IonQ (IONQ) Risk Analysis

In the ordinary course of business, we access, collect, receive, store, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, share, and otherwise process personal data and other sensitive information, including intellectual property, proprietary and confidential business data, trade secrets, sensitive third-party data, business plans, transactions, and financial information of our own, our partners, our vendors and their own supply chains, our customers, or other third parties, which we refer to collectively as Sensitive Data. We and the third parties upon which we rely process Sensitive Data, and, as a result, we and the third parties upon which we rely face a variety of evolving threats to our information technology systems, data, and physical facilities (such as those where our quantum computers are stored), including but not limited to ransomware attacks, advanced persistent threats and other causes of security incidents. Additionally, Sensitive Data could be leaked, disclosed or revealed as a result of or in connection with our employees', contractors', consultants', affiliates' or vendors' use of generative artificial intelligence, or AI, technologies. Cyber-attacks, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our Sensitive Data and information technology systems, and those of the third parties upon which we rely. Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer "hackers," threat actors, "hacktivists," organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors. U.S. law enforcement agencies have indicated to us that quantum computing technology is of particular interest to certain threat actors, including nation state and other malicious actors, who may steal our Sensitive Data, including our intellectual property or other proprietary or confidential information, including our trade secrets. Our employees, contractors, affiliates, and/or related parties may have already been directly targeted by nation state actors and may be so targeted in the future. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state and nation-state-supported actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other geopolitical tensions or conflicts, we, the third parties upon which we rely, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to distribute our services. We and the third parties upon which we rely are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss or unavailability of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, floods, and other similar threats. In particular, severe ransomware attacks are becoming increasingly prevalent and could lead to significant interruptions in our operations, loss or unavailability of Sensitive Data and loss of income, reputational harm and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Additionally, we are incorporated into the supply chains of companies worldwide and, as a result, if our services are compromised, a significant number or, in some instances, all of our customers and their data could be simultaneously affected. The potential liability and associated consequences we could suffer as a result of such a large-scale event could be catastrophic and result in irreparable harm. Remote work has increased risks to our information technology systems and data, as more of our employees use network connections, computers, and devices outside our premises or network, including working at home, while in transit and in public locations. Additionally, future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities' systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program. In addition, our reliance on third-party service providers could introduce new cybersecurity risks and vulnerabilities, including supply-chain attacks, and other threats to our business operations. Our platform is built to be accessed through third-party cloud providers, such as AWS's Amazon Braket, Microsoft's Azure Quantum, and Google's Cloud Marketplace, and we rely on these and other third-party service providers and technologies to operate critical business systems to process Sensitive Data in a variety of contexts, including, without limitation, other cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, content delivery to customers, and other functions. We also rely on third-party service providers to provide other products, services or parts, or otherwise to operate our business. There can be no assurance that our third-party service providers' security measures have been or will be effective to protect against various cybersecurity risks and vulnerabilities. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties' infrastructure in our supply chain or our third-party partners' supply chains have not been compromised. Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental access to, or acquisition, modification, destruction, loss, alteration, encryption, disclosure, or other processing of our Sensitive Data (including proprietary information and intellectual property) or our information technology systems, or those of the third parties upon whom we rely. A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely) to provide our services. We may expend significant resources or modify our business activities to try to protect against security incidents. Additionally, certain privacy and security obligations may require us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and Sensitive Data. While we have implemented security measures designed to protect against security incidents and other interruptions, there can be no assurance that these measures will be effective. We take steps to detect and remediate vulnerabilities in our information technology systems (including in our services), but we may not be able to detect and remediate all vulnerabilities because the threats and techniques used to exploit vulnerabilities change frequently and are often sophisticated in nature. Therefore, such vulnerabilities could be exploited but may not be detected until after a security incident has occurred; and, we may not be able to anticipate or detect attacks or vulnerabilities. These vulnerabilities pose material risks to our business. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities. As a result, we may be unable to implement adequate preventative and responsive measures to stop or mitigate security incidents before or while they are occurring. Finally, incidents that may appear to be minor when assessed individually, may become material, at a later date, when considered in the aggregate. Applicable privacy and security obligations may require us to notify relevant stakeholders of security incidents. Such disclosures are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences. If we (or a third party upon whom we rely) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences. These consequences may include: exposure, loss, unavailability, acquisition, or other unauthorized processing of Sensitive Data (including intellectual property or confidential or proprietary information); government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing Sensitive Data (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; interruptions in our operations (including availability of data); financial loss; and other similar harms. Security incidents and attendant consequences may cause customers to stop using our services, deter new customers from using our services and negatively impact our ability to grow and operate our business. Our efforts to prevent and overcome these challenges could increase our expenses and may not be successful. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our privacy and security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security obligations, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims. In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position.

We are subject to numerous federal, state, local and foreign environmental laws and regulations governing, among other things, solid and hazardous waste storage, treatment and disposal, and remediation of releases of hazardous materials. There are significant capital, operating and other costs associated with compliance with these environmental laws and regulations. Environmental laws and regulations may become more stringent in the future, which could increase costs of compliance or require us to manufacture with alternative technologies and materials. Federal, state and local authorities also regulate a variety of matters, including, but not limited to, health, safety and permitting in addition to the environmental matters discussed above. New legislation and regulations may require us to make material changes to our operations, resulting in significant increases to the cost of production. Our manufacturing process will have hazards such as, but not limited to, hazardous materials, machines with moving parts, and high voltage and/or high current electrical systems typical of large manufacturing equipment and related safety incidents. There may be safety incidents that damage machinery or product, slow or stop production, or harm employees. Consequences may include litigation, regulation, fines, increased insurance premiums, mandates to temporarily halt production, workers' compensation claims, or other actions that impact the company brand, finances, or ability to operate.

Our future success is highly dependent on our ability to attract and retain our executive officers, key employees, subject matter experts and other qualified personnel, including our employees who have specialized knowledge and our employees from acquired businesses. We have experienced in the past, and as we build our brand and become more well known, there is increased risk that we may further experience in the future, competitors or other companies hiring our personnel. The loss of the services provided by these individuals could adversely impact the achievement of our business strategy. These individuals could leave our employment at any time, as they are "at will" employees. A loss of one of our key employees, particularly to a competitor, could also place us at a competitive disadvantage. Effective succession planning is important to our long-term success, and failure to ensure effective transfer of knowledge and smooth transitions involving key employees could hinder our strategic planning and execution. Our future success also depends on our continuing ability to attract, develop, motivate and retain highly qualified and skilled employees. The market for highly skilled workers and leaders in the quantum industry is extremely competitive. In particular, hiring qualified personnel specializing in engineering, software development and sales, as well as other technical staff and research and development personnel is critical to our business and the development of our quantum solutions. Some of these professionals are hard to find and we may encounter significant competition in our efforts to hire them. Many of the other companies with which we compete for qualified personnel have greater financial and other resources than we do. The effective operation of our supply chain, including the acquisition of critical components and materials, the development and commercialization of our quantum technologies and the effective operation of our managerial and operating systems all depend upon our ability to attract, train and retain qualified personnel in the aforementioned specialties. Additionally, changes in immigration and work permit laws and regulations or the administration, interpretation or enforcement of such laws or regulations could impair our ability to attract and retain highly qualified employees. If we cannot attract, train and retain qualified personnel, in this competitive environment, we may experience delays in the development of our quantum technologies and be otherwise unable to maintain customer relationships or develop and grow our business as projected, or even at all. Additionally, during 2025, as we began to bring on the talent that we believe is necessary to guide us through our next stage of rapid and transformative growth, we experienced significant turnover in our executive ranks and on our Board of Directors. Management transition, even where initiated by the company, is often difficult and inherently causes some loss of institutional knowledge and a learning curve for new executives, which could negatively affect our results of operations and financial condition. Our ability to execute our business strategies may be adversely affected by the uncertainty associated with any such transition, and the time and attention from the board and management needed to train new employees and those of newly acquired and integrated companies could disrupt our business. Further, we expect to continue to acquire and integrate new businesses, and we cannot guarantee that we will not face turnover in the future. Although we generally enter into employment agreements with our executives, the agreements have no specific duration and our executive officers are at-will employees. As a result, they may terminate their employment relationship with us at any time, and we cannot ensure that we will be able to retain the services of any of them. Our senior management's knowledge of our business and industry would be difficult to replace, and any further turnover could negatively affect our business, growth, financial conditions, results of operations and cash flows.

We are reliant on third-party suppliers, including sole source suppliers, for components necessary to develop and manufacture our quantum solutions. As our business grows, we must continue to scale and adapt our supply chain or it could have an adverse impact on our business. Any of the following factors (and others) could have an adverse impact on the availability of these components necessary to our business: - our inability to enter into agreements with suppliers on commercially reasonable terms, or at all;- inability of suppliers to mature their operations in line with our growth and to meet our evolving requirements;- a significant increase in the price of one or more components, including due to industry consolidation occurring within one or more component supplier markets or as a result of decreased production capacity at manufacturers;- any reductions or interruption in supply, including disruptions on our global supply chain as a result of the global chip shortage, geopolitical tensions in and around Ukraine, Israel, Taiwan and other areas of the world and any indirect effects thereof;- financial problems of either manufacturers or component suppliers;- intentional sabotage by malicious actors;- significantly increased raw material costs and other expenses associated with our business;- difficulty obtaining raw materials that meet our quality standards;- significantly increased freight charges, disruptions in shipping or reduced availability of freight transportation;- the imposition of, or a sustained or temporary increase in, tariffs, trade protection measures or import and export controls by the United States or other countries;- actions taken by suppliers or other parties in response to expected or threatened increases in tariffs, trade protection measures or import or export controls by the United States or other countries;- requirements under securities laws to determine, disclose and report whether our products contain conflict minerals and, if applicable, potential changes to products, processes or sources of supply as a consequence of such verification activities;- reduced access to raw materials due to suppliers entering into exclusivity arrangements with our competitors;- rising prices for or limited availability of satellite launch services;- other factors beyond our control or that we do not presently anticipate that could affect our suppliers' ability to deliver components to us on a timely basis;- risks associated with essential components and materials that are available from a limited number of sources;- a failure to develop our supply chain management capabilities and recruit and retain qualified professionals;- a failure to adequately authorize procurement of inventory by our contract manufacturers; or - a failure to appropriately cancel, reschedule or adjust our requirements based on our business needs. We have experienced supply chain issues in the past. If any of the aforementioned factors were to materialize, it could cause us to delay or halt production of our quantum solutions and entail higher manufacturing costs, any of which could materially adversely affect our business, operating results and financial condition and could materially damage customer relationships.

Our results of operations may vary based on the impact of changes in our industry or the global economy on us or our customers and potential customers. The global economy, including credit and financial markets, has experienced extreme volatility and disruptions, including severely diminished liquidity and credit availability, declines in customer confidence, declines in economic growth, increases in unemployment rates, increases in inflation rates, higher interest rates and uncertainty about economic stability. For example, the coronavirus pandemic resulted in widespread unemployment, economic slowdown and extreme volatility in the capital markets and any future public health crises could result in similar impacts on the global economy. Similarly, geopolitical tensions in and around Ukraine, Israel and other areas of the world have created extreme volatility in the global capital markets and are expected to have further global economic consequences, including disruptions of the global supply chain and energy markets, and further acts of war, terror, or responses to each could result in similar or increased impacts on the global economy. Increased inflation rates can adversely affect us by increasing our costs, including labor and employee benefit costs. Employee salaries and benefits expenses have increased as a result of economic growth, increased demand for business services and increased competition for trained and talented employees, among other wage-inflationary pressures and we cannot assure that they will not continue to rise. In addition, higher inflation also could increase our customers' operating costs, which could result in reduced budgets for our customers and potentially less demand for our platform and the development of quantum technologies. Any significant increases in inflation and related increase in interest rates could have a material adverse effect on our business, results of operations and financial condition. In addition, in challenging economic times, our current or potential future customers may experience cash flow problems and as a result may modify, delay or cancel plans to purchase our products and services. Additionally, if our customers are not successful in generating sufficient revenue or are unable to secure financing, they may not be able to pay, or may delay payment of, accounts receivable due to us. Moreover, our key suppliers may reduce their output or become insolvent, thereby adversely impacting our ability to manufacture our products. Furthermore, uncertain economic conditions may make it more difficult for us to raise funds through borrowings or private or public sales of debt or equity securities. We cannot predict the timing, location, strength or duration of any economic slowdown, instability or recovery, generally or within any particular industry. Furthermore, a disruption or failure of our systems or operations because of an earthquake, weather event, cyberattack, terrorist attack, pandemic or other catastrophic event could cause delays in providing services or performing other critical functions, which could also delay commercial deals and the associated revenue recognition for those deals. Our principal manufacturing facility and a significant portion of our research and development activities, and certain other essential business operations, are located in the Seattle, Washington area, which is a seismically active region. A catastrophic event that results in the destruction or disruption of any of our critical business or IT systems, or the infrastructure or systems they rely on could harm our ability to conduct normal business operations.

We currently maintain offices and/or have personnel in the United States and other international locations. We expect to continue to expand our international operations by developing our sales and operations presence internationally, which may include opening offices in new jurisdictions. Any additional international expansion efforts that we are undertaking and may undertake may not be successful. In addition, conducting international operations subjects us to new risks, some of which we have not generally faced in the United States or other countries where we currently operate. These risks include, among other things: - lack of familiarity and burdens of complying with foreign laws, legal standards, privacy and cybersecurity standards, regulatory requirements, tariffs and other barriers, and the risk of penalties to our customers and individual members of management or employees if our practices are deemed to not be in compliance;- practical difficulties of enforcing intellectual property rights in countries with varying laws and standards and reduced or varied protection for intellectual property rights in some countries;- an evolving legal framework and additional legal or regulatory requirements for privacy and cybersecurity, which may necessitate the establishment of systems to maintain data in local markets, requiring us to invest in additional data centers and network infrastructure, and the implementation of additional employee privacy documentation (including locally compliant privacy notices and policies), all of which may involve substantial expense and may cause us to need to divert resources from other aspects of our business, all of which may adversely affect our business;- unexpected changes in regulatory requirements, taxes, foreign investment rules, trade laws, tariffs, export quotas, custom duties or other trade restrictions;- difficulties in managing systems integrators and partners;- increased or unexpected supply chain challenges or delays;- differing technology standards;- different pricing environments, longer sales cycles, longer accounts receivable payment cycles and difficulties in collecting accounts receivable;- increased financial accounting and reporting burdens and complexities;- difficulties in managing and staffing international operations including the proper classification of independent contractors and other contingent workers, differing employer/employee relationships and local employment laws;- increased costs involved with recruiting and retaining an expanded employee population, including highly skilled workers and leaders in the quantum computing industry, outside the United States through cash and equity-based incentive programs, and legal costs and regulatory restrictions in issuing our shares to employees outside the United States;- global political and regulatory changes that may lead to restrictions on immigration and travel for our employees;- fluctuations in exchange rates that may decrease the value of our foreign-based revenue or increase the cost of our foreign operations;- global public health threats or geopolitical events such as tensions in and around Ukraine, Israel and other areas of the world;- degradation in U.S. relationships with targeted countries that could result in those countries disfavoring doing business with U.S. companies;- potentially adverse tax consequences, including the complexities of foreign value added tax (or other tax) systems, restrictions on the repatriation of earnings, and transfer pricing requirements; and - permanent establishment risks and complexities in connection with international payroll, tax and social security requirements for international employees. Additionally, operating in international markets also requires significant management attention and financial resources. We cannot be certain that the investment and additional resources required in establishing operations in other countries will produce desired levels of revenue or profitability. Compliance with laws and regulations applicable to our global operations also substantially increases our cost of doing business in foreign jurisdictions. We have limited experience in marketing, selling and supporting our solutions outside of the United States. Our limited experience in operating our business internationally increases the risk that any potential future expansion efforts that we may undertake will not be successful. If we invest substantial time and resources to expand our international operations and are unable to do so successfully, in a timely manner, our business, financial condition, revenues, results of operations or cash flows will suffer. We may be unable to keep current with changes in government requirements as they change from time to time. Failure to comply with these regulations could harm our business. In many countries, it is common for others to engage in business practices that are prohibited by our internal policies and procedures or other regulations applicable to us. Although we have implemented policies and procedures designed to ensure compliance with these laws and policies, there can be no assurance that all of our employees, contractors, partners and agents will comply with these laws and policies. Violations of laws or key control policies by our employees, contractors, partners or agents could result in delays in revenue recognition, financial reporting misstatements, enforcement actions, reputational harm, disgorgement of profits, fines, civil and criminal penalties, damages, injunctions, other collateral consequences or the prohibition of the importation or exportation of our solutions and could harm our business, financial condition, revenues, results of operations or cash flows.

We are continuing to expand our international operations as part of our growth strategy. However, there are a variety of risks and costs associated with our international sales and operations, which include making investments prior to the sales or use of quantum solutions, the cost of conducting our business internationally and hiring and training international employees and the costs associated with complying with local law. Furthermore, we cannot predict the rate at which our quantum solutions will be accepted in international markets by potential customers. Our sales, support and engineering organization outside the United States is substantially smaller than our U.S. sales organization. We believe our ability to attract new customers to subscribe to our platform or to attract existing customers to renew or expand their use of our platform is directly correlated to the level of engagement we obtain with the customer. To the extent we are unable to effectively engage with non-U.S. customers due to our limited sales force capacity, we may be unable to effectively grow in international markets. As our international operations expand, our exposure to the effects of fluctuations in currency exchange rates grows. While we have primarily transacted with customers in U.S. dollars historically, we expect to continue to expand the number of transactions with our customers that are denominated in foreign currencies in the future. Additionally, fluctuations in the value of the U.S. dollar and foreign currencies may make our products and services more expensive for international customers, which could harm our business. Additionally, we incur expenses for employee compensation and other operating expenses for our non-U.S. employees in the local currency for such locations. Fluctuations in the exchange rates between the U.S. dollar and other currencies could result in an increase to the U.S. dollar equivalent of such expenses. These fluctuations could cause our results of operations to differ from our expectations or the expectations of our investors. Additionally, such foreign currency exchange rate fluctuations could make it more difficult to detect underlying trends in our business and results of operations. We may attempt to mitigate a portion of these risks through foreign currency hedging based on our judgment of the appropriate trade-offs among risk, opportunity, and exposure. Any future hedging activities may not offset the full, or in some cases any, adverse financial impact resulting from unfavorable movement in foreign currency exchange rates, which could adversely affect our financial condition and results of operations.