Bridgeline Digital (BLIN) Risk Factors

We will need to continue to enhance our products in order to maintain our competitive position. We may not be successful in developing and marketing enhancements to our products on a timely basis, and any enhancements we develop may not adequately address the changing needs of the marketplace. Overlaying the risks associated with our existing products and enhancements are ongoing technological developments and rapid changes in customer requirements. Our future success will depend upon our ability to develop and introduce, in a timely manner, new products that take advantage of technological advances and respond to new customer requirements. The development of new products is increasingly complex and uncertain, which increases the risk of delays. We may not be successful in developing new products and incorporating new technology on a timely basis, and any new products may not adequately address the changing needs of the marketplace. Failure to develop new products and product enhancements that meet market needs in a timely manner could have a material adverse effect on our business, financial condition and operating results.

Security breaches could expose us to a risk of loss of our customers' information, litigation and possible liability. While we have security measures in place, they may be breached as a result of third-party action, including intentional misconduct by computer hackers and cybercriminals, employee error, malfeasance or otherwise and result in someone obtaining unauthorized access to our IT systems, our customers' data or our data, including our intellectual property and other confidential business information. Because the techniques used to obtain unauthorized access, or to sabotage systems, change frequently and generally are not recognized until launched against a target, we may be unable to implement adequate preventative measures. In addition, our customers may authorize third-party technology providers to access their customer data, and some of our customers may not have adequate security measures in place to protect their data that is stored on our services. Because we do not control our customers or third-party technology providers, or the processing of such data by third-party technology providers, we cannot ensure the integrity or security of such transmissions or processing. Malicious third parties may also conduct cyber-attacks designed to temporarily deny customers access to our services. Any security breach could result in a loss of confidence in the security of our services, damage our reputation, negatively impact our future sales, disrupt our business and lead to legal liability. We rely on encryption and authentication technology from third parties to provide the security and authentication to effectively secure transmission of confidential information, including consumer payment card numbers. Such technology may not be sufficient to protect the transmission of such confidential information or these technologies may have material defects that may compromise the confidentiality or integrity of the transmitted data. Any imposition of liability, particularly liability that is not covered by insurance, or is in excess of insurance coverage, could harm our reputation, business and operating results. We might be required to expend significant capital and other resources to protect further against security breaches or to rectify problems caused by any security breach, which, in turn, could divert funds available for corporate growth and expansion or future acquisitions.

We develop and sell complex web engagement software which may contain undetected errors or bugs. Such errors can be detected at any point in a product's life cycle but are frequently found after introduction of new software or enhancements to existing software. We continually introduce new products and new versions of our products. Despite internal testing and testing by current and potential customers, our current and future products may contain serious defects. If we detect any errors before we ship a product, we might have to delay product shipment for an extended period of time while we address the problem. We might not discover software errors that affect our new or current products or enhancements until after they are deployed, and we may need to provide enhancements to correct such errors. Therefore, it is possible that, despite our testing, errors may occur in our software. These errors could result in the following: - harm to our reputation;   - lost sales;   - delays in commercial release;   - product liability claims;   - contractual disputes;   - negative publicity;   - delays in or loss of market acceptance of our products;   - license terminations or renegotiations; or   - unexpected expenses and diversion of resources to remedy errors. Furthermore, our customers may use our software together with products from other companies. As a result, when problems occur, it might be difficult to identify the source of the problem. Even when our software does not cause these problems, the existence of these errors might cause us to incur significant costs, divert the attention of our technical personnel from our product development efforts, impact our reputation, or cause significant customer relations problems.

Our customers have no obligation to renew their subscription licenses, and some customers have elected or may elect not to do so. Our license renewal rates may decline or fluctuate as a result of a number of factors, including customer dissatisfaction with our products and services, our failure to update our products to maintain their attractiveness in the market, or constraints or changes in budget priorities faced by our customers. A decline in license renewal rates could cause our revenue to decline, which would have a material adverse effect on our operations.

We operate in a highly competitive marketplace and generally encounter intense competition to create and maintain demand for our services and to obtain service contracts. If we are unable to successfully compete for new business and license renewals, our revenue growth and operating margins may decline. The market for our platforms and web development services are competitive and rapidly changing. Barriers to entry in such markets are relatively low. Competitors and partners are investing in artificial intelligence. With the introduction of new technologies and market entrants, we expect competition to intensify in the future. Some of our principal competitors offer their products at a lower price, which may result in pricing pressures. Such pricing pressures and increased competition generally could result in reduced sales, reduced margins or the failure of our product and service offerings to achieve or maintain more widespread market acceptance. The marketplace is highly fragmented with a large number of competitors and potential competitors. Our competitors include companies such as Algolia, Bloomreach, Coveo, Searchspring, SEMrush, Sitecore and Yext. We face competition from customers and potential customers who develop their own applications internally. We also face competition from potential competitors that are substantially larger than we are and who have significantly greater financial, technical and marketing resources, and established direct and indirect channels of distribution. As a result, they are able to devote greater resources to the development, promotion and sale of their products than we can.

We have previously and may from time to time derive a significant portion of our revenues from a relatively concentrated number of customers. Considering a reduction in our license renewal rate could reduce our revenue, these consequences could be exacerbated if we are dependent upon several major customers and any one of them were to elect not to renew.

The decision by a customer to purchase our products often involves the development of a complex implementation plan across a customer's business. This process often requires a significant commitment of resources both by prospective customers and us. Given the significant investment and commitment of resources required in order to implement our software, it may take several months, or even several quarters, for marketing opportunities to materialize. If a customer's decision to purchase our products is delayed, or if the installation of our products takes longer than originally anticipated, the date on which we may recognize revenue from these sales would be delayed. Such delays and fluctuations could cause our revenue to be lower than expected in a particular period, and we may not be able to adjust our costs quickly enough to offset such lower revenue, potentially negatively impacting our results of operations.

We are subject not only to regulations applicable to businesses generally, but also to laws and regulations directly applicable to electronic commerce. In addition, an inability to satisfy the standards of certain voluntary third-party certification bodies that our customers may expect, such as an attestation of compliance with the Payment Card Industry ("PCI") Data Security Standards, may have an adverse impact on our business and results. Further, there are various statutes, regulations, and rulings relevant to the direct email marketing and text-messaging industries, including the Telephone Consumer Protection Act ("TCPA"), the CAN-SPAM Act and related Federal Communication Commission ("FCC") orders. The interpretation of many of these statutes, regulations, and rulings is evolving in the courts and administrative agencies and an inability to comply may have an adverse impact on our business and results. If in the future we are unable to achieve or maintain industry-specific certifications or other requirements or standards relevant to our customers, it may harm our business and adversely affect our results. We may also expand our business in countries that have more stringent data protection laws than those in the United States, and such laws may be inconsistent across jurisdictions and are subject to evolving and differing interpretations. In particular, the European Union has passed the General Data Protection Regulation ("GDPR"), which came into force on May 25, 2018. The GDPR includes more stringent operational requirements for entities that receive or process personal data (as compared to U.S. privacy laws and previous EU laws), along with significant penalties for non-compliance, more robust obligations on data processors and data controllers, greater rights for data subjects, and heavier documentation requirements for data protection compliance programs. Additionally, both laws regulating privacy and third-party products purporting to address privacy concerns could negatively affect the functionality of, and demand for, our products and services, thereby reducing our revenue.

Geopolitical events, trade and other international disputes, war, terrorism, natural disasters, public health issues, and other business interruptions can adversely impact international commerce and the global economy, and could have a material adverse effect on our business, customers, employees, and partners.