What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-12-16 compared with 2024-12-20 · 66 added, 51 removed, 176 unchanged (40% of the section changed)

5 unchanged sentences

Both the HPP and TS segments are reliant upon a small number of significant customers, and the loss of or significant reduction in sales to any one of which could have a material adverse effect on our business.

For the fiscal year ended September 30, 2024 and 2023 no one customer accounted for 10% or more of our total revenues for the fiscal year.

For the fiscal years ended September 30, 2025 and 2024, no one customer accounted for 10% or more of our total revenues.

Our revenues are largely dependent upon the ability of our customers to continue to grow or need services or to develop and sell products that incorporate our products.

28 unchanged sentences

Highly complex products, such as those we offer, may contain defects and bugs when they are first introduced or as new versions, software documentation or enhancements are released, or their release may be delayed due to unforeseen difficulties during product development.

If any of our products or third-party components used in our products contain defects or bugs, or have reliability, quality or compatibility problems, we may not be able to successfully design workarounds.

Furthermore, if any of these problems are not discovered until after we have commenced commercial production or deployment of a new product, we may be required to incur additional development costs and product recall, repair or replacement costs.

11 unchanged sentences

In addition, there are certain risks inherent in transacting business internationally, such as changes in applicable laws and regulatory requirements, export and import restrictions, export controls relating to technology, tariffs and other trade barriers, longer payment cycles, problems in collecting accounts receivable, political instability, fluctuations in currency exchange rates, expatriation controls and potential adverse tax consequences, any of which could adversely impact the success of our international activities.

In particular, it is possible activity in the United Kingdom and the rest of Europe will be adversely impacted and that we will face increased regulatory and legal complexities, including those related to tax, trade, and employee relations as a result of Brexit.

A portion of our revenues are from sales to foreign entities, including foreign governments, which are primarily paid in the form of foreign currencies.

There can be no assurance that one or more of

such factors will not have a material adverse effect on our future international activities and, consequently, on our business, financial condition or results of operations.

There can be no assurance that one or more of such factors will not have a material adverse effect on our future international activities and, consequently, on our business, financial condition or results of operations.

We face competition that could adversely affect our sales and profitability.

6 unchanged sentences

Their entry into markets historically targeted by us could have a material adverse effect on our business, financial condition and results of operations.

Pandemics, epidemics or disease outbreaks, such as the novel coronavirus (“COVID-19”), may materially adversely affect our business, results of operations, cash flows and financial condition.

Pandemics, epidemics, or disease outbreaks, such as COVID-19 may cause harm to us, our employees, our clients, our vendors and supply chain partners, and financial institutions, which could have a material adverse effect on our business, results of operations, cash flows, and financial condition.

The impact of a pandemic, epidemic, or other disease outbreak, such as COVID-19, may include, but would not be limited to:

Pandemics, epidemics or disease outbreaks may materially adversely affect our business, results of operations, cash flows and financial condition.

Pandemics, epidemics, or disease outbreaks, may cause harm to us, our employees, our clients, our vendors and supply chain partners, and financial institutions, which could have a material adverse effect on our business, results of operations, cash flows, and financial condition.

The impact of a pandemic, epidemic, or other disease outbreak may include, but would not be limited to:

(i) disruption to operations due to the unavailability of employees due to illness, quarantines, risk of illness, travel restrictions or factors that limit our existing or potential workforce;

(ii) volatility in the demand for or availability of our products and services, (iii) inability to meet our customers’ needs due to disruptions in the manufacture, sourcing and distribution of our products and services, or (iv) failure of third parties on which we rely, including our suppliers, clients, and external business partners, to meet their obligations to us, or significant disruptions in their ability to do so.

Government Contracting Risks

During certain fiscal years, we may depend on contracts with the federal government, primarily with the Department of Defense ("DoD"), for a portion of our revenue, and our business could be seriously harmed if the government significantly decreased or ceased doing business with us.

We derived below 1% of our total revenue in fiscal year 2024 and 5% of our total revenue in fiscal year 2023 from the DoD as a subcontractor.

Although we only derived 1% of our total revenue in fiscal year 2024, we expect that the DoD contracts to continue to be important to our business for the foreseeable future.

If we were suspended or debarred from contracting with the federal government generally, the General Services Administration, or any significant agency in the intelligence community or the DoD, if our reputation or relationship with government agencies were to be impaired, or if the government otherwise ceased doing business with us or significantly decreased the amount of business it does with us, our business, prospects, financial condition and operating results would be materially and adversely affected.

Our business could be adversely affected by changes in budgetary priorities of the federal government.

Because we derive a significant percentage of our revenue from contracts with the federal government, changes in federal government budgetary priorities could directly affect our financial performance.

A significant decline in government expenditures, a shift of expenditures away from programs that we support or a change in federal government contracting policies could cause federal government agencies to reduce their purchases under contracts, to exercise their right to terminate contracts at any time without penalty or not to exercise options to renew contracts.

In years when Congress does not complete its budget process before the end of its fiscal year (September 30), government operations are funded through a continuing resolution ("CR") that temporarily funds federal agencies.

Recent CRs have generally provided funding at the levels provided in the previous fiscal year and have not authorized new spending initiatives.

When the federal government operates under a CR, delays can occur in the procurement of products

and services.

Historically, such delays have not had a material effect on our business;

however, should funding of the federal government by CR be prolonged or extended, it could have significant consequences for our business and our industry.

Additionally, our business could be seriously affected if changes in DoD priorities reduces the demand for our services on contracts supporting some operations and maintenance activities or if we experience an increase in set-asides for small businesses, which could result in our inability to compete directly for contracts.

Federal government contracts contain numerous provisions that are unfavorable to us.

Federal government contracts contain provisions and are subject to laws and regulations that give the government rights and remedies, some of which are not typically found in commercial contracts, including allowing the government to:

● cancel multi-year contracts and related orders if funds for contract performance for any subsequent year become unavailable;

● claim rights in systems and software developed by us;

● suspend or debar us from doing business with the federal government or with a governmental agency;

● impose fines and penalties and subject us to criminal prosecution;

● control or prohibit the export of our data and technology.

If the government terminates a contract for convenience, we may recover only our incurred or committed costs, settlement expenses and profit on work completed prior to the termination.

If the government terminates a contract for default, we may be unable to recover even those amounts, and instead may be liable for excess costs incurred by the government in procuring undelivered items and services from another source.

Depending on the value of a contract, such termination could cause our actual results to differ materially and adversely from those anticipated.

As is common with government contractors, we have experienced and continue to experience occasional performance issues under certain of our contracts.

Depending upon the value of the matters affected, a performance problem that impacts our performance of a program or contract could cause our actual results to differ materially and adversely from those anticipated.

Intellectual Property and Systems Risks

4 unchanged sentences

Also, despite the steps taken by us to protect our proprietary rights, it may be possible for unauthorized third parties to copy or reverse-engineer aspects of our products develop similar technology independently or otherwise obtain and use information that we regard as proprietary and we may be unable to successfully identify or prosecute unauthorized uses of our technology.

valid if subsequently challenged or that others will not claim rights in or ownership of the patents (and patent applications) and other proprietary rights held by us.

Furthermore, with respect to our issued patents and patent applications, we cannot assure that patents from any pending patent applications (or from any future patent applications) will be issued, that the scope of any patent protection will include competitors or provide competitive advantages to us, that any of our patents will be held valid if subsequently challenged or that others will not claim rights in or ownership of the patents (and patent applications) and other proprietary rights held by us.

If we become subject to intellectual property infringement claims, we could incur significant expenses and could be prevented from selling specific products.

1 unchanged sentence

We cannot assure that, if made, these claims will not be successful.

Any claim of infringement could cause us to incur substantial costs defending against the claim even if the claim is invalid and could distract management from other business.

Any claim of infringement could cause us to incur substantial costs defending against the claim even if the claim is invalid and could distract management from other

Any judgment against us could require substantial payment in damages and could also include an injunction or other court order that could prevent us from offering certain products.

13 unchanged sentences

Customers specify delivery date requirements that coincide with their need for our products and services.

Because these customers may use our products and services in connection with a variety of defense programs or other projects with different sizes and durations, a customer’s orders for one quarter generally do not indicate a trend for future orders by that customer.

Because these customers may use our products and services in connection with other projects with different sizes and durations, a customer’s orders for one quarter generally do not indicate a trend for future orders by that customer.

As such, we have not been able in the past to consistently predict when our customers will place orders and request shipments so that we cannot always accurately plan our manufacturing, inventory, and working capital requirements.

25 unchanged sentences

If we experience a disaster or other business continuity problem, we may not be able to recover successfully, which could cause material financial loss, loss of human capital, regulatory actions, reputational harm, or legal liability.

If we experience a local or regional disaster or other business continuity problem, such as a hurricane, earthquake, terrorist attack, pandemic or other natural or man-made disaster, our continued success will depend, in part, on the availability of our personnel, our office facilities, and the proper functioning of our computer, telecommunication and other related systems and operations.

As we grow our operations, the potential for particular types of natural or man-made disasters, political, economic or infrastructure instabilities, or other country- or region-specific business continuity risks increases.

If we experience a local or regional disaster or other business continuity problem, such as a hurricane, earthquake, terrorist attack, pandemic or other natural or human-made disaster, our continued success will depend, in part, on the availability of our personnel, our office facilities, and the proper functioning of our computer, telecommunication and other related systems and operations.

As we grow our operations, the potential for particular types of natural or human-made disasters, political, economic or infrastructure instabilities, or other country- or region-specific business continuity risks increases.

If we suffer any data breaches involving the designs, schematics, or source code for our products or other sensitive information, our business and financial results could be adversely affected.

3 unchanged sentences

Other potential costs could include loss of brand value, incident response costs, loss of stock market value, regulatory inquiries, litigation, and management distraction.

In addition, a security breach that involved classified information could subject us to civil or criminal penalties, loss of a government contract, loss of access to classified information, or debarment as a government contractor.

In addition, a security breach that involved classified information could subject us to civil or criminal penalties,

loss of a government contract, loss of access to classified information, or debarment as a government contractor.

Similarly, a breach that involved loss of customer-provided data could subject us to loss of a customer, loss of a contract, litigation costs and legal damages, and reputational harm.

16 unchanged sentences

The effects of the ongoing conflict could heighten many of our known risks described in these "Risk Factors.”

Our business, financial condition and results of operations could be adversely affected by disruptions in the global economy caused by the ongoing conflict between Israel and Hamas.

Our business, financial condition and results of operations could be adversely affected by disruptions in the global economy caused by the conflict between Israel and Hamas.

The global economy has been negatively impacted by the military conflict between Israel and Hamas.

There could be an expansion of the countries involved, which could lead to significant detrimental effects to the global economy.

Although we do not have significant customers or suppliers in the Middle East region, we do have customers and suppliers in surrounding regions which may be affected.

Further escalation of the Israel and Hamas conflict and geopolitical tensions related to such military conflict, including increased trade barriers or restrictions on global trade, could result in, among other things, cyber attacks, supply disruptions, lower consumer demand, and changes to foreign exchange rates and financial markets, any of which may adversely affect our business, financial condition and results of operations.

Violation of the peace process may lead to to renewed military conflict and/or escalation of the Israel and Hamas conflict and geopolitical tensions related to such military conflict and/or escalation, including increased trade barriers or restrictions on global trade, could result in, among other things, cyber attacks, supply disruptions, lower consumer demand, and changes to foreign exchange rates and financial markets, any of which may adversely affect our business, financial condition and results of operations.

The effects of the ongoing conflict could heighten many of our known risks described in these "Risk Factors.”

Significant political, trade, regulatory developments, and other circumstances beyond our control, could have a material adverse effect on our financial condition or results of operations.

Significant political, trade, or regulatory developments in the jurisdictions in which we sell or purchase our products, including country of origin of such products, are difficult to predict and may create periods of volatility in such markets which may have a material adverse effect on us.

Recent changes in U.S.

federal policy that affect the geopolitical landscape could give rise to circumstances outside our control that could have negative impacts on our business operations.

Beginning in the second quarter of 2025, new U.S.

Tariffs were announced, including additional tariffs on imports from China, India, Japan, South Korea, Taiwan, Vietnam and the EU, among others.

In response, several countries have imposed, or threatened to impose, reciprocal tariffs on imports from the U.S.

and other retaliatory measures.

Various modifications and delays to the U.S.

Tariffs have been announced and further changes are expected to be made in the future, which may include additional sector-based tariffs or other measures.

For example, the U.S.

Department of Commerce has initiated an investigation under Section 232 of the Trade Expansion Act of 1962, as amended, into, among other things, imports of semiconductors, semiconductor manufacturing equipment, and their derivative products, including downstream products that contain semiconductors.

These tariffs do not currently include software, services, intangibles, and other digital services;

however, we cannot predict future trade policy or tariffs, including the impact or timing thereof, or whether such services will be subject to any form of tariffs or other restrictions in the future.

The ultimate impact remains uncertain and will depend on several factors, including whether additional or incremental U.S.

Tariffs or other measures are announced or imposed, to what extent other countries implement tariffs or other retaliatory measures in response, and the overall magnitude and duration of these measures.

If disputes and conflicts further escalate, actions by governments in response could be significantly more severe and restrictive.

Any of the foregoing could materially adversely affect the Company’s business, results of operations, financial condition and stock price.

Legal and Regulatory Risks

8 unchanged sentences

This assessment includes disclosure of any material weaknesses identified by our management in our internal control over financial reporting.

Our management concluded that our internal control over financial reporting was ineffective as of September 30, 2024, and identified certain material weaknesses in our internal controls.

While management is working to remediate the material weaknesses, there is no assurance that such changes will remediate the identified material weaknesses or that the controls will prevent or detect future material weaknesses.

Our management concluded that our internal control over financial reporting was effective as of September 30, 2025.

If we are not able to maintain effective internal control over financial reporting, our financial statements, including related disclosures, may be inaccurate, which could have a material adverse effect on our business.

1 unchanged sentence

As a public company, we operate in an increasingly demanding regulatory environment, which requires us to comply with the Sarbanes-Oxley Act of 2002, and the related rules and regulations of the SEC.

Company responsibilities required by the Sarbanes-Oxley Act include establishing corporate oversight and adequate internal control over financial reporting and disclosure controls and procedures.

Company responsibilities required by the Sarbanes-Oxley Act include establishing corporate oversight and adequate internal control over financial

reporting and disclosure controls and procedures.

Effective internal controls are necessary for us to produce reliable financial reports and are important to help prevent financial fraud.

2 unchanged sentences

This requires that we incur substantial additional professional fees and internal costs to expand our accounting and finance functions and that we expend significant management efforts.

As of September 30, 2024, we discovered material weaknesses in our system of internal financial and accounting controls and procedures that could result in a material misstatement of our financial statements.

Our internal control over financial reporting will not prevent or detect all errors and all fraud.

A control system, no matter how well designed and operated, can provide only reasonable, not absolute, assurance that the control system’s objectives will be met.

of the inherent limitations in all control systems, no evaluation of controls can provide absolute assurance that misstatements due to error or fraud will not occur or that all control issues and instances of fraud will be detected.

Because of the inherent limitations in all control systems, no evaluation of controls can provide absolute assurance that misstatements due to error or fraud will not occur or that all control issues and instances of fraud will be detected.

If we are not able to comply with the requirements of Section 404 of the Sarbanes-Oxley Act, or if we are unable to remediate or maintain proper and effective internal controls, we may not be able to produce timely and accurate financial statements.

16 unchanged sentences

In addition, the stock market in general and the NASDAQ Global Market and technology companies in particular, have experienced extreme price and volume fluctuations that have often been unrelated or disproportionate to the operating performance of such companies.

These broad market and industry factors may materially adversely affect the market price of our common stock, regardless of our actual operating performance.

These broad market and industry factors may materially adversely affect the market price

of our common stock, regardless of our actual operating performance.

In the past, following periods of volatility in the market price of a company’s securities, securities class action litigation has often been instituted against such companies.

If any shareholder were to issue a lawsuit, we could incur substantial costs defending the lawsuit and the attention of management could be diverted.

Cybersecurity

Risk Management and Strategy

We have implemented a comprehensive cybersecurity risk management strategy to evaluate, detect, and mitigate significant risks posed by cybersecurity threats.

The Information Security Risk component of our overall Risk Management Policy outlines our approach to manage processes, people and technology to address and meet the ever-changing challenges in the global IT security landscape.

Our program aims to safeguard our systems, data, and operations against cyber threats, maintain business continuity, ensure compliance with relevant privacy and other regulations, and fulfill our commitments to members, customers, suppliers, employees, and other stakeholders.

Our cybersecurity program is designed to align with and meet the rigorous standards set by industry frameworks such as NIST, SOC 2 Type 2, and other relevant guidelines.

By adhering to these frameworks, we ensure that our security measures are robust, comprehensive, and effective in protecting our systems, data, and operations.

This commitment not only helps us maintain compliance with regulatory requirements but also demonstrates our dedication to providing a secure environment for our members, customers, suppliers, employees, and other stakeholders.

Risk Assessment;

Third Party Assessments and Audits

An information security Risk Assessment (RA) is conducted annually or following any significant changes to the operating or sensitive data environments to identify vulnerabilities and implement appropriate controls and risk mitigation strategies.

These assessments can be conducted on any entity within CSPi or any external entity that has signed a Third-Party Agreement with CSPi , covering information systems, applications, servers, networks, and related processes.

The IT Manager, along with the responsible department, oversees the execution, development, and implementation of remediation programs.

The RA process involves assembling a team, defining the scope, identifying business and IT owners, conducting interviews, reviewing controls and incidents, developing a threat/risk matrix, and preparing an executive summary with recommendations.

The executive team reviews and approves the recommendations, and a project is initiated to implement the necessary controls and procedures, which are tested quarterly.

Incident Response Planning

Our incident response policies and procedures are aligned with applicable laws and state policies.

They encompass the identification of roles and responsibilities, investigation, containment and escalation procedures, documentation and preservation of evidence, communication protocols, and lessons learned.

We have established robust incident reporting policies and procedures.

These include training employees and contractors to recognize and report incidents promptly upon discovery, as well as preparing and submitting follow-up written reports.

To date, no cybersecurity incident has resulted in any material impact on our business, operations or financial results or our ability to service our customers or run our business.

A formal process exists through our enterprise risk management matrix developed by the management team of the Company that tracks the Company’s material risks, associated mitigation and remediation strategies and direct accountability which is submitted quarterly to the Audit Committee of the Board of Directors for review and oversight.

The management team includes our Vice President and General Manager of the HPP segment , who has developed cybersecurity software at the Company.

In addition, he has been the Chief Technical Officer and served in various roles at several cybersecurity companies over his 40 year career.

He holds a Bachelor of Science in Business and Engineering as well as a Masters of Science in Finance.

Also on the team is the Vice President of Managed Services at the TS segment, who has over twenty years of technology experience including the monitoring and management of other organization’s security systems.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors