Extreme Networks (EXTR) Risk Analysis

We have in the past, currently are and will likely in the future pursue or be subject to claims or lawsuits in the normal course of our business. In addition to the risks related to the intellectual property lawsuits described herein, we are currently parties to other litigation as described in Note 9, Commitments and Contingencies, in the Notes to Consolidated Financial Statements included elsewhere in this Annual Report on Form 10-K. Regardless of the result, litigation can be expensive, lengthy and disruptive to normal business operations. Moreover, the results of complex legal proceedings are difficult to predict. An unfavorable resolution of a lawsuit in which we are a defendant could result in a court order against us or payments to other parties that would have a material adverse effect on our business, financial condition, or operating results. Even if we are successful in prosecuting claims and lawsuits, we may not recover damages sufficient to cover our expenses incurred to manage, investigate and pursue the litigation. In addition, subject to certain limitations, we may be obligated to indemnify our current and former customers, suppliers, directors, officers and employees in certain lawsuits. We may not have adequate insurance coverage to cover all of our litigation costs and liabilities.

In connection with running our business, we receive, store, use and otherwise process information that relates to individuals and/or constitutes "personal data," "personal information," "personally identifiable information," or similar terms under applicable data privacy laws (collectively, "Personal Information"), including from and about actual and prospective customers, as well as our employees and business contacts and information we process for or on behalf of our customers in the course of our business. We are therefore subject to laws, regulations and other requirements relating to the privacy, security, and handling of Personal Information either directly or where we are processing Personal Information for or on behalf of our customers or another third party. For example, the EU General Data Protection Regulation, U.S. state privacy laws, and other global privacy, cybersecurity, and data protection requirements impose disclosure obligations, security, retention, deletion, and other compliance requirements with respect to Personal Information and may allow for penalties for violations. We have invested, and continue to invest, human and technology resources in our efforts to comply with such requirements that may be time-intensive and costly. The application and interpretation of such requirements are constantly evolving and are subject to change, creating a complex compliance environment. In some cases, these requirements may be either unclear in their interpretation and application or may have inconsistent or conflicting requirements. Further, there has been a substantial increase in legislative activity and regulatory focus on data privacy and security, including in relation to artificial intelligence, data rights and cybersecurity incidents. In addition, some such requirements place restrictions on our ability to process Personal Information across our business or across country borders. It is possible that new laws, regulations and other requirements, or amendments to or changes in interpretations of existing laws, regulations and other requirements, may require us to incur significant costs, implement new processes, or change our handling of information and business operations, which could ultimately hinder our ability to grow our business and to develop, market and deliver our products and services efficiently. In addition, any failure or perceived failure by us to comply with laws, regulations and other requirements relating to the privacy, security, and handling of information could result in legal claims or proceedings (including class actions), regulatory investigations, or enforcement actions. We could incur significant costs in investigating and defending such claims and, if found liable, pay significant damages or fines or be required to make changes to our business. Such proceedings and any subsequent adverse outcomes may subject us to significant negative publicity and an erosion of trust. If any of these events were to occur, our business, results of operations, and financial condition could be materially adversely affected.

The markets for our products are constantly evolving and characterized by rapid technological change, frequent product introductions, changes in customer requirements, evolving industry standards, and continuous pricing pressures. For example, cloud-based network management is among the fastest growing market categories within the networking industry. Our success may be impacted by our ability to provide cloud-based networking solutions that address the needs of our customers more effectively and economically than those of other competitors or existing technologies. If the cloud-based network management market does not develop in the way we anticipate, if our solutions do not offer significant benefits compared to competing legacy products, if end customers do not recognize the benefits that our solutions provide, or if we are unable to successfully execute on the transition to, and customer adoption of, our cloud-based networking solutions and related subscription offerings, then our growth prospects, including our ability to grow our subscription revenue, could be adversely affected. Because a portion of our revenues from cloud-based or subscription offerings is recognized over time, changes in customer bookings, renewals, or consumption levels may not be immediately reflected in our reported revenue, which could reduce visibility into the underlying performance of our business. If we are unsuccessful in integrating AI into the functionality of our products and achieving customer adoption of our AI-powered platform, our revenue growth could be limited. We may also face challenges accurately forecasting customer renewal rates, conversion rates from on-premises to cloud offerings, and levels of customer usage or consumption, which could result in volatility in our operating results. Our ability to grow subscription revenue also depends on our ability to attract new subscribers, retain existing customers, expand adoption of subscription and cloud offerings, and maintain favorable renewal and attach rates, any of which may be adversely affected by competition, customer budget constraints, pricing pressures, or changes in customer preferences. When we announce new products or product enhancements that have the potential to replace or shorten the life cycle of our existing products, customers may defer or cancel orders for our existing products; in addition, ending sales of existing products may cause customers to cancel or defer orders for our existing products. These actions could have a material adverse effect on our operating results by unexpectedly decreasing sales, increasing inventory levels of older products and exposing us to greater risk of product obsolescence. We cannot guarantee that we will be able to anticipate future technological shifts, market needs and opportunities or be able to develop new products, product enhancements and business strategies to meet such technological shifts, needs or opportunities in a timely manner or at all. If we fail to anticipate market requirements or opportunities or fail to develop and introduce new products, product enhancements or business strategies to meet those requirements or opportunities in a timely manner, it could cause us to lose customers, and such failure could substantially decrease or delay market acceptance and sales of our present and future products and services. Even if we are able to anticipate, develop, and commercially introduce new products and enhancements, we cannot assure that new products or enhancements will achieve widespread market acceptance. Any or all of the foregoing could materially adversely affect our business, financial condition, and operating results.

In the ordinary course of business, we provide cloud-based services and store data, including personally identifiable information, as well as proprietary business information belonging to our business (such as trade secrets) and belonging to our customers, suppliers and business partners. We store such data on our computer systems, hardware, software, technology infrastructure and online sites and networks for both internal and external operations that are critical to our business (collectively, "IT Systems"). In addition, we store information through cloud-based services that may be hosted by third parties and in data center infrastructure maintained by third parties. We are also increasingly dependent on third-party service providers, including software-as-a-service providers and other vendors, for critical aspects of our operations. These providers may have short operating histories, fewer resources, or less mature security programs, which could increase the risk of service disruptions, security incidents, or operational failures affecting our business. We have experienced security incidents in the past, including incidents involving social engineering and unauthorized access to systems or information, and may experience similar or more significant incidents in the future. For example, this year, a threat actor was able to obtain temporary access to certain employee accounts through vishing. The non-material incident was contained, there was no impact on the functionality of our products and services, and we promptly engaged outside cybersecurity experts and notified law enforcement. We face numerous and evolving additional cybersecurity risks that threaten the confidentiality, integrity and availability of our IT Systems and data. These threats come from diverse threat actors, such as state-sponsored organizations, opportunistic hackers and hacktivists, as well as through diverse attack vectors, such as social engineering/phishing, malware (including ransomware), technological error, and as a result of bugs, misconfigurations or exploited vulnerabilities in software or hardware, including vulnerabilities in commercial software that is integrated into our (or our suppliers' or service providers') IT Systems, products or services. Usage of "legacy" products that have been determined to have reached an end-of-life engineering status but will continue to operate for a limited amount of time may subject us or our customers to vulnerabilities. Increasingly, companies, including us, are subject to a variety of attacks on their networks and/or cloud-based services on an ongoing basis. Geopolitical tensions and military conflicts may further increase the frequency and sophistication of cyberattacks, espionage, and other hostile activities directed at private-sector organizations. Additionally, any integration of AI in our or any third party's operations, products, or services is expected to pose new or unknown cybersecurity risks and challenges. The number of sophisticated attacks continues to increase on a global scale in frequency and magnitude, and with the availability to bad actors of AI to assist them in perpetrating these attacks, we expect the speed and complexity of these attacks to continue to escalate. Attacks could include supply chain attacks targeting our suppliers and attempts to penetrate our systems or disrupt our services directly. In some cases, sophisticated hardware, operating system software, and software applications and services that we produce or procure from third parties may contain vulnerabilities in design or manufacture or security defects that could allow network intrusion or unexpectedly interfere with the operation of our systems, products or services we provide to customers. In addition, outages, disruptions, or security incidents affecting our services or those of our third-party providers could result in our failure to meet service level commitments, which may require us to provide service credits, refunds, or other remedies to customers, and could expose us to contractual liability. Further, employee error, malfeasance, or other disruptions can result in a security or data breach. Despite our security measures, we may not be able to effectively detect, prevent, or protect against or otherwise mitigate losses from all cyberattacks or prevent all security or data breaches. There can also be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with, or effective in protecting our IT Systems and data. Because the techniques and tools used by bad actors, many of whom are highly sophisticated and well-funded, to access or sabotage networks change frequently and generally are not recognized until after they are used, we may be unable to anticipate or immediately detect and remediate these techniques. Any such breach could compromise our networks, products, or cloud-based services by creating system disruptions, slowdowns or even shutdowns, and exploiting security vulnerabilities of our products, services, and the information stored as part of our operations could be accessed, publicly disclosed, lost or stolen. Remote and hybrid working arrangements at our company (and at many third-party providers) also increase cybersecurity risks due to the challenges associated with managing remote computing assets and security vulnerabilities that are present in many non-corporate and home networks. Additionally, because our products and services are integrated with our customers' systems and processes, any circumvention or failure of our cybersecurity defenses or measures could compromise the confidentiality, integrity, and availability of our customers' own IT Systems and/or our customers' proprietary or other sensitive information. Any adverse impact to the availability, integrity, or confidentiality of our IT Systems, including any actual or perceived breach of network security involving our products, network, or the network of a customer of our networking products, regardless of whether the breach is attributable to our products, could harm the market perception of the effectiveness or security of our products. This could impede our sales efforts and impact our market share and future revenue. Such events require significant management attention and resources, impacting our expenses and resources available to commit to other efforts. In addition, the economic costs to us to eliminate, mitigate, or recover from, or remediate cyber or other security problems, such as bugs, viruses, worms, ransomware or other malware, and security vulnerabilities could be significant and may be difficult to anticipate or measure. Further, this could result in legal claims or proceedings (such as class actions), regulatory investigations and enforcement actions, fines and penalties. We cannot guarantee that any costs and liabilities incurred in relation to an attack or incident will be covered by our existing insurance policies or that applicable insurance will be available to us in the future on economically reasonable terms or at all. Any or all of the foregoing could materially adversely affect our business, operating results, and financial condition.

Our products are designed to interface with our customers' existing networks, each of which may have different specifications and utilize multiple protocol standards, products from other vendors, third-party platforms, operating systems, cloud environments, applications, and applications that we do not control. Many of our customers' networks contain multiple generations of products that have been added over time as these networks have grown and evolved. Our products must interoperate with many or all of these third-party products, as well as future products, to meet our customers' requirements. If we identify errors in existing software, defects in hardware, changes to third-party platforms, modifications to application programming interfaces, delays in access to new releases, or restrictions on interoperability, we may need to modify our solutions to maintain compatibility, which could be costly and time consuming. In addition, if our products do not successfully interoperate with our customers' networks or other third-party technologies, demand for our products could be adversely affected, orders could be delayed or canceled, and the functionality of our offerings could be impaired. This could materially adversely affect our business, financial condition, operating results, and future financial performance.

The market for network switches, routers and software (including analytics) is intensely competitive and dominated primarily by Cisco Systems Inc., Hewlett Packard Enterprise Company, and Huawei Technologies Co. Ltd. To a lesser extent, Extreme competes with products and solutions from Arista Networks, Inc., RUCKUS Networks, Fortinet, Inc., and Ubiquiti Inc. Most of our competitors have greater name recognition, larger customer bases, broader product lines and substantially greater financial, technical, sales, marketing and other resources. As a result, these competitors are able to devote greater resources to the development, promotion, sale and support of their products. In addition, they have larger distribution channels, stronger brand names, access to more customers, a larger installed customer base, and a greater ability to make attractive offers to channel partners and customers than we do. Further, many of our competitors have made substantial investments in hardware networking capabilities and offerings as well as software and AI functionality to run and manage the networks. These competitors may be able to gain market share by leveraging their investments to attract customers at lower prices or with greater synergies. The pricing policies of our competitors impact the overall demand for our products and services. Some of our competitors are capable of operating at significant losses for extended periods of time or otherwise offer competitive products at lower prices, increasing pricing pressure on our products and services. If we do not maintain competitive pricing, the demand for our products and services, as well as our market share, may decline. From time to time, we may lower the prices of our products and services in response to competitive pressure. When this happens, if we are unable to reduce our component costs or improve operating efficiencies, our revenues and gross margins will be adversely affected. There has been a trend toward industry consolidation in our markets for several years, and we expect this trend to continue as companies attempt to strengthen or hold their market positions in an evolving industry and as companies are acquired or are unable to continue operations. As competitors merge or acquire additional lines of business, their expanded resources may make competition more difficult. In addition, companies that are strategic alliance partners in some areas of our business may acquire or form alliances with our competitors, thereby reducing their business with us. We believe industry consolidation may result in stronger competitors that are better able to compete as sole-source vendors for customers. This could lead to a loss of market share and revenue for us. Furthermore, particularly in the service provider market, rapid consolidation will lead to fewer customers, with the effect that loss of a major customer could have a material impact on results not anticipated in a customer marketplace composed of more numerous participants. We may also face increased competition from traditional networking solutions companies, companies in adjacent industries such as information security moving into networking, and cloud hyperscalers offering Infrastructure as a Service and Platform as a Service products to enterprise customers. In particular, AWS, Microsoft Azure, and GCP may provide enterprise customers with a cloud-based platform of data center computing and networking services that could compete with our services and adversely impact our market share and revenue. In addition, AI software vendors and platforms could leverage their AI model capabilities, integrations, and agentic workflows to address network-centric use cases that compete with traditional network management solutions. If these technologies enable customers to manage, analyze, and operate network infrastructure through AI-enabled interfaces, they could disrupt portions of the networking industry and adversely affect our competitive position, revenue, and growth prospects. One of our key differentiators is the quality of our support and services. Our failure to continue to provide high-quality support and services could materially adversely affect our business, financial condition, operating results, and future growth prospects.

Network products frequently contain undetected errors when new products or new versions or updates of existing products are released to the marketplace. In the past, we have experienced such errors in connection with new products and product updates. We have experienced component problems in prior years that caused us to incur higher than expected warranty, service costs and expenses, and other related operating expenses. In the future, we expect that, from time to time, such errors or component failures will be found in new or existing products after the commencement of commercial shipments. These problems may have a material adverse effect on our business by causing us to incur significant warranty, repair and replacement costs, diverting the attention of our engineering personnel from new product development efforts, delaying the recognition of revenue, and causing significant customer relations problems. Further, if products are not accepted by customers due to such defects, such returns could exceed the amount we accrued for defective returns. Our products are used in conjunction with products from other vendors. As a result, when problems occur in a network, it may be difficult to identify the sources of these problems. The occurrence of system errors, whether or not caused by our products, could result in the delay or loss of market acceptance of our products and any necessary revisions may cause us to incur significant expenses. Any or all of the foregoing could have a material adverse effect on our business, operating results, and financial condition.

The ongoing unpredictability of U.S. economic and trade policies, including tariff actions and related government measures, continues to create significant uncertainty in the world economy, including inflationary pressures. In addition, various military actions, armed conflicts, and geopolitical tensions, including the Russia-Ukraine conflict, the Israel-Hamas conflict and related regional instability in the Middle East, and military actions involving the United States and Iran, have increased global uncertainty. Potential impacts of these policies and tensions could include decreased demand for our products, increased costs to us, supply chain limitations, and volatility of our stock price. A substantial portion of our business depends on the demand for enterprise-scale networking, which, in turn, is impacted by the overall economic health of our current and prospective end-customers. Volatility in the global economic market or other global or regional economic uncertainty, inflation, interest rate fluctuations, foreign exchange instability, limited availability of credit, a reduction in business confidence and activity, reductions in government spending, and other difficulties may affect one or more of the industries to which we sell our products and services. If economic conditions continue to be uncertain, many existing and prospective end-customers may delay or reduce their IT spending. This could result in reductions in sales of our products and services, longer sales cycles, slower adoption of new technologies, and increased price competition. While we have diversified our manufacturing presence and limited our reliance on imports from China, tariffs have been imposed and threaten to be increased on other countries where our products are manufactured, such as Taiwan, Vietnam, Thailand, and the Philippines. A majority of our products are currently excluded from the bulk of these tariffs, though we cannot predict that will continue to be the case. Any imposition of tariffs or new export controls affecting imports of our products to the United States may result in increased costs and potential delays. Additionally, global trade partners may continue to respond to U.S. tariffs with retaliatory measures. For instance, China has, in the past, made threats of restricting exports of critical raw materials, including rare earth minerals essential to several of our components. Such actions could disrupt our supply chain, elevate input costs, create delays as alternative suppliers are sought, and undermine the competitiveness of our offerings. Similarly, other countries could impose retaliatory tariffs against American imports, which could potentially increase the cost of our products to customers in those countries, making our products less competitive. Any one of these impacts, or the aggregate impact of them, could adversely affect our business, financial condition, and operating results.

International sales constitute a significant portion of our net revenues. Our ability to grow will depend in part on the expansion of international sales. There are a number of risks arising from our international business, including: - the payment of operating expenses in local currencies, which exposes us to risks of currency fluctuations;- fluctuations in local economies which impact demand;- import tariffs imposed by the United States and the possibility of reciprocal tariffs by foreign countries;- compliance with trade compliance laws and regulations, including restrictions on trade with embargoed or sanctioned countries or with denied parties, and rules related to the export of encryption technology;- differing privacy regulations, data localization requirements, and restrictions on cross-border data transfers;- compliance with U.S. laws and regulations pertaining to the sale and distribution of products to customers in foreign countries, including anti-corruption laws such as the Foreign Corrupt Practices Act ("FCPA") and the U.K. Bribery Act 2010;- compliance with regulatory requirements of foreign countries, including compliance with rapidly evolving environmental regulations;- difficulty in conducting due diligence with respect to business partners in certain international markets;- reduced or limited protection of intellectual property rights, particularly in jurisdictions that have less developed intellectual property regimes, such as China and India;- difficulties in managing operations across disparate geographic areas;- longer accounts receivable collection cycles;- higher credit risks requiring cash in advance or letters of credit;- potential adverse tax consequences;- increased complexity of accounting rules and financial reporting requirements;- difficulties associated with enforcing agreements through foreign legal systems;- systemic transportation issues could impact delivery of product around the world;- terrorism, war or other armed conflict; and - natural disasters, epidemics, and pandemics. Any or all of these factors could have a material adverse impact on our business, financial condition, and operating results. Substantially all of our international sales are U.S. Dollar-denominated. Fluctuations in exchange rates between the U.S. Dollar and foreign currencies could increase our operating expenses, which are often paid in local currency. In the future, we may elect to invoice a larger portion of our international customers in local currency, which would expose us to greater fluctuations in exchange rates between the U.S. Dollar and the particular local currency. If we do so, we may decide to engage in hedging transactions to minimize the risk of such fluctuations. We have entered into foreign exchange forward contracts to offset the impact of payment of operating expenses in local currencies to some of our operating foreign subsidiaries. However, if we are not successful in managing these foreign currency transactions, we could incur losses from these activities.