Rigetti Computing (RGTI) Risk Analysis

In the ordinary course of our business, we and the third parties upon which we rely, collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process), proprietary, confidential, and sensitive data, including personal data, intellectual property, controlled unclassified information and trade secrets (collectively, sensitive information). Cybersecurity incidents such as malicious internet-based activity, online and offline fraud, denial-of-service attacks, ransomware attacks, business email compromises, computer malware, viruses, and social engineering (including through deep fakes or other attacks using artificial intelligence which may be increasingly more difficult to identify as fake, and phishing attacks) as well as natural disasters and other similar activities threaten the confidentiality, integrity, and availability of our sensitive information and information technology systems, and those of the third parties upon which we rely. Such threats are prevalent in the technology industry and our customers' industries and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer "hackers," threat actors, "hacktivists," organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors. The techniques may be used to sabotage or to obtain unauthorized access to our platform, systems, networks, or physical facilities where our quantum computers are stored, and we may be unable to implement adequate preventative measures or stop cybersecurity incidents from occurring or expanding in scope. U.S. law enforcement agencies have indicated to us that quantum computing technology is of particular interest to certain malicious cyber threat actors, including nation-state-supported actors. In addition, our cybersecurity risk could be increased as a result of the ongoing military conflict between Russia and Ukraine and the related sanctions imposed against Russia. During times of war and other major conflicts, we, the third parties upon which we rely, may be vulnerable to a heightened risk of cybersecurity incidents, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, our third-party information systems, supply chain, and ability to produce, sell and distribute our goods and services. We and the third parties upon which we rely are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, floods, and other similar threats. In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, loss of sensitive data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Remote work has become more common and has increased risks to our information technology systems and data, as more of our employees utilize network connections, computers and devices outside our premises or network, including working at home, while in transit and in public locations. In addition, future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities' systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program. We rely on third-party service providers and technologies to operate critical business systems to process sensitive information in a variety of contexts. Our platform is built to be accessed through third-party public cloud providers such as AWS. These providers may also experience cybersecurity incidents and attacks to their products which may impact our systems. Cybersecurity incidents may also result from non-technical means, such as actions by an employee with access to our systems. Our ability to monitor these third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. If our third-party service providers experience a cybersecurity incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. We may expend significant resources or modify our business activities to try to protect against security incidents. Certain data privacy and security obligations may require us to implement and maintain specific security measures to protect our information technology systems and sensitive information. While we and our third-party cloud providers have implemented security measures designed to protect against cybersecurity incidents, there can be no assurance that these measures will be effective and these measures could fail or may be insufficient. Although we take steps designed to detect, mitigate, and remediate vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties upon which we rely), but we may not be able to detect and remediate all vulnerabilities on a timely basis because the threats and techniques used to exploit the vulnerability change frequently and are often sophisticated in nature. Therefore, such vulnerabilities could be exploited but may not be detected until after a cybersecurity incident has occurred. In addition, applicable data privacy and security obligations may require us to notify relevant stakeholders, including affected individuals, customers, regulators, and investors of cybersecurity incidents. Such disclosures are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences. Actual or perceived cybersecurity incidents affecting sensitive information about the Company, our partners, our customers or third parties could expose us and the parties affected to a risk of loss or misuse of this information, resulting in litigation and potential liability, paying damages, regulatory inquiries or actions, damage to our brand and reputation or other harm to our business. Our efforts to prevent and overcome these challenges could increase our expenses and may not be successful. If we fail to detect or remediate a cybersecurity incident in a timely manner, or it otherwise affects our customers or impacts our ability to operate our platform, we may experience adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; material damage to our reputation; monetary fund diversions; diversions of management attention; interruptions in our operations (including availability of data); financial loss; and other similar harms. Cybersecurity incidents and attendant consequences may cause customers to stop using our services, deter new customers from using our services, and negatively impact our ability to grow and operate our business. Cybersecurity incidents also may result in current or future competitors obtaining sensitive information, including proprietary information. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims. In addition to experiencing a cybersecurity incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveal competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position.

We are subject to numerous federal, state and local environmental laws and regulations governing, among other things, solid and hazardous waste storage, treatment and disposal, and remediation of releases of hazardous materials. There are significant capital, operating and other costs associated with compliance with these environmental laws and regulations. Environmental laws and regulations may become more stringent in the future, which could increase costs of compliance or require us to manufacture with alternative technologies and materials. Federal, state and local authorities also regulate a variety of matters, including, but not limited to, health, safety and permitting in addition to the environmental matters discussed above. New legislation and regulations may require us to make material changes to our operations, resulting in significant increases to the cost of production. Our manufacturing process will have hazards such as but not limited to hazardous materials, machines with moving parts, and high voltage and/or high current electrical systems typical of large manufacturing equipment and related safety incidents. There may be safety incidents that damage machinery or product, slow or stop production, or harm employees. Consequences may include litigation, regulation, fines, increased insurance premiums, mandates to temporarily halt production, workers' compensation claims, or other actions that impact our brand, finances, or ability to operate.

We have received, and may continue to receive, a high degree of media coverage that is published or otherwise disseminated by third parties, including blogs, articles, message boards and social and other media. This includes coverage that is not attributable to statements made by our officers. Information provided by third parties may not be reliable or accurate and could materially impact the trading price of our Common Stock which could cause stockholders to lose their investments.

Our future success is highly dependent on our ability to attract and retain our executive officers, key employees and other qualified personnel. As we build our brand and become more well known, there is an increased risk that competitors or other companies may seek to hire our personnel. The loss of the services provided by these individuals will have an adverse impact on the achievement of our business strategy. These individuals could leave our employment at any time, as they are "at will" employees. A loss of a member of senior management, or an engineer or other key employee particularly to a competitor, could also place us at a competitive disadvantage. Effective succession planning is also important to our long-term success and may cause disruption to our business due to, among other things, diverting management's attention away from the operations of the business or causing a deterioration in morale. Failure to ensure effective transfer of knowledge and smooth transitions involving key employees could hinder our strategic planning and execution. Our future success also depends on our continuing ability to attract, develop, motivate, and retain highly qualified and skilled employees. The market for highly skilled workers and leaders in the quantum computing industry is extremely competitive. In particular, hiring qualified personnel specializing in supply chain management, engineering and sales, as well as other technical staff and research and development personnel is critical to our business and the development of our quantum computing systems. Some of these professionals are hard to find and we may encounter significant competition in our efforts to hire them. Many of the other companies with which we compete for qualified personnel have greater financial and other resources than we do. The effective operation of our supply chain, including the acquisition of critical components and materials, the development and commercialization of our quantum computing technologies and the effective operation of our managerial and operating systems all depend upon our ability to attract, train and retain qualified personnel in the aforementioned specialties. Additionally, changes in immigration and work permit laws and regulations or the administration or interpretation of such laws or regulations could impair our ability to attract and retain highly qualified employees. If we cannot attract, train and retain qualified personnel in this competitive environment, we may experience delays in the development of our quantum computing technologies and otherwise be unable to develop and grow our business as projected, or even at all.

We currently maintain offices and have personnel in the United States, the United Kingdom, Australia and Canada. In the years ended December 31, 2024 and December 31, 2023, our non-U.S. revenue was approximately 41.4% and 7.6% of our total revenue, respectively. Depending on customer opportunities and our ability to access quantum engineering talent, we may continue to expand our international operations, which may include opening offices in new jurisdictions. Any additional international expansion efforts that we are undertaking and may undertake may not be successful. In addition, conducting international operations subjects us to new risks, some of which we have not generally faced in the United States or other countries where we currently operate. These risks include, among other things: - unexpected costs and errors in the localization of our platform and solutions, including translation into foreign languages and adaptation for local culture, practices and regulatory requirements;- lack of familiarity and burdens of complying with foreign laws, legal standards, privacy and cybersecurity standards, regulatory requirements, foreign export control rules, tariffs and other barriers, and the risk of penalties to our customers and individual members of management or employees if our practices are deemed to not be in compliance;- practical difficulties of enforcing intellectual property rights in countries with varying laws and standards and reduced or varied protection for intellectual property rights in some countries;- an evolving legal framework and additional legal or regulatory requirements for data privacy and cybersecurity, which may necessitate the establishment of systems to maintain data in local markets, requiring us to invest in additional data centers and network infrastructure, and the implementation of additional employee data privacy documentation (including locally-compliant data privacy notice and policies), all of which may involve substantial expense and may cause us to need to divert resources from other aspects of our business, all of which may adversely affect our business;- unexpected changes in regulatory requirements, taxes, trade laws, tariffs, export quotas, custom duties or other trade restrictions;- difficulties in managing systems integrators and technology partners;- differing technology standards;- different pricing environments, longer sales cycles, longer accounts receivable payment cycles and difficulties in collecting accounts receivable;- increased financial accounting and reporting burdens and complexities;- difficulties in managing and staffing international operations including the proper classification of independent contractors and other contingent workers, differing employer/employee relationships and local employment laws;- increased costs involved with recruiting and retaining an expanded employee population outside the United States through cash and equity-based incentive programs and unexpected legal costs and regulatory restrictions in issuing our shares to employees outside the United States;- global political and regulatory changes that may lead to restrictions on immigration and travel for our employees;- fluctuations in exchange rates that may decrease the value of foreign-based revenue;- potentially adverse tax consequences, including the complexities of foreign value added tax (or other tax) systems, restrictions on the repatriation of earnings, and transfer pricing requirements; and - permanent establishment risks and complexities in connection with international payroll, tax and social security requirements for international employees. Additionally, operating in international markets also requires significant management attention and financial resources. We cannot be certain that the investment and additional resources required in establishing operations in other countries will produce desired levels of revenue or profitability. Compliance with laws and regulations applicable to our global operations also substantially increases the cost of doing business in foreign jurisdictions. We have limited experience in marketing, selling and supporting our platform outside of the United States. Our limited experience in operating our business internationally increases the risk that any potential future expansion efforts that we may undertake will not be successful. If we invest substantial time and resources to expand our international operations and are unable to do so successfully and in a timely manner, our business, financial condition, revenues, results of operations or cash flows will suffer. We may be unable to keep current with changes in government requirements as they change from time to time. Failure to comply with these regulations could harm our business. In many countries, it is common for others to engage in business practices that are prohibited by our internal policies and procedures or other regulations applicable to us. Although we have implemented policies and procedures designed to ensure compliance with these laws and policies, there can be no assurance that all of our employees, contractors, partners and agents will comply with these laws and policies. Violations of laws or key control policies by our employees, contractors, partners or agents could result in delays in revenue recognition, financial reporting misstatements, enforcement actions, reputational harm, disgorgement of profits, fines, civil and criminal penalties, damages, injunctions, other collateral consequences or the prohibition of the importation or exportation of our solutions and could harm our business, financial condition, revenues, results of operations or cash flows.

Our facilities or operations could be adversely affected by power outages as well as events outside of our control, such as natural disasters and other calamities. We cannot assure you that any backup systems will be adequate to protect us from the effects of fire, floods, typhoons, earthquakes, power loss resulting from such natural disasters, telecommunications failures, break-ins, war, riots, terrorist attacks or similar events. Any of the foregoing events may give rise to interruptions, breakdowns, system failures, technology platform failures or internet failures, which could cause delays in development and fabrication, the loss or corruption of data or malfunctions of software or hardware as well as adversely affect our ability to provide services. A significant power outage may disrupt our operations and could have a material adverse impact on our business, financial condition, results of operations and cash flows.