Airspan Networks Holdings (MIMOQ) Risk Analysis

We are at risk for interruptions, outages and breaches of: operational systems, including business, financial, accounting, product development, data processing or production processes, owned by us or our third-party vendors or suppliers; facility security systems, owned by us or our third-party vendors or suppliers; in-product technology owned by us or our third-party vendors or suppliers; the integrated software in our products; or customer data that we process or our third-party vendors or suppliers process on our behalf. Such cyber incidents have previously and in the future could materially disrupt operational systems; result in loss of intellectual property, trade secrets or other proprietary or competitively sensitive information; compromise certain information of customers, employees, suppliers, drivers or others; jeopardize the security of our facilities; or affect the performance of in-product technology and the integrated software in our products. A cyber incident could be caused by disasters, insiders (through inadvertence or with malicious intent) or malicious third parties (including nation-states or nation-state supported actors) using sophisticated, targeted methods to circumvent firewalls, encryption and other security defenses, including hacking, fraud, trickery or other forms of deception. The techniques used by cyber attackers change frequently and may be difficult to detect for long periods of time. Although we maintain information technology measures designed to protect ourselves against intellectual property theft, data breaches and other cyber incidents, such measures have not successfully detected or prevented all previous cyber incidents and will require updates and improvements, and we cannot guarantee that such measures will be adequate to detect, prevent or mitigate future cyber incidents. For example, in December 2021, we experienced a ransomware incident that impacted the availability of certain systems within our computer network. In response to this incident, we secured digital assets within our computer systems, immediately commenced an investigation with assistance from an outside cybersecurity firm and were able to successfully restore our systems, without paying a ransom, after working to get the systems back up as quickly as possible. Despite these actions, we experienced some delays and disruptions to our business, primarily with respect to employee access to business applications and e-mail service. In addition, in January 2022, we experienced a denial- of-service attack on our e-mail service. We were able to restore e-mail service after working to do so as quickly as possible. In connection with these incidents, we have incurred certain incremental one-time costs of $0.1 million related to consultants, experts and data recovery efforts, net of insurance recoveries, and expect to incur additional costs related to cybersecurity protections in the future. Although we have not been the subject of any legal proceedings involving these incidents, it is possible that we could be the subject of claims from persons alleging that they suffered damages from these incidents. We also are in the process of implementing a variety of measures to further enhance our cybersecurity protections and minimize the impact of any future attack. However, cyber threats are constantly evolving, and there can be no guarantee that a future cyber event will not occur. In addition, the implementation, maintenance, segregation and improvement of these systems requires significant management time, support and cost. Moreover, there are inherent risks associated with developing, improving, expanding and updating current systems, including the disruption of our data management, procurement, production execution, finance, supply chain and sales and service processes. These risks may affect our ability to manage our data and inventory, procure parts or supplies or produce, sell, deliver and service our products, adequately protect our intellectual property or achieve and maintain compliance with, or realize available benefits under, applicable laws, regulations and contracts. We cannot be sure that the systems upon which we rely, including those of our third-party vendors or suppliers, will be effectively implemented, maintained or expanded as planned. If we do not successfully implement, maintain or expand these systems as planned, our operations may be disrupted, our ability to accurately and timely report our financial results could be impaired, and deficiencies may arise in our internal control over financial reporting, which may impact our ability to certify our financial results. Moreover, our proprietary information or intellectual property has previously and in the future could be compromised or misappropriated and our reputation may be adversely affected. For example, through our investigation of the December 2021 incident referenced above, we discovered that the individuals responsible for this incident acquired certain files from our servers. If our systems do not operate as we expect them to, we have previously been and may in the future be required to expend significant resources to make corrections or find alternative sources for performing these functions. A significant cyber incident could harm our reputation, cause us to breach our contracts with other parties or subject us to regulatory actions or litigation, any of which could materially affect our business, prospects, financial condition and operating results. In addition, our insurance coverage for cyber-attacks may not be sufficient to cover all the losses we may experience as a result of a cyber-incident.