SoundThinking Inc (SSTI) Risk Analysis

Companies in the software and technology industries, including some of our current and potential competitors, own large numbers of patents, copyrights, trademarks and trade secrets and frequently enter into litigation based on allegations of infringement or other violations of intellectual property rights. In addition, many of these companies have the capability to dedicate substantially greater resources to enforce their intellectual property rights and to defend claims that may be brought against them. The litigation may involve patent holding companies or other adverse patent owners that have no relevant product revenues and against which our patents may therefore provide little or no deterrence. We may have previously received, and may in the future receive, notices that claim we have misappropriated, misused, or infringed other parties' intellectual property rights, and, to the extent we gain greater market visibility, we face a higher risk of being the subject of intellectual property infringement claims. There may be third-party intellectual property rights, including issued or pending patents that cover significant aspects of our technologies or business methods. Any intellectual property claims, with or without merit, could be very time-consuming, could be expensive to settle or litigate and could divert our management's attention and other resources. These claims could also subject us to significant liability for damages, potentially including treble damages if we are found to have willfully infringed patents or copyrights. These claims could also result in our having to stop using technology found to be in violation of a third party's rights. We might be required to seek a license for the intellectual property, which may not be available on a timely basis, on reasonable terms or at all. We also may be required to modify our products, services, internal systems or technologies. Even if a license were available, we could be required to pay significant royalties, which would increase our operating expenses. As a result, we may be required to develop alternative non-infringing technology, which could require significant effort and expense. If we cannot license or develop technology for any infringing aspect of our business, we would be forced to limit or stop sales of our software and may be unable to compete effectively. Any of these results would adversely affect our business, operating results, financial condition and cash flows.

Our operations and those of the third parties with whom we work, involve the processing, collection, receipt, storage, storage processing, generation, use, transfer, disclosure, protection, disposal of, transmission, and sharing (collectively, "processing") of proprietary, confidential and sensitive data, including personal information, intellectual property, trade secrets and other sensitive information such as gunfire incident data, including date, time, address and GPS coordinates, occurring in our customer's coverage area (collectively, "sensitive information"). Additionally, our systems process information from third parties including criminal justice information. Cyber-attacks, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our sensitive information and information technology systems, and those of the third parties with whom we work. Such threats are prevalent and continue to increase generally, and are increasingly difficult to detect, and come from a variety of sources, including traditional computer "hackers," threat actors, "hacktivists," organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we, the third parties with whom we work, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our products and services. We and the third parties upon which we rely may be subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing, credential harvesting, personnel misconduct or error, and supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, attacks enhanced or facilitated by AI, telecommunications failures, earthquakes, fires, floods, and other similar threats. For example, we have been notified of security incidents impacting some of our services providers in the past. In particular, ransomware attacks are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, ability to provide our products or services, loss of data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Remote work poses risks to our information technology systems and data, as certain of our employees utilize network connections, computers and devices outside our premises or network, including working at home, while in transit and in public locations. It may be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident. Our efforts to do so may not be successful. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. For example, threat actors may use an initial compromise of one part of our environment to gain access to other parts of our environment, or leverage a compromise of our networks or systems to gain access to the networks or systems of third parties with whom we work, such as through phishing or supply chain attacks. As we increase our customer base and our brand becomes more widely known and recognized, third parties may increasingly seek to compromise our security controls or gain unauthorized access to customer data or other sensitive information. Further, because of the nature of the services that we provide to our customers, we may be a unique target for attacks. Future or past business transactions (such as acquisitions or integrations, including of Forensic Logic, LLC and SafePointe, LLC) expose us to additional cybersecurity risks and vulnerabilities, as we and our systems are negatively affected by vulnerabilities and weaker security controls present in acquired or integrated entities' systems, products, processes and technologies. Furthermore, we may not have adequate visibility into security issues of such acquired or integrated entities, may discover security issues that were not found during due diligence of such entities, and it may be difficult to integrate companies and their products into our information technology environment and security program. We rely on third parties to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, content delivery to customers, and other functions. We also rely on third parties to provide other products, services, parts, or otherwise to operate our business. Our ability to monitor these third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. If the third parties with whom we work experience a security incident or other interruption, we have in the past and could in the future experience adverse consequences. If third parties with whom we work, such as vendors or developers, violate applicable laws or our security policies, such violations may also put our systems and data at risk and could in turn have an adverse effect on our business. In addition, such a violation could expose sensitive data including; criminal justice information, and other data we are contractually obliged to keep confidential. While we may be entitled to damages if the third parties with whom we work fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties' infrastructure in our supply chain or that of the third parties with whom we work have not been compromised. While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We take steps to detect and remediate vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties with whom we work). We have not and may not in the future, however, detect and remediate all such vulnerabilities including on a timely basis. Vulnerabilities could be exploited and result in a security incident. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities. We employ a shared responsibility model where our customers are responsible for using, configuring and otherwise implementing security measures related to our platform, services and products in a manner that meets applicable cybersecurity standards, complies with laws, and addresses their information security risk. As part of this shared responsibility security model, we make certain security features available to our customers that can be implemented at our customers' discretion, or identify security areas or measures for which our customers are responsible. For example, we recommend that customers implement Multifactor Authentication (MFA) when using our products. In certain cases where our customers choose not to implement, or incorrectly implement, those features or measures, misuse our services, or otherwise experience their own vulnerabilities, policy violations, credential exposure or security incidents, even if we are not the cause of a resulting customer security issue or incident, our customer relationships, reputation, and revenue have been and in the future may be adversely impacted. Any of the previously identified or similar threats have in the past and may in the future cause a security incident or other interruption that could result in unauthorized, unlawful or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of or access to our sensitive information or our information technology systems, or those of the third parties upon whom we rely. A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely) to provide our solutions. We may expend significant resources or modify our business activities to try to protect against security incidents. Certain data privacy and security obligations have required us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and sensitive information. Applicable data privacy and security obligations may require us, or we may voluntarily choose, to notify relevant stakeholders, including affected individuals, customers, regulators and investors, of security incidents, or to take other actions, such as providing credit monitoring and identity theft protection services. Such disclosures and related actions can be costly, and the disclosure or the failure to comply with such applicable requirements could lead to adverse consequences. For example, many governments have enacted laws requiring companies to notify individuals of data security incidents or unauthorized transfers involving certain types of personal information. In addition, some of our customers contractually require notification of any data security incident. If we (or a third party with whom we work) experience a security incident or are perceived to have experienced a security incident, we may experience material adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal information); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions in our operations (including availability of data); financial loss; and other similar harms. Security incidents and attendant material consequences may prevent or cause customers to stop using our solutions, deter new customers from using our solutions, and negatively impact our ability to grow and operate our business. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. While we maintain general liability insurance coverage and coverage for errors or omissions, we cannot be sure that such coverage would be adequate or sufficient to protect us from liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims. In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position.

Promoting and demonstrating the utility of our solutions as useful, reliable and important tools for law enforcement and security personnel is critical to the success of our business. Our ability to secure customer renewals, expand existing customer coverage areas, and enter into new customer contracts is dependent on our reputation and our ability to deliver our solutions effectively. We believe that our reputation among police departments using SoundThinking solutions is particularly important to our success. Our ability to meet customer expectations will depend on a wide range of factors, including: - our ability to continue to offer high-quality, innovative and accurate precision policing solutions;- our ability to maintain continuous gunshot detection monitoring during high outdoor-noise activity periods such as New Year's Day, the Fourth of July and Cinco de Mayo, and Carnival for international deployments;- our ability to maintain high customer satisfaction, including meeting our service level agreements standards;- the perceived value and quality of our solutions;- differences in opinion regarding the metrics that measure the success of our solutions;- our ability to successfully communicate the unique value proposition of our solutions;- our ability to provide high-quality customer support;- any misuse or perceived misuse of our solutions;- interruptions, delays or attacks on our platform;- litigation- or regulation-related developments; and - damage to or degradation of our sensors or sensor network and cameras by third parties. In some cases, if our solutions fail to detect threats such as a firearm or other potential weapon or explosive device, or if our products contain undetected errors or defects, these failures or errors could result in injury or loss of life, which could harm our brand and reputation, subject us to litigation and potential claims against us, and have an adverse effect on our business, operating results and financial condition. There is no guarantee that our solutions will detect and prevent all attacks, especially in light of the rapidly changing security landscape to which it must respond, as well as unique factors that may be present in our customers' operating environments. If our products fail to detect security threats for any reason, including failures due to customer personnel or security processes, it may also result in significant costs, the attention of our key personnel could be diverted, our customers may delay or withhold payment to us or elect not to renew or cause other significant customer relations problems to arise.