Smith Micro Software (SMSI) Risk Analysis

A customer's decision to purchase and launch to the market certain of our products or solutions, particularly products or versions of products that are new to the market, may involve a lengthy contracting, design, and qualification processes, with a timing gap between contracting and launch. Further, a lengthy contracting process, together with lengthy testing, qualification and approval processes are often a prerequisite to our customers' being in a position to launch updated versions of our products. In particular, customers deciding on the implementation of our products may have lengthy and unpredictable procurement and go-to-market processes that may delay or impact expected revenues. This unpredictability may cause our revenues and operating results to vary unexpectedly from quarter-to-quarter, making our future operational results less predictable.

We and/or the third-party systems that we use to deliver our products and services may be subject to cyber-attacks by third parties seeking unauthorized access to our data or our customers' or their end users' data or to disrupt our ability to provide service. Our products and services involve the collection, storage, processing, and transmission of data. The uninterrupted operation of our hosted solutions and the confidentiality and security of our data, our customers' and their end users' data, and other third-party information and materials is critical to our business. Any failure to prevent or mitigate security breaches and improper access to or disclosure of our data or our customers' data or their users' data, including personal information from users, or of the other third party information and materials in our possession or control, including pre-release mobile devices in our custody, could result in the loss, modification, disclosure, destruction, or other misuse of such data or materials, which could harm our business and reputation, subject us to material liability and diminish our competitive position. In addition, computer malware, viruses, and general hacking have become more prevalent and may occur on our systems or on the third-party systems that we use. Such breaches and attacks may cause interruptions to the services we provide, degrade the user experience, cause our customers and their users to lose confidence and trust in our products and services, impair our internal systems or the third-party systems that we use, and result in financial harm to us. If we are unable to protect, or our customers and mobile device manufacturer partners perceive that we are unable to protect, the security and privacy of information, data and materials in our care, our growth could be materially adversely affected, and we could be subject to material liability. A security or privacy breach may: - cause our customers to lose confidence in our solutions;- cause our mobile device manufacturer partners to cease doing business with us;- harm our reputation;- expose us to material liability; and - increase our expense from potential remediation costs. While we believe we use proven applications and have established adequate physical and technological safeguards designed for facility security, data security and integrity to process electronic transactions, there can be no assurance that these applications and safeguards will be adequate to prevent a security breach or that in the event of a security breach we will be able to react in a timely manner, or that our remediation efforts will be successful. We also cannot be certain that these applications and safeguards will be or remain sufficient to address changing market conditions or the security and privacy concerns of existing and potential customers and device manufacturer partners. Our efforts to protect our data, our customers' and their end users' data and the other third party information and materials we receive, and to disable undesirable activities on our systems, may also be unsuccessful due to software bugs or other technical malfunctions, employee, contractor, or vendor error or malfeasance, including defects or vulnerabilities in our vendors' information technology systems or offerings, breaches of security of our facilities or technical infrastructure, or other threats that may evolve in the future. In addition, our customers and end users may use our products and services in a manner which violates cybersecurity or data privacy laws in one or more jurisdictions. Any significant or high-profile security breach, data privacy breach or violation of data privacy laws could result in the loss of business and reputation, litigation against us, liquidated and other damages, and regulatory investigations and penalties that could adversely affect our operating results and financial condition.

We operate in markets that are extremely competitive and subject to rapid changes in technology. Because there are low barriers to entry into the software markets in which we participate and may participate in the future, we expect significant competition to continue from both established and emerging software companies, domestic and international. In fact, our growth opportunities in new product markets could be limited to the extent established and emerging software companies enter or have entered those markets. We also may face competition from our existing customers that choose to internally develop and operate a competing product. Many of our other current and prospective competitors have significantly greater financial, marketing, service, support, technical, and other resources than we do. As a result, they may be able to adapt more quickly than we can to new or emerging technologies and changes in customer requirements, or to devote greater resources to the promotion and sale of their products. Announcements of competing products by competitors could result in our carrier customers reducing, delaying, or withholding the adoption, promotion, or launch of our products and services in anticipation of the introduction of such new products. In addition, some of our competitors are currently making complementary products that are sold separately. Such competitors could decide to enhance their competitive position by bundling their products to attract customers seeking integrated, cost-effective software applications. Some competitors have a retail emphasis and offer OEM products with a reduced set of features. The opportunity for retail upgrade sales may induce these and other competitors to make OEM products available at their own cost or even at a loss. We also expect competition to increase as a result of software industry consolidations, which may lead to the creation of additional large and well-financed competitors. Increased competition is likely to result in price reductions, fewer customer orders, reduced margins, and loss of market share.

We sell our wireless products and solutions primarily to large wireless carriers, so there are a limited number of actual and potential customers for our products, resulting in significant customer concentration. For the year ended December 31, 2025, sales to our three largest customers comprised 60%, 21%, and 18% of our revenues. No other customer was greater than 10% of our revenues individually. Because of our relatively high customer concentration, a small number of significant customers possess a relative level of pricing and negotiating power over us, enabling them to achieve advantageous pricing and other contractual terms, including the ability to terminate their agreements with us with a limited amount of notice. In addition, because our contracts generally provide our customers with the right and license, but not the obligation, to deploy our solutions to their end users, the existence of a contract does not guarantee that our solutions will be deployed as widely as we expect or at all. Any material decrease in our sales to any of these customers, including the termination of contracts with any of these customers or a customer's curtailment or cessation of offering our solutions to their end users, would materially affect our revenue and profitability. The reduction in sales or termination of relationships with any of these customers would also increase the customer concentration and risk as to our remaining large customers. If there are delays in the distribution of our products or if customer negotiations for our new products cannot occur on a timely basis, we may not be able to generate sufficient revenues to meet the needs of the business in the foreseeable future or at all.

Certain of our customers in the communications industry are subject to regulation by the Federal Communications Commission, which could have an indirect effect on our business. In addition, the U.S. telecommunications industry has been subject to continuing deregulation since 1984. We cannot predict when, or upon what terms and conditions, further regulation or deregulation might occur, or the effect regulation or deregulation may have on demand for our products from customers in the communications industry. Demand for our products may be indirectly affected by regulations imposed upon potential users of those products, which may increase our costs and expenses.

In the ordinary course of our business, through the delivery of our solutions and in connection with our routine processing of human resources data, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, share and otherwise process confidential, proprietary, and sensitive information, including personal information, and information that may be considered sensitive personal information in certain jurisdictions. As a result, we are subject to numerous data privacy, data protection, and information security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, and contractual requirements, and may become subject to new obligations of this nature in the future. The data privacy, data protection, and information security laws and regulations to which we are and may become subject address and will address a range of issues, including data privacy, cybersecurity, age-appropriate design, and restrictions or technological requirements regarding the collection, use, storage, protection, retention, or transfer of personal information. The regulatory framework and enforcement mechanisms for data privacy and cybersecurity issues worldwide can vary substantially between jurisdictions. New laws continue to be enacted that may require considerable resources to ensure timely and ongoing compliance given the nuances of each jurisdiction's legal obligations. For example, more U.S. states are enacting comprehensive data privacy laws similar to the California Consumer Privacy Act of 2018 and the substantial amendments to that framework from the California Privacy Rights Act (CPRA), which took effect in January 2023, that provide new data privacy rights to state residents, expand certain protections to personal information of employees in the state, and create special degrees of protection for certain "sensitive" personal information. The CPRA establishes a dedicated California data protection authority, which may increase enforcement actions and penalties for privacy regulation violations, as well as audits of possible violations. Additionally, expanded business-to-business personal information protections may require additional negotiation of new and existing data processing agreements with service providers. We may also be or become subject to laws requiring age-appropriate design of online products accessed by children, which may require us to expend resources to make conforming updates to our products. Burgeoning legal obligations may require expenditure of considerable resources to establish and maintain the necessary internal infrastructure to comply with monitoring obligations, requests from data subjects, and other requirements, which may limit the use and adoption of our offerings. Other state and federal legislative and regulatory bodies have enacted or may enact similar legislation regarding the handling of personal data. Foreign privacy and data protection laws and regulations can be more restrictive than those in the United States. For example, in the European Union, the GDPR includes operational and governance requirements for companies that collect or process personal data of residents of the European Union and provides for significant penalties for non-compliance. The costs of compliance with, and other burdens imposed by, these laws and regulations may become substantial and may limit the use and adoption of our offerings, require us to change our business practices, impede the performance and development of our solutions. In addition to data privacy and security laws, we are contractually subject to industry standards adopted by industry groups and may become subject to such obligations in the future. We are also bound by other contractual obligations related to privacy, data protection, and information security, and our efforts to comply with such obligations may not be successful. We publish privacy policies, marketing materials, and other statements, such as compliance with certain certifications or self-regulatory principles, regarding privacy, data protection, and information security privacy, data protection, and information security. For the offerings that are distributed by our customers under their respective brands, our customers develop the applicable privacy policies, terms of service and other similar materials and statements. If any of these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to investigation, claims, litigation, enforcement actions by regulators, contractual penalties or indemnification obligations, or other adverse consequences. We may at times fail (or be perceived to have failed) in our efforts to comply with our privacy, data protection, and information security obligations. Moreover, despite our efforts, our personnel or third parties on whom we rely, including the third-party providers of services we utilize to deliver some of the functionality of our offerings, may fail to comply with such obligations, which could negatively impact our business operations. If we or the third parties on which we rely fail, or are perceived to have failed, to address or comply with applicable privacy, data protection, and information security obligations, we could face significant consequences, including but not limited to significant fines, penalties, or liabilities for noncompliance, government enforcement actions, litigation (including class-action claims), additional reporting requirements and/or oversight, bans on processing personal information, and orders to destroy or not use personal information. Any of these events could have a material adverse effect on our reputation, business, or financial condition.

Our future performance depends in significant part upon the continued service of our senior management and other key technical personnel. We do not have employment agreements with our key employees. The loss of the services of our key employees could materially and adversely affect our business, financial condition, and results of operations. Our future success also depends on our ability to continue to attract, retain, and motivate qualified personnel, particularly highly skilled engineers involved in the ongoing research and development required to develop and enhance our products. Competition for these employees remains high and employee retention is a common problem in our industry. Our inability to attract and retain the highly trained technical personnel that are essential to our product development, sales, marketing, service, and support teams may limit the rate at which we can generate revenue, develop new products or product enhancements, and generally would have an adverse effect on our business, financial condition, and results of operations.

The Company's actions to reduce operating costs have caused the Company to incur additional charges related to severance and reorganization activities in 2025 and 2024, which included charges related to employee transition, severance payments, employee benefits, and stock-based compensation. Similar events and/or operating cost reduction efforts in the future could cause the Company to take similar remedial actions, which could cause the Company to incur additional charges in the short-term period following such events or actions. Additional continuing risks associated with the impact of these efforts include employee attrition beyond our intended reduction in force and adverse effects on employee morale, diversion of management attention, adverse effects to our reputation as an employer (which could make it more difficult for us to hire new employees in the future), and potential failure or delays to meet operational and growth targets due to the loss of qualified employees. If we do not realize the expected benefits of our cost reduction efforts on a timely basis or at all, our business, results of operations and financial condition could be adversely affected.

In recent years, our revenues derived from sales to customers outside the U.S. have not been material. Our revenues derived from such sales can vary from quarter to quarter and from year to year. In the future, we may expand our international business activities. International operations are subject to many inherent risks, including: - general political, social and economic instability;- trade restrictions;- the imposition of governmental controls;- exposure to different legal standards, particularly with respect to intellectual property;- burdens of complying with a variety of foreign laws, including without limitation data privacy laws, such as the General Data Protection Regulation ("GDPR") in Europe;- import and export license requirements and restrictions of the United States and any other country in which we operate;- unexpected changes in regulatory requirements;- foreign technical standards;- changes in tariffs;- difficulties in staffing and managing international operations;- difficulties in securing and servicing international customers;- difficulties in collecting receivables from foreign entities;- fluctuations in currency exchange rates and any imposition of currency exchange controls; and - potentially adverse tax consequences. These conditions may increase our cost of doing business. Moreover, as our customers are adversely affected by these conditions, our business with them may be disrupted and our results of operations could be adversely affected.