Enovix (ENVX) Risk Analysis

Our success depends on our ability to attract and retain our executive officers, key employees and other qualified personnel on a global basis, and, as a relatively small company with key talent residing in a limited number of employees, our operations and prospects may be severely disrupted if we lose any one or more of their services. There have been, and may continue to be, changes in our management team resulting from the departure or onboarding of executives and key employees, which could disrupt our business. For example, in addition to turnover of key executive positions in 2023, our Chief Financial Officer stepped down in December 2024, we created a new role and appointed a Chief Accounting Officer at the end of December 2024, appointed a new Chief Financial Officer in April 2025, and our Chief Operating Officer announced his retirement, effective February 2026, after which we appointed a new Chief Operating Officer in the third quarter of fiscal 2026. Such changes in our executive management team or workforce may be disruptive to our business, divert management's attention, result in a loss of knowledge and negatively impact employee morale. If we encounter further turnover or difficulties associated with the transition or departure of our executive officers and key employees, or if we are unsuccessful in recruiting new personnel or in retaining and motivating existing personnel, our operations may be disrupted, which could harm our business. We are dependent on the continued service of our senior technical and management personnel because of the complexity of our products. Our senior management and key employees are employed on an at-will basis. We cannot ensure you that we will be able to retain the services of our senior management team or other key employees, or that we will be able to timely replace such employees. The loss of one or more of our senior management or other key employees could harm our business. Labor is subject to external factors that are beyond our control, including our industry's highly competitive market for skilled workers and leaders, cost inflation, and workforce participation rates. As we build our brand and become more well known and grow globally, there is increased risk that competitors or other companies will seek to hire our personnel. While some of our employees are bound by non-competition agreements, these may prove to be unenforceable. The failure to attract, integrate, train, motivate and retain these personnel could seriously harm our business and prospects.

In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process) personal data and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, and sensitive third-party data. Cyberattacks, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our sensitive information and information technology systems, and those of the third parties upon which we rely. Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer "hackers," threat actors, "hacktivists," organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we, the third parties upon which we rely, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our goods and services. We and the third parties upon which we rely are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing attacks, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, attacks facilitated or enhanced by artificial intelligence, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, floods, and other similar threats. In particular, severe ransomware attacks are becoming increasingly prevalent – particularly for companies like ours that are engaged in manufacturing – and can lead to significant interruptions in our operations, loss of sensitive data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Remote work has become more common and has increased risks to our information technology systems and data, as more of our employees utilize network connections, computers and devices outside our premises or network, including working at home, while in transit and in public locations. Additionally, future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities' systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate any acquired companies into our information technology environment and security program. We rely on third-party service providers and technologies to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, and other functions. Our ability to monitor these third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. For example, the Crowdstrike-Microsoft outage in July 2024 caused temporary disruptions to our systems and servers at our U.S., Malaysia and India locations. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, or we may be entitled to reimbursement under our insurance policies, any award may be insufficient to cover our damages, or we may be unable to recover such award. Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or our information technology systems, or those of the third parties upon whom we rely. A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely) to provide our products. We may expend significant resources or modify our business activities to try to protect against security incidents. Certain data privacy and security obligations may require us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and sensitive information. While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We take steps to detect, mitigate, and remediate vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties upon which we rely), but we may not be able to detect and remediate all vulnerabilities on a timely basis because the threats and techniques used to exploit the vulnerability change frequently and are often sophisticated in nature. Therefore, such vulnerabilities could be exploited but may not be detected until after a security incident has occurred. These vulnerabilities pose material risks to our business. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities. Vulnerabilities could be exploited and result in a security incident. Applicable data privacy and security obligations may require us to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents. For example, new SEC rules require disclosure on Form 8-K of the nature, scope and timing of any material cybersecurity incident and the reasonably likely impact of such incident. Such disclosures are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences. If we (or a third party upon whom we rely) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions in our operations (including availability of data); financial loss; and other similar harms. Security incidents and attendant consequences may cause customers to stop using our products, deter new customers from using our products, and negatively impact our ability to grow and operate our business. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims. Additionally, sensitive information of the Company or our customers could be leaked, disclosed, or revealed as a result of or in connection with the use by our employees, personnel, or vendors of generative artificial intelligence ("AI") technologies.

We are working to incorporate AI and GenAI tools into various aspects of our business operations, including research and development, battery design, manufacturing optimization and other testing applications. AI-based technologies are complex, rapidly evolving and may not produce the intended benefits. Algorithms, models or training data may be flawed, biased or incomplete, which could result in inaccurate analyses or design decisions. If AI-assisted outputs are relied upon in product development, performance modeling, safety analysis or manufacturing processes and prove to be incorrect, our product performance, reliability, safety profile or regulatory compliance could be adversely affected, potentially resulting in delays, increased costs, product liability exposure or reputational harm. The use of AI may also increase the risk of intellectual property infringement, trade secret exposure or unauthorized disclosure of confidential information, including proprietary battery designs and manufacturing processes. In addition, our suppliers, partners or competitors may more effectively leverage AI technologies, which could impair our competitive position. The evolving regulatory landscape governing AI may impose additional compliance obligations or restrict our ability to deploy AI tools. Any of these risks could adversely affect our business, financial condition and results of operations.

Over the last three years, we have expanded our global footprint through acquisitions as well as a restructuring of our manufacturing operations. Namely, in South Korea, we acquired a battery manufacturer in 2023, Routejade, as well as a second manufacturing facility and certain other related assets in 2025. During this time, we have also established a research and development center in Hyderabad, India, which supports the product and manufacturing teams in our other locations, and relocated all of our manufacturing activities from Fremont, California to Malaysia, as well as established a subsidiary in Shenzhen, China. Following the shift of our manufacturing facilities to Malaysia and a reduction in force that primarily affected our U.S. operations, a higher percentage of our employees and a significant portion of our business operations are located overseas, while our leadership team is primarily located in the U.S. Additionally, relationships with customers and potential customers outside of the U.S. accounted for a significant portion of our revenues during 2025. While we are continuing to adapt to and develop strategies to address international markets and to manage our international activities and geographically diverse workforce, there is no guarantee that such efforts will have the desired effect. We have in the past and may continue to experience operational challenges associated with global business operations and a globally dispersed workforce, such as coordinating activities across multiple time zones and cultures and maintaining consistent operations standards across diverse locations. In addition, effective collaboration between R&D and manufacturing teams located overseas, and other parts of the organization, may be hindered by distance, language and cultural differences, which may have a negative impact on product innovation and overall operational efficacy. We expect that our international activities will continue to grow for the foreseeable future as we continue to pursue opportunities in existing and new international markets, which will require significant dedication of management attention and financial resources. As a result of having significant international operations, including our manufacturing operations, we are subject to a number of risks, including: - burdens of complying with a wide variety of laws and regulations;- unexpected changes in regulatory requirements;- exposure to political or economic instability and general economic fluctuations in the countries we operate;- changes in currency exchange rates;- changes in diplomatic and trade relationships;- trade restrictions;- terrorist activities, natural disasters, epidemics, pandemics and other outbreaks, including the regional or local impacts of any such activity;- political, economic and social instability, war or armed conflict;- differing employment practices and laws and labor disruptions, including strikes and other work stoppages, strains on the available labor pool, labor unrest, changes in labor costs and other employment dynamics;- the imposition of government controls;- lesser degrees of intellectual property protection;- tariffs and customs duties, or other barriers to some international markets, and the classifications of our goods by applicable governmental bodies; and - a legal system subject to undue influence or corruption. The current geopolitical climate and certain actions by the U.S. administration have created uncertainty regarding and fluctuations in trade policies, and our operations and business are subject to these uncertainties given the extent of our international operations and dependencies on international supply chains and access to international employees. These factors and risks could negatively affect our international business operations, increase the difficulty or cost of selling our products in (or restrict our access to) certain foreign markets, divert management's attention, and increase our costs, which would adversely affect our business, operating results, growth prospects and financial condition.

Our facilities or operations could be adversely affected by events outside of our control, such as natural disasters, wars or other armed conflicts, health epidemics, pandemics and other outbreaks, the long-term effects of climate change and other calamities. Our headquarters is located in Fremont, California, which is prone to earthquakes. We cannot assure you that any backup systems will be adequate to protect us from the effects of fire, floods, typhoons, earthquakes, power loss, telecommunications failures, break-ins, war, riots, terrorist attacks or similar events. Any of the foregoing events may give rise to interruptions, breakdowns, system failures, technology platform failures or internet failures, which could cause the loss or corruption of data or malfunctions of software or hardware as well as adversely affect our ability to provide services.