely. A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely) to provide our solutions. We may expend significant resources or modify our business activities to try to protect against security incidents. Certain data privacy and security obligations may require us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and sensitive information. Applicable data privacy and security obligations may require us to notify relevant stakeholders of security incidents. Such disclosures are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences. For example, many governments have enacted laws requiring companies to notify individuals of data security incidents or unauthorized transfers involving certain types of personal information. In addition, some of our customers contractually require notification of any data security incident. If we (or a third party upon whom we rely) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal information); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; interruptions in our operations (including availability of data); financial loss; and other similar harms. Security incidents and attendant consequences may prevent or cause customers to stop using our solutions, deter new customers from using our solutions, and negatively impact our ability to grow and operate our business. Furthermore, security incidents experienced by our competitors, by our customers or by us may lead to public disclosures, which may lead to widespread negative publicity and significant costs. Any security compromise , whether actual or perceived, could harm our reputation, erode customer confidence in the effectiveness of our security measures, negatively impact our ability to attract new customers, cause existing customers to elect not to renew their subscriptions or subject us to third-party lawsuits, regulatory fines or other action or liability, which could materially and adversely affect our business and operating results. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security incidents. While we maintain general liability insurance coverage and coverage for errors or omissions, we cannot assure you that such coverage would be adequate or would otherwise protect us from liabilities or damages with respect to claims alleging compromise or loss of data, or that such coverage will continue to be available on acceptable terms or at all, or that such coverage will pay future claims. In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. Additionally, sensitive information of the Company or our customers could be leaked, disclosed, or revealed as a result of or in connection with our employee's, personnel's, or vendor's use of generative AI technologies.

We use generative AI tools in our business, including to generate code and other materials incorporated with our proprietary software and systems, and expect to use generative AI tools in the future. Generative AI tools producing content which can be indistinguishable from that generated by humans is a relatively novel development, with benefits, risks, and liabilities still unknown. Recent decisions of the U.S. Copyright Office suggest that we would not be able to claim copyright ownership in any source code, text, images, or other materials, which we develop through use of generative AI tools, and the availability of such protections in other countries is unclear. As a result, we could have no remedy if third parties reused those same materials, or similar materials also generated by AI tools. We also face risks to any confidential or proprietary information of the Company which we may include in any prompts or inputs into any generative AI tools, as the providers of the generative AI tools may use these inputs or prompts to further train the tools. Not all providers offer an option to opt-out of such usage, and, even where we do opt-out, we cannot guarantee that the opt-out will be fully effective. In addition, we have little or no insight into the third-party content and materials used to train these generative AI tools, or the extent of the original works which remain in the outputs. As a result, we may face claims from third parties claiming infringement of their intellectual property rights, or mandatory compliance with open source software or other license terms, with respect to software, or other materials or content we believed to be available for use, and not subject to license terms or other third-party proprietary rights. We could also be subject to claims from the providers of the generative AI tools, if we use any of the generated materials in a manner inconsistent with their terms of use. Any of these claims could result in legal proceedings and could require us to purchase a costly license, comply with the requirement of open source software license terms, or limit or cease using the implicated software, or other materials or content unless and until we can re-engineer such software, materials, or content to avoid infringement or change the use of, or remove, the implicated third-party materials, which could reduce or eliminate the value of our technologies and services. Our use of generative AI tools may also present additional security risks because the generated source code may have been modelled from publicly available code, or otherwise not subject to all of our standard internal controls, which may make it easier for hackers and other third parties to determine how to breach our website and systems that rely on the code. Any of these risks could be difficult to eliminate or manage, and, if not addressed, could have a material adverse effect on our business, results of operations, financial condition, and future prospects.

We have in the past experienced, and may in the future experience, performance issues due to a variety of factors, including infrastructure changes, human or software errors, intentional or accidental damage to our technology (including sensors), website or third-party hosting disruptions or capacity constraints due to a number of potential causes including technical failures, natural disasters or security attacks. If our security is compromised, our platform is unavailable or our users are unable to receive our alerts or otherwise communicate with our IRC reviewers, within a reasonable amount of time or at all, our business could be negatively affected. In some instances, we may not be able to identify the cause or causes of these performance problems within an acceptable period of time. In addition, our IRC department personnel operate either remotely or out of our offices. Any interruption or delay in service from our IRC, such as from a communications or power outage, could limit our ability to deliver our solutions. In addition, it may become increasingly difficult to maintain and improve the performance of our solutions, especially during peak usage times as the capacity of our IRC operations reaches its limits. If there is an interruption or delay in service from our IRC operations and a gunshot is detected but not reviewed in the allotted time, our software will flag the incident for off-line review. This may result in delayed notifications to our customers and as a result, we could experience a decline in customer satisfaction with our solutions and our reputation and growth prospects could be harmed. We expect to continue to make significant investments to maintain and improve the performance of our solutions. To the extent that we do not effectively address capacity constraints, upgrade our systems as needed and continually develop our technology to accommodate actual and anticipated changes in technology, our business, operating results and financial condition may be adversely affected.

We rely on wireless carriers, mainly AT&T and Verizon, to provide access to wireless networks for machine-to-machine data transmissions, which are an integral part of our services. Our wireless carriers may suspend wireless service to expand, maintain or improve their networks. These wireless carriers perform routine maintenance and periodic software and firmware updates that may damage our sensors or make them inoperable. Any suspension or other interruption of services would adversely affect our ability to provide our services to our customers and may adversely affect our reputation. In addition, the terms of our agreements with these wireless carriers provide that either party can cancel or terminate the agreement for convenience. If one of our wireless carriers were to terminate its agreement with us, we would need to source a different wireless carrier and/or modify our equipment during the notice period in order to minimize disruption in the performance of our solutions. Price increases or termination by our wireless carriers or changes to existing contract terms could have a material adverse effect on our business, operating results and financial condition. Furthermore, our reliance on wireless carriers may require updates to our technology and making such updates could also result in interruptions in our service or increase our costs of operations. We may not be able to successfully implement new technologies or adapt existing technologies to changing market demands. If we are unable to adapt timely to changing technologies, market conditions or customer preferences, our business, operating results and financial condition could be materially and adversely affected.

Agencies typically share their private CJIS data sets with us through subscription agreements. If we lose access to their data sets because of a technical problem, such as a ransomware attack, or other issues that arise through no fault of our own that makes that data set inaccessible, this may result in the loss of a customer to a competitor, subscriptions not being renewed and may make it more difficult to sell CrimeTracer in that geographic region and to the federal market.

Because our software is complex, undetected errors, failures or bugs may occur. Our software is often installed and used with different operating systems, system management software, and equipment and networking configurations, which may cause errors or failures of our software or other aspects of the computing environment into which it is deployed. In addition, deployment of our software into computing environments may expose undetected errors, compatibility issues, failures or bugs in our software. Despite our testing, errors, failures, vulnerabilities, or bugs may not be found in our software until it is released to our customers. Moreover, our customers could incorrectly implement or inadvertently misuse our software, which could result in customer dissatisfaction and adversely impact the perceived utility of our products as well as our brand. Any of these real or perceived errors, compatibility issues, failures or bugs in our software could result in negative publicity, reputational harm, loss of or delay in market acceptance of our software, loss of competitive position or claims by customers for losses sustained by them. In any such event, we may be required, or may choose, for customer relations or other reasons, to expend additional resources in order to correct the problem. Alleviating any of these problems could require significant expenditures of our capital and other resources and could cause interruptions or delays in the use of our solutions, which could cause us to lose existing or potential customers and could adversely affect our operating results and growth prospects.

Promoting and demonstrating the utility of our solutions as useful, reliable and important tools for law enforcement and security personnel is critical to the success of our business. Our ability to secure customer renewals, expand existing customer coverage areas, and enter into new customer contracts is dependent on our reputation and our ability to deliver our solutions effectively. We believe that our reputation among police departments using SoundThinking solutions is particularly important to our success. Our ability to meet customer expectations will depend on a wide range of factors, including: - our ability to continue to offer high-quality, innovative and accurate precision policing solutions;- our ability to maintain continuous gunshot detection monitoring during high outdoor-noise activity periods such as New Year's Day, the Fourth of July and Cinco de Mayo, and Carnival for international deployments;- our ability to maintain high customer satisfaction, including meeting our service level agreements standards;- the perceived value and quality of our solutions;- differences in opinion regarding the metrics that measure the success of our solutions;- our ability to successfully communicate the unique value proposition of our solutions;- our ability to provide high-quality customer support;- any misuse or perceived misuse of our solutions;- interruptions, delays or attacks on our platform;- litigation- or regulation-related developments; and - damage to or degradation of our sensors or sensor network by third parties. In some cases, if our solutions fail to detect threats such as a firearm or other potential weapon or explosive device, or if our products contain undetected errors or defects, these failures or errors could result in injury or loss of life, which could harm our brand and reputation, subject us to litigation and potential claims against us, and have an adverse effect on our business, operating results and financial condition. There is no guarantee that our solutions will detect and prevent all attacks, especially in light of the rapidly changing security landscape to which it must respond, as well as unique factors that may be present in our customers' operating environments. If our products fail to detect security threats for any reason, including failures due to customer personnel or security processes, it may also result in significant costs, the attention of our key personnel could be diverted, our customers may delay or withhold payment to us or elect not to renew or cause other significant customer relations problems to arise.

A portion of our technologies incorporates open source software, and we expect to continue to incorporate open source software into our platform in the future. Few of the licenses applicable to open source software have been interpreted by courts, and their application to the open source software integrated into our proprietary technology platform may be uncertain. If we fail to comply with these licenses, then pursuant to the terms of these licenses, we may be subject to certain requirements, including requirements that we make available the source code for our software that incorporates the open source software. We cannot assure you that we have not incorporated open source software in our software in a manner that is inconsistent with the terms of the applicable licenses or our current policies and procedures. If an author or other third party that distributes such open source software were to allege that we had not complied with the conditions of one or more of these licenses, we could incur significant legal expenses defending against such allegations. Litigation could be costly for us to defend, have a negative effect on our operating results and financial condition or require us to devote additional research and development resources to change our technology platform.

We license third-party software and depend on services from various third parties for use in our solutions. In the future, such software or services may not be available to us on commercially reasonable terms, or at all. Any loss of the right to use any of the software or services could result in decreased functionality of our solutions until equivalent technology is either developed by us or, if available from another provider, is identified, obtained and integrated, which could harm our business. In addition, any errors or defects in or failures of the third-party software or services could result in errors or defects in our solutions or cause our solutions to fail, which could harm our business and be costly to correct. Many of these providers attempt to impose limitations on their liability for such errors, defects or failures, and if enforceable, we may have additional liability to our customers or third-party providers that could harm our reputation and increase our operating costs. We will need to maintain our relationships with third-party software and service providers, and obtain from such providers software and services that do not contain any errors or defects. Any failure to do so could adversely impact our ability to deliver effective products to our customers and could harm our operating results.