Bentley Systems (BSY) Risk Analysis

We rely heavily on our direct sales force. From time to time, we reorganize and make adjustments to our sales leadership and/or our sales force in response to such factors as management changes, performance issues, market opportunities, and other considerations. These changes may result in a temporary lack of sales production and may adversely impact revenues in future quarters. Market acceptance of any new business or sales initiative is dependent on our ability to match our accounts' needs at the right time and price. There can be no assurance that we will not restructure our sales force in future periods or that the transition issues associated with such a restructuring will not occur. Similarly, reorganization of our research and development and administrative functions can disrupt our operations and negatively impact our results of operations if the execution is not managed properly. If any of our assumptions about expenses, revenues, or revenue recognition principles from these initiatives proves incorrect, or our attempts to improve efficiency are not successful, our actual results may vary materially from those anticipated, and our financial results could be negatively impacted.

As we digitize and use cloud and web-based technologies to leverage account data to deliver a more complete account experience, we are exposed to increased security risks and the potential for unauthorized access to, or improper use of, our and our accounts' information. Certain of our services involve the storage and transmission of accounts' proprietary information, and security breaches could expose us to a risk of loss of this information,litigation, and possible liability. Although we devote resources to maintaining our security and integrity, we may not prevent security incidents. The risk of a security breach or disruption, particularly through cyber-attack or cyber intrusion, including by computer hackers, foreign governments, and cyber terrorists, has increased as the number, intensity, and sophistication of attempted attacks and intrusions from around the world have increased. These threats include but are not limited to identity theft, unauthorized access, domain name system attacks, wireless network attacks, viruses and worms, advanced persistent threat, application centric attacks, peer-to-peer attacks, phishing, backdoor trojans, and distributed denial of service attacks. Any of the foregoing could attack our accounts' data (including their employees' personal data), our data (including colleagues' personal data), our IT systems or those of our accounts and/or critical vendors. It is virtually impossible for us to entirely eliminate this risk. Like all software, our software is vulnerable to cyber-attacks. The impact of cyber-attacks could disrupt the proper functioning of our software or services, cause errors in the output of our accounts' work, allow unauthorized access to sensitive, proprietary, or confidential information of ours or our accounts, and other destructive outcomes. Additionally, third parties may attempt to fraudulently induce colleagues or accounts into disclosing sensitive information such as user names, passwords, or other information in order to gain access to our accounts' data, our data, or our IT systems. Malicious third parties may also conduct attacks designed to temporarily deny accounts access to our services. Any security breach could result in a loss of confidence in the security of our products and services, damage our reputation, negatively impact our future sales, disrupt our business, and lead to regulatory inquiry and legal liability.

As a global software and service provider, we collect and process personal data and other data from our users and prospective users. We use this information to provide software offerings to our accounts, to validate user identity, to fulfill contractual duties and administer billing and support, to expand and improve our business, and to communicate and recommend products and services through our marketing and advertising efforts. We may also share accounts' personal data with certain third parties as described in the privacy statement provided to each account. We may also share accounts' personal data with certain third parties as described in the privacy statement provided to each account. Further, we collect and otherwise process personal data of our global employees and contractors. Governments, regulators, privacy advocates, plaintiffs' attorneys, and our users and accounts are increasingly focused on how companies collect, process, use, store, share, and transmit personal data. Regulation relating to the provision of our software is evolving, as federal, state, and foreign governments continue to adopt new, or modify existing, laws and regulations addressing privacy, data protection, data sovereignty, information security and the collection, processing, storage, sharing, transmission, and use of data generally. This evolving regulatory landscape may be subject to differing interpretations, jurisdiction specific inconsistencies, or may conflict with other rules. We expect the regulatory landscape to remain uncertain for the foreseeable future. Further, our expectation is that there will continue to be new laws, regulations, and industry standards applicable to our collection, processing, storage, sharing, transmission, and use of data generally. Globally, laws such as the General Data Protection Regulation (the "GDPR") in the European Union (the "E.U.") and the Personal Information Protection Law (the "PIPL") in China have been enacted, and numerous other countries have proposed or have enacted laws concerning privacy, data protection, data sovereignty, and information security; these laws impose obligations directly on us as both a data controller and a data processor, as well as on many of our users. In addition, new and emerging state laws in the U.S. governing privacy, data protection, and information security, such as the California Consumer Privacy Act ("CCPA"), the California Privacy Rights Act ("CPRA"), and numerous laws in other states, many of which provide for obligations similar to the CCPA and CPRA, have been enacted. These laws and regulations, as well as industry self-regulatory codes, create new compliance obligations and substantially expand the scope of potential liability and provide greater penalties for non-compliance. For example, the GDPR provides for penalties of up to €20 million or 4% of a company's annual global revenue, whichever is greater, the PIPL provides for penalties of up to 50 million renminbi or 5% of a company's annual revenue and disgorgement of all illegal gains, whichever is greater, and the CCPA provides for penalties of up to $7,988 per violation. Although, we monitor the regulatory environment and have invested in addressing these developments, operating in an increasingly complex regulatory landscape may impact our innovation and business drivers in developing new and emerging technologies (e.g., AI). Globally, these and other requirements are causing increased scrutiny amongst users, particularly in the public sector and highly regulated industries, which could restrict the use and adoption of our software (in particular cloud services). Further, these developments may require us to take on more onerous obligations in our contracts, restrict our ability to store, transfer, and process data or, in some cases, impact our ability or our users' ability to offer our services in certain locations, to deploy our offerings, or to derive insights from user data globally. Around the world, there is continued uncertainty in relation to the legal mechanisms supporting cross-border data flows which are subject to evolving guidance, active litigation, and enforcement proceedings in a number of jurisdictions. A number of countries including China, Australia, New Zealand, Brazil, and Japan have established specific requirements for cross-border data transfers. Further, a number of countries and states have adopted or are considering adopting data localization policies which would further restrict cross-border data transfers and may require data to be localized in the country of origin (potentially at a state level) which could substantially impact our operations. Our failure to comply with applicable laws and regulations, or to protect data, could result in enforcement action against us, including fines and public censure, claims for damages by users, accounts, and other affected individuals, damage to our reputation and loss of goodwill (both in relation to existing accounts and prospective accounts), any of which could harm our business, financial condition, and results of operations. Around the world, there are numerous lawsuits in process against various technology companies that process personal data. If those lawsuits are successful, it could increase the likelihood that we may be exposed to liability for our own policies and practices concerning the processing of personal data and could hurt our business. Our accounts expect us to meet voluntary certification or other standards established by third parties or imposed by the accounts themselves. If we are unable to maintain these certifications or meet these standards, it could adversely affect our ability to provide our software to certain accounts and could harm our business. Further, if we were to experience a breach of systems compromising our accounts' sensitive data, our brand and reputation could be adversely affected, use of our software and services could decrease, and we could be exposed to a risk of loss, litigation, and regulatory proceedings. The costs of compliance with and other burdens imposed by laws, regulations, and standards may limit the use and adoption of our services and reduce overall demand for them, or lead to significant fines, penalties, or liabilities for any noncompliance. Furthermore, concerns regarding privacy, data protection, cross-border data flows, and information security may cause our accounts' customers to resist providing the data necessary to allow our accounts to use our services effectively. Even the perception that the privacy of data is not satisfactorily protected or does not meet regulatory requirements could inhibit sales of our software or services, and could limit adoption of our cloud-based offerings.

Our operations and performance depend significantly on foreign and domestic economic and political conditions. Uncertainty regarding economic and political conditions may negatively impact us as accounts defer spending or postpone infrastructure projects in response to tighter credit, higher unemployment, higher interest rates, higher inflation, increases on tariffs, financial market volatility, government austerity programs, negative financial news, declining valuations of investments, and other factors. In addition, certain of our accounts' budgets may be constrained and they may be unable to procure our offerings at the same level as in prior periods. Our accounts' ability to pay for our software and services may also be impaired, which may lead to an increase in our allowance for doubtful accounts and write-offs of accounts receivable. Since we are exposed to the majority of major world markets, uncertainty in any significant market may negatively impact our performance and results, particularly with respect to our largest geographic accounts. Our accounts include government entities, including the U.S. government, and if spending cuts impede the ability of governments to purchase our products and services, our revenues could decline. In addition, a number of our accounts rely, directly and indirectly, on government spending. We are unable to predict economic conditions or the likelihood of additional economic uncertainty arising in any of our key markets. Changes in economic conditions could result in us not meeting our revenue growth objectives and could harm our business, financial condition, results of operations, and cash flows. Geopolitical trends toward nationalism and protectionism and the weakening or dissolution of international trade pacts in response to changing trade policies may increase the cost of, or otherwise interfere with, conducting our business including supply chain disruptions, and reduced competitiveness due to the imposition of trade barriers. These trends have increased levels of political and economic unpredictability globally, and may increase the volatility of global financial markets; the impact of such developments on the global economy remains uncertain. Political instability or adverse political developments, including, without limitation, as a result of or in connection with trade relations between the U.S., E.U., and China, as well as terrorist attacks, cyber events, armed conflicts (or the threat or escalation thereof), bank failures, civil unrest, espionage, natural disasters, epidemics, and pandemics in any of the countries in which we do business could harm our business, financial condition, results of operations, and cash flows.

Approximately 59%, 58%, and 58% of our total revenues were from outside the U.S. for the years ended December 31, 2025, 2024, and 2023, respectively. We anticipate that revenues from accounts outside the U.S. will continue to comprise a majority of our total revenues for the foreseeable future. Our international revenues, including from emerging economies, are subject to general economic and political conditions in foreign markets and our revenues are impacted by the relative geographical and country mix of our revenues over time. These factors could adversely impact our international revenues and, consequently, our business. Our dependency on international revenues also makes us more exposed to global economic and political trends, which can negatively impact our financial results. Further, our operations outside the U.S. are subject to legal, regulatory, social, political, economic, and other risks inherent in international business operations, including, without limitation, local product preference and product requirements, trade protection measures, sanctions, quotas, embargoes, import and export licensing requirements, duties, tariffs or surcharges and more stringent regulations relating to privacy and data security and access to, or use of, commercial and personal information. The occurrence of any one of these risks could negatively affect our international business and, consequently, our business, financial condition, and results of operations. Additionally, operating in international markets requires significant management attention and financial resources. We cannot be certain that the investment and additional resources required to operate in other countries will produce desired levels of revenue or profitability.

Our sales are based significantly on accounts' demand for software in the following infrastructure sectors: (i) public works/utilities; (ii) resources; (iii) industrial; and (iv) commercial/facilities. Although these sectors are typically countercyclical to one another in nature, each periodically experiences economic declines and may be exacerbated by other economic factors. If participants in any of these sectors reduce spending or allocate future funding in a manner that results in fewer infrastructure improvement or expansion projects, then our accounts' underlying business may be impacted and demand for our software may decrease or our rate of contract renewals may decrease. A prolonged decrease in such spending may harm our results of operations. Our accounts may request discounts or extended payment terms on new arrangements or seek to extend payment terms on existing arrangements due to lower levels of infrastructure spending or for other reasons, all of which may reduce revenue. We may not be able to adjust our operating expenses to offset such discounts or other arrangements because a substantial portion of our operating expenses is related to personnel, facilities, and marketing programs. The level of personnel and related expenses may not be able to be adjusted quickly and is based, in significant part, on our expectations for future revenues and demand. Infrastructure projects typically have long timelines and we may invest in building capacity based on expected demand for our software that takes longer to develop than we expect or fails to develop at all. Additionally, government spending on infrastructure may decrease, which could decrease the demand for our software and have a negative impact on our results of operations. We may not be successful in forecasting future demand levels and could fail to win business at the expected rates. If we underestimate the demand for our software, we may be unable to fulfill the increased demand in a timely fashion or at all. If we overestimate the demand for our software, we may incur additional expenses for which we would not have corresponding revenues, negatively impacting our results of operations.

Our offerings are, in some cases, highly complex and incorporate advanced software technologies that we attempt to make interoperable with the products of other software providers. Despite testing prior to release, our software may contain undetected defects or errors. Further, the combined use of our software with those of other software providers may cause errors or failures, or it may expose undetected defects, errors, or failures in our software. These defects, errors, or failures could affect software performance and damage the businesses of our accounts, as well as delay the development or release of new software or new versions of software. Further, we cannot guarantee that all of our accounts are using the latest versions of our software with enhanced security features and may be more vulnerable to cyber-attacks. Allegations of unsatisfactory performance in any of these situations could damage our reputation in the market and our relationships with our accounts, cause us to lose revenue or market share, increase our service costs, cause us to incur substantial costs in analyzing, correcting, or redesigning the software, cause us to lose accounts, subject us to liability for damages, and divert our resources from other tasks, any one of which could adversely affect our business, financial condition, results of operations, and prospects. We may also be required to provide full replacements or refunds for such defective software. We cannot assure you that such remediation would not harm our business, financial condition, results of operations, and prospects.

We license third-party technologies to develop certain software offerings, and, in some cases, we incorporate third-party technologies into our own software, including technologies owned by our competitors. If we were to seek to expand the scope of this activity in the future, we could be required to obtain additional licenses and enter into long-term arrangements with third parties on whose technology we could become substantially dependent. If we are unable to use or license these third-party technologies on reasonable terms, including commercially justifiable royalty rates, or if these technologies fail to operate properly or be appropriately supported, maintained, or enhanced, we may not be able to secure alternatives in a timely manner and our ability to develop and commercialize our own software offerings could be adversely impacted. In addition, licensed technology may be subject to claims that it infringes others' intellectual property rights and we may lose access to or have restrictions placed on our use of the licensed technology. We also incorporate open source software into our products. While we have attempted not to use open source code in a manner which could adversely impact our proprietary code, the terms of many open source licenses have not been interpreted by U.S. courts, and there is a risk that such licenses could be construed in a manner that could impose unanticipated conditions or restrictions on our ability to market or sell our products or to develop new products.