908 Devices (MASS) Risk Analysis

Developing our products is expensive, and the investment in product development may involve a long payback cycle. Our investment in research and development may not result in marketable products or may result in products that take longer to generate revenue, or generate less revenue, than we anticipate. Our future plans include significant investments in research and development of product opportunities for expansion of our handheld products. We believe that we must continue to dedicate a significant amount of resources to our research and development efforts to maintain our competitive position. However, we may not receive significant revenue from these investments for several years, if at all.

We are party to royalty-bearing license agreements and we may need to obtain additional licenses from others to advance our research, development and commercialization activities. Our current license agreements impose, and we expect that any future exclusive in-bound license agreements will impose, various development, diligence, commercialization and other obligations on us. We have also entered into engagements in the past, and may enter into engagements in the future, with other partners and customers under which we obtain certain intellectual property rights relating to our platform and technology. These engagements take the form of exclusive licenses, non-exclusive licenses, or assignment of actual ownership of intellectual property rights or technology from third parties. Our rights to use the technology we license are subject to the continuation of and compliance with the terms of those agreements. In some cases, we may not control the prosecution, maintenance or filing of the patents and patent applications to which we hold licenses, or the enforcement of those patents against third parties. Moreover, disputes may arise with respect to our licensing or other upstream agreements, including: - the scope of rights granted under the agreements and other interpretation-related issues;- the extent to which our systems and consumables, technology and processes infringe on intellectual property rights of the licensor that are not licensed under the licensing agreement;- the sublicensing of patent and other rights under our collaborative development relationships;- our diligence obligations under the license agreements and what activities satisfy those diligence obligations;- the inventorship and ownership of inventions and know-how resulting from the joint creation or use of intellectual property by our licensors and us and our partners; and - the priority of invention of patented technology. In spite of our efforts to comply with our obligations under our in-bound license agreements, our licensors might conclude that we have materially breached our obligations under our license agreements and might therefore, including in connection with any aforementioned disputes, terminate the relevant license agreement, thereby removing or limiting our ability to develop and commercialize products and technology covered by these license agreements. If any such in-bound license is terminated, or if the licensed patents fail to provide the scope of exclusivity expected, competitors or other third parties might have the freedom to market, develop, or commercialize products similar to ours. In addition, absent the rights granted to us under such license agreements, we may infringe the intellectual property rights that are the subject of those agreements, we may be subject to litigation by the licensor, and if such litigation by the licensor is successful we may be required to pay damages to our licensor, or we may be required to cease our development and commercialization activities which are deemed infringing, and in such event we may ultimately need to modify our activities or products to design around such infringement, which may be time- and resource-consuming, and which may not be ultimately successful. Any of the foregoing could have a material adverse effect on our business, financial condition, results of operations, and prospects. In addition, our rights to certain technologies are licensed to us on a non-exclusive basis. The owners of these non-exclusively licensed technologies are therefore free to license them to third parties, including our competitors, on terms that may be superior to those offered to us, which could place us at a competitive disadvantage. Moreover, our licensors may own or control intellectual property that has not been licensed to us and, as a result, we may be subject to claims,regardless of their merit, that we are infringing or otherwise violating the licensor's rights. In addition, certain of our agreements with third parties may provide that intellectual property arising under these agreements, such as data that could be valuable to our business, will be owned by the counterparty, in which case, we may not have adequate rights to use such data or have exclusivity with respect to the use of such data, which could result in third parties, including our competitors, being able to use such data to compete with us.

In the ordinary course of our business, we and the third parties with whom we work process, collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process) proprietary, confidential, and sensitive data, including personal data, intellectual property, and trade secrets (collectively, sensitive information). We rely on information technology systems to keep financial records, facilitate our research and development initiatives, manage our manufacturing operations, maintain quality control, fulfill customer orders, maintain corporate records, communicate with staff and external parties and operate other critical functions. Cyber-attacks, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our sensitive information and information technology systems, and those of the third parties with whom we work. Such threats are prevalent and continue to increase, are increasingly difficult to detect, and come from a variety of sources, including traditional computer "hackers," threat actors, "hacktivists," organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we, the third parties with whom we work, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, which could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our goods and services. We and the third parties with whom we work are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing attacks, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, floods, attacks enhanced or facilitated by AI, and other similar threats. In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, ability to provide our products or services, loss of sensitive data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. We, like others in our industry, have experienced and expect to continue to experience certain of these and other threats to our information systems and infrastructure. It may be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident. Our efforts to do so may not be successful. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. For example, threat actors may use an initial compromise of one part of our environment to gain access to other parts of our environment, or leverage a compromise of our networks or systems to gain access to the networks or systems of third parties with whom we work, such as through phishing or supply chain attacks. Remote work has increased risks to our information technology systems and data, as our personnel utilize network connections, computers and devices outside our premises or network, including working at home, while in transit and in public locations. Additionally, future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities' systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program. We rely on third parties to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, delivery of products or services to customers, and other functions. Our ability to monitor these third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. If the third parties with whom we work experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if the third parties with whom we work fail to satisfy their privacy or security-related obligations, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties' infrastructure in our supply chain or that of the third parties with whom we work have not been compromised. While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We take steps designed to detect, mitigate, and remediate vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties with whom we work). We have not and may not in the future, however, detect and remediate all such vulnerabilities including on a timely basis. Further, we have and may in the future experience delays in developing and deploying remedial measures and patches designed to address identified vulnerabilities. Vulnerabilities could be exploited and result in a security incident. Any of the previously identified or similar threats have in the past and may in the future cause a security incident or other interruption that have in the past and may in the future result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or our information technology systems, or those of the third parties with whom we work. For example, through a social engineering scheme, a threat actor obtained limited unauthorized access to certain components of our information systems. The actor then leveraged such access in an effort to perpetrate further unauthorized activity such as by sending unauthorized emails to a limited number of external recipients. We, however, identified the unauthorized activity and implemented measures designed to contain it and mitigate its effects. A security incident or other interruption could disrupt our ability (and that of third parties with whom we work) to provide our products and services. For example, if operations at our facilities were disrupted due to a compromise in our information systems, it may cause a material disruption in our business if we are not capable of restoring functionality on an acceptable timeframe. We may expend significant resources or modify our business activities to try to protect against security incidents. Additionally, certain data privacy and security obligations (such as contracts) have required us to implement and maintain specific security measures or industry-standard or reasonable security measures designed to protect our information technology systems and sensitive information. Security incidents or perceived security incidents, may lead to material adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions in our operations (including availability of data); financial loss; and other similar harms. Security incidents and attendant material consequences may prevent or cause customers to stop using our products and services, deter new customers from using our products and services, and negatively impact our ability to grow and operate our business. Additionally, applicable data privacy and security obligations may require us, or we may voluntarily choose, to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents, or to take other actions, such as providing credit monitoring and identity theft protection services. Such disclosures and related actions can be costly, and the disclosure or the failure to comply with such applicable requirements could lead to adverse consequences. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims. In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. Additionally, sensitive information of the Company or our customers could be leaked, disclosed, or revealed as a result of or in connection with use of generative AI technologies by our employees, personnel, or vendors. Furthermore, as a contractor supporting defense customers, we are subject to certain additional regulatory compliance requirements relating to data privacy and cybersecurity. We also may be subject to the Department of Defense Cybersecurity Maturity Model Certification ("CMMC"), requirements in the future, which require all contractors to receive specific certifications relating to specified cybersecurity standards in order to be eligible for contract awards. In addition, CMMC certification requirements may be required in modifications to existing contracts. To the extent we are unable to achieve certification in advance of applicable contract awards that specify the requirement, we will be unable to bid on such contract awards or on follow-on awards for existing work with the Department of Defense, depending on the level of standard as required for each solicitation, or be ineligible to receive option awards under existing contracts that specify the certification requirement, which could adversely impact our revenue and profitability. In addition, any obligations that may be imposed on us under the CMMC may be different from or in addition to those otherwise required by applicable laws and regulations, which may cause additional expense for compliance.

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). Numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. Certain of these state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018 (CCPA) applies to personal data of consumers, business representatives, and employees who are California residents, and requires businesses who are subject to the CCPA to provide specific disclosures in privacy notices and respond to requests of such individuals to exercise certain privacy rights. The CCPA also provides for fines and allows private litigants affected by certain data breaches to recover significant statutory damages. Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future. Outside the United States, an increasing number of laws, regulations, and industry standards govern data privacy and security. For example, the European Union's General Data Protection Regulation (EU GDPR) and the United Kingdom's GDPR (UK GDPR) (collectively, GDPR) impose strict requirements for processing personal data. Under the GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million Euros under the EU GDPR, 17.5 million pounds sterling under the UK GDPR or, in each case, 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. In the ordinary course of business, we transfer personal data from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the European Economic Area (EEA) and the United Kingdom (UK) have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it generally believes are inadequate. Other jurisdictions may adopt or have already adopted similarly stringent data localization and cross-border data transfer laws. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EEA standard contractual clauses, the UK's International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States. If there is no lawful manner for us to transfer personal data from the EEA, the UK or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions (such as Europe) at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Additionally, companies that transfer personal data out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of Europe for allegedly violating the GDPR's cross-border data transfer limitations. Globally, regulators (including in the U.S.), have enacted and may in the future enact further prohibitions or restrictions on certain cross-border data transfers that may impact our operations. Our personnel use generative artificial intelligence technologies to perform their work, and the disclosure and use of personal data in artificial intelligence technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws and regulations regulating artificial intelligence technologies. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use artificial intelligence technologies, it could make our business less efficient and result in competitive disadvantages. We are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. In addition, we are subject to industry standards adopted by industry groups and may in the future become subject to additional such obligations. For example, we are subject to the Payment Card Industry Data Security Standard ("PCI DSS"). The PCI DSS requires companies to adopt certain measures to ensure the security of cardholder information, including using and maintaining firewalls, adopting proper password protections for certain devices and software, and restricting data access. Noncompliance with PCI DSS can result in penalties ranging from $5,000 to $100,000 per month by credit card companies, litigation, damage to our reputation, and revenue losses. We also rely on vendors to process payment card data, who may be subject to PCI DSS, and our business may be negatively affected if our vendors are fined or suffer other consequences as a result of PCI DSS noncompliance. We publish and may in the future publish privacy policies, marketing materials, whitepapers, and other statements, such as statements related to compliance with certain certifications or self-regulatory principles, concerning data privacy, and security. Regulators are increasingly scrutinizing these statements, and if these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, misleading, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences. Obligations related to data privacy and security (and consumers' data privacy expectations) are quickly changing, becoming increasingly stringent, and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources, which may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal data on our behalf. We may at times fail (or be perceived to have failed) in our efforts to comply with our data privacy and security obligations. Moreover, despite our efforts, our personnel or third parties with whom we work may fail to comply with such obligations, which could negatively impact our business operations. If we or the third parties with whom we work fail, or are perceived to have failed, to address or comply with applicable data privacy and security obligations, we could face significant consequences, including but not limited to: government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar); litigation (including class-action claims) and mass arbitration demands; additional reporting requirements and/or oversight; bans or restrictions on processing personal data; orders to destroy or not use personal data; and imprisonment of company officials. In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to: loss of customers; interruptions or stoppages in our business operations; inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize our products; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or substantial changes to our business model or operations.

The marketing, sale and use of our products could lead to the filing of product liability claims were someone to allege that our products identified inaccurate or incomplete information regarding the analyzed or otherwise failed to perform as designed. We may also be subject to liability for errors in, a misunderstanding of or inappropriate reliance upon, the information we provide in the ordinary course of our business activities. A product liability claim could result in substantial damages and be costly and time-consuming for us to defend. We maintain product liability insurance, but this insurance may not fully protect us from the financial impact of defending against product liability claims. Any product liability claim brought against us, with or without merit, could increase our insurance rates or prevent us from securing insurance coverage in the future. Additionally, any product liability lawsuit could damage our reputation, or cause current customers to terminate existing agreements and potential clinical partners to seek other partners, any of which could impact our business, financial condition, results of operations, and prospects.

Under legislation enacted in 2017, informally titled the Tax Cuts and Jobs Act, as modified by the Coronavirus Aid, Relief, and Economic Security Act, or CARES Act, unused federal net operating losses, or NOLs, generated in tax years beginning after December 31, 2017, will not expire and may be carried forward indefinitely, and generally may not be carried back to prior taxable years, except that under the CARES Act, net operating losses generated in 2018, 2019 and 2020 may be carried back five taxable years. Additionally, the deductibility of such federal NOLs in tax years beginning after December 31, 2020, is limited to 80% of taxable income. It is uncertain if and to what extent various states will conform to the Tax Cuts and Jobs Act, or the CARES Act. In addition, under Sections 382 and 383 of the Internal Revenue Code of 1986, as amended, or the Code, if a corporation undergoes an "ownership change," generally defined as a cumulative change of more than 50 percentage points (by value) in its equity ownership by certain stockholders over a three-year period, the corporation's ability to use its pre-change NOL carryforwards and other pre-change tax attributes (such as research tax credits) to offset its post-change income or taxes may be limited. We may experience ownership changes in the future as a result of shifts in our stock ownership (some of which may be outside our control). As a result, if we earn net taxable income, our ability to use our pre-change NOL carryforwards to offset such taxable income may be subject to limitations. Similar provisions of state tax law may also apply to limit our use of accumulated state tax attributes. For example, California recently imposed limits on the usability of California state NOLs to offset taxable income in certain tax years. As a result, even if we attain profitability, we may be unable to use a material portion of our NOL carryforwards and other tax attributes, which could adversely affect our future cash flows.

Substantially all of our manufacturing operations occur at our Danbury, Connecticut facility. A natural or other disaster, such as a fire or flood, at this location could cause substantial delays in our operations, damage or destroy our manufacturing equipment or inventory, and cause us to incur additional expenses. The insurance we maintain against fires, floods and other natural disasters may not be adequate to cover our losses in any particular case. With or without insurance, damage to our manufacturing facility or our other property, or to any of our suppliers, due to fire, flood or other natural disaster or casualty event may have a material adverse effect on our business, financial condition and results of operations.

Our future success depends on our ability to recruit, train, retain and motivate key personnel, including our senior management, research and development, manufacturing and sales, customer service and marketing personnel. In particular, Dr. Knopp, our Chief Executive Officer and one of our co-founders, is critical to our vision, strategic direction, culture and products. Each of our employees may terminate his or her relationship with us at any time and the loss of the services of such persons could have an adverse effect on our business. We rely on our senior management to manage our existing business operations and to identify and pursue new growth opportunities. The loss of any member of senior management could significantly delay or prevent the achievement of our business objectives and their replacement would likely involve significant time and expense. As we continue to scale our business, we may find that certain of our products and certain customers or certain markets, may require a dedicated sales force or sales personnel with different experience than those whom we currently employ. Our continued growth will depend, in part, on attracting, retaining and motivating highly-trained sales personnel with the necessary scientific background and technical ability to understand our systems and effectively identify and sell to potential new customers. Identifying, recruiting and training additional qualified personnel will require significant time, expense and attention. In addition, the continued development of complementary software tools, such as our analysis tools and visualization software, requires us to compete for highly trained software engineers in the New England area and for highly trained customer service personnel globally. We do not have fixed term employment contracts with any of our employees. As a result, our employees could leave our company with little or no prior notice and may be free to work for a competitor, subject to the terms of their confidentiality, non-solicitation and intellectual property assignment agreements. Because of the complex and technical nature of our products and the dynamic market in which we compete, any failure to attract, train, retain and motivate qualified personnel could materially harm our operating results and growth prospects.

We provide a one-year assurance-type warranty on our products and consumables. Existing and future warranties place us at the risk of incurring future repair and/or replacement costs. At the time revenue is recognized, we establish an accrual for estimated warranty expenses based on historical data and trends. We exercise judgment in estimating the expected product warranty costs, using data such as the actual and projected product failure rates, estimated repair costs, freight, material, labor and overhead costs. While we believe that historical experience provides a reliable basis for estimating such warranty costs, unforeseen quality issues or component failure rates could result in future costs in excess of such estimates, or alternatively, improved quality and reliability in our products and consumables could result in actual expenses that are below those currently estimated. Substantial amounts of warranty claims could have a material adverse effect on our business, financial condition, and results of operations.

Our products are subject to U.S. export controls and economic sanctions laws and regulations, including the International Traffic in Arms Regulations, or ITAR, the Export Administration Regulations, or EAR, sanctions regulations administered by the Office of Foreign Assets Control, or OFAC, and other similar laws and regulations of other applicable jurisdictions, which we refer to collectively as Trade Controls. Applicable Trade Controls restrict our ability to export our products and services to, or otherwise transact or deal with, certain countries, territories, individuals, and entities, unless required governmental licenses or authorizations are obtained or a general license or license exception is available. We may also be required to obtain licenses from the U.S. government before we can work with foreign entities on the development of our products. Obtaining export licenses and authorizations can be a costly and time-consuming process, often several months in duration. In addition, in some cases, a license might not be granted Failure to obtain licenses and authorizations or to comply with the requirements of the licenses or authorizations or of Trade Controls, or changes in U.S. export regulatory policy, particularly changes in the foreign policy or national security relationship between the U.S. and other jurisdictions could result in the imposition of restrictions on existing or future authorizations of exports and sales, which could adversely affect our business. Changes in our products or changes in export regulations may require reclassification of our products and create delays in the introduction and sale of our products in international markets, prevent our customers with international operations from deploying our products throughout their global systems or, in some cases, constrain in some way the export of our products to additional countries. Any change in export regulations or related legislation, shift in approach to the enforcement or scope of existing regulations or change in the countries, persons or technologies targeted by these regulations could result in decreased use of our products by, or in our decreased ability to export or sell our products to, existing or potential customers with international operations. Trade Controls may also inhibit the open interchange of technical discussions among our employees. Absent license authorization from the appropriate governmental agency, technical information related to certain of our products and technologies cannot be discussed with or otherwise disclosed to our foreign national employees, or with our foreign channel partners. Export licensing requirements may delay product development and other engineering activities. Violations of Trade Controls are subject to criminal, civil and administrative penalties. Governmental agencies responsible for administering Trade Controls are authorized to impose monetary penalties or even to suspend export privileges. While such actions have not been taken against our company to date, such risks exist in this highly regulated field, and we cannot entirely eliminate the possibility that such agency action may occur in the future. There is no certainty that all of our employees, agents, suppliers, manufacturers, contractors or collaborators, or those of our affiliates, will comply with Trade Controls.

In 2025, substantially all of our revenue was derived from sales of our handheld products. Today, this market consists primarily of first responders, firefighters, local, state and federal law enforcement, as well as military, customs and homeland security customers. Continued market acceptance of the products we sell to these organizations is critical to our future success, and the adoption of our products by these organizations worldwide is a key part of our growth strategy. If market demand for our products declines, if our products fail to maintain or achieve greater market acceptance, or if we fail to execute on our sales and customer service efforts, we will not be able to grow our revenue sufficiently to achieve or maintain profitability.