CoStar Group (CSGP) Risk Analysis

Our business relies on IT Systems and involves the generation, collection, storage, processing, and transmission of Confidential Information, including personal information and proprietary business information, by us and by third-party providers we rely on. We own and manage IT Systems but also rely on third-party managed IT Systems that we do not control and a broad array of third-party products and services to support our business operations. Because we make extensive use of third-party service providers, such as cloud and SaaS services, significant cyberattacks that disrupt or result in unauthorized access to third-party IT Systems could materially impact our operations and financial results. Tools and techniques (including AI) used to obtain unauthorized, improper, or illegal access to a target's systems, data, or customers' data, disable or degrade services, or sabotage systems are constantly evolving and have become increasingly complex and sophisticated. It is increasingly difficult to detect, investigate, and remediate cyber-attacks, and attacks often are not recognized or detected until after they have been launched against a target. We expect that unauthorized parties will continue to attempt to gain access to or disrupt our IT systems or facilities through various means, including hacking into IT Systems or facilities or those of our customers or vendors, installing malware (including ransomware) or attempting to fraudulently induce (for example, through spear phishing attacks or social engineering) our employees, customers, vendors, or other users of IT Systems into disclosing access credentials or other sensitive information to access our IT Systems. Numerous and evolving cybersecurity risks, including from diverse threat actors, such as state-sponsored organizations, opportunistic hackers and hacktivists, as well as through diverse attack vectors, such as advanced cyberattacks, phishing, social engineering schemes, malware (including ransomware), malfeasance by insiders, human or technological error, and as a result of bugs, misconfigurations, or exploited vulnerabilities in software or hardware, could threaten the confidentiality, availability, and integrity of Confidential Information and our IT systems. Efforts by us, our customers, our vendors and other users of our IT Systems to prevent, detect, and respond to data security incidents cannot guarantee protection due to attackers increasingly using tools and techniques that are designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic evidence. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our IT Systems and Confidential Information. Our IT Systems are vulnerable to cyberattacks and security breaches involving our customers' or our employees' Confidential Information, including personal or proprietary information, that is stored on or accessible through those systems. We have experienced and expect to continue to experience in the future, cyberattacks as well as breaches of our security measures due to human error, malfeasance, system errors or vulnerabilities, or other irregularities. In the past, for example, one of our vendors providing IT infrastructure management software was compromised by cyberattacks. We are also regularly exposed to vulnerabilities in widely deployed third-party software that we use in the ordinary course of business. Moreover, given the nature of complex software and services like ours, and the scanning tools that we deploy across our networks, infrastructure, and products, we regularly identify and track security vulnerabilities. We are unable to comprehensively apply patches or confirm that measures are in place to mitigate all such vulnerabilities, or that patches will be applied before vulnerabilities are exploited by a threat actor. To date, these cyberattacks and vulnerabilities have not had a material adverse effect on our operations, but there can be no guarantee that material attacks or incidents will not occur in the future. In the past three years, we have not experienced a material cybersecurity incident, but any actual or perceived cybersecurity incidents or breaches of our security could result in any or all of the following, among other things, any of which could adversely affect our business and results of operations: - Interruption of our operations;- Unavailability of our systems or services;- Unauthorized or improper disclosures of data;- Unauthorized or improper payments;- Harm to our reputation and brands;- Data breach notification requirements, regulatory scrutiny, enforcement actions, legal proceedings and claims, (including class action lawsuits), and other legal and financial exposure;- Remediation, system restoration, incident response, and compliance costs;- Loss of customer confidence in, or decreased use of, our products and services;- Diversion of the attention of management from the operation of our business; and - Contractual penalties or other payments as a result of third-party losses or claims. In addition, significant cyberattacks or data security breaches affecting companies that we acquire and/or that provide us services (including data center and cloud computing providers) could materially impact our business. Further, we may not be able to recover any or all damages suffered as a result of security breaches or other security incidents from such third-party providers. The coverage under our insurance policies for cybersecurity and related issues may not be adequate to reimburse us for losses caused by cyberattacks or other security incidents or be available on economically reasonable terms or at all.

New tax laws or regulations, or changes in existing laws or regulations, or the manner of their interpretation or enforcement, could increase our cost of doing business. In addition, from time to time, U.S. and foreign tax authorities, including state and local governments, consider legislation that could increase our effective tax rate. Further, the Organization for Economic Co-operation and Development has a framework to implement a global minimum corporate tax of 15% for companies with global revenue and profits above certain thresholds (referred to as Pillar 2), with certain aspects of Pillar 2 effective January 1, 2024 and other aspects effective January 1, 2025. While it is uncertain whether the U.S. will enact legislation to adopt Pillar 2, certain countries in which we operate have adopted legislation, and other countries are in the process of introducing legislation to implement Pillar 2. Although we do not expect Pillar 2 to have a material impact on our effective tax rate or our consolidated results of operations, financial position, and cash flows at this time, certain implementation details have yet to be developed, and the enactment of certain of these changes has not yet taken effect in all jurisdictions in which we operate. As a result, these changes may have adverse consequences for us, may increase our compliance costs, and may increase the amount of tax we are required to pay in certain jurisdictions.

We depend on IT Systems. We own and manage some IT Systems but also rely on third-party service providers and vendors for a range of products and services, including cloud products/services, that are critical to internal and/or external customer-facing operations. In the course of our business, we and certain of our third-party providers collect, use, transmit, and disclose Confidential Information, including personal data about our employees, current and potential customers, and employees of third parties we work with. As a result, we are subject to a variety of state, national, and international laws and regulations that apply to the collection, use, retention, protection, disclosure, transfer, and other processing of personal information, including, but not limited to, the EU and UK GDPR (together, the "GDPR") and CCPA. These laws and regulations are evolving, with new or modified laws and regulations proposed and implemented frequently and existing laws and regulations subject to new or different interpretations. For example, in the EEA and the UK, the GDPR comprehensively regulates our use of personal data, including cross-border transfers of personal data out of the EEA and UK, in respect of which we expect the existing legal complexity and uncertainty regarding international personal data transfers to continue, and international transfers to the United States, China, and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators. As the regulatory guidance and enforcement landscape in relation to data transfers continue to develop, we could suffer additional costs, we may have to make operational changes, it could otherwise affect the manner in which we provide our services, and could adversely affect our business, operations and financial condition. Failure to comply with the GDPR could result in penalties for noncompliance. Since we are subject to the supervision of relevant data protection authorities under multiple legal regimes (including under both the EU GDPR and the UK GDPR), we could be fined under those regimes independently in respect of the same breach. In addition to fines, a breach of the GDPR may result in regulatory investigations, reputational damage, orders to cease/change our data processing activities, enforcement notices, assessment notices (for a compulsory audit) or civil claims (including class actions). The CCPA, among other things, provides rights to California residents related to their personal information, places limitations on data uses, and creates new audit requirements for higher risk data. The CCPA also provides for civil penalties for violations, as well as a private right of action for data breaches that may increase data breach litigation. Other state privacy laws apply to operations, and similar laws have been proposed, and likely will continue to be proposed, in other states and at the federal level, and if passed, may have potentially conflicting requirements that would make compliance challenging. In addition to risks we face under applicable privacy laws, we are subject to evolving consumer protection and marketing laws and increased litigation and government enforcement by the Federal Trade Commission and state Attorneys General. These agencies are aggressively interpreting and enforcing federal and state consumer protection laws in relation to very broad sales and marketing and advertising contexts. There are also federal laws covering our activities that are a source of potential liability for our business, including the CAN-SPAM Act, the TCPA, and the FCRA. In particular, any claims that we have violated the TCPA could be costly to litigate and could expose us to substantial statutory damages or settlement costs. The regulatory framework for AI Technologies is rapidly evolving as many federal, state and foreign government bodies and agencies have introduced or are currently considering additional laws and regulations. Additionally, existing laws and regulations may be enjoined in judicial proceedings from being enforced or may be interpreted in ways that would affect the operation of our AI Technologies, or could be rescinded or amended as new administrations take differing approaches to evolving AI Technologies. As a result, implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, and we cannot yet completely determine the impact future laws, regulations, standards, or market perception of their requirements may have on our business and may not always be able to anticipate how to respond to these laws or regulations. Already, certain existing legal regimes (e.g., relating to data privacy) regulate certain aspects of AI Technologies, and new laws regulating AI Technologies have either entered into force in the United States and the EU in 2025 or are expected to enter into force in 2026. For example, in Europe, the EU AI Act entered into force and established a comprehensive, risk-based governance framework for AI in the EU market. The majority of the substantive requirements will apply from August 2, 2026. The EU AI Act applies to companies that develop, use and/or provide AI in the EU and, depending on the use case, includes requirements around transparency, conformity assessments and monitoring, risk assessments, human oversight, security, accuracy, general purpose AI and foundation models and fines for breach of up to 7% of worldwide annual turnover. Once fully applicable, the EU AI Act will have a material impact on the way AI is regulated in the EU, and together with developing guidance and/or decisions in this area, may affect our use of AI Technologies and our ability to provide, improve, or commercialize our services, and could require additional compliance measures and changes to our operations and processes. Any failure or alleged failure to comply with the EU AI Act (and other AI related regulations), and privacy, data protection, or consumer protection laws could lead to government enforcement actions and litigation and significant penalties against us, and could materially adversely affect our reputation, business, financial condition, cash flows, and results of operations. Compliance with any of the foregoing laws and regulations can be costly, can delay or impede the development of new products, and may require us to change the way we operate. Separately, the EU Data Act came into effect on September 12, 2025, establishing new requirements for manufacturers of connected products and providers of related services to such products, and providers of data processing services (including cloud, SaaS) into the EU. The Data Act imposes data access, sharing, design and transparency requirements on manufacturers of connected products, providers of related services and data holders. It also requires providers to facilitate customers switching to other providers/ on-premise solutions and porting their data within certain timeframes, remove technical, contractual, and commercial obstacles to service switching (including switching charges), and include certain mandatory terms in customer contracts. Failure to comply with the Data Act can result in regulatory enforcement and fines, civil claims, and reputational damage. The Data Act, together with developing guidance in this area, may require changes to our products, customer contracts, operations, and business practices, increase our compliance costs, require adjustments to our revenue recognition practices, and adversely affect our financial condition, business, and operations. Further, the EU's NIS 2 and its EU Member State transpositions and implementing regulations impose security obligations, including on online marketplace providers. We may be required to implement additional security measures and/or operational changes and incur additional costs which could adversely affect our business, operations and financial condition. It is possible that additional new laws and regulations will be adopted in the United States and in other non-U.S. jurisdictions, or that existing laws and regulations, including competition and antitrust laws, may be interpreted or enforced in ways that would limit our ability to use AI Technologies for our business, or require us to change the way we use AI Technologies in a manner that negatively affects the performance of our products, services, and business and the way in which we use AI Technologies. We may need to expend resources to adjust our products or services in certain jurisdictions if the laws, regulations, or decisions are not consistent across jurisdictions. Such an increase in operating expenses, as well as any actual or perceived failure to comply with such laws and regulations, could adversely affect our business, financial condition and results of operations.

If we are unable to compete successfully against our existing or future competitors, our business, results of operations, or financial condition could be adversely affected. Our existing or future competitors may have greater name recognition, larger customer bases, better technology or data, lower prices, easier access to data, greater user traffic or greater financial, technical, or marketing resources than we have to provide services that users might view as superior to our offerings. Competition in these markets may increase if economic conditions or other circumstances cause customer bases and customer spending to decrease and service providers to compete for fewer customer resources. Competitors, or future competitors, may introduce different solutions that attract users away from our services, such as AI-powered platforms that provide access to real estate agents, real estate data, and related content without directing users to our marketplaces, or provide solutions similar to ours that have the advantage of better branding or marketing resources. Our competitors may be able to undertake more effective marketing campaigns, obtain more data, adopt more aggressive pricing policies, make more attractive offers to potential employees, subscribers, advertisers, distribution partners, and content providers, or may be able to respond more quickly to new or emerging technologies, including the integration of generative AI Technologies in response to changing consumer behavior or user requirements. Moreover, rapid advancement of generative AI Technologies may reduce the barrier to entry for new competitors. Increased competition or failure to adapt effectively to technological shifts could result in lower revenue and higher expenses, which would reduce our profitability. Also, we compete to attract advertisers. To compete successfully for advertisers, we must continue to invest resources in developing our advertising platform and proving the effectiveness and relevance of our advertising services. Pressure from competitors seeking to acquire a greater share of our advertisers' overall marketing budget could adversely affect our pricing and margins, lower our revenue, and increase our research and development and marketing expenses.

We rely heavily on our brands, which we believe are key assets of our company. Awareness and differentiation of our brands are important for attracting and expanding the number of users of, and subscribers to, our online marketplaces, such as the LoopNet Network, the Apartments.com Network, the Homes.com, OnTheMarket residential marketplaces, the Land.com Network, and Domain. We continue to invest significantly in sales and marketing as we seek to grow the numbers of users of, subscribers to and advertisers on, our marketplaces. Our methods of advertising may not be successful in increasing brand awareness or, ultimately, be cost-effective. If we are unable to maintain or enhance user and advertiser awareness of our brands, or if we are unable to recover our marketing and advertising costs through increased usage of our services and increased advertising on our websites, our business, results of operations, and financial condition could be adversely affected.

In December 2021, we announced our plans to expand our research and technology center in Richmond, Virginia. These plans have required and will continue to require significant capital expenditures over the next several years and our business plans may change. Future changes in growth or fluctuations in cash flow may also negatively impact our ability to finance this project. Additionally, actual capital expenditures could vary materially from our projected capital expenditures, which could negatively impact our business, operating results, and financial condition. If we are provided with any grants, tax credits, abatements, or other incentives related to this expansion effort and do not meet requirements associated with those incentives, we may not be able to benefit from those incentives, which could cause the cost of the project to be significantly more than anticipated or significantly increase our taxes above what we currently expect. To date, we have financed construction with cash on hand and plan to finance the remainder of construction in the same way. Use of cash on hand to finance construction has and will continue to reduce the amount of cash available for other corporate uses and could also reduce our ability to meet our scheduled debt service obligations or to meet the covenants required to borrow additional funds under our 2024 Credit Agreement. Any of the foregoing may adversely affect our financial position and results of operations.

Global economic uncertainties or downturns could adversely affect our business and results of operations, including financial and credit market fluctuations, changes in economic policy, elevated inflation and responsive actions, elevated interest rates, labor shortages, supply chain disruptions, trade uncertainty, political unrest, geographical instability, unanticipated disasters or global health events, or other impacts from the macroeconomic environment. Additionally, tariffs, trade barriers and restrictions, and other acts by governments to protect domestic markets or to retaliate against the trade tariffs and restrictions of other nations could negatively affect our business operations. These macroeconomic conditions could cause a decrease in customer spending and negatively affect the rate of growth of our business. The real estate market may be adversely impacted by many different factors, including lower than expected job growth or job losses resulting in reduced real estate demand; reduced real estate demand due to continued remote work policies or a period of or rising elevated interest rates, elevated inflation, slowing transaction volumes, and other macroeconomic trends that negatively impact investment returns; excessive speculation in new construction in localized markets resulting in increased vacancy rates and diminished rent growth; unanticipated disasters or global health events; and other adverse events such as decreased growth in the working age population resulting in reduced demand for all types of real estate. A downturn in the real estate market, including as a result of increased interest rates or a decline in leasing activity and absorption rates may affect our ability to generate revenue and may lead to more cancellations by our current or future customers, either of which could cause our revenue or our revenue growth rate to decline and reduce our profitability. A depressed real estate market has a negative impact on our core customer base, which could decrease demand for our online marketplaces, information, and analytics. Also, companies in this industry may consolidate, often in order to reduce expenses. Consolidation, or other cost-cutting measures by our customers, may lead to cancellations of our online marketplace services, information, and analytics by our customers, reduce the number of our existing clients, reduce the size of our target market, or increase our clients' bargaining power, all of which could cause our revenue to decline and reduce our profitability. If cancellations, reductions of services, and failures to pay increase, and we are unable to offset the resulting decrease in revenue by increasing sales to new or existing customers, our revenue may decline or grow at lower rates.

Our international operations and expansion subject us to additional business, regulatory, and economic risks, including: currency exchange rate fluctuations; difficulty in adapting to the differing business practices and laws in foreign countries, including differing laws regarding privacy data protection and technology regulation; difficulty in managing foreign operations; limited protection for intellectual property rights in some countries; difficulty in collecting accounts receivable and longer collection periods; costs of enforcing contractual obligations; impact of recessions in economies outside the U.S.; geopolitical instability, terrorism, and war; and potentially adverse tax consequences. In addition, international expansion imposes additional burdens on our executive and administrative personnel, systems development, research, and sales departments, and general managerial resources. If we are not able to manage our international operations successfully, we may incur higher expenses and our profitability may be reduced. Finally, the investment required for additional international expansion sometimes exceeds the profit generated from such expansion, which reduces our profitability and may adversely affect our financial position.

Natural disasters, disease outbreaks and pandemics, power shortages, terrorism, political unrest, telecommunications failure, vandalism, geopolitical instability, war, climate related events, and other events beyond our control could negatively impact our operations or otherwise harm our business. Such events may result in damage or loss of service to our data centers or other infrastructure that our operations rely on, potentially reducing the attractiveness of real estate in areas we provide services, causing delays in product development or availability, or result in losses of critical data, any of which may adversely impact our operations. In addition, the impacts of climate-related events on the global economy and our industry are rapidly evolving. Physical impacts of climate-related events (including, but not limited to, floods, droughts, more frequent and/or intense storms, and wildfires) may disrupt our operations, as well as the operations of our suppliers and customers. Longer-term physical impacts may also result in changing consumer preferences, which may adversely impact demand for certain of our products. Transition impacts of climate-related events can also subject us to increased regulations, reporting requirements (such as the State of California disclosure rules and the European Union's Corporate Sustainability Reporting Directive), standards, or expectations regarding the environmental and/or social impacts, risks, and opportunities of our business. Failure to disclose accurate information in a timely manner may also adversely affect our reputation, business, or financial performance.

A portion of our business is denominated in foreign currencies. We translate sales and other results denominated in foreign currency into U.S. dollars for our financial statements. During periods of a strengthening U.S. dollar, our reported international sales and earnings could be reduced because foreign currencies may translate into fewer U.S. dollars. Foreign currency exchange rates have fluctuated and may continue to fluctuate. Significant foreign currency exchange rate fluctuations may negatively impact our international revenue, which in turn affects our consolidated revenue. Currently, we are not party to any hedging transactions intended to reduce our exposure to exchange rate fluctuations. We may seek to enter into hedging transactions in the future, but we may be unable to enter into these transactions successfully, on acceptable terms or at all. We cannot predict whether we will incur foreign exchange losses in the future. Further, significant foreign exchange rate fluctuations resulting in a decline in the respective local currency may decrease the value of our foreign assets, as well as decrease our revenue and earnings from our foreign subsidiaries, which would reduce our profitability and adversely affect our financial position.