Shenandoah Telecommunications Co (SHEN) Risk Analysis

Our historical operational and financial results have depended, and our future results will depend, upon the retention and continued performance of our management team, as well as the attraction and retention of relevant key roles across our organization. Specifically, the highly-competitive market for talent for key roles in our industry, including executive officers and key personnel to support our engineering, sales, service delivery, information technology, finance and accounting functions, could adversely impact our ability to retain and hire new key employees and contractors. The loss of the services of key members of executive management or other employees or contractors in critical roles, and the inability or delay in hiring new key employees and contractors could materially and adversely affect our ability to manage and expand our business and our future operational and financial results. Moreover, an inability to retain sufficient qualified personnel throughout our organization or to attract new personnel as we grow our business could adversely affect our ability to achieve our operational, sales and financial goals impacting our financial results, financial condition and our stock price.

The supply of critical supplies, such as modems, consumer Wi-Fi equipment, energy, optical equipment and fiber is important to our business operations. These materials form the core components needed to deliver both video and data services to our customers. We work to ensure we have a forward-looking supply of these items and redundancy of supply types and suppliers. However, global impacts to supply chains, including cost increases as a result of changes to federal tariffs or retaliatory tariffs by the U.S. or foreign governments, across some or all suppliers and manufacturers could result in significant supply issues and/or increased cost. If supplies of these items became severely impacted, our plans to build out new networks could be adversely impacted. Additionally, the lack of certain equipment and/or supplies could limit our ability to service existing customers. Significant impact to supply chains could materially and adversely affect our business, including reduced revenues, loss of customers, significantly increased costs, and limitations on future growth. Additionally, at times we choose to leverage third-party suppliers to help us deliver services to customers because of efficiency reasons or because third-parties provide a service we cannot replicate easily. Should those third-party suppliers be impacted by a shortage of materials, equipment or resources, their inability to provide services to us could also negatively impact our ability to deliver network services or build out future network.

The cable television industry has continued to experience an increase in the cost of programming, especially sports programming and retransmission fees. In addition, as we add programming to our video services for existing customers or distribute existing programming to more customers, we incur increased programming expenses. Broadcasters affiliated with major over-the-air network services have been increasing their demands for cash payments and other concessions for the right to carry local network television signals on our cable systems. As compared to large national providers, our smaller base of subscribers limits our ability to negotiate lower programming costs. While we pass programming rate increases on to our video customers, we may experience higher churn and lower revenues. If we are unable to raise our customers' rates, these increased programming costs could have an adverse impact on our results of operations. Moreover, as our programming contracts and retransmission agreements with programming providers expire, there can be no assurance that they will be renewed on acceptable terms, which could lead to a loss of video customers and could have an adverse effect on our business and our results of operations.

Approximately 28% of commercial revenues are with the national wireless service providers who have carrier grade SLAs for network reliability and mean time to restore outages. If the Company and its network vendors providing off-network backhaul circuits to certain cellular towers do not meet the SLAs, contractual monetary penalties may be incurred which would have an adverse effect on revenues and profitability. Network investments may be required to remediate the issues.

We utilize our information technology infrastructure to manage and store various proprietary information and sensitive or confidential data relating to our operations. We routinely process, store and transmit large amounts of data for our customers, including sensitive and personally identifiable information. We depend on our information technology infrastructure to conduct business operations and provide customer services. We may be subject to data breaches and disruptions of the information technology systems we use for these purposes. Our industry has witnessed an increase in the frequency, intensity and sophistication of cybersecurity incidents caused by threat actors such as foreign governments, criminals, hacktivists, terrorists and insider threats. Threat actors may be able to penetrate our network security and misappropriate or compromise our confidential, sensitive, personal or proprietary information, or that of third parties, and engage in the unauthorized use or dissemination of such information. They may be able to create system disruptions, or cause shutdowns. Threat actors may be able to develop and deploy viruses, malware, ransomware and other malicious software programs that attack our products or otherwise exploit security vulnerabilities of our systems causing operational damage that could impact our ability to serve customers and result in financial losses. In addition, sophisticated hardware and operating system software and applications that we procure from third parties may contain defects in design or manufacture, including "bugs," cybersecurity vulnerabilities and other problems that could unexpectedly interfere with the operation or security of our systems. Like many other companies, we increasingly leverage third-party Software as a Service ("SaaS") solutions and external service providers to help us deliver services to our customers. In the delivery of these services, we are dependent on the security infrastructure of those third-party providers. These providers are also vulnerable to the myriad of possible cyber-attacks. In the case where a third-party provider becomes victim to an attack, it could have an impact on our operations or ability to service customers. To date, interruptions of our information technology infrastructure and third party suppliers have been infrequent and have not had a material impact on our operations. However, because technology is increasingly complex and cyber-attacks are increasingly sophisticated and more frequent, there can be no assurance that such incidents will not have a material adverse effect on us in the future. The consequences of a breach of our security measures or those of a third-party provider, a cyber-related service or operational disruption, or a breach of personal, confidential, proprietary or sensitive data caused by a hacker or other malicious actor could be significant for us, our customers and other affected third parties. For example, the consequences could include damage to infrastructure and property, impairment of business operations, disruptions to customer service, financial costs and harm to our liquidity, costs associated with remediation, loss of revenues, loss of customers, competitive disadvantage, legal expenses associated with litigation, regulatory action, fines or penalties or damage to our brand and reputation. In addition, the costs to us to eliminate or address the foregoing security challenges and vulnerabilities before or after a cyber-incident could be significant. In addition, our remediation efforts may not be successful and could result in interruptions, delays or cessation of service. We could also lose existing or potential customers for our services in connection with any actual or perceived security vulnerabilities in the services. We are subject to laws, rules and regulations relating to the collection, use and security of user data. Our operations are also subject to federal and state laws governing information security. In the event of a data breach or operational disruption caused by an information security incident, such rules may require consumer and government agency notification and may result in regulatory enforcement actions with the potential of monetary forfeitures as well as civil litigation. We have incurred, and will continue to incur, expenses to comply with privacy and security standards and protocols imposed by law, regulation, industry standards and contractual obligations. Notification to customers could also result in reputational damage which could result in loss of customers or future customers due to a lack of confidence in our ability to secure their data.

A disruption of our information technology infrastructure or overall operations, or the infrastructure or operations of certain vendors who provide information technology or overall operations services to us or our customers, could be caused by a natural disaster, power failure, manufacturing defect, telecommunications system failure, ransomware attack, cybersecurity attack or intrusion, terrorist attack, defective or improperly installed new or upgraded business management systems, or construction failure, including but not limited to a utility line strike. Although we make significant efforts to maintain the security and integrity of the Company's operations and information technology infrastructure, there can be no assurance that our security efforts, business impact planning and disaster recovery measures will be effective or that attempted security breaches or catastrophic disruptions would not be successful or damaging, especially in light of the growing sophistication of cyber-attacks and intrusions sponsored by state or other interests. Portions of our information technology infrastructure also may experience interruptions, delays or cessations of service or produce errors in connection with systems integration or migration work that takes place from time to time. In the event of any such disruption, we may be unable to conduct our business in the normal course. Moreover, our business involves the processing, storage and transmission of data, which would also be negatively affected by such an event. A significant disruption of our information technology infrastructure or operations could result in damage to our reputation and credibility, customer dissatisfaction and ultimately a loss of customers or revenue. Significant loss of customers or revenue, or significant increase in costs of serving those customers, could adversely affect our growth, financial condition and results of operations. We also could incur significant expense in repairing system damage and taking other remedial measures. Like many organizations, we increasingly rely on third party software and infrastructure supports to deliver our services. Disruptions, failures, defects, or other security vulnerabilities experienced by those third parties could cause adverse operational impacts, damage our reputation, adversely affect our financial impacts, or harm our business if significant in nature.