Telos (TLS) Risk Analysis

We are subject to the reporting requirements of the Exchange Act, the Sarbanes-Oxley Act of 2002 ("Sarbanes-Oxley Act"), the rules and regulations of Nasdaq, and other securities rules and regulations that impose various requirements on public companies. Our management and other personnel devote substantial time and resources to comply with these rules and regulations. Such compliance has increased, and will continue to increase, our legal, accounting and financial compliance costs, makes some activities more difficult, time-consuming and costly, and places significant strain on our personnel, systems and resources. The Sarbanes-Oxley Act requires, among other things, that we maintain effective disclosure controls and procedures and internal control over financial reporting, and to report any material weaknesses in such internal control. In fiscal year ended 2022, management identified a material weakness related to ineffective design and maintenance of controls over the assessment of the accounting for forfeitures of non-standard equity awards. While the identified material weakness has been remediated in fiscal year 2023, we cannot provide assurance that we will not identify additional material weaknesses in future periods or that we will be successful in remediating any future significant deficiencies or material weaknesses in internal control over financial reporting. We are continuing to develop and refine our disclosure controls, internal control over financial reporting and other procedures that are designed to ensure information required to be disclosed by us in our consolidated financial statements and in the reports that we file with the SEC is recorded, processed, summarized and reported within the time periods specified in SEC rules and forms, and information required to be disclosed in reports under the Exchange Act is accumulated and communicated to our principal executive and financial officers. Our current controls and any new controls we develop may become inadequate because of changes in conditions in our business. Additionally, to the extent we acquire other businesses, the acquired company may not have a sufficiently robust system of internal controls and we may uncover new deficiencies. Weaknesses in our internal controls may be discovered in the future. Any failure to develop or maintain effective controls, or any difficulties encountered in their implementation or improvement, could harm our results of operations, may result in a restatement of our consolidated financial statements for prior periods, could cause us to fail to meet our reporting obligations, and could result in an adverse opinion regarding our internal control over financial reporting from our independent registered public accounting firm, and lead to investigations or sanctions by regulatory authorities. Any failure to maintain effective disclosure controls and internal control over financial reporting could have a material and adverse effect on our business and results of operations and could cause a decline in the price of our stock. Section 404 of the Sarbanes-Oxley Act requires our management to certify financial and other information in our quarterly and annual reports and provide an annual management report on the effectiveness of our internal control over financial reporting. We are also required to have our independent registered public accounting firm attest to, and issue an opinion on, the effectiveness of our internal control over financial reporting. If we are unable to assert that our internal control over financial reporting is effective, or if, when required, our independent registered public accounting firm is unable to express an opinion on the effectiveness of our internal control over financial reporting, we could lose investor confidence in the accuracy and completeness of our financial reports, which would cause the price of our common stock to decline.

To increase our revenue, and achieve and maintain profitability, we plan to expand our operations in new commercial markets, including those where we may have limited operating experience, and may be subject to increased business, technology and economic risks that could affect our financial results. In the future, we may increasingly focus on commercial customers, including in the banking, financial services, healthcare, manufacturing, telecommunication, airlines and aerospace, insurance, retail, transportation, shipping and logistics, and energy industries, as well as other critical infrastructure industries. Entering new verticals and expanding in the verticals in which we are already operating will continue to require significant resources and there is no guarantee that such efforts will be successful or beneficial to us. Although sales to a new customer have often led to additional sales to the same customer or similarly situated customers, it is uncertain we will achieve the same penetration and organic growth in the future, and our reputation, business, financial condition, and results of operations could be negatively impacted. As we expand into and within new and emerging markets and heavily regulated industry verticals, we will likely face additional regulatory scrutiny, risks, and burdens from the governments and agencies which regulate those markets and industries.

Our ability to increase revenue from existing customers and attract new customers will depend, in part, on our ability to anticipate and respond effectively to rapid technological changes and market developments. Virtually all of the products we produce and sell are highly engineered and require sophisticated manufacturing and system integration techniques and capabilities. The government market in which we primarily operate is characterized by rapidly changing technologies. The product or program needs of our government and commercial customers change and evolve regularly. Accordingly, our future performance in part depends on our ability to identify emerging technological trends, develop and manufacture competitive products, and bring those products to market quickly at cost-effective prices. If we fail to effectively anticipate, identify and respond to those changes in a timely manner, our business could be negatively impacted. Likewise, if we are unable to develop new products that meet customers' changing needs, future sales and earnings may be adversely affected.

We rely on the technology, infrastructure, and software applications of certain third parties in order to host or operate some of certain key platform features or functions of our business. Additionally, we rely on third-party computer hardware and cloud capabilities in order to deliver our solutions and services. Our business is dependent on the integrity, security and efficient operation of this technology and infrastructure, and we do not necessarily control the operation or data security of the third-parties we utilize. If any of these third-party services experience errors, disruptions, security issues, or other performance deficiencies; if they are updated such that our solutions become incompatible; if these services, software, or hardware fails or becomes unavailable due to extended outages, interruptions, defects, or otherwise; or if they are no longer available on commercially reasonable terms or prices (or at all), these issues could result in errors or defects in our solutions, failure of our solutions to perform, decline in our revenue and margins, damage to our reputation and brand, exposure to legal or contractual liability, increase in our expenses, and interruption in our ability to manage our operations. In addition, our processes for managing our sales and servicing our customers could be impaired until equivalent services or technology, if available, are identified, procured, and implemented, all of which may take significant time and resources, increase our costs, and could adversely affect our business. Many of these third-party providers attempt to impose limitations on their liability for such errors, disruptions, defects, performance deficiencies, or failures, and if enforceable, we may have additional liability to our customers or third-party providers. Furthermore, our solutions are, in many cases, important or essential to our customers' operations, including in some cases, their cybersecurity or oversight and compliance programs, and subject to service level agreements. Any interruption in our service, whether as a result of an internal or third-party issue, could damage our brand and reputation, cause our customers to terminate or not renew their contracts with us or decrease the use of our solutions and services, require us to indemnify our customers against certain losses, result in our issuing credit or paying penalties or fines, subject us to other losses or liabilities, cause our solutions to be perceived as unreliable or unsecure, and prevent us from gaining new or additional business from current or future customers, any of which could harm our business, financial condition, and results of operations. Moreover, to the extent that we do not effectively address capacity constraints, upgrade our systems as needed, and continually develop our technology and network architecture to accommodate actual and anticipated changes in technology, our business, financial condition, and results of operations could be adversely affected. The provisioning of additional cloud hosting capacity requires lead time. These third parties have no obligation to renew their agreements with us on commercially reasonable terms, or at all. If these third parties increase pricing terms, terminate or seek to terminate our contractual relationship, establish more favorable relationships with our competitors, or change or interpret their terms of service or policies in a manner that is unfavorable with respect to us, we may be required to transfer to other cloud providers or invest in a private cloud. In that case, we could incur significant costs and experience possible service interruption in connection with doing so, or risk loss of customer contracts if they are unwilling to accept such a change. A failure to maintain our relationships with our third-party providers (or obtain adequate replacements), and to receive services from such providers that do not contain any material errors or defects, could adversely affect our ability to deliver effective products and solutions to our customers and adversely affect our business and results of operations.

We are subject to a variety of local, state, national, and international laws and directives and regulations in the United States and abroad that involve matters central to our business, including privacy and data protection, data security, data storage, retention, transfer and deletion, technology protection, and personal information. Foreign data protection, data security, privacy, and other laws and regulations can impose different obligations or be more restrictive than those in the United States. These U.S. federal and state and foreign laws and regulations, which, depending on the regime, may be enforced by private parties or government entities, are constantly evolving and can be subject to significant change, and they are likely to remain uncertain for the foreseeable future. In addition, the application, interpretation, and enforcement of these laws and regulations are often uncertain, and may be interpreted and applied inconsistently from country to country and inconsistently with our current policies and practices. A number of proposals are pending before U.S. federal, state, and foreign legislative and regulatory bodies that could significantly affect our business. The overarching complexity of privacy and data protection laws and regulations around the world pose a compliance challenge that could manifest in costs, damages, or liability in other forms as a result of failure to implement proper programmatic controls, failure to adhere to those controls, or the malicious or inadvertent breach of applicable privacy and data protection requirements by us, our employees, our business partners, or our customers. In addition to government regulation, self-regulatory standards and other industry standards may legally or contractually apply to us, be argued to apply to us, or we may elect to comply with such standards or to facilitate our customers' compliance with such standards. Because privacy, data protection, and information security are critical competitive factors in our industry, we may make statements on our website, in marketing materials, or in other settings about our data security measures and our compliance with, or our ability to facilitate our customers' compliance with, these standards. We also expect that there will continue to be new proposed laws and regulations concerning privacy, data protection, and information security, and we cannot yet determine the impact such future laws, regulations and standards, or amendments to or re-interpretations of existing laws and regulations, industry standards, or other obligations may have on our business. New laws, amendments to or re-interpretations of existing laws and regulations, industry standards, and contractual and other obligations may require us to incur additional costs and restrict our business operations. As these legal regimes relating to privacy, data protection, and information security continue to evolve, they may result in ever-increasing public scrutiny and escalating levels of enforcement and sanctions. Furthermore, because the interpretation and application of laws, standards, contractual obligations and other obligations relating to privacy, data protection, and information security are uncertain, these laws, standards, and contractual and other obligations may be interpreted and applied in a manner that is, or is alleged to be, inconsistent with our data management practices, our policies or procedures, or the features of our solutions. If so, in addition to the possibility of fines, lawsuits, and other claims, we could be required to fundamentally change our business activities and practices or modify our solutions, which could have an adverse effect on our business. We may be unable to make such changes and modifications in a commercially reasonable manner or at all, and our ability to fulfill existing obligations, make enhancements, or develop new solutions and features could be limited. Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations, and policies that are applicable to the businesses of our customers may limit the use and adoption of, and reduce the overall demand for, our solutions. These existing and proposed laws and regulations can be costly to comply with and can make our solutions and services less effective or valuable, delay or impede the development of new products, result in negative publicity, increase our operating costs, require us to modify our data handling practices, limit our operations, impose substantial fines and penalties, require significant management time and attention, or put our data or technology at risk. Any failure or perceived failure by us or our solutions to comply with U.S. or applicable foreign laws, regulations, directives, policies, industry standards, or legal obligations relating to privacy, data protection, or information security, or any security incident that results in loss of or the unauthorized access to, or acquisition, use, release, or transfer of, personal information, personal data, or other customer or sensitive data or information may result in governmental investigations, inquiries, enforcement actions and prosecutions, private claims and litigation, indemnification or other contractual obligations, other remedies, including fines or demands that we modify or cease existing business practices, or adverse publicity, and related costs and liabilities, which could significantly and adversely affect our business and results of operations.

Our customers are substantially U.S. government agencies. The customer relationship with the U.S. government involves certain unique risks. The programs we participate in must compete with other programs and policy imperatives during the budget and appropriations process. If government funding relating to our contracts with the U.S. government becomes unavailable, or is reduced or delayed, or planned orders are reduced, our contracts or subcontracts may be terminated or adjusted by the U.S. government or the prime contractor. Our operating results could also be adversely affected by spending caps or changes in the budgetary priorities of the U.S. government, as well as delays in program starts or the award of contracts or task orders under contracts. In recent years, U.S. government appropriations have been affected by larger U.S. government budgetary issues and related legislation. As a result, DoD funding levels have fluctuated and have been difficult to predict. Future spending levels are subject to a wide range of factors, including Congressional action. In addition, over the last few years, the U.S. government has been unable to complete its budget process before the end of its fiscal year, resulting in both a government shutdown and continuing resolutions to extend sufficient funds only for U.S. government agencies to continue operating. Not long ago, the federal government was shut down due to a lack of funding for over one month between late 2018 and early 2019, and currently a series of continuing resolutions have funded the government at fiscal year 2023 levels, with no new starts. Moreover, the national debt threatened to reach the statutory debt ceiling in 2023, and such an event in future years could result in the U.S. government defaulting on its debts. As a result, government spending levels are difficult to predict beyond the near term due to numerous factors, including the external threat environment, future government priorities and the state of government finances. Significant changes in government spending or changes in U.S. government priorities, policies and requirements could have a material adverse effect on our results of operations, financial condition or liquidity.

We rely on subcontractors and other suppliers to provide materials, major components and subsystems for our products or to perform a portion of the services that we provide to our customers. Occasionally, we rely on only one or two sources of supply, which, if disrupted, could have an adverse effect on our ability to meet our commitments to customers. We depend on these subcontractors and suppliers to fulfill their contractual obligations in a timely and satisfactory manner in full compliance with customer requirements. If one or more of our suppliers or subcontractors is unable to satisfactorily provide on a timely basis the agreed-upon supplies or perform the agreed-upon services per its contractual obligations, our ability to perform our obligations as a prime contractor may be adversely affected, and we may be exposed to liability.