Cogent Comms (CCOI) Risk Analysis

With the acquisition of the Sprint Business, our operations now include the ownership of a substantial fiber network. With this ownership, we assume the critical responsibility for the maintenance and repair of the entire fiber infrastructure. This introduces inherent risks that could impact our operational continuity. As we did not own a fiber network historically, the new responsibility necessitates an adjustment in our operational approach and poses challenges affecting the efficiency of maintenance activities. If we are unable to maintain our fiber or adequately and efficiently manage disruptions to our fiber network, our ability to provide services in the affected markets or parts of markets would be impaired unless we have or can obtain alternative fiber routes. In addition, we may incur unexpected and significant costs, delays or other difficulties in maintaining or repairing our fiber infrastructure, resulting in increased disruption in services to our customers. We may, as a result, lose revenue or customers.

In the second half of 2021, we notified our employees worldwide that they would be required to return to the office on a full-time basis when permitted by local regulations. For employees in the United States, our return to office began in September 2021. As other countries relaxed their COVID regulations, our employees in those countries returned to the office as well. Except for a brief period at the beginning of 2022 when we temporarily shifted a portion of our workforce to remote work, we have maintained our requirement that all employees work in our offices. In August 2021, we also notified employees in the United States that they would be required to attest that they were fully vaccinated against the COVID-19 virus unless they received a medical or religious exemption. We subsequently mandated that all U.S. employees receive a COVID-19 booster vaccine no later than six weeks after first becoming eligible for such vaccine. We required that the employees of the Sprint Business in the United States attest and provide proof that they are fully vaccinated against the COVID-19 virus unless they received a medical or religious exemption. Our employees have largely complied with our vaccine mandate in the United States. However, we experienced an increase in employee departures, particularly within our sales department, beginning in the second half of 2021 and continuing into 2022. The departure rate returned to our long-term historical rates in 2023. We believe that the rise in departures was attributable, in part, to the unwillingness of some employees to work in a full-time, in-office environment. In the United States, we believe the rise in departures was also attributable to the unwillingness of some employees to be vaccinated. If we continue to require employees to work in the office on a full-time basis and/or to mandate COVID-19 vaccinations in the United States, we may find it difficult to retain existing employees or hire new employees. Further, a resurgence of COVID-19 due to immunity-resistant variants may cause employees to be more reluctant to continue in, or make new employees more reluctant to accept, a full-time, in-office position due to concerns about COVID-19. If this occurs, this may impact our revenue growth and profitability.

We rely on computer systems, hardware, software, technology infrastructure and online sites and networks for both internal and external operations that are critical to our business (collectively, "IT Systems"). We own and manage some of these IT Systems but also rely on third parties for a range of IT Systems and related products and services, including but not limited to cloud computing services. Our business depends on our ability to limit and mitigate interruptions to or degradation of the security of our network. We face numerous and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our IT Systems, as well as trade secrets, intellectual property, personal information or other Company confidential information (collectively "Confidential Information"). We are considered a critical infrastructure provider and therefore may be more likely to be the target of cyber-attacks. Our IT Systems are subject and vulnerable to unauthorized access, social engineering/phishing, malware (including ransomware), malfeasance by insiders, human or technological error, and as a result of bugs, misconfigurations or exploited vulnerabilities in software or hardware, computer viruses, cyber-attacks, distributed denial of service ("DDOS"), and other cybersecurity risks. We and our employees are the target of phishing attempts and compromised links, and our IT Systems are the target of attempts at unauthorized access, a small number of which have been successful in accessing non-critical areas of our IT Systems. Our customer-facing network firewall regularly suppresses cyber-attacks and our network routinely manages DDOS attacks. Although none of the incidents, individually or in the aggregate, have materially impacted our operations or business, we cannot guarantee material incidents will not occur in the future. An attack on or security breach of our network could result in theft Confidential Information, the interruption, degradation, or cessation of services, an inability to meet our service level commitments or our financial reporting obligations, and potentially compromise customer data stored on or transmitted over our network. Cyber-attacks are expected to accelerate on a global basis in frequency and magnitude as threat actors are becoming increasingly sophisticated in using techniques and tools – including artificial intelligence – that circumvent security controls, evade detection and remove forensic evidence. As a result, we may be unable to detect, investigate, remediate or recover from future attacks or incidents, or avoid a material adverse impact to our IT Systems, Confidential Information or business. Moreover, as cyber warfare becomes a tool in asymmetric conflicts between the United States and other nations, we, as a US provider, may be targeted with increasing frequency. We cannot guarantee that our security measures will not be circumvented, thereby resulting in security events, network failures or interruptions that could impact our network security or availability and have a material adverse effect on our business, our ability to meet our financial reporting obligations, financial condition and operational results. We may be required to expend significant resources to protect against such threats, and may experience a reduction in revenues, litigation (including class action lawsuits), and a diminution in goodwill, caused by a compromise of our cybersecurity. Although our customer contracts limit our liability, affected customers and third parties may seek to recover damages from us under various legal theories. We cannot guarantee that any costs and liabilities incurred in relation to an attack or incident will be covered by our existing insurance policies or that applicable insurance will be available to us in the future on economically reasonable terms or at all. In response to past attacks, we have implemented further controls and taken and planned for other preventative actions to further strengthen our systems against future attacks. However, we cannot assure you that such measures will provide absolute security, that we will be able to react in a timely manner, or that our remediation efforts following any past or future attacks will be successful. There can also be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our IT Systems and Confidential Information. Any adverse impact to the availability, integrity or confidentiality of our IT Systems or Confidential Information can result in legal claims or proceedings (such as class actions), regulatory investigations and enforcement actions, fines and penalties, negative reputational impacts that cause us to lose existing or future customers, and/or significant incident response, system restoration or remediation and future compliance costs. Any or all of the foregoing could materially adversely affect our business, operating results, and financial condition.

In the United States, Internet services are generally not subject to taxes. Consequently, in the United States we collect few taxes from our customers even though most telecommunications services are subject to numerous taxes. Various local jurisdictions have asserted or may assert that some of our operations or services should be subject to local taxes. If such jurisdictions assess taxes on prior years we may be subject to a liability for unpaid taxes that we may be unable to collect from our customers or former customers. If the taxation of Internet service is expanded, we will need to collect those taxes from our customers. The process of implementing a system to properly bill and collect such taxes may require significant resources. In addition, the FCC is considering changes to its Universal Services Fund that could result in its application to Internet services. This too would require that we expend resources to collect this tax. Finally, the cumulative effect of these taxes levied on Internet services could discourage potential customers from using Internet services to replace traditional telecommunication services and negatively impact our ability to grow our business. Our private network services, such as our VPN services, are subject to taxes and fees in various jurisdictions including the Universal Service Contribution tax in the US. We believe we collect all required taxes; however, a jurisdiction may assert we have failed to collect certain taxes. The expense of paying any unpaid taxes could be substantial and we might not be able to collect such back taxes from our customers. We are subject to value-added taxes and other taxes in many jurisdictions outside of the United States. We are also subject to audit of our tax compliance in numerous jurisdictions. These may result in the assessment of amounts due that are material and therefore would have an adverse effect on us.

We have expanded our network into 54 countries worldwide on every continent other than Antarctica. We continue to explore expansion opportunities. We have experienced difficulties, ranging from lack of dark fiber, to regulatory issues, to slower revenue growth rates from our operations in these markets. If we are not successful in developing our market presence in these regions, our operating results and revenue growth could be adversely impacted. Our international operations involve a number of risks, including: - fluctuations in currency exchange rates, particularly those involving the Euro as we are required to fund certain of our cash flow requirements of our operations outside of the United States;- exposure to additional regulatory and legal requirements, including laws that may make it difficult or costly to enforce our contracts, import restrictions and controls, exchange controls, tariffs and other trade barriers and privacy and data protection regulations;- compliance with laws regarding privacy, trade restrictions, economic sanctions, and corruption and bribery, including the United States Foreign Corrupt Practices Act;- difficulties in staffing and managing our foreign operations;- changes in political and economic conditions; and - exposure to additional and potentially adverse tax regimes. As we continue to expand into other countries, our success will depend, in part, on our ability to anticipate and effectively manage these and other risks. Our failure to manage these risks and grow our operations outside the United States may have a material adverse effect on our business and results of operations.

We face significant competition from incumbent carriers, Internet service providers and facilities-based network operators. Relative to us, many of these providers have significantly greater financial resources, more well-established brand names, larger customer bases, and more diverse strategic plans and service offerings. A number of these providers also have large bases of consumers, which makes their networks particularly attractive to content providers as they can provide a direct connection to their customers. Intense competition from these traditional and new communications companies has led to declining prices and margins for many communications services, and we expect this trend to continue as competition intensifies in the future. Decreasing prices for high-speed Internet services have somewhat diminished the competitive advantage that we have enjoyed as a result of our service pricing. Our business is premised on the idea that customers want simple Internet access and private networks rather than a combination of such services with other services such as voice services and complex managed services. Our competitors offer such services. Should the market come to favor such services our ability to acquire and keep customers would be impaired. Our competitors may also upgrade their existing services or introduce new technologies or services, such as satellite-based Internet or 5G services that could make our services less attractive to potential customers. Moreover, the continuous evolution of technology may empower our competitors to upgrade their existing services or introduce new, more advanced offerings that could potentially diminish our sales of VPN and colocation services. As a consequence, we may face challenges in acquiring and retaining customers.

In the fall of 2021, we began to implement an in-office work policy designed to return the vast majority of our employees to an in-office work environment. Except for a brief return to remote work at the beginning of 2022 for a portion of our workforce, we have, with the exception of a limited number of employees who become eligible for hybrid work on a quarterly basis, maintained our requirement that all employees work in our offices wherever possible. A small minority of our workforce declined to return to full-time in-office employment and left our employment. We are experiencing modest competitive challenges versus some competitors who are offering some employees a hybrid work option. Increasing demands to work in a hybrid work style may reduce our ability to attract and retain employees, in particular attracting and retaining salespeople.