Veritone, Inc. 10-Q

Item 1. Legal Proceedings From time to time, we may be involved in litigation relating to claims arising out of our operations in the normal course of business. We currently are not a party to any legal proceedings, the adverse outcome of which, in management’s opinion, individually or in the aggregate, would have a material adverse effect on our results of operations, financial position or cash flows. Regardless of the outcome, any litigation could have an adverse impact on us due to defense and settlement costs, diversion of management resources and other factors. Item 1A. Ri sk Factors Our Annual Report on Form 10-K for the year ended December 31, 2023 contains a discussion of the material risks associated with our business. Other than as set forth below, there have been no material changes to the risks described in such Annual Report on Form 10-K. Our ability to continue as a going concern depends on, among other factors, our financial condition and operating performance, which are subject to prevailing economic and competitive conditions and certain financial, business and other factors beyond our control. Based on our liquidity position at June 30, 2024 and our current forecast of operating results and cash flows, absent any other action, management determined that there is substantial doubt about our ability to continue as a going concern over the twelve months following the filing of this Quarterly Report on Form 10-Q, principally driven by our current debt service obligations, historical negative cash flows and recurring losses. Our ability to continue as a going concern is dependent on our ability to service our debt obligations under the Term Loan as they become due, which, in turn, is dependent on, among other factors, our financial condition and operating performance, which are subject to prevailing economic and competitive conditions and certain financial, business and other factors beyond our control. Our determination that we may be unable to continue as a going concern may materially harm our business and reputation and may make it more difficult for us to obtain financing for the continuation of our operations, including through equity financings, incurring additional debt or otherwise, which in turn, may adversely impact our financial condition, results of operations and cash flows. In the near term, to meet our cash obligations as they come due, we are evaluating strategies to obtain funding for future operations. These strategies may include, but are not limited to, obtaining equity financing, debt and/or further restructuring of operations to grow revenues and decrease operating expenses, which include capturing past cost reduction and potential future cost synergies from our past acquisitions. In addition, management recently commenced a formal process to divest the Asset, which transaction management intends to close within the twelve months following the filing of this Quarterly Report on Form 10-Q. If consummated, this transaction is expected to generate substantial cash proceeds to be used to pay down a portion of the Term Loan and fund future operations. There is no assurance that such transaction will close in the subsequent twelve-month period, or at all, and as a result, these cash flows have been excluded from management’s plans to remediate the doubt of going concern. The going concern assumption contemplates the realization of assets and satisfaction of liabilities in the normal course of business. We may not be able to access additional equity under acceptable terms, and may not be successful in future operational restructurings or at growing our revenue base. If we are unable to capture past cost reduction and potential future cost synergies from our past acquisitions or consummate the sale of the Asset on terms favorable to us, or at all, we would likely not have sufficient cash on hand or available liquidity to service our current debt obligations, and our ability to execute on our operating plans may be materially adversely impacted. If we become unable to continue as a going concern, we may have to dispose of other or additional assets and might realize significantly less value than the values at which they are carried on our condensed consolidated financial statements. These actions may cause stockholders to lose all or part of their investment in our common stock. If we cannot continue as a going concern, adjustments to the carrying values and classification of our assets and liabilities and the reported amounts of income and expenses could be required and could be material. The security or operation of our platform, networks, computer systems or data, or those of third parties upon which we rely, may be breached or otherwise disrupted, and any such breach or other disruption could have an adverse effect on our business and reputation. In the ordinary course of business, we process proprietary, confidential, and sensitive data, including proprietary and confidential business data, trade secrets, intellectual property, sensitive third-party data, business plans, transactions, financial information, and biometric data (collectively, sensitive information). Certain data privacy and security obligations may require us to implement and maintain specific security measures or industry-standard or reasonable security measures designed to protect our information technology systems and sensitive information. In particular, the data processed and stored in our platform, networks, and computer systems by customers in the government market may contain highly sensitive data protected under government regulations, and we are obligated to comply with stringent requirements related to the security of such data, such as FedRAMP and Criminal Justice Information Services (“CJIS”) security requirements. Individuals or entities have in the past and may in the future attempt to penetrate our network, computer system or platform security, or that of our third-party hosting and storage providers and other third parties upon which we rely, and could gain access to our sensitive information, including customer data. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation, nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we, the third parties upon which we rely, and our customers may be vulnerable to a heightened risk of these attacks, 45 including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our services. For example, we have operations and third parties upon which we rely to support our business located in unstable regions and regions experiencing (or expected to experience) geopolitical or other conflicts, including in the Middle East, where businesses have experienced an increase in cyberattacks in relation to the Israel/Hamas conflict. In addition, our network, computer system or platform are subject to a variety of evolving threats, including but not limited to computer malware (including as a result of advanced persistent threat intrusions), viruses, worms and computer hacking, fraudulent use attempts, phishing and other social engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake), denial-of-service attacks, credential stuffing attacks, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks and disruptions, adware, attacks enhanced or facilitated by AI, and other similar threats, all of which have become more prevalent in our industry. In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, loss of sensitive information and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. It may be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident. Our efforts to do so may not be successful. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems . Our data and information systems or those of third party service providers on which we rely may also fail for reasons other than malicious activity, including but not limited to software bugs, server malfunctions, software or hardware failures, service outages, loss of data or other information technology assets, telecommunications failures, earthquakes, fires, and floods. Remote work has become more common and has increased risks to our platform, network, computer systems, and data, as more of our employees utilize network connections, computers and devices outside our premises or network, including working at home, while in transit and in public locations. Additionally, future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our platform, network, or computer systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. Furthermore, we may discover security issues that were not found during due diligence, and it may be difficult to integrate companies into our information technology environment and security program. These and other threats, attacks, disruptions, outages, or accidents involving us or our third party service providers could result in the unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure, access, unavailability or misappropriation of our proprietary or confidential information, including of our customers and their employees or third parties, and/or damage to our or our third party service providers’ platform, network, or computer systems. For instance, in the second quarter of 2024, we were made aware of an article posted by a security researcher which identified a temporary vulnerability related to two Azure environments related to a limited number of government customers. The vulnerability was remediated as of June 30, 2024, and we notified our potentially affected customers. Our investigation into and response to the matter and this issue has concluded and has not resulted in the loss of any of our customers. While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We take steps designed to detect, mitigate and remediate vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties upon which we rely). However, we may not be able to detect and remediate all vulnerabilities because the threats and techniques used to exploit a vulnerability may change frequently and are often sophisticated in nature, and as a result, such vulnerabilities could be exploited but may not be detected until after a security incident has occurred. Further, we may experience delays in developing and deploying remedial measures and patches designed to address identified vulnerabilities. Even if we have issued or otherwise made patches or information for vulnerabilities in our software applications, products or services, our customers may be unwilling or unable to deploy such patches and use such information effectively and in a timely manner. These vulnerabilities could be exploited and result in a security incident. Applicable data privacy and security obligations may require us, or we may voluntarily choose, to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents or vulnerabilities, or to take other actions, such as providing credit monitoring and identity theft protection services. Such disclosures and related actions are costly, and the disclosure or the failure to comply with such applicable requirements could lead to adverse consequences. An actual or perceived security breach of our platform, network or computer systems, or those of our technology service providers or third party vendors, could result in adverse consequences such as the loss of business, financial losses, reputational damage, negative publicity, government enforcement actions (for example, regulatory investigations, orders, fines, penalties, audits, and inspections), additional reporting requirements and/or oversight, litigation (including class claims), indemnity obligations, damages for contract breach, civil and criminal penalties (including for violation of applicable laws, regulations or contractual obligations), restrictions on processing sensitive data (including personal data), diversion of management attention, interruptions in our operations (including availability of data), significant costs, fees and other monetary payments for remediation, and other similar harms. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security 46 practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims. If we fail or are perceived to have failed to maintain the reliability, security and availability of our platform, network, or computer systems, or if customers believe that our platform does not provide adequate security for the storage of sensitive information or its transmission over the Internet, we may lose existing customers and we may not be able to attract new customers, negatively impacting our ability to grow and operate our business. If we experience security breaches or cyber-attacks or fail to comply with security requirements related to our secure government cloud environment, we may lose our ability to obtain or maintain a FedRAMP certification, which could result in the loss of business from customers in the government market. Any of the foregoing could have a material adverse effect on our business, results of operations and financial position and negatively impact our ability to grow and operate our business. The reliability and continuous availability of our platform and services is critical to our success. However, software such as ours can contain errors, defects, security vulnerabilities or software bugs that are difficult to detect and correct, particularly when such vulnerabilities are first introduced or when new versions or enhancements of our product are released. Additionally, even if we are able to develop a patch or other fix to address such vulnerabilities, such fix may be difficult to push out to our customers or otherwise be delayed. Furthermore, our business depends upon the appropriate and successful implementation of our platform and services by our customers. If our customers fail to use our platform or services according to our specifications, our customers may suffer a security incident on their own systems or other adverse consequences. Even if such an incident is unrelated to our security practices, it could result in our incurring significant economic and operational costs in investigating, remediating, and implementing additional measures to further protect our customers from their own vulnerabilities, and could result in reputational harm. In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveal competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. Additionally, our sensitive information or sensitive information of our customers could be leaked, disclosed, or revealed as a result of or in connection with the use of generative AI technologies by our employees, personnel, or vendors.