What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-03-31 compared with 2024-04-01 · 196 added, 177 removed, 723 unchanged (34% of the section changed)

15 unchanged sentences

• maintain our competitive and technology leadership position;

• manage our business successfully through macroeconomic pressures, such as inflation, rising interest rates, and past and potential future disruptions in access to bank deposits and lending commitments due to bank failures, and any resulting impact on economic conditions, including conditions impacting the availability of funding for our public safety solution.

• manage our business successfully through macroeconomic pressures, such as the imposition of tariffs, inflation, rising interest rates, and past and potential future disruptions in access to bank deposits and lending commitments due to bank failures, and any resulting impact on economic conditions, including conditions impacting the availability of funding for our public safety solutions.

As usage of our solutions grows, we will need to continue to make investments to develop and implement new or updated solutions, technologies, security features and cloud-based infrastructure operations.

9 unchanged sentences

• the renewal or non-renewal of subscription agreements with, and expansion of coverage areas by, existing customers;

or cross-selling of other products or services to existing customers;

• the size, timing, terms and deployment schedules of our sales to both existing and new customers;

6 unchanged sentences

• the concentration of our revenue in a small number of large contracts with the potential for fluctuations and delays;

• general economic factors, such as inflation, rising interest rates, past and potential future disruptions in access to bank deposits and lending commitments due to bank failures, and political conditions, both domestically and internationally.

For example, with regard to the concentration of our revenue, for the year ended December 31, 2023, the City of New York and the City of Chicago, our two largest customers accounted for 25% and 9% of the Company’s total revenues, respectively.

We have extended our contract with the City of Chicago through November 2024, but there is no guarantee we will receive another extension.

Additionally, we are experiencing a delay in our ShotSpotter renewal with Puerto Rico, see the risk entitled “Our success depends on maintaining and increasing our sales, which depends on factors we cannot control, including the availability of funding to our customers.” Any delays in renewal of our contracts or any of the other factors above or other factors discussed elsewhere in this report may result in fluctuations in our revenues and operating results, meaning that quarter-to-quarter comparisons of our revenues, results of operations and cash flows may not necessarily be indicative of our future performance.

• general economic factors, such as the imposition of tariffs, inflation, rising interest rates, past and potential future disruptions in access to bank deposits and lending commitments due to bank failures, and political conditions, both domestically and internationally.

For example, with regard to the concentration of our revenue, for the year ended December 31, 2024, the City of New York and the City of Chicago as our two largest customers accounted for 23% and 10% of the Company’s total revenues, respectively.

Our contract with the City of Chicago ended in November 2024 and we renewed our two contracts with the City of New York in the first quarter of 2025.

The ending of our contract with the City of Chicago and any inability to renew or delays in renewal of our contract with the City of New York or any of the other factors above or other factors discussed elsewhere in this report will result in fluctuations in our revenues and operating results, meaning that quarter-to-quarter comparisons of our revenues, results of operations and cash flows may not necessarily be indicative of our future performance.

Because of the fluctuations described above, our ability to forecast revenues is limited and we may not be able to accurately predict our future revenues or results of operations.

9 unchanged sentences

Consequently, a decline in sales, customer renewals or market acceptance of our solutions in any one quarter would not necessarily be fully reflected in the revenues in that quarter and would negatively affect our revenues and profitability in future quarters.

This ratable revenue recognition also makes it difficult for us to rapidly increase our revenues through additional sales in any period, as revenues from new customers generally are recognized over the applicable agreement term.

This ratable revenue recognition also makes it difficult for us to rapidly increase our revenues through additional sales

in any period, as revenues from new customers generally are recognized over the applicable agreement term.

Our subscription-based approach may result in uneven recognition of revenues.

6 unchanged sentences

The variation in the timeline for deploying our solutions and completing renewals may result in fluctuations in our revenues, which could cause our results to differ from projections.

Additionally, while we generally invoice for 50% of the contract cost upon a customer’s go-live date, our cash flows may be volatile and will not match our revenues recognition.

Additionally, while we generally invoice for 50% of the contract cost upon a customer’s go-live date, our cash flows may be volatile and will not match our revenue recognition.

We have not been profitable in the past and may not achieve or maintain profitability in the future.

We had a net loss of $9.2 million for the year ended December 31, 2024 and as of December 31, 2024, we had an accumulated deficit of $104.3 million.

Although we posted net income in 2019, 2020 and 2022, we had a net loss in 2021 and we had net losses prior to 2019.

Although we posted net income in 2020 and 2022, we had a net loss in 2021 and 2023.

We are not certain whether we will be able to maintain enough revenues from sales of our solutions to sustain or increase our growth or maintain profitability in the future.

4 unchanged sentences

• research and development related to our solutions, including investments in our engineering and technical teams;

• acquisition of complementary technologies or businesses, such as our acquisition of HunchLab technology in October 2018, our acquisition of Technologic in November 2020, our acquisition of Forensic Logic in January 2022 and our acquisition of SafePointe in August 2023;

• acquisition of complementary technologies or businesses, such as our acquisition of LEEDS, LLC, now known as Technologic, in November 2020, our acquisition of Forensic Logic in January 2022 and our acquisition of SafePointe in August 2023;

• continued international expansion of our business;

17 unchanged sentences

To date, substantially all of our revenues have been derived from contracts with local governments and their agencies, in particular the police departments of major cities in the United States.

To a lesser extent, we also generate

revenues from federal agencies, foreign governments and higher education institutions.

We believe that the success and growth of our business will continue to depend on our ability to add new police departments and other government agencies, domestically and internationally, as customers of our public safety solution and new universities, corporate campuses and key infrastructure and transportation centers as customers of our security solutions.

To a lesser extent, we also generate revenues from federal agencies, foreign governments and higher education institutions.

We believe that the success and growth of our business will continue to depend on our ability to add new police departments and other government agencies, domestically and internationally, as customers of our public safety solutions and new universities, corporate campuses and key infrastructure and transportation centers as customers of our security solutions.

Many of our target customers have restricted budgets, such that we are forced to compete with programs or solutions that offer an alternative use of the same funds.

A number of factors could cause current and/or potential customers to delay or refrain from purchasing our solutions, prevent expansion of, or reduce coverage areas and/or terminate use of our solutions, including:

• decreases or changes in available funding, including tax revenues, budgetary allocations, government grants and other government funding programs;

• decreases or changes in available funding, including as a result of policies implemented by Trump administration’s Department of Government Efficiency within the Office of Management and Budget (“DOGE”), tax revenues, budgetary allocations, government grants and other government funding programs;

• potential delays or changes in appropriations or other funding authorization processes;

• changes in fiscal or contracting policies;

• macro- and/or local economic changes, such as inflation, rising interest rates, and past and potential future disruptions in access to bank deposits and lending commitments due to bank failures, that may affect customer funding;

• macro- and/or local economic changes, such as the imposition of tariffs, inflation, rising interest rates, and past and potential future disruptions in access to bank deposits and lending commitments due to bank failures, that may affect customer funding;

• changes in elected or appointed officials;

1 unchanged sentence

• changes in laws or public sentiment regarding privacy or surveillance.

For example, our existing contract with the City of Chicago remains in effect until November 2024 and we may not be able to renew or extend our contract on reasonable terms, if at all.

The City of Chicago is one of our largest customers and represented 9% and 10% of our total revenues for the year ended December 31, 2023 and 2022, respectively.

Additionally, while we signed an interim contract with Puerto Rico through January 31, 2024, we are working on the delayed renewal with Puerto Rico, which represented 1.6% and 2.6% of our total revenues for the year ended December 31, 2023 and 2022, respectively.

If we are unable to renew our contracts with the City of Chicago or Puerto Rico, this could have a material adverse effect on our operating results.

The past and potential future disruptions in access to bank deposits and lending commitments due to bank failures, geopolitical developments such as the conflicts between Ukraine and Russia in Israel, and other macroeconomic pressures in the United States and the global economy such as rising inflation and interest rates, supply chain constraints, labor market shortages, energy prices and recession fears, and any associated impact on economic conditions, could also cause or exacerbate any of the foregoing.

For example, our contract with the City of Chicago ended in November 2024 and we were not able to renew or extend our contract.

The City of Chicago was one of our largest customers and represented 10% of our total revenues for the year ended December 31, 2024.

macroeconomic pressures in the United States and the global economy such as the imposition of tariffs, rising inflation and interest rates, supply chain constraints, labor market shortages, energy prices and recession fears, and any associated impact on economic conditions, could also cause or exacerbate any of the foregoing.

The occurrence of any of the foregoing would impede or delay our ability to maintain or increase the amount of revenues derived from these customers, which could have a material adverse effect on our business, operating results and financial condition.

7 unchanged sentences

For example, if the federal government provides grants to certain state and local governments for our solutions, and such governments do not continue to receive these grants, then these customers have the ability to terminate their contracts with us without penalty.

Government entities often impose compliance requirements that are complicated, require preferential pricing or “most favored nation” terms and conditions, or are otherwise

time-consuming and expensive to satisfy.

Government entities often impose compliance requirements that are complicated, require preferential pricing or “most favored nation” terms and conditions, or are otherwise time-consuming and expensive to satisfy.

Compliance with these special standards or satisfaction of such requirements could complicate our efforts to obtain business or increase the cost of doing so.

Due to the nature of our business as a software-as-a-service provider, we are occasionally unable to meet certain requirements related to the utilization of small businesses in providing our services.

Even if we do meet these special standards or requirements, the increased costs associated with providing our solutions to government customers could harm our margins.

Additionally, even once we have secured a government contract, the renewal process can be lengthy and as time-consuming as the initial sale, and we may be providing our service for months past the contract expiration date without certainty if the renewal agreement will be signed or not.

During periods of economic uncertainty resulting from the past and potential future disruptions in access to bank deposits and lending commitments due to bank failures, geopolitical developments such as the conflicts between Ukraine and Russia and in Israel, and other macroeconomic pressures in the United States and the global economy such as rising inflation and interest rates, supply chain constraints, labor market shortages, energy prices and recession fears, and any associated impact on economic conditions, these risks are more pronounced than usual, as government entities struggle with reduced levels of resources related to implications of such global events.

During periods of economic uncertainty resulting from the past and potential future disruptions in access to bank deposits and lending commitments due to bank failures, geopolitical developments such as the conflicts between Ukraine and Russia and in the Middle East, and other macroeconomic pressures in the United States and the global economy such as the imposition of tariffs, rising inflation and interest rates, supply chain constraints, labor market shortages, energy prices and recession fears, and any associated impact on economic conditions, these risks are more pronounced than usual, as government entities struggle with reduced levels of resources related to implications of such global events.

Changes in the underlying regulatory conditions, political landscape or required procurement procedures that affect these types of customers could be introduced prior to the completion of our sales cycle, making it more difficult or costly to finalize a contract with a new customer or expand or renew an existing customer relationship.

3 unchanged sentences

Our ability to increase revenues will depend in large part on our ability to sell our current and future public safety solutions.

For example, our ability to have our ShotSpotter customers renew their annual subscriptions and expand their mileage coverage or purchase and implement our other products, such as CaseBuilder (formerly ShotSpotter Investigate) and ResourceRouter (formerly ShotSpotter Connect), drives our ability to increase our revenues.

For example, our ability to have our ShotSpotter customers renew their annual subscriptions and expand their mileage coverage or purchase and implement our other products, such as CaseBuilder and ResourceRouter, drives our ability to increase our revenues.

Most of our ShotSpotter customers begin using our solution in a limited coverage area.

Our experience has been, and we expect will continue to be, that after the initial implementation of our solutions, our new customers typically renew their annual subscriptions, and many also choose to expand their coverage area.

However, some customers may choose to not renew or reduce their coverage.

However, some customers may choose to not renew or reduce their coverage, including as a negative reaction to price increases.

If existing customers do not choose to renew or expand their coverage areas, or choose to reduce their coverage, our revenues will not grow as we anticipate, or may even decline.

During periods of economic uncertainty resulting from past and potential future disruptions in access to bank deposits and lending commitments due to bank failures, geopolitical developments such as the conflicts between Ukraine and Russia and in Israel, and other macroeconomic pressures in the United States and the global economy, such as rising inflation and interest rates, supply chain constraints, labor market shortages, energy prices and recession fears, and any associated impact on economic conditions, this risk is more pronounced than usual, as our customers’ priorities may change or they may have greater uncertainty regarding the availability of funding for our solutions as a result.

During periods of economic uncertainty resulting from past and potential future disruptions in access to bank deposits and lending

commitments due to bank failures, geopolitical developments such as the conflicts between Ukraine and Russia and in the Middle East, and other macroeconomic pressures in the United States and the global economy, such as the imposition of tariffs, rising inflation and interest rates, supply chain constraints, labor market shortages, energy prices and recession fears, and any associated impact on economic conditions, this risk is more pronounced than usual, as our customers’ priorities may change or they may have greater uncertainty regarding the availability of funding for our solutions as a result.

Our ability to further penetrate the market for our public safety solutions depends on several factors, including:

6 unchanged sentences

and the costs of our solutions.

Some potential public safety customers may be reluctant or unwilling to use our solution for a number of reasons, including concerns about additional costs, unwillingness to expose or lack of concern regarding the extent of gun violence in their community, uncertainty regarding the reliability and security of cloud-based offerings or lack of awareness of the benefits of our public safety solutions.

Some potential public safety customers may be reluctant or unwilling to use our solution for a number of reasons, including concerns about additional costs or increased prices, unwillingness to expose or lack of concern regarding the extent of gun violence in their community, uncertainty regarding the reliability and security of cloud-based offerings or lack of awareness of the benefits of our public safety solutions.

If we are unsuccessful in expanding the coverage of SoundThinking solutions by existing public safety customers or adding new customers, our revenues and growth prospects would suffer.

1 unchanged sentence

Our sales process involves educating prospective customers and existing customers about the use, technical capabilities and benefits of our solutions.

Prospective customers, especially government agencies, often undertake a prolonged evaluation process that may last up to nine months or more and that typically involves comparing the

benefits of our solutions to alternative uses of funds.

Prospective customers, especially government agencies, often undertake a prolonged evaluation process that may last up to nine months or more and that typically involves comparing the benefits of our solutions to alternative uses of funds.

We may spend substantial time, effort and money on our sales and marketing efforts without any assurance that our efforts will produce any sales.

2 unchanged sentences

The policy is also designed to protect CJI that comes from sources other than the FBI.

As part of the process of implementing CaseBuilder for a customer, we will have to complete a rigorous application process to become an approved CJIS compliant vendor.

While this CJIS compliant vendor approval process is based upon the FBI’s CJIS Security Policy, a separate process will have to be completed in each state where CaseBuilder will be implemented.

As part of the process of implementing CaseBuilder for a customer, we may have to become an approved CJIS compliant vendor.

In some states CJIS compliance is required, a separate process will have to be completed in locations where CaseBuilder will be implemented.

We are continually improving our security, compliance, and processes.

2 unchanged sentences

These initiatives require fiscal and time investments.

Failure to obtain a SOC2 Type 2 audit report or to be compliant with the CJIS standard could adversely affect our reputation and sales, as well as the availability of our solutions in certain markets.

Failure to obtain a SOC2 Type 2 audit report or to be compliant with the CJIS standard or HIPAA could adversely affect our reputation and sales, as well as the availability of our solutions in certain markets.

Additionally, events affecting our customers’ budgets or missions may occur during the sales cycle that could negatively impact the size or timing of a purchase after we have invested substantial time, effort and resources into a potential sale, contributing to more unpredictability in the growth of our business.

If we are unable to succeed in closing sales with new and existing customers, our business, operating results and financial condition will be harmed.

During periods of economic uncertainty resulting from the past and potential future disruptions in access to bank capital and lending commitments due to bank failures, geopolitical developments such as the conflicts between Ukraine and Russia and in Israel, and other macroeconomic pressures in the United States and the global economy, such as rising inflation and interest rates, supply chain constraints, labor market shortages, energy prices and recession fears, and any associated impact on economic conditions, this risk is more pronounced than usual, as our customers’ priorities may change or they may have greater uncertainty regarding the availability of funding for our solutions as a result.

During periods of economic uncertainty resulting from the past and potential future disruptions in access to bank capital and lending commitments due to bank failures, geopolitical developments such as the conflicts between Ukraine and Russia and in the Middle East, and other macroeconomic pressures in the United States and the global economy, such as the imposition of tariffs, rising inflation and interest rates, supply chain constraints, labor market shortages, energy prices and recession fears, and any associated impact on economic conditions, this risk is more pronounced than usual, as our customers’ priorities may change or they may have greater uncertainty regarding the availability of funding for our solutions as a result.

Changes in the availability of federal funding to support local law enforcement efforts could impact our business.

3 unchanged sentences

Social unrest, protests against racial inequality, protests against police brutality and movements such as “Defund the Police” have increased in past years.

In addition, four members of Congress previously requested the Inspector General of the Department of Homeland Security to investigate the appropriateness of the use of federal funds to purchase our ShotSpotter solution.

Furthermore, the New York Comptroller previously issued a report with certain conclusions questioning the accuracy and value of our ShotSpotter solution, which that we disputed in a formal reply on the basis that they were misinformed and did not give adequate weight to the New York Police Department’s views.

Additionally, funds under the American Rescue Plan Act (“ARPA”), which is a federal stimulus bill that included emergency funding for state, local, territorial and tribal governments to aid public health and economic recovery from the COVID-19 pandemic, are nearing their limit.

Changes in the availability of federal funding, such as under ARPA or due to policies implemented by DOGE, may lead to changes in the operations of federal agencies, which may adversely impact our business and operating results.

These events may directly or indirectly affect municipal and police agency budgets, including federal funding available to current and potential customers.

If federal funding is reduced or eliminated and our customers cannot find alternative sources of funding to purchase our solutions, our business will be harmed.

Federal stimulus funding or earnings as a result of the COVID-19 pandemic had been provided;

however, we do not know whether additional stimulus funding will be made available to our existing or potential customers, and many state and local governments anticipate budget shortfalls without additional funding.

Further, the allocation and prioritization of stimulus funds or earnings is uncertain and may change.

There is no guarantee that additional funding will be made available to fund our solutions.

Real or perceived false positive gunshot alerts or false positive security threat detection, or failure or perceived failure to generate alerts for actual gunfire could adversely affect our customers and their operations, damage our brand and reputation and adversely affect our growth prospects and results of operations.

Real or perceived false positive gunshot alerts or false positive security threat detection, or failure or perceived failure to generate alerts for actual gunfire or missed weapon detection could adversely affect our customers and their operations, damage our brand and reputation and adversely affect our growth prospects and results of operations.

A false positive alert, in which a non-gunfire incident is reported as gunfire or detection of items that do not actually represent security threats, could result in an unnecessary rapid deployment of police officers and first responders, which may raise unnecessary fear among the occupants of a community or facility, and may be deemed a waste of police and first responder resources.

A failure to alert law enforcement or security personnel of actual gunfire or security threats (false negative) could result in a less rapid or no response by police officers and first responders, increasing the probability of injury or loss of life.

Both false positive alerts and the failure to generate alerts of actual

gunfire or security threats (false negative) may result in customer dissatisfaction, potential loss of confidence in our solutions, and potential liabilities to customers or other third parties, any of which could harm our reputation and adversely impact our business and operating results.

A failure to alert law enforcement or security personnel of actual gunfire or security threats (false negative) or missed weapon detection could result in a less rapid or no response by police officers and first responders, increasing the probability of injury or loss of life.

Both false positive alerts and the failure to generate alerts of actual gunfire or security threats (false negative) or missed weapon detection may result in customer dissatisfaction, potential loss of confidence in our solutions, and potential liabilities to customers or other third parties, any of which could harm our reputation and adversely impact our business and operating results.

Additionally, third parties may misunderstand or misrepresent what constitutes a false positive or false negative and generate negative publicity regarding our solutions.

For example, a May 2021 report by the MacArthur Center for Justice appears to argue that any incident that does not result in a police report is a false positive.

The perception of a false positive alert or of a failure to generate an alert, even where our customers understand that our solutions were utilized correctly, could lead to negative publicity or harm the public perception of our solutions, which could harm our reputation and adversely impact our business and operating results.

For example, a June 2024 report by the New York City Comptroller appears to argue that any incident that does not result in a police report is a false positive.

The perception of a false positive alert or of a failure to generate an alert or missed weapon detection, even where our customers understand that our solutions were utilized correctly, could lead to negative publicity or harm the public perception of our solutions, which could harm our reputation and adversely impact our business and operating results.

The nature of our business may result in undesirable press coverage or other negative publicity, which could adversely affect our growth prospects and results of operations.

10 unchanged sentences

Economic uncertainties or downturns could adversely affect our business and operating results.

Negative conditions in the general economy both in the United States and abroad, including past and potential future disruptions in access to bank deposits and lending commitments due to bank failures, conditions resulting from changes in gross domestic product growth, labor market shortages, inflation, interest rates, financial and credit market fluctuations, political deadlock, natural catastrophes, warfare, geopolitical tensions, such as the ongoing conflicts between Russia and Ukraine and in Israel, terrorist attacks, climate change and global pandemics, could cause a decrease in funds available to our existing and potential customers and negatively affect the rate of growth of our business.

Negative conditions in the general economy both in the United States and abroad, including past and potential future disruptions in access to bank deposits and lending commitments due to bank failures, conditions resulting from changes in gross domestic product growth, labor market shortages, the imposition of tariffs, inflation, interest rates, financial and credit market fluctuations, political deadlock, natural catastrophes, warfare, geopolitical tensions, such as the ongoing conflicts between Russia and Ukraine and in the Middle East, terrorist attacks, climate change and global pandemics, could cause a decrease in funds available to our existing and potential customers and negatively affect the rate of growth of our business.

Changes in the availability of federal funding, such as under ARPA, and the leadership of federal agencies under the Trump administration, including return-to-office policy, hiring freeze, layoffs, and other policies implemented by DOGE, may lead to changes in the operations of federal agencies, which may adversely impact our business and operating results.

These economic conditions may make it extremely difficult for our customers and us to forecast and plan future budgetary decisions or business activities accurately, and they could cause our customers to reevaluate their decisions to purchase our solutions, which could delay and lengthen our sales cycles or result in cancellations of planned purchases.

2 unchanged sentences

We cannot predict the timing, strength or duration of any economic slowdown, instability or recovery, generally or within any particular industry, or the impact of political changes.

If the economic conditions of the general economy or industries in which we operate worsen from present levels, or if past political changes result in less funding being

available to purchase our solutions, our business, operating results, financial condition and cash flows could be adversely affected.

New competitors may enter the market for our public safety solution.

If cities and other government entities increase their efforts to reduce gun violence or our solutions gain visibility in the market, companies could decide to enter into the public safety solution market and thereby increase the competition we face.

In addition to other gunshot detection products, we also compete with other technologies and solutions targeting our public safety customers’ resources for law enforcement and crime prevention.

If the economic conditions of the general economy or industries in which we operate worsen from present levels, or if past political changes result in less funding being available to purchase our solutions, our business, operating results, financial condition and cash flows could be adversely affected.

New competitors may enter the market for our public safety solutions.

If cities and other government entities increase their efforts to reduce gun violence or our solutions gain visibility in the market, companies could decide to enter into the public safety solutions market and thereby increase the competition we face.

In addition to other gunshot detection products, vehicle and plate identification and weapons detection, we also compete with other technologies and solutions targeting our public safety customers’ resources for law enforcement, security teams and crime prevention.

Our competitors could benefit from the disclosure of our data or information concerning our techniques and processes due to legal or other obligations (for example, as a result of public-records requests or subpoenas to provide information or to testify in court).

4 unchanged sentences

However, perceived privacy concerns may result in negative media coverage and efforts by private citizens to persuade municipalities, educational institutions or other potential customers not to purchase our precision policing solutions for their communities, campuses or facilities.

In addition, laws may exist or be enacted to address such concerns that could impact our ability to deploy our solutions.

laws may exist or be enacted to address such concerns that could impact our ability to deploy our solutions.

For example, the City of Toronto, Canada decided against using SoundThinking solutions because the Ministry of the Attorney General of Ontario indicated that it may compromise Section 8 of Canada’s Charter of Rights and Freedoms, which relates to unreasonable search and seizure.

5 unchanged sentences

Strategic and Operational Risks

If we are unable to sell our solutions into new markets, our revenues may not grow.

If we are unable to sell our solutions into new markets, or cross-sell our other solutions to our existing customers, our revenues may not grow.

Part of our growth strategy depends on our ability to increase sales of our security and public safety solutions in markets outside of the United States.

and to increase sales of our other solutions to our existing ShotSpotter customers.

We are focused on expanding the sales of these solutions into new markets, but customers in these new markets may not be receptive or sales may be delayed beyond our expectations, causing our revenue growth and growth prospects to suffer.

We are also trying to increase our cross-selling efforts targeted at our existing customers, for example by encouraging our existing ShotSpotter customers to implement our other solutions such as CaseBuilder and ResourceRouter but there is no assurance that our existing customers will be receptive to our other solutions.

During periods of economic uncertainty resulting from the past and potential future disruptions in access to bank deposits and lending commitments due to bank failures, geopolitical developments such as the conflicts between Ukraine and Russia and in the Middle East, and other macroeconomic pressures in the United States and the global economy such as the imposition of tariffs, rising inflation and interest rates, supply chain constraints, labor market shortages, energy prices and recession fears, and any associated impact on economic conditions, this risk is more pronounced than usual.

Our ability to successfully face these challenges depends on several factors, including increasing the awareness of our solutions and their benefits;

1 unchanged sentence

the costs of our solutions;

to attract, retain and effectively train sales and marketing personnel;

our ability to attract, retain and effectively train sales and marketing personnel;

and our ability to develop relationships with communication carriers and other partners.

If we are unsuccessful in developing and marketing our solutions into new markets, new markets for our solutions might not develop or might develop more slowly than we expect, either of which would harm our revenues and growth prospects.

If we are unsuccessful in developing and marketing our solutions into new markets, or growing our revenues from our existing customers through cross-selling, new markets for our solutions might not develop or might develop more slowly than we expect, or we may not be able to expand our relationships with our existing customers, all of which would harm our revenues and growth prospects.

The failure of our solutions to meet our customers’ expectations or of our solutions generally could, in some cases, result in injury or loss of life, and could harm our reputation, which may have a material adverse effect on our business, operating results and financial condition.

13 unchanged sentences

• litigation- or regulation-related developments;

• damage to or degradation of our sensors or sensor network by third parties.

• damage to or degradation of our sensors or sensor network and cameras by third parties.

In some cases, if our solutions fail to detect threats such as a firearm or other potential weapon or explosive device, or if our products contain undetected errors or defects, these failures or errors could result in injury or loss of life, which could harm our brand and reputation, subject us to litigation and potential claims against us, and have an adverse effect on our business, operating results and financial condition.

2 unchanged sentences

Interruptions or performance problems associated with our technology and infrastructure may adversely affect our business and results of operations.

We have in the past experienced, and may in the future experience, performance issues due to a variety of factors, including infrastructure changes, human or software errors, intentional or accidental damage to our technology (including sensors), website or third-party hosting disruptions or capacity constraints due to a number of potential causes including technical failures, natural disasters or security attacks.

We have in the past experienced, and may in the future experience, performance issues due to a variety of factors, including infrastructure changes, human or software errors, intentional or accidental damage to our technology (including sensors and cameras), website or third-party hosting disruptions or capacity constraints due to a number of potential causes including technical failures, natural disasters or security attacks.

If our security is compromised, our platform is unavailable or our users are unable to receive our alerts or otherwise communicate with our IRC reviewers, within a reasonable amount of time or at all, our business could be negatively affected.

In some instances, we may not be able to identify the cause or causes of these performance problems within an acceptable period of time.

In addition, our IRC department personnel operate either remotely or out of our offices.

In addition, our IRC department personnel operate either in a hybrid work model or out of our offices.

Any interruption or delay in service from our IRC, such as from a communications or power outage, could limit our ability to deliver our solutions.

25 unchanged sentences

Our facilities would likely be costly to repair or replace, and any such efforts would likely require substantial time.

In addition, like many companies, at the beginning of the COVID-19 pandemic, we implemented a work from home

In addition, like many companies, at the beginning of the COVID-19 pandemic, we implemented a work from home policy.

We expect to work in a hybrid work model for the foreseeable future.

23 unchanged sentences

The market for security solutions for university campuses, corporate campuses and transportation and key infrastructure centers includes a number of available options, such as video surveillance and increased human security presence.

Because there are several possible uses of funds for security needs, we may face increased challenges in demonstrating or distinguishing the benefits of ShotSpotter for Highways, ShotSpotter for Campus and ShotSpotter for Corporate.

Because there are several possible uses of funds for security needs, we may face increased challenges in demonstrating or distinguishing the benefits of ShotSpotter for Campus and ShotSpotter for Corporate.

In particular, while we have seen growing interest in our security solutions, interest in the indoor gunshot detection offering was limited, and as a result, in June 2018, we made the strategic decision to cease indoor coverage as part of our service offering.

4 unchanged sentences

We may not achieve revenue growth from expanding our sales force if we are unable to hire, develop and retain talented sales personnel with appropriate experience, if our new sales personnel are unable to achieve desired productivity levels in a reasonable period of time or if our sales and marketing programs are not effective.

During the COVID-19 pandemic, this risk was more pronounced than usual, as our sales and marketing organization were unable to travel and meetings with current and potential customers were more difficult to conduct.

Our strategy includes pursuing acquisitions, and our inability to successfully integrate newly acquired technologies, assets or businesses, or our becoming subject to certain liabilities assumed or incurred with our acquisitions, may harm our financial results.

19 unchanged sentences

We may not be successful in overcoming these risks or any other problems encountered with the acquisition of and integration of Technologic, Forensic Logic and SafePointe, intellectual property assets acquired or any future acquisitions.

To the extent that we do not successfully avoid or overcome the risks or problems related to any such acquisitions, our results of operations and financial condition could be harmed.

To the extent that we do not successfully avoid or overcome the risks or problems related to any such

acquisitions, our results of operations and financial condition could be harmed.

Acquisitions also could impact our financial position and capital requirements or could cause fluctuations in our quarterly and annual results of operations.

13 unchanged sentences

Further, certain of our insurance policies and the laws of some states may limit or prohibit insurance coverage for punitive or certain other types of damages or liability arising from gross negligence, or other issues, such as damages caused due to installation of our sensors on buildings owned by third parties, and we cannot assure you that we are adequately insured against the risks that we face.

Real or perceived errors, failures, vulnerabilities, or bugs in our software could adversely affect our operating results and growth prospects.

Real or perceived errors, failures, or bugs in our software could adversely affect our operating results and growth prospects.

Because our software is complex, undetected errors, failures or bugs may occur.

Our software is often installed and used with different operating systems, system management software, and equipment and networking configurations, which may cause errors or failures of our software or other aspects of the computing environment into which it is deployed.

Our software is often installed and used with different operating systems, system management software, equipment and networking configurations, which may cause errors or failures of our software or other aspects of the computing environment into which it is deployed.

In addition, deployment of our software into computing environments may expose undetected errors, compatibility issues, failures or bugs in our software.

Despite our testing, errors, failures, vulnerabilities, or

bugs may not be found in our software until it is released to our customers.

Despite our testing, errors, failures, or bugs may not be found in our software until it is released to our customers.

Moreover, our customers could incorrectly implement or inadvertently misuse our software, which could result in customer dissatisfaction and adversely impact the perceived utility of our products as well as our brand.

2 unchanged sentences

Alleviating any of these problems could require significant expenditures of our capital and other resources and could cause interruptions or delays in the use of our solutions, which could cause us to lose existing or potential customers and could adversely affect our operating results and growth prospects.

Any interruptions or delays in service from our third-party providers could impair our ability to make our solutions available to our customers, resulting in customer dissatisfaction, damage to our reputation, loss of customers, limited growth and reduction in revenue.

We currently use third-party data center hosting facilities to host certain components of our solutions.

Our operations depend, in part, on our third-party providers’ abilities to protect these facilities against damage or interruption from natural disasters, power or communications failures, cyber incidents, criminal acts and similar events.

In the event that any of our third-party facility arrangements is terminated, or if there is a lapse of service or damage to a facility, we could experience service interruptions in our solutions as well as delays and additional expenses in arranging new facilities and services.

People continuing to work remotely may increase the likelihood of service interruptions or cyber incidents at these data center hosting facilities.

Any changes in third-party service levels at our data centers or any errors, defects, disruptions, cyber incidents or other performance problems with our solutions could harm our reputation.

Any damage to, or failure of, the systems of the communications providers with whom our data center provider contracts could result in interruptions to our solutions.

The occurrence of spikes in usage volume, natural disasters, cyber incidents, acts of terrorism, vandalism or sabotage, closure of a facility without adequate notice or other unanticipated problems could result in lengthy interruptions in the availability of our services.

Problems faced by these network providers, or with the systems by which they allocate capacity among their customers, including us, could adversely affect the experience of our customers.

People continuing to work remotely may increase the likelihood of these problems with such network providers and their capacity allocation systems.

Interruptions in our services might cause us to issue refunds to customers and subject us to potential liability.

Further, our insurance policies may not adequately compensate us for any losses that we may incur in the event of damage or interruption, and therefore the occurrence of any of the foregoing could subject us to liability, cause us to issue credits to customers or cause customers not to renew their subscriptions for our applications, any of which could materially and adversely affect our business.

If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, our solutions may be perceived as not being secure, our customers may be harmed and we could experience adverse consequences, including but not limited to regulatory investigations or actions;

If our information technology systems or data, or those of third parties with whom we work, are or were compromised, our customers may be harmed and we could experience adverse consequences resulting from such compromise, including, but not limited to, regulatory investigations or actions;

litigation or mass arbitration demands;

5 unchanged sentences

and other adverse consequences.

Our operations involve the collection, receipt, storage, storage processing, generation, use, transfer, disclosure, protection, disposal of, transmission, and sharing (collectively, “processing”) of proprietary, confidential, and sensitive data, including personal information, intellectual property, trade secrets and other sensitive information such as gunfire incident data, including date, time, address and GPS coordinates, occurring in our customer’s coverage area (collectively, “sensitive information”).

Additionally, our systems read, write, store and transfer information from third parties including criminal justice information.

Cyber-attacks, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our sensitive information and information technology systems, and those of the third parties upon which we rely.

Our operations and those of the third parties with whom we work, involve the processing, collection, receipt, storage, storage processing, generation, use, transfer, disclosure, protection, disposal of, transmission, and sharing (collectively, “processing”) of proprietary, confidential and sensitive data, including personal information, intellectual property, trade secrets and other sensitive information such as gunfire incident data, including date, time, address and GPS coordinates, occurring in our customer’s coverage area (collectively, “sensitive information”).

Additionally, our systems process information from third parties including criminal justice information.

Such threats are prevalent and continue to increase generally, and are increasingly difficult to detect, and come from a variety of sources, including traditional computer “hackers,” threat actors, “hacktivists,” organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors.

Some actors now engage and are expected to continue to engage in

cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities.

During times of war and other major conflicts, we, the third parties upon which we rely, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our goods and services.

We and the third parties upon which we rely may be subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing, credential harvesting, personnel misconduct or error, and supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, attacks enhanced or facilitated by artificial intelligence (“AI”), telecommunications failures, earthquakes, fires, floods, and other similar threats.

For example, in November 2023, we discovered that a recently terminated employee logged on to an employee resource, obtained our confidential information, and began posting some of the information publicly on social media.

We took steps to remove the information and prevent the former employee from posting the information again, but we are uncertain to what extent this will reoccur and the postings will affect our business or operations.

Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities.

During times of war and other major conflicts, we, the third parties with whom we work, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our products and services.

We and the third parties upon which we rely may be subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing, credential harvesting, personnel misconduct or error, and supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, attacks enhanced or facilitated by AI, telecommunications failures, earthquakes, fires, floods, and other similar threats.

For example, in November 2023, we discovered that a terminated employee logged on to an employee resource, obtained our confidential information, and began posting some of the information publicly on social media.

We took steps to remove the information and prevent the former employee from posting the information again, but we are uncertain to what extent this will reoccur and if it does, whether it will materially impact our business or operations.

In particular, ransomware attacks are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, ability to provide our products or services, loss of data and income, reputational harm, and diversion of funds.

Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments.

Remote work has become more common and has increased risks to our information technology systems and data, as more of our employees utilize network connections, computers and devices outside our premises or network, including working at home, while in transit and in public locations.

We may be unable to anticipate or prevent techniques used to obtain unauthorized access or to sabotage systems because such techniques change frequently and often are not detected until after an incident has occurred.

Remote work has increased risks to our information technology systems and data, as more of our employees utilize network connections, computers and devices outside our premises or network, including working at home, while in transit and in public locations.

It may be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident.

Our efforts to do so may not be successful.

Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business.

Threat actors may also gain access to other networks and systems after a compromise of our networks and systems.

As we increase our customer base and our brand becomes more widely known and recognized, third parties may increasingly seek to compromise our security controls or gain unauthorized access to customer data or other sensitive information.

1 unchanged sentence

Future or past business transactions (such as acquisitions or integrations, including of Forensic Logic, LLC and SafePointe, LLC) expose us to additional cybersecurity risks and vulnerabilities, as we and our systems are negatively affected by vulnerabilities and weaker security controls present in acquired or integrated entities’ systems, products, processes and technologies.

Furthermore, we may not have adequate visibility into security issues of such acquired or integrated entities, may discover security issues that were not found during due diligence of such entities, and it may be difficult to integrate companies and their products into our information technology environment and security program.

We rely on third-party service providers and technologies to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, content delivery to customers, and other functions.

We also rely on third-party service providers to provide other products, services, parts, or otherwise to operate our business.

Furthermore, we may not have adequate visibility into security issues of such acquired or

integrated entities, may discover security issues that were not found during due diligence of such entities, and it may be difficult to integrate companies and their products into our information technology environment and security program.

We rely on third parties to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, content delivery to customers, and other functions.

We also rely on third parties to provide other products, services, parts, or otherwise to operate our business.

Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place.

If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences.

If the third parties with whom we work experience a security incident or other interruption, we have in the past and could in the future experience adverse consequences.

If third parties with whom we work, such as vendors or developers, violate applicable laws or our security policies, such violations may also put our systems and data at risk and could in turn have an adverse effect on our business.

1 unchanged sentence

criminal justice information, and other data we are contractually obliged to keep confidential.

While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.

While we may be entitled to damages if the third parties with whom we work fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.

In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or that of the third parties with whom we work have not been compromised.

While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective.

We take steps to detect and remediate vulnerabilities, but we may not be able to detect and remediate all vulnerabilities because the threats and techniques used to exploit the vulnerability

change frequently and are often sophisticated in nature.

Therefore, such vulnerabilities could be exploited but may not be detected until after a security incident has occurred.

Unremediated high risk or critical vulnerabilities pose material risks to our business.

We take steps to detect and remediate vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties with whom we work).

We have not and may not in the future, however, detect and remediate all such vulnerabilities including on a timely basis.

Vulnerabilities could be exploited and result in a security incident.

Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities.

Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or our information technology systems, or those of the third parties upon whom we rely.

We employ a shared responsibility model where our customers are responsible for using, configuring and otherwise implementing security measures related to our platform, services and products in a manner that meets applicable cybersecurity standards, complies with laws, and addresses their information security risk.

As part of this shared responsibility security model, we make certain security features available to our customers that can be implemented at our customers’ discretion, or identify security areas or measures for which our customers are responsible.

For example, we recommend that customers implement Multifactor Authentication (MFA) when using our products.

In certain cases where our customers choose not to implement, or incorrectly implement, those features or measures, misuse our services, or otherwise experience their own vulnerabilities, policy violations, credential exposure or security incidents, even if we are not the cause of a resulting customer security issue or incident, our customer relationships, reputation, and revenue have been and in the future may be adversely impacted.

Any of the previously identified or similar threats have in the past and may in the future cause a security incident or other interruption that could result in unauthorized, unlawful or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of or access to our sensitive information or our information technology systems, or those of the third parties upon whom we rely.

A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely) to provide our solutions.

We may expend significant resources or modify our business activities to try to protect against security incidents.

Certain data privacy and security obligations may require us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and sensitive information.

Applicable data privacy and security obligations may require us to notify relevant stakeholders of security incidents.

Such disclosures are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences.

Certain data privacy and security obligations have required us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and sensitive information.

Applicable data privacy and security obligations may require us, or we may voluntarily choose, to notify relevant stakeholders, including affected individuals, customers, regulators and investors, of security incidents, or to take other actions, such as providing credit monitoring and identity theft protection services.

Such disclosures and related actions can be costly, and the disclosure or the failure to comply with such applicable requirements could lead to adverse consequences.

For example, many governments have enacted laws requiring companies to notify individuals of data security incidents or unauthorized transfers involving certain types of personal information.

In addition, some of our customers contractually require notification of any data security incident.

If we (or a third party upon whom we rely) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections);

If we (or a third party with whom we work) experience a security incident or are perceived to have experienced a security incident, we may experience material adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections);

additional reporting requirements and/or oversight;

5 unchanged sentences

monetary fund diversions;

diversion of management attention;

interruptions in our operations (including availability of data);

1 unchanged sentence

and other similar harms.

Security incidents and attendant consequences may prevent or cause customers to stop using our solutions, deter new customers from using our solutions, and negatively impact our ability to grow and operate our business.

Furthermore, security incidents experienced by our competitors, by our customers or by us may lead to public disclosures, which may lead to widespread negative publicity and significant costs.

Any security compromise , whether actual or perceived, could harm our reputation, erode customer confidence in the effectiveness of our security measures, negatively impact our ability to attract new customers, cause existing customers to elect not to renew their subscriptions or subject us to third-party lawsuits, regulatory fines or other action or liability, which could materially and adversely affect our business and operating results.

Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security incidents.

While we maintain general liability insurance coverage and coverage for errors or omissions, we cannot assure you that such coverage would be adequate or would otherwise protect us from liabilities or damages with respect to claims alleging compromise or loss of data, or that such coverage will continue to be available on acceptable terms or at all, or that such coverage will pay future claims.

Security incidents and attendant material consequences may prevent or cause customers to stop using our solutions, deter new customers from using our solutions, and negatively impact our ability to grow and operate our business.

While we maintain general liability insurance coverage and coverage for errors or omissions, we cannot be sure that such coverage would be adequate or sufficient to protect us from liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.

In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position.

Additionally, sensitive information of the Company or our customers could be leaked, disclosed, or revealed as a result of or in connection with our employee’s, personnel’s, or vendor’s use of generative AI technologies.

We rely on the cooperation of customers and third parties to permit us to install our ShotSpotter sensors and SafePointe bollards on their facilities, and failure to obtain these rights could increase our costs or limit the effectiveness of our ShotSpotter and SafePointe solutions.

Our ShotSpotter solution requires us to deploy ShotSpotter sensors in our customer coverage areas, which typically entails the installation of approximately 15 to 25 sensors per square mile.

The ShotSpotter sensors are

mounted on city facilities and third-party buildings, and occasionally on city or utility-owned light poles, and installing the sensors requires the consent of the property owners, which can be time-consuming to obtain and can delay deployment.

The ShotSpotter sensors are mounted on city facilities and third-party buildings, and occasionally on city or utility-owned light poles, and installing the sensors requires the consent of the property owners, which can be time-consuming to obtain and can delay deployment.

Generally, we do not pay a site license fee in order to install our sensors, and our contractual agreements with these facility owners provide them the right to revoke permission to use their facility with notice of generally 60 days.

10 unchanged sentences

We offer customer support 24 hours a day, seven days a week, as well as training on best practices, forensic expertise and expert witness services.

Providing these services requires that our personnel have specific experience, knowledge and expertise, making it more difficult for us to hire qualified personnel and to scale up our support operations.

Providing these services requires that our personnel have specific experience,

knowledge and expertise, making it more difficult for us to hire qualified personnel and to scale up our support operations.

The importance of high-quality customer support will increase as we expand our business and pursue new customers.

45 unchanged sentences

Other jurisdictions may decide to adopt similar or more restrictive legislation that may render the use of such technologies challenging.

Additionally, the disclosure and use of personal information in generative AI technologies is subject to various data privacy and security laws and other obligations.

Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and consumer lawsuits.

Also, we use AI/ML to assist us in making certain decisions, which is regulated by certain privacy laws.

Due to inaccuracies or flaws in the inputs, outputs, or logic of the AI/ML, the model could be biased and could lead us to make decisions that could bias certain individuals (or classes of individuals), and adversely impact their rights, employment, and ability to obtain certain pricing, products, services, or benefits.

If we do not or cannot maintain the compatibility of our platform with applications that our customers use, our business could suffer.

6 unchanged sentences

We currently operate in limited number of locations outside the United States.

A key component to our business strategy is to expand our international operations to increase our revenues from customers outside of the United States as part of our growth strategy.

A key component to our business strategy is to expand our international operations to increase our revenues from customers outside of the United States

as part of our growth strategy.

Operating in international markets requires significant resources and management attention and will subject us to regulatory, economic and political risks in addition to those we already face in the United States.

45 unchanged sentences

Legal and Regulatory Risks

We are subject to stringent and evolving laws, governmental regulation contractual obligations, policies and other legal obligations, particularly related to data privacy and security.

Our actual or perceived failure to comply with such obligations could lead to regulatory investigations or actions;

litigation (including class claims) and mass arbitration;

We and the third parties with whom we work are subject to stringent and evolving U.S.

and foreign laws, regulations, and rules, contractual obligations, industry standards, policies and other obligations related to data privacy and security.

Our (or the third parties with whom we work) actual or perceived failure to comply with such obligations could lead to regulatory investigations or actions;

litigation (including class claims) and mass arbitration demands;

fines and penalties;

disruptions of our business operations;

reputation harm;

reputational harm;

loss of revenue or profits;

1 unchanged sentence

and other adverse business consequences.

Compliance with such laws could impair our efforts to maintain and expand our customer base, and thereby decrease our revenues.

In the ordinary course of business, we process confidential, proprietary, and/or sensitive information, including data collected by our sensors, personal information business data, trade secrets, and intellectual property.

Accordingly, our data processing activities are subject to a variety of data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security and restrictions on audio monitoring and the collection, use, storage and disclosure of personal information.

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws).

states —including California, Virginia, Colorado, Connecticut, and Utah—have adopted and others are considering proposals for comprehensive data privacy and security laws and regulations.

that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal information., As applicable, such rights may include the right to access, correct and delete certain personal information, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making.

Accordingly, our data processing activities subject us to a variety of data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security and restrictions on audio monitoring and the processing of personal information.

In the United States, federal, state, and local governments have enacted numerous data privacy

and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws).

Numerous U.S.

states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal information.

As applicable, such rights may include the right to access, correct or delete certain personal information, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making.

The exercise of these rights may impact our business and ability to provide our products and services.

These state laws also allow for statutory fines for noncompliance.

For example the California Consumer Privacy Act (“CCPA”), applies to personal information of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain privacy rights, such as those noted below.

The CCPA provides for fines of up to $7,500 per intentional violation and allows private litigants affected by certain data breaches to recover significant statutory damages.

Other similar laws are being considered in several other states, as well as at the federal and local levels.

These developments further complicate compliance efforts, and increase legal risk and compliance costs for us, and the third parties upon whom we rely.

Certain states also impose stricter requirements for processing certain personal information, including sensitive information, such as conducting data privacy impact assessments.

These state laws allow for statutory fines for noncompliance.

For example the California Consumer Privacy Act of 2018 (“CCPA”), applies to personal information of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights.

The CCPA provides for fines and allows private litigants affected by certain data breaches to recover significant statutory damages.

Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future.

Outside the United States, an increasing number of laws, regulations, and industry standards govern data privacy and security.

For example, the European Union’s General Data Protection Regulation (“EU GDPR”), the United Kingdom’s GDPR (“UK GDPR”), Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or “LGPD”) (Law No.

For example, the European Union’s General Data Protection Regulation (“EU GDPR”), the United Kingdom’s GDPR (“UK GDPR”) (collectively, “GDPR”), Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or “LGPD”) (Law No.

13,709/2018), and China’s Personal Information Protection Law (“PIPL”) impose strict requirements for processing personal information.

For example, under the EU GDPR and UK GDPR, companies may face temporary or definitive bans on data processing and other corrective actions;

For example, under the GDPR, companies may face temporary or definitive bans on data processing and other corrective actions;

fines of up to 20 million Euros under the EU GDPR, 17.5 million pounds sterling under the UK GDPR or, in each case, 4% of annual global revenue, whichever is greater;

1 unchanged sentence

Additionally, we may be required, under various data privacy and security laws and other obligations, to obtain certain consents to process personal information.

Our inability or failure to do so could result in adverse consequences.

For example, some of our data processing practices may be challenged under wiretapping laws, if we obtain consumer information from third parties through various methods, including chatbot and session replay providers, or via third-party marketing pixels.

1 unchanged sentence

Our inability or failure to obtain consent for these practices could result in adverse consequences, including class action litigation and mass arbitration demands.

Regulators are increasingly scrutinizing the activities of data suppliers, and laws in the United States (including the CCPA and California’s Delete Act) and other jurisdictions are likewise regulating such activity.

These laws, which may apply to us and our partners, pose additional, material compliance risks to data suppliers, and suppliers may not be able to provide personal information in compliance with these laws.

Furthermore, our business relies on the acquisition and sale of personal data, including data obtained from third-party data suppliers.

Regulators are increasingly scrutinizing the activities of third-party data suppliers and acquisition and sale of personal data from or to third parties, and laws in the United States (including the CCPA and California’s Delete Act) and other jurisdictions, such as Europe (including through the GDPR and the ePrivacy Directive), are likewise regulating such activity.

These laws pose additional, material compliance risks to such data suppliers, and these suppliers may not be able to provide us with personal information in compliance with these laws.

For example, some data suppliers are required to register as data brokers under California and Vermont law and file reports with regulators, which exposes them to increased scrutiny.

Additionally, California’s Delete Act requires a regulatory agency to establish by January 1, 2026 a mechanism to allow California consumers to submit a single, verifiable request to delete all of their personal information held by all registered data brokers and their service providers.

Additionally, California’s Delete Act requires the California Privacy Protection Agency to establish by January 1, 2026 a mechanism to allow California consumers to submit a single, verifiable request to delete all of their personal information held by all registered data brokers and their service providers.

Moreover, data suppliers have recently been subject to increased litigation under various claims of violating certain state privacy laws.

These laws and related challenges may make it so difficult for us or our suppliers to provide the data that the costs associated with the data materially increase or may materially decrease the availability of data that data suppliers can provide.

In addition, we may face compliance risks and limitations on our ability to use certain data provided by our data suppliers if those suppliers have not complied with applicable privacy laws, provided appropriate notice to data subjects, obtained necessary consents, or established a legal basis for the transfer and processing of the data by us.

Our employees and personnel use generative AI technologies to perform their work, and the disclosure and use of personal information in generative AI technologies is subject to various data privacy and security laws and other obligations.

Governments have passed and are likely to pass additional laws regulating generative AI.

Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and consumer lawsuits.

If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages.

We use AI/ML to assist us in making certain decisions, which is regulated by certain data privacy and security laws.

These laws and challenges may make it so difficult for us or our suppliers to provide the data that the costs associated with the data materially increase or may materially decrease the availability of data that data suppliers can provide.

Obtaining and selling personal data from third parties carries risk to us.

For example, we have registered as a data broker and file reports with certain regulators, which exposes us to increased scrutiny.

In addition, we may face compliance risks and limitations on our ability to use certain data provided by our third-party suppliers if those suppliers have not complied with applicable privacy laws, provided appropriate notice to

data subjects, obtained necessary consents, or established a legal basis for the transfer and processing of the data by us.

These challenges may make it so difficult for us and our suppliers to provide the data and the costs associated with the data materially increase or may materially decrease the availability of data that we or our data suppliers can provide.

We are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful.

For example, certain data privacy and security laws, such as the GDPR and the CCPA, require our customers to impose specific contractual restrictions on their service providers.

We publish privacy policies, marketing materials and other statements, such as compliance with certain certifications or self-regulatory principles, regarding data privacy and security.

If these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences.

For example, certain privacy laws, such as the GDPR and the CCPA, require our customers to impose specific contractual restrictions on their service providers.

We publish privacy policies, marketing materials, whitepapers, and other statements, such as statements related to compliance with certain certifications or self-regulatory principles, concerning data privacy, security, and AI.

Regulators in the United States are increasingly scrutinizing these statements, and if these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, misleading, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences.

Obligations related to data privacy and security (and consumers’ data privacy and security expectations) are quickly changing, becoming increasingly stringent, and creating uncertainty.

3 unchanged sentences

We may at times fail (or be perceived to have failed) in our efforts to comply with our data privacy and security obligations.

Moreover, despite our efforts, our personnel or third parties on whom we rely may fail to comply with such obligations, which could negatively impact our business operations.

If we or the third parties on which we rely fail, or are perceived to have failed, to address or comply with applicable data privacy and security obligations, we could face significant consequences, including but not limited to:

Moreover, despite our efforts, our personnel or third parties with whom we work may fail to comply with such obligations, which could negatively impact our business operations.

If we or the third parties with whom we work fail, or are perceived to have failed, to address or comply with applicable data privacy and security obligations, we could face significant consequences, including but not limited to:

government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar);

1 unchanged sentence

additional reporting requirements and/or oversight;

on processing personal information;

bans or restrictions on processing personal information;

orders to destroy or not use personal information;

and imprisonment of company officials.

In particular, plaintiffs have become increasingly more active in bringing data privacy-related claims against companies, including class claims and mass arbitration demands.

In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims and mass arbitration demands.

Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations.

17 unchanged sentences

These federal and state NOLs may be available to reduce future income subject to income taxes.

In general, under Section 382 of the Internal Revenue Code of 1986, as amended (“the Code”), a corporation that undergoes an “ownership change” is subject to limitations on its ability to utilize its NOLs to offset future taxable income.

In general, under Section 382 of the Internal Revenue Code

of 1986, as amended (the "Code"), a corporation that undergoes an “ownership change” is subject to limitations on its ability to utilize its NOLs to offset future taxable income.

Past or future changes in our stock ownership, some of which are outside of our control, may have resulted or could result in an ownership change.

10 unchanged sentences

As a result, a settlement of, or an unfavorable outcome on, any of the matters referenced above or other litigation matters could have a material adverse effect on our business, operating results, financial condition and cash flows.

We, or our customers, may be subject to requests for our data or information concerning our techniques and processes, pursuant to state or federal law (for example, public-records requests or subpoenas to provide information

or to testify in court).

This data and information, some of which we may deem to be confidential or trade secrets, could therefore become a matter of public record and also become accessible by competitors, which could negatively impact our business.

13 unchanged sentences

We also license one other U.S.

patent from one third party.

patent from one third party which expired in November 2023.

The patents that we own or those that we license from others (including those that may be issued in the future) may not provide us with any competitive advantages or may be challenged by third parties.

23 unchanged sentences

Companies in the software and technology industries, including some of our current and potential competitors, own large numbers of patents, copyrights, trademarks and trade secrets and frequently enter into litigation based on allegations of infringement or other violations of intellectual property rights.

In addition, many of these companies have the capability to dedicate substantially greater resources to enforce their intellectual property rights and to defend claims that may be brought against them.

In addition, many of these companies

have the capability to dedicate substantially greater resources to enforce their intellectual property rights and to defend claims that may be brought against them.

The litigation may involve patent holding companies or other adverse patent owners that have no relevant product revenues and against which our patents may therefore provide little or no deterrence.

26 unchanged sentences

A portion of our technologies incorporates open source software, and we expect to continue to incorporate open source software into our platform in the future.

Few of the licenses applicable to open source software have been interpreted by courts, and their application to the open source software integrated into our proprietary technology platform may be uncertain.

Few of the licenses applicable to open source software have been interpreted by courts, and their application to the open source software integrated into our proprietary technology

platform may be uncertain.

If we fail to comply with these licenses, then pursuant to the terms of these licenses, we may be subject to certain requirements, including requirements that we make available the source code for our software that incorporates the open source software.

3 unchanged sentences

Risks Related to the Ownership of Our Common Stock

We have identified a material weakness in our internal control over financial reporting as of December 31, 2024.

If we are unable to develop and maintain an effective system of internal control over financial reporting, we may not be able to accurately report our financial results in a timely manner, which may adversely affect investor confidence in us and materially and adversely affect our business and operating results.

A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented, or detected and corrected on a timely basis.

Effective internal controls are necessary for us to provide reliable financial reports and prevent fraud.

Under the supervision of and with the participation of our management, we assessed the effectiveness of our internal control over financial reporting as of December 31, 2024, using the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) in Internal Control — Integrated Framework (2013).

Based on management’s assessment of our internal control over financial reporting, under the criteria described in the preceding sentence, management has identified a material weakness in internal control during the year ended December 31, 2024.

See Part II, Item 9A, “Controls and Procedures” of this report.

We cannot assure you that there will not be additional material weaknesses or significant deficiencies in our internal control over financial reporting in the future.

Any failure to maintain internal control over financial reporting could severely inhibit our ability to accurately report our financial condition, results of operations or cash flows.

If we are unable to conclude that our internal control over financial reporting is effective, or if our independent registered public accounting firm determines we have a material weakness in our internal control over financial reporting, investors may lose confidence in the accuracy and completeness of our financial reports, the market price of our common stock could decline, and we could be subject to sanctions or investigations by Nasdaq, the SEC or other regulatory authorities.

Failure to remedy any material weakness in our internal control over financial reporting, or to implement or maintain other effective control systems required of public companies, could also restrict our future access to the capital markets.

Management has been implementing and continues to implement measures to remediate the material weakness.

These remediation measures may be time consuming and costly and there is no assurance that these initiatives will ultimately have the intended effects.

If we identify any new material weaknesses in the future, any such newly identified material weakness could limit our ability to prevent or detect a misstatement of our accounts or disclosures that could result in a material misstatement of our annual or interim financial statements.

In such case, we may be unable to maintain compliance with securities law requirements regarding timely filing of periodic reports in addition to applicable stock exchange listing requirements, investors may lose confidence in our financial reporting and our stock price may decline as a result.

We cannot assure you that the measures we have taken to date, or any measures we may take in the future, will be sufficient to avoid potential future material weaknesses.

Our stock price may be volatile or may decline regardless of our operating performance, resulting in substantial losses for investors.

24 unchanged sentences

In addition, in the future we may issue common stock or other securities if we need to raise additional capital.

The number of new shares of our common stock issued in connection with raising additional capital could constitute a material portion of the then outstanding shares of our common stock.

The number of new shares of our common stock issued in connection with raising additional capital could constitute a material portion of the then outstanding

shares of our common stock.

In the event a large number of shares of common stock are sold in the public market, such share sales could reduce the trading price of our common stock.

5 unchanged sentences

Repurchases of our shares could increase the volatility of the trading price of our stock, which could have a negative impact on the trading price of our stock.

Similarly, the future announcement of the termination or suspension

of the stock repurchase program, or our decision not to utilize the full authorized repurchase amount under the stock repurchase program, could result in a decrease in the trading price of our stock.

Similarly, the future announcement of the termination or suspension of the stock repurchase program, or our decision not to utilize the full authorized repurchase amount under the stock repurchase program, could result in a decrease in the trading price of our stock.

In addition, the stock repurchase program could have the impact of diminishing our cash reserves, which may impact our ability to finance our growth, complete acquisitions and execute our strategic plan.

13 unchanged sentences

In order to maintain and, if required, improve our disclosure controls and procedures and internal control over financial reporting to meet this standard, significant resources and management oversight may be required.

Furthermore, if any issues in complying with those requirements are identified (for example, our recent identification of a material weakness over our internal controls over financial reporting and any additional material weaknesses or significant deficiency in the internal control over financial reporting that we or our independent registered public accounting firm may identify in the future), we could incur additional costs rectifying those issues, and the existence of those issues could adversely affect our reputation or investor perceptions of it.

As a result, management’s attention may be diverted from other business concerns, which could adversely affect our business and operating results.

Although we have already hired additional corporate employees to comply with these requirements, we may need to hire more corporate employees in the future or engage outside consultants, which would increase our costs and expenses.

Although we have already hired additional corporate employees to comply with these requirements,

we may need to hire more corporate employees in the future or engage outside consultants, which would increase our costs and expenses.

In addition, changing laws, regulations and standards relating to corporate governance and public disclosure are creating uncertainty for public companies, increasing legal and financial compliance costs and making some activities more time-consuming.

1 unchanged sentence

This could result in continuing uncertainty regarding compliance matters and higher costs necessitated by ongoing revisions to disclosure and governance practices.

We intend to invest resources to comply with evolving laws, regulations and standards, and this investment may result in increased general and administrative expenses and a diversion of management’s time and attention from revenue-generating activities to compliance activities.

We invest resources to comply with evolving laws, regulations and standards, and these investments may result in increased operating expenses and a diversion of management’s time and attention from revenue-generating activities to compliance activities.

If our efforts to comply with new laws, regulations and standards differ from the activities intended by regulatory or governing bodies due to ambiguities related to their application and practice, regulatory authorities may initiate legal proceedings against us and our business may be adversely affected.

25 unchanged sentences

These forum selection clauses in our certificate of incorporation may limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us.

While the Delaware courts have determined that such choice of forum

provisions are facially valid and several state trial courts have enforced such provisions and required that suits asserting Securities Act claims be filed in federal court, there is no guarantee that courts of appeal will affirm the enforceability of such provisions and a stockholder may nevertheless seek to bring a claim in a venue other than those designated in the exclusive forum provisions.

While the Delaware courts have determined that such choice of forum provisions are facially valid and several state trial courts have enforced such provisions and required that suits asserting Securities Act claims be filed in federal court, there is no guarantee that courts of appeal will affirm the enforceability of such provisions and a stockholder may nevertheless seek to bring a claim in a venue other than those designated in the exclusive forum provisions.

In such instance, we would expect to vigorously assert the validity and enforceability of the exclusive forum provisions of our certificate of incorporation.

10 unchanged sentences

conducting scans of our environment;

evaluating threats reported to us and coordinating with law enforcement concerning certain threats;

evaluating threats reported to us and coordinating with law enforcement concerning certain threats as may be appropriate;

conducting threat assessments of both internal and external threats;

conducting vulnerability assessments to identify vulnerabilities;

conducting risk, threat and vulnerability assessments to identify vulnerabilities;

working with third parties to conduct testing and tabletop exercises;

24 unchanged sentences

We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and network and cellular communications providers.

We have a vendor management program to manage cybersecurity risks associated with our use of these providers.

We have a vendor management program to manage cybersecurity risks associated with our use of certain of these providers.

Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, including for example, conducting risk assessment of certain vendors, providing our vendors with a security questionnaire or reviewing their SOC report, reviewing the vendor’s written information security program in certain circumstances, conducting audits of our vendors as may be needed, and requiring certain technical controls of our vendors through contractual obligations.

For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1.

Risk Factors in this Annual Report on Form 10-K, including the

risks titled “If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, our solutions may be perceived as not being secure, our customers may be harmed and we could experience adverse consequences, including but not limited to regulatory investigations or actions;

Risk Factors in this Annual Report on Form 10-K, including the risks titled “If our information technology systems or data, or those of third parties with whom we work, are or were compromised, our solutions may be perceived as not being secure, our customers may be harmed and we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions;

litigation or mass arbitration demands;

7 unchanged sentences

The board of directors’ audit committee is responsible for overseeing Company’s cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.

Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Vice President of Operational Engineering, Dave Halliday.

Halliday has over thirty years of experience in information technology and information security management and oversees our operational engineering component, which includes our information security function, IT, networking, cloud operations, and development operations teams.

Halliday is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company’s overall risk management strategy, and communicating key priorities to relevant personnel.

Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Vice President of Operational Engineering.

Our Vice President of Operational Engineering has over thirty years of experience in information technology and information security management and oversees our operational engineering component, which includes our information security function, IT, networking, cloud operations, and development operations teams.

Our Vice President of Operational Engineering is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company’s overall risk management strategy, and communicating key priorities to relevant personnel.

Our Chief Financial Officer is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

1 unchanged sentence

Those members of management work with the Company’s incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified.

In addition, the Company’s incident response and vulnerability management processes includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.

In addition, the Company’s incident response and vulnerability management processes includes members of management reporting to the audit committee of the board of directors for certain cybersecurity incidents.

The audit committee receives periodic reports from the Chief Financial Officer concerning the Company’s significant cybersecurity threats and risk and the processes the Company has implemented to address them.

1 unchanged sentence

Our principal facilities consist of office space for our corporate headquarters in Fremont, California.

We also have offices in Washington D.C., Newark, New Jersey, Walnut Creek, California, Eustis, Florida and Tucson, Arizona.

We also have offices in Washington D.C., Iselin, New Jersey and Tucson, Arizona.

We lease our facilities and do not own any real property.

3 unchanged sentences

On August 28, 2018, Silvon S.

Simmons (the “Plaintiff”) amended a complaint against the City of Rochester, New York and various city employees, filed in the United States District Court, Western District of New York, to add us and employees as defendants.

The amended complaint alleges conspiracy to violate the Plaintiff's civil rights, denial of the right to a fair trial, and malicious prosecution.

The Plaintiff claims that we colluded with the City of Rochester to fabricate and create gunshot alert evidence to secure Plaintiff's conviction.

On the basis of the allegations, the

Plaintiff has petitioned for compensatory and punitive damages and other costs and expenses, including attorney’s fees.

We believe that the Plaintiff’s claims are without merit and are disputing them vigorously.

We may become subject to legal proceedings, as well as demands and claims that arise in the normal course of our business, including claims of alleged infringement of third-party patents and other intellectual property rights, breach of contract, employment law violations, and other matters and matters involving requests for information from us or our customers under federal or state law.

The amended complaint alleged conspiracy to violate the Plaintiff's civil rights, denial of the right to a fair trial, and malicious prosecution.

The Plaintiff claimed that we colluded with the City of Rochester to fabricate and create gunshot alert evidence to secure Plaintiff’s conviction.

On the basis of

the allegations, the Plaintiff petitioned for compensatory and punitive damages and other costs and expenses, including attorney’s fees.

In September 2024, SoundThinking was dismissed from the lawsuit.

We may become subject to legal proceedings, as well as demands and claims that arise in the normal course of our business, including claims of alleged infringement of third-party patents and other intellectual property rights, breach of contract, employment law violations and other matters involving requests for information from us or our customers under federal or state law.

Such claims, even if not meritorious, could result in the expenditure of significant financial and management resources.

6 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors