Jamf Holding (JAMF) Risk Factors

We believe that maintaining, enhancing, and protecting the Jamf brand, including Jamf Nation, is important to support the marketing and sale of our existing and future products to new customers and expand sales of our products to existing customers. We also believe that the importance of brand recognition will increase as competition in our market increases. Successfully maintaining, enhancing, and protecting our brand will depend largely on our ability to: develop and deploy effective marketing efforts; provide reliable products that continue to meet the needs of our customers at competitive prices; maintain our customers' trust; continue to develop new functionality and use cases; successfully differentiate our products and product capabilities from competitive products; and obtain, maintain, protect, and enforce trademark and other intellectual property protection for our brand. Our brand promotion activities may not generate customer awareness or yield increased revenue, and even if they do, any increased revenue may not offset the expenses we incur in building our brand. In addition, independent industry analysts provide reviews of our platform, as well as products and services offered by our competitors, and perception of our platform in the marketplace may be significantly influenced by these reviews. If these reviews are negative, or less positive as compared to those of our competitors' products and services, our brand may be adversely affected. If we fail to successfully promote, maintain, or protect our brand, our business, financial condition, and results of operations may suffer.

Cyberattacks, computer malware, viruses, social engineering (including phishing and ransomware attacks), and general hacking are becoming more prevalent and more sophisticated in our industry, and we may in the future become the target of third parties seeking unauthorized access to our confidential or sensitive information or that of our customers or partners. While we have security measures in place designed to protect our and our customers' confidential and sensitive information and prevent data loss, these measures cannot provide absolute security and may not be effective to prevent a security breach, including as a result of employee error, theft, misuse, or malfeasance, third-party actions, unintentional events, or deliberate attacks by cyber criminals, any of which may result in someone obtaining unauthorized access to our customers' data, our data, our intellectual property, and/or our other confidential or sensitive business information. In addition, third parties may attempt to fraudulently induce employees, contractors, or users to disclose information, including user names and passwords, to gain access to our customers' data, our data, or other confidential or sensitive information, and we may be the target of email scams that attempt to acquire personal information or company assets. Because techniques used to sabotage or obtain unauthorized access to systems change frequently, have increased in sophistication, and generally are not recognized until successfully launched against a target, we may be unable to anticipate these techniques, react in a timely manner, or implement adequate preventative measures. Furthermore, our solutions may not help detect situations in which a valid user identity has been compromised, for example as part of a sophisticated cyberattack. We devote significant financial and personnel resources to implement and maintain security measures; however, these resources may not be sufficient, and as cybersecurity threats develop, evolve, and grow more complex over time, it may be necessary to make significant further investments to protect our data and infrastructure. We rely on certain third-party software vendors to operate our business, including identity and access management, payment processing, and hosting services; however, our ability to monitor our third-party service providers' data security is limited. Because we do not control our third-party service providers, or the processing of data by our third-party service providers, we cannot ensure the integrity or security of measures they take to protect and prevent unauthorized, accidental, or unlawful access or loss of our data or our customers' data. A security breach suffered by us or our third-party service providers, an attack against our service availability, any unauthorized, accidental, or unlawful access or loss of data, or the perception that any such event has occurred, could result in a disruption to our service, litigation, an obligation to notify regulators and affected individuals, the triggering of service availability, indemnification and other contractual obligations, regulatory investigations, government fines and penalties, reputational damage, loss of investor confidence, loss of sales and customers, mitigation and remediation expenses, and other significant costs and liabilities. In addition, we may incur significant costs and operational consequences of investigating, remediating, eliminating, and putting in place additional tools and devices designed to prevent future actual or perceived security incidents, as well as the costs to comply with any notification or other obligations resulting from any security incidents. We also cannot be certain that our existing insurance coverage will cover any indemnification claims against us relating to any security incident or breach, will be available in sufficient amounts to cover the potentially significant losses that may result from a security incident or breach, will continue to be available on acceptable terms or at all, or that the insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could adversely affect our reputation, business, financial condition, and results of operations. Further, if a high profile security breach occurs with respect to any Apple operating systems, our customers and potential customers may lose trust in our products generally in addition to any Apple operating system products, such as ours in particular. Further, ransomware attacks are becoming increasingly frequent and severe, and we may be unwilling or unable to make ransom payments due to, among other things, applicable laws or regulations prohibiting such payments. We cannot assure you that our products or hosted services will not be subject to cyberattacks, or other security incidents, especially in light of the rapidly changing security threat landscape that our products and hosted services seek to address. Due to a variety of both internal and external factors, including, without limitation, defects or misconfigurations of our products, our products could become vulnerable to security incidents (both from intentional attacks and accidental causes). In addition, because the techniques used by computer hackers to access or sabotage networks and endpoints change frequently, are increasing in sophistication, and generally are not recognized until launched against a target, there is a risk that advanced attacks could emerge that attack our software that we are unable to detect or prevent until after some of our customers are affected. If our cybersecurity products fail to detect a security incident, there could potentially be claims against us for such security incident, which could require us to pay damages and could hurt our reputation, whether or not the security incident was the fault of our products. There also has been increased regulatory scrutiny from the SEC with respect to adequately disclosing risks concerning cybersecurity. Such scrutiny from the SEC increases the risk of investigations into the cybersecurity practices and related disclosures of companies within its jurisdiction, which uniquely affects public companies like ours that do business in cybersecurity and adjacent markets. Further, our customers and their service providers administer access to their data and systems. We offer tools and support for what we believe are best practices to maintain security utilizing our services; however, our customers are ultimately responsible for the administration and control of their information systems and they are not required to utilize those tools or follow our suggested practices or those of their other software vendors. Further, vulnerabilities in open source or any proprietary or third-party integrations can persist even after security patches have been issued if customers have not installed the most recent updates, or if the attackers exploited the vulnerabilities before patching was complete. As a result, a customer may suffer a cybersecurity event on its own systems, unrelated to our own, and a malicious actor could obtain access to the customer's information held on our system. Even if such a breach is unrelated to our own security programs or practices, or if the customer failed to adequately protect our products, that breach could result in our incurring significant economic and operational costs in investigating, remediating, eliminating, and putting in place additional tools and devices to further protect our customers from their own vulnerabilities, and could also result in reputational harm to us. Any of these negative outcomes could adversely affect the market perception of our platform and customer and investor confidence in our company, and would adversely affect our business, operating results, and financial condition. We have accordingly increased our investments in protective measures and risk mitigation strategies, but we cannot guarantee that our efforts, or the efforts of those upon whom we rely and partner with, will be successful in preventing any such cybersecurity incidents. Protecting our own assets has become more expensive from a dollar investment and time perspective, which we expect will continue to increase in the future.

As a global company, Jamf is subject to global data protection, privacy, and security laws, regulations, and codes of conduct that apply to our various business units and data processing activities. Laws such as the GDPR in Europe, and new and emerging state laws in the U.S. on privacy, data, and related technologies, such as the CCPA and CPRA, as well as industry self-regulatory codes, create new compliance obligations and expand the scope of potential liability, either jointly or severally with our customers, partners, and suppliers. While we have invested in readiness to comply with applicable requirements, the dynamic and evolving nature of these laws, regulations, and codes, as well as their interpretation by regulators and courts, may affect our ability (and our customers' ability) to reach current and prospective customers, to respond to customer requests under the laws (such as individual rights of access, correction, and deletion of their personal information), and to implement our business models effectively. These requirements, among others, may impact demand for our platform and force us to bear the burden of more onerous obligations in our contracts. Transferring personal information across international borders is complex and subject to legal and regulatory requirements as well as active litigation and enforcement in a number of jurisdictions around the world, each of which could have an adverse impact on our ability to process and transfer personal data as part of our business operations. For example, European data transfers outside the European Economic Area are highly regulated and litigated. The mechanisms that we and many other companies rely upon for European data transfers (for example, Standard Contractual Clauses and the EU - U.S. Data Privacy Framework) are the subject of legal challenge, regulatory interpretation, and judicial decisions by the Court of Justice of the EU. The suitability of Standard Contractual Clauses for data transfer in some scenarios has recently been the subject of legal challenge, and while the U.S. and the EU reached agreement on the EU - U.S. Data Privacy Framework, there are also legal challenges to that data transfer mechanism. We continue to monitor developments related to valid transfer mechanisms available for transferring personal data outside the European Economic Area (including the Trans-Atlantic Data Privacy Framework) and other countries that have similar trans-border data flow requirements and adjust our practices accordingly. The open judicial questions and regulatory interpretations related to the validity of transfers using Standard Contractual Clauses have resulted in some changes in the obligations required to provide our services in the EU and could expose us to potential sanctions and fines for non-compliance. In addition, certain jurisdictions have imposed data localization laws that may, for example, require personal information of citizens to be collected, stored, and modified only within that country. We publicly post documentation regarding our practices concerning the collection, processing, use, and disclosure of data. Although we endeavor to comply with our published policies and documentation, we may at times fail to do so or be alleged to have failed to do so. The publication of our privacy policy and other documentation that provide promises and assurances about privacy and security can subject us to potential state and federal action if they are found to be deceptive, unfair, or misrepresentative of our actual practices. Because the interpretation and application of many privacy and data protection laws along with contractually imposed industry standards are uncertain, it is possible that these laws may be interpreted and applied in a manner that is inconsistent with laws in other jurisdictions, our existing data management practices, or the features of our products and product capabilities. We therefore cannot yet fully determine the impact these or future laws, rules, regulations, and industry standards may have on our business or operations. Any failure or perceived failure by us, or any third parties with which we do business, to comply with our posted privacy policies, changing consumer expectations, evolving laws, rules and regulations, industry standards, or contractual obligations to which we or such third parties are or may become subject, may result in actions or other claims against us by governmental entities or private actors, the expenditure of substantial costs, time, and other resources or the imposition of significant fines, penalties, or other liabilities. In addition, any such action, particularly to the extent we were found to be guilty of violations or otherwise liable for damages, would damage our reputation and adversely affect our business, financial condition, and results of operations. Complying with these requirements and changing our policies and practices may be onerous and costly, and we may not be able to respond quickly or effectively to regulatory, legislative, and other developments. These changes may in turn impair our ability to offer our existing or planned features, products, and services and/or increase our cost of doing business. As we expand our customer base, these requirements may vary from customer to customer, further increasing the cost of compliance and doing business.

Our revenue, results of operations, and cash flows depend on the overall demand for our products. We operate globally and as a result our business and revenue are impacted by global macroeconomic conditions. Global financial developments seemingly unrelated to us or the software industry may harm us. Currently, the U.S. and other key international economies are impacted by high levels of inflation, elevated interest rates, volatility in credit, equity, and foreign exchange markets, and overall economic uncertainty. These factors have resulted in, and could continue to result in, reductions in hiring and IT spending by our existing and prospective customers, increased price sensitivity, and customers delaying or canceling IT projects, choosing to focus on in-house development efforts, or seeking to lower their costs by requesting us to renegotiate existing contracts and renewals on less advantageous terms (such as shifting to annual billing of multi-year contracts), defaulting on payments due on existing contracts, reducing the scope of their Jamf deployments, or not renewing at the end of existing contract terms. As a result of this macroeconomic uncertainty, certain of our existing and prospective customers took a more moderate outlook when planning their future hiring, device growth, and overall software vendor needs. Our customers have requested and may continue to request price concessions and delayed payment terms. Moreover, our customers may merge with other entities who use alternatives to our products and, during weak economic times, there is an increased risk that one or more of our customers will file for bankruptcy protection, either of which may harm our revenue, profitability, and results of operations. We also face risk from international customers that file for bankruptcy protection in foreign jurisdictions, particularly given that the application of foreign bankruptcy laws may be more difficult to predict. In addition, we may determine that the cost of pursuing any claim may outweigh the recovery potential of such claim. As a result of any of the foregoing, adverse macroeconomic conditions could harm our business, revenue, results of operations, and cash flows.

Our business operations are subject to interruption by various events beyond our control. Our global operations expose us to risks associated with public health crises, such as pandemics and epidemics, which could harm our business and cause our operating results to suffer. In addition, natural disasters or other catastrophic events may cause damage or disruption to our operations, international commerce, and the global economy, thus harming our business. In the event of a major earthquake, hurricane, or catastrophic event such as fire, power loss, telecommunications failure, cyberattack, war, terrorist attack, or other geopolitical unrest, we may be unable to continue our operations and may endure system interruptions, reputational harm, delays in our application development, lengthy interruptions in our products, breaches of data security, and loss of critical data. More generally, a catastrophic event could adversely affect economies and financial markets globally and the trading prices for our and other technology companies' securities may be highly volatile as a result of a catastrophic event, which may reduce our ability to access capital on favorable terms or at all. Further, the insurance and incident response capabilities we maintain may not be adequate to cover or mitigate our losses resulting from disasters or other business interruptions. Any of the foregoing could adversely affect our business, results of operations, and financial condition.

Today, our international contracts are denominated in U.S. dollars and local currencies, and the majority of our international costs are denominated in local currencies. Over time, it is possible that an increasing portion of our international contracts may be denominated in local currencies. Therefore, fluctuations in the value of the U.S. dollar and foreign currencies may affect our results of operations when translated into U.S. dollars. We do not currently engage in currency hedging activities to limit the risk of exchange rate fluctuations. However, in the future, we may use derivative instruments, such as foreign currency forward and option contracts, to hedge certain exposures to fluctuations in foreign currency exchange rates. The use of such hedging activities may not offset any or more than a portion of the adverse financial effects of unfavorable movements in foreign exchange rates over the limited time the hedges are in place. Moreover, the use of hedging instruments may introduce additional risks if we are unable to structure effective hedges with such instruments.

We depend on the continued services of key personnel, including our senior management team. From time to time, there may be changes in our senior management team. In the last two years, we have hired (including via internal promotions) a new Chief Executive Officer, Chief Financial Officer, Chief Sales Officer, and Chief People Officer, among other leadership changes. We generally do not have fixed-term employment agreements with our employees, and, therefore, they could terminate their employment with us at any time without penalty. While we enter into non-compete agreements where permissible, not all jurisdictions permit such agreements, and regardless of the jurisdiction, our key personnel could still pursue employment opportunities with other parties, including, potentially any of our competitors and there are no assurances that our non-compete agreements with any such key personnel would be enforceable in a cost effective manner, if at all. Additionally,our non-compete periods expire, at which time key personnel could work for any of our competitors. In such event, we would be unable to prevent our current employees and other personnel formerly employed by us from competing with us, potentially resulting in the loss of some of our business. The loss of key personnel, including members of management and key engineering, product development, marketing, and sales personnel, could disrupt our operations, adversely impact employee retention and morale, and seriously harm our business. Competition for highly qualified personnel is intense, especially for experienced design and software development engineers and sales professionals. In recent years, recruiting, hiring, and retaining employees with expertise in our industry and in the geographies where we operate has become increasingly difficult as the demand for software professionals, particularly in certain geographic areas where we operate, has increased as a result of the numerous technology, software, and other companies requiring these talents, particularly in tight labor markets. We have, from time to time, experienced, and we expect to continue to experience, difficulty in hiring and retaining employees with appropriate qualifications. Many of the companies with which we compete for experienced personnel have greater resources than we have. In addition, the recent move by companies, including us, to offer a remote or hybrid work environment has resulted in increased competition for qualified personnel and wage inflation in certain markets. If we hire employees from competitors or other companies, their former employers may attempt to assert that these employees or we have breached certain legal obligations, resulting in a diversion of our time and resources. In addition, job candidates and existing employees often consider the value of the equity awards they receive in connection with their employment. Volatility or lack of performance in our stock price may also affect our ability to attract and retain our key employees. Also, some of our employees have become, or will soon become, vested in a substantial amount of equity awards, which may give them a substantial amount of personal wealth. This may make it more difficult for us to retain and motivate these employees, and this wealth could affect their decision about whether or not they continue to work for us. Any failure to successfully attract, integrate, or retain qualified personnel to fulfill our current or future needs could adversely affect our business, results of operations, and financial condition. In January 2024, we announced a workforce reduction plan intended to reduce operating costs, improve operating margins, and continue advancing our ongoing commitment to profitable growth. The workforce reduction plan is expected to impact approximately 6% of the Company's full-time employees. We expect that the execution of the workforce reduction plan will be substantially complete by the end of the second quarter of 2024, subject to local law and consultation requirements. This workforce reduction plan, or any similar actions taken in the future, could negatively impact our ability to attract, integrate, retain, and motivate key employees. In addition, we believe that our corporate culture has been a critical component to our success and that our culture creates an environment that drives and perpetuates our overall business strategy. As our organization has grown and expanded globally, and as our workplace plans have developed (including, for example, the workforce reduction plan), we may find it increasingly difficult to maintain the beneficial aspects of our corporate culture and effectively manage our global, hybrid workforce. Over time, our hybrid work model may decrease the cohesiveness of our teams and our ability to maintain our culture, both of which are critical to our success. Any failure to preserve our culture could negatively affect our future success, including our ability to recruit and retain personnel and effectively focus on and pursue our business strategy.

We are not party to any exclusive agreements or arrangements with Apple. Accordingly, while we believe our market opportunity expands as organizations increasingly adopt Apple technologies, the continued success and growth of our business is ultimately dependent upon our ability to compete effectively by reaching new customers, cross-selling to existing customers, and maintaining our position as the standard for Apple in the enterprise. As a result, even if organizations' adoption of Apple technologies continues to increase, if we are not able to compete successfully, our business, results of operations, and financial condition could be adversely affected. See "- If we fail to maintain, enhance, or protect our brand, our ability to expand our customer base will be impaired and our business, financial condition, and results of operations may suffer" and "- We are in a highly competitive market, and competitive pressures from existing and new companies, including as a result of consolidation in our market, may harm our business, revenue, growth rates, and market share."