eGain (EGAN) Risk Analysis

Our directors and executive officers, together with their affiliates and members of their immediate families, beneficially owned, in the aggregate, approximately 34% of our outstanding capital stock as of December 31, 2024, of which our Chief Executive Officer, Ashutosh Roy, beneficially owned approximately 31% as of such date. As a result of these concentrated holdings, Mr. Roy individually or together with this group has the ability to exercise significant control over most matters requiring our stockholders' approval, including the election and removal of directors and the approval of significant corporate transactions, such as a merger or sale of our company or its assets.

Generally accepted accounting principles and the related accounting pronouncements, implementation guidelines and interpretations for some of our significant accounting policies are highly complex and require subjective judgments and assumptions. Some of our more significant accounting policies that could be affected by changes in the accounting rules and the related implementation guidelines and interpretations include: - recognition of revenue;- contingencies and litigation; and - accounting for income taxes. Changes in these or other rules, or scrutiny of our current accounting practices, or a determination that our judgments or assumptions in the application of these accounting principles were incorrect, could have a significant adverse effect on our reported operating results or the way in which we conduct our business.

We assume a certain level of credit risk with our customers in order to do business. Conditions affecting any of our customers could cause them to become unable or unwilling to pay us in a timely manner, or at all, for products or services we have already provided them. In the past, we have experienced collection delays from certain customers, and we cannot predict whether we will continue to experience similar or more severe delays in the future. Although we have established a provision to cover losses due to delays or inability to pay, there can be no assurance that such reserves will be sufficient to cover our losses. If losses due to delays or inability to pay are greater than our reserves, it could harm our business, operating results and financial condition.

Our success and future growth depend in part upon the skills, experience, performance and continued service of our distribution partners, including software and hardware vendors and resellers. Our distribution partners engage with us in a number of ways, including assisting us to identify prospective customers, distributing our products and services in geographies where we do not have a physical presence and distributing our products and services where they are considered complementary to other products of the partner or third-party products distributed by the partner. We believe that our future success depends in part upon our ability to develop, maintain and expand strategic, long-term and profitable partnerships and reseller relationships. If we are unable to do so for any reason, including as a result of any change in the leadership of our distribution partners, or if any existing or future distribution partners fail to successfully market, resell, implement or support our products for their customers, or if distribution partners represent multiple providers and devote greater resources to market, resell, implement and support competing products and services, our future revenue growth could be impeded. We sometimes rely on distribution partners to recommend our products to their customers. We likewise depend on broad market acceptance by these distribution partners of our product and service offerings. Our agreements generally do not prohibit competitive offerings and our distribution partners may develop market or recommend software applications that compete with our products. To the extent we devote resources to these relationships and the partnerships do not proceed as anticipated or provide revenue or other results as anticipated, our business may be harmed. Once partnerships are forged, there can be no guarantee that such relationships will be renewed in the future or available on acceptable terms. If we lose strategic third-party relationships, fail to renew or develop new relationships, or fail to fully exploit revenue opportunities within such relationships, our results of operations and future growth may suffer.

Our customers and potential customers conduct business in a variety of industries, including financial services, the public sector, healthcare and telecommunications. Regulators in certain industries have adopted and may in the future adopt regulations or interpretive positions regarding the use of cloud computing and other outsourced services. The costs of compliance with, and other burdens imposed by, industry-specific laws, regulations and interpretive positions may limit customers' use and adoption of our services and reduce overall demand for our services. For example, some financial services regulators have imposed guidelines for use of cloud computing services that mandate specific controls or require financial services enterprises to obtain regulatory approval prior to outsourcing certain functions. If we are unable to comply with these guidelines or controls, or if our customers are unable to obtain regulatory approval to use our service where required, our business may be harmed. In addition, an inability to satisfy the standards of certain voluntary third-party certification bodies that our customers may expect, such as an attestation of compliance with the PCI Data Security Standards, may have an adverse impact on our business. If we are unable to achieve or maintain these industry-specific certifications or other requirements or standards relevant to our customers, it could adversely affect our ability to provide our services to certain customers and harm our business. In some cases, industry-specific laws, regulations or interpretive positions may also apply directly to us as a service provider. Any failure or perceived failure by us to comply with such requirements could have an adverse impact on our business.

Further to the above, regulation related to the provision of services on the Internet is increasing, as federal, state and foreign governments continue to adopt new laws and regulations addressing data privacy and the collection, processing, storage and use of personal information. Further, laws are increasingly aimed at the use of personal information for marketing purposes, such as the EU's e-Privacy Directive (which is set to be replaced by a new EU e-Privacy Regulation which will have a "direct effect" in each EU Member State), and the country-specific regulations that implement that directive. These and other requirements could reduce demand for our solutions or restrict our ability to store and process data or, in some cases, impact our ability to offer our services and solutions in certain locations. Although we have implemented contracts, diligence programs, policies and procedures designed to address compliance with applicable laws and regulations, there can be no assurance that our employees, contractors, partners, suppliers, data providers or agents will not violate such laws and regulations or our contracts, policies and procedures. Additionally, public perception and standards related to the privacy of personal information can shift rapidly, in ways that may affect our reputation or influence regulators to enact regulations and laws that may limit our ability to provide certain products and services. For example, numerous jurisdictions, including the EU, are considering laws and regulations that would impose additional data privacy and other compliance requirements on the use of AI and could require us to adjust or limit our product offerings in such jurisdictions. In the U.S., California enacted the California Consumer Privacy Act (CCPA) on June 28, 2018, which went into effect on January 1, 2020. The CCPA gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. On November 3, 2020, California passed the California Privacy Rights Act (CPRA), which became effective on January 1, 2023 and amends and expands the CCPA, including the introduction of sensitive personal information as a new regulated dataset in California that is subject to new disclosure and purpose limitation requirements. Additionally, by July 2024, additional states had enacted numerous comprehensive state data privacy laws, requiring businesses to evaluate each law individually for specific compliance requirements and consumer rights, including the following: - The Virginia Consumer Data Protection Act (VCDPA) became effective on January 1, 2023;- The Colorado Privacy Act and the Connecticut Data Privacy Act both become effective on July 1, 2023;- The Utah Consumer Privacy Act became effective on December 31, 2023;- Florida's Digital Bill of Rights, Oregon's Consumer Privacy Act, and Texas' Data Privacy and Security Act went into effect on July 1, 2024;- Montana's Consumer Data Privacy Act will come into effect on October 1, 2024;- Delaware's Personal Data Privacy Act,  Iowa's Consumer Data Protection Act, Nebraska's Online Data Privacy Act and New Hampshire's Privacy Act will come into effect on January 1, 2025;- New Jersey's Privacy Act will come into effect on January 15, 2025;- Tennessee's Information Protection Act will come into effect on July 1, 2025;- Minnesota's Consumer Privacy Act will come into effect on July 31, 2025;- Maryland's Online Data Privacy Act will come into effect on October 1, 2025; and - Indiana's Consumer Data Protection Act and Kentucky's Consumer Data Protection Act will come into effect on January 1, 2026. Furthermore, New York enacted the Stop Hacks and Improve Electronic Data Security Act (SHIELD Act), which became effective March 2020 and requires companies with data relating to New Yorkers to adopt comprehensive cybersecurity programs. Aspects of the CCPA, CPRA and other states' privacy laws remain unclear and we may be required to modify our practices further in an effort to comply with them. These statutes may increase our compliance costs and potential liability. Furthermore, on August 11, 2023, India's Digital Personal Data Protection Bill (DPDP) received presidential assent after passing both houses of India's legislature but there has been no official slated implementation date. DPDP applies to personal data processed within India and personal data outside the territory of India if such processing is in connection with any activity related to offering of goods or services to data subjects. We will continue to monitor developments related to new privacy laws which will require us to incur additional costs and expenses in an effort to monitor and comply with such laws. In addition to government activity, privacy advocacy and other industry groups have established or may establish new self-regulatory standards that may place additional burdens on us. Our customers expect us to meet voluntary certification or other standards established by third parties, such as TRUSTe. If we are unable to maintain these certifications or meet these standards, it could adversely affect our ability to provide our solutions to certain customers and could harm our business. The costs of compliance with and other burdens imposed by laws, regulations and standards may limit the use and adoption of our service and reduce overall demand for it, or lead to significant fines, penalties or liabilities for any noncompliance. Furthermore, concerns regarding data privacy may cause our customers' customers to resist providing the data necessary to allow our customers to use our service effectively. Even the perception that the privacy of personal information is not satisfactorily protected or does not meet regulatory requirements could inhibit sales of our products or services, and could limit adoption of our subscription solution. Moreover, as our customers face increased scrutiny for data privacy breaches, they may elect to transfer the risk to us through contractual provisions which may subject us to increasing levels of contractual liability for data privacy breaches.

We depend on the widespread acceptance and use of our applications as an effective solution for businesses seeking to manage high volumes of customer interactions across multiple channels, including Web, phone, email, print and in-person. While we believe the potential to be very large, we cannot accurately estimate the size or growth rate of the potential market for such product and service offerings generally, and we do not know whether our products and services in particular will achieve broad market acceptance. The market for customer engagement software is rapidly evolving, and concerns over the security and reliability of online transactions, the privacy of users and quality of service or other issues may inhibit the growth of the Internet and commercial online services. If the market for our applications fails to grow or grows more slowly than we currently anticipate, our business will be seriously harmed. Furthermore, our business model is premised on business assumptions that are still evolving. Our business model assumes that both customers and companies will increasingly elect to communicate through multiple channels, as well as demand integration of the online channels into the traditional telephone-based call center. If any of these assumptions is incorrect or if customers and companies do not adopt digital technology in a timely manner, our business will be seriously harmed and our stock price will decline.

The long sales cycle for our products may cause license and SaaS revenue and operating results to vary significantly from period to period. The sales cycle for our products can be six months or more and varies substantially from customer to customer. Because we sell complex and deeply integrated solutions, it can take many months of customer education to secure sales. Since our potential customers may evaluate our products before, if ever, executing definitive agreements, we may incur substantial expenses and spend significant management and legal effort in connection with a potential customer. Our multi-product offering and the increasingly complex needs of our customers contribute to a longer and unpredictable sales cycle. Consequently, we often face difficulty predicting the quarter in which expected sales will actually occur. This contributes to the uncertainty and fluctuations in our future operating results. In particular, the corporate decision-making and approval process of our customers and potential customers has become more complicated. This has caused our average sales cycle to further increase and, in some cases, has prevented the closure of sales that we believed were likely to close.

Expansion and growth of our business is dependent on our ability to expand our sales force and on the ability of our sales force to increase sales. If we are not able to effectively develop and maintain awareness of our products in a cost-effective manner, we may not achieve widespread acceptance of our existing and future products. This may result in a failure to expand and attract new customers and enhance relationships with existing customers. This may impede our efforts to improve operations in our other areas and may result in declines in the market price of our common stock. Due to the complexity of our customer engagement hub platform and related products and services, we must utilize highly trained sales personnel to educate prospective customers regarding the use and benefits of our products and services as well as provide effective customer support. If we have turnover in our sales and marketing teams, we may not be able to successfully compete with our competitors, and our results of operations and financial condition may be harmed.