Item 1A. Risk Factors .
Our business, financial condition, operating results, and cash flows may be impacted by a number of factors, many of which are beyond our control, including those set forth below and elsewhere in this 2025 Form 10-K, the occurrence of any one of which could have a material adverse effect on our actual results.
Cybersecurity and Technology Risks
Our products and services are highly technical and if they contain undetected errors, our business could be adversely affected and we may have to defend lawsuits or pay damages in connection with any alleged or actual failure of our products and services.
Our products and services are highly technical and complex. Our products and services have contained and may contain one or more undetected errors, defects, or security vulnerabilities. Some errors in our products and services may only be discovered after a product or service has been used by end customers. Any errors or security vulnerabilities discovered in our products after commercial release could result in loss of revenue or delay in revenue recognition, or loss of customers, any of which could adversely affect our business and results of operations. In addition, we could face claims for product liability or breach of personal information. Defending a lawsuit, regardless of its merit, is costly and may divert management’s attention. In addition, if our business liability insurance coverage is inadequate or future coverage is unavailable on acceptable terms or at all, our financial condition could be harmed.
If we fail to respond to rapid technological changes in the data and analytics sector, we may lose customers and/or our products and/or services may become obsolete.
The data and analytics sector is characterized by rapidly changing technology, frequent product introductions, and continued evolution of new industry standards. As a result, our success depends upon our ability to develop and introduce in a timely manner new products and services and enhancements to existing products and services that meet changing customer requirements and evolving industry standards. The development of technologically advanced product solutions is a complex and uncertain process requiring high levels of innovation, rapid response and accurate anticipation of technological and market trends. We cannot assure you that we will be able to identify, develop, manufacture, market, or support new or enhanced products and services successfully in a timely manner. Further, we or our competitors may introduce new products or services or product enhancements that shorten the life cycle of existing products or services or cause existing products or services to become obsolete.
Because our networks and information technology systems are critical to our success, if unauthorized persons access our systems or our systems otherwise cease to function properly, our operations could be adversely affected and we could lose revenue or proprietary information, all of which could materially adversely affect our business .
As our business is conducted largely online, it is dependent on our networks being accessible and secure. If an actual or perceived breach of network security occurs, regardless of whether the breach is attributable to our network security controls, the market perception of the effectiveness of our network security could be harmed resulting in loss of current and potential end user customers, data suppliers, or cause us to lose potential value-added resellers, distributors, or strategic partners. Our business is largely dependent on our customer-facing websites and our websites may be inaccessible because of service interruptions or subject to hacking or computer attacks. Because the techniques used by computer hackers to access or sabotage networks change frequently and generally are not recognized until launched against a target, we may be unable to anticipate these techniques. If an actual or perceived breach were to occur, we cannot you that we would not revenue or not sustain operating as a result.
We also rely heavily on large information technology databases and the ability to provide services using that information from those databases. A party who is able to breach the security measures on our networks or who otherwise is able to access our system through unauthorized means could misappropriate either our proprietary information or the personal information of consumers that we collect, or otherwise cause interruptions or malfunctions to our operations. Hacking of computer data systems is a growing problem. Hackers may especially target concerns that are known to maintain large repositories of proprietary information or personal information, which can then be exploited for the hacker's personal gain. If we grow and obtain more visibility, we may be more vulnerable to hacking or other attempts to gain access to our system. Moreover, the increased use of mobile devices also increases the risk of theft or the and disclosure of data including proprietary information or personal information. We may be to anticipate all of these and implement adequate preventative measures and, in some cases, we may not be to immediately detect a security . Any security could result in legal, regulatory, and financial liability, as well as to our reputation.
We may be required to expend significant capital and other resources to protect against such threats or to alleviate problems caused by breaches in security. Additionally, any server interruptions, break-downs or system failures, including failures which may be attributable to events within or outside our control, could increase our future operating costs and cause us to lose business. We maintain insurance policies covering losses relating to our network systems or other assets. However, these policies may not cover the entire cost of a claim. Any future disruptions in our information technology systems, whether caused by hacking or otherwise, may have a material adverse effect on our future results.
Privacy concerns relating to the collection, use, accuracy, correction and sharing of personal information and any perceived or actual unauthorized disclosure of personal information, whether through breach of our network by an unauthorized party, employee theft, misuse, or error could harm our reputation, impair our ability to attract website visitors and to attract and retain customers, result in a loss of confidence in the security of our products and services, or subject us to claims or litigation arising from damages suffered by consumers, and thereby harm our business and results of operations. In addition, we could incur significant costs which our insurance policies may not cover, and we may need to expend significant resources to protect security , comply with any data notification provisions contained in our customer contracts, and comply with the multitude of state and federal laws regarding data privacy and data notification obligations.
Data security and integrity are critically important to our business, and breaches of security, unauthorized access to or disclosure of confidential information, disruption, including distributed denial of service (“DDoS”) attacks or the perception that confidential information is not secure, could result in a material loss of business, substantial legal liability or significant harm to our reputation.
As a nationwide provider of risk and information solutions, we aggregate, store, and process a large amount of sensitive and confidential consumer information including financial information and personal information. This data is often accessed through secure transmissions over public and private networks, including the internet. We have invested significant resources to implement technical and physical security policies, procedures and systems, as well as contractual precautions, that we believe are reasonably designed to identify, detect, and prevent the unauthorized access to and alteration and disclosure of our data. Despite these investments and precautions, we cannot assure you that systems that access our services and databases will not be compromised or disrupted, whether as a result of criminal conduct, DDoS attacks or other advanced persistent attacks by malicious actors, including hackers, nation states, and criminals, breaches due to employee error or malfeasance, or other during the process of upgrading or replacing computer software or hardware, power , computer viruses, telecommunication or utility , or natural or other events. Due to both the nature and volume of the information we aggregate, store, and process, it is not unusual for efforts to occur (coordinated or otherwise) by persons to attempt to obtain access to our systems or data, or to inhibit our ability to deliver products or services to a customer. These efforts are likely becoming more sophisticated over time and may attempt to obscure . We must regularly monitor and develop our information technology networks and infrastructure to prevent, detect, address, and mitigate the risk of access, , computer viruses and other events that could have a security impact. disclosure, or of our data or of our customers to access our systems could our operations, subject us to substantial legal liability, result in a material of business, and significantly our reputation.
Our precautions may be inadequate to thwart a cybersecurity incident. Furthermore, we may not be able to immediately address the consequences of a cybersecurity incident because a successful breach of our computer systems, software, networks, or other technology assets could occur and persist for an extended period of time before being detected due to, among other things:
the breadth and complexity of our operations and the high volume of transactions that we process;
the large number of customers, counterparties and third-party service providers with which we do business;
the proliferation and increasing sophistication of cyberattacks; and
the possibility that a third party, after establishing a foothold on an internal network without being detected, might obtain access to other networks and systems.
The extent of a particular cybersecurity incident and the steps that we may need to take to investigate it may not be immediately clear, and it may take a significant amount of time before such an investigation can be completed and full and reliable information about the incident is known. While such an investigation is ongoing, we may not necessarily know the extent of the harm or how best to remediate it, and certain errors or actions could be repeated or compounded before they are discovered and remediated, any or all of which could further increase the costs and consequences of a cybersecurity incident.
A growing number of legislative and regulatory bodies have adopted consumer notification and other requirements in the event that a consumer's personal information is accessed by unauthorized persons. It is likely that additional laws pertaining to the use, access, accuracy, and security of personal information will be adopted in the future. In the United States, federal and state laws provide for more than 50 disparate data breach notification regimes, all of which we may be subject to. Complying with such numerous and complex regulations in the event of unauthorized access would be expensive and difficult, and failure to comply with these regulations could subject us to regulatory scrutiny and additional liability.
If we fail to maintain and improve our systems, our certifications, our technology, and our interfaces with data and customers, demand for our services could be adversely affected.
In our industry, there are continuous improvements in computer hardware, network operating systems, programming tools, programming languages, operating systems, data matching, data filtering and other database technologies, as well as the use of the internet and emerging technologies, such as but not limited to, artificial intelligence. These improvements, as well as changes in customer preferences or regulatory requirements, may require changes in the technology used to gather and process our data and deliver our services. Our future success will depend, in part, upon our ability to:
internally develop and implement new and competitive technologies;
use leading third-party technologies effectively;
respond to changing customer needs and regulatory requirements, including being able to bring our new products to the market quickly; and
transition customers and data sources successfully to new interfaces or other technologies.
We cannot provide assurance that we will successfully implement new technologies, cause customers or data suppliers to implement compatible technologies, or adapt our technology to evolving customer, regulatory, and competitive requirements. If we fail to respond, or fail to cause our customers or data suppliers to respond, to changes in technology, regulatory requirements or customer preferences, the demand for our services, the delivery of our services or our market reputation could be adversely affected. Additionally, our failure to implement important updates could affect our ability to successfully meet the timeline for us to generate cost savings resulting from our investments in improved technology. Failure to achieve any of these objectives would impede our ability to deliver strong financial results.
Furthermore, we may be required to obtain various industry or technical certifications under our contracts or otherwise to keep pace with our competitors. If we fail to achieve and maintain these key industry or technical certifications, our customers may stop doing business with us and we may not be able to win new business, which would negatively affect our revenue.
Issues in the development and use of artificial intelligence and generative artificial intelligence may result in reputational harm, liability, or other adverse consequences to our business.
We use certain machine learning and artificial intelligence technologies and processes in our business, including the use of generative artificial intelligence, and we are making continuing investments in this area, including ongoing deployment and improvement of existing machine learning and artificial intelligence technologies. These AI-enabled technologies and processes are complex and continually evolving, and we face significant competition from other companies. Also, certain laws and regulations have been enacted related to the development and use of these technologies, and more are likely to be enacted in the future. Adapting our existing policies and controls to address the evolving legal and regulatory landscape may be costly and time consuming. In addition, the application, interpretation, and enforcement of these laws and regulations are often uncertain, particularly in the new and rapidly evolving industry in which we operate, and may be interpreted and applied inconsistently from jurisdiction to jurisdiction and inconsistently with our current policies and practices. Increasing our utilization of machine learning and artificial intelligence technologies within existing products or introducing them into new products may result in increased risks, such as the risk of government scrutiny, lawsuits, security risks, or other issues that could affect our business, our reputation, and/or our financial results.
Also, artificial intelligence and generative artificial intelligence may create content that appears correct but is flawed or erroneous. Any flaws or errors discovered in our products after commercial release could result in loss of revenue or delay in revenue recognition, or loss of customers, any of which could adversely affect our business and results of operations. In addition, we could face claims for product liability. Defending a lawsuit, regardless of its merit, is costly and may divert management’s attention. In addition, if our business liability insurance coverage is inadequate or future coverage is unavailable on acceptable terms or at all, our financial condition could be harmed.
Computer hackers and others routinely attack the security of technology products, services, systems and networks using a wide variety of methods, and the increased use of generative artificial intelligence may introduce novel methods of attack. In the event of such actions, we, our customers and other third parties could be exposed to liability, litigation, and regulatory or other government action, including debarment, as well as the loss of existing or potential customers, damage to brand and reputation, damage to our competitive position, and other financial loss.
Legal, Regulatory and Compliance Risks
Our business is subject to various governmental regulations, laws, and orders, compliance with which may cause us to incur significant expenses or reduce the availability or effectiveness of our solutions, and the failure to comply with which could subject us to civil or criminal penalties or other liabilities.
Our business is subject to regulation under the GLBA, the DPPA, the FTC Act, and various other federal, state, and local laws and regulations, as well as, when we provide services to government agencies, applicable government procurement regulations and associated contract clauses. These laws and regulations, which generally are designed to protect consumers and to prevent the misuse of personal information are complex, change frequently, and have tended to become more stringent over time. We have already incurred significant expenses in our endeavors to comply with these laws.
Currently, public concern is high with regard to the collection, use, accuracy, correction, and sharing of personal information, including Social Security numbers, dates of birth, financial information, department of motor vehicle data, and other data which is personally identifiable or may be considered sensitive. In addition, many advocacy groups as well as some legislatures and government regulators believe that existing laws and regulations do not adequately protect privacy, and are otherwise concerned with businesses’ collection, storage, and use of personal information. There are calls to limit the availability of data made available for customer use cases that we may currently serve, such as for marketing purposes or for law enforcement purposes. Relatedly, several U.S. states have introduced and passed legislation to provide consumers with greater transparency and control over their personal information. Laws may allow consumers to request that businesses disclose to them what personal information is collected about them, delete or correct such personal information, and opt-them out of the sale or sharing of their personal information. There are approximately 20 states that have enacted some form of comprehensive data privacy legislation similar to the California Consumer Privacy Act and/or the Virginia Consumer Data Protection Act. While these laws include specific exemptions, including exemptions for practices and activities conducted pursuant to the GLBA and DPPA, they apply to other portions of our business that are not conducted pursuant to these laws. California has recently enacted the Delete Act, intending to make it for consumers to request the deletion of their personal information. Other states are actively considering privacy and security bills, and may pass laws, either similar or dissimilar to existing state privacy laws in the future.
These U.S. federal and state laws and regulations, which can be enforced by government entities or, in some cases, private parties, are constantly evolving and can be subject to significant change. Keeping our business in compliance with or bringing our business into compliance with new laws may be costly and may affect our revenue and/or harm our financial results. In addition, the application, interpretation, and enforcement of these laws and regulations are often uncertain, particularly in the new and rapidly evolving industry in which we operate, and may be interpreted and applied inconsistently from jurisdiction to jurisdiction and inconsistently with our current policies and practices. In addition, new laws or regulations or changes in enforcement of existing laws or regulations applicable to our customers could affect the activities or strategies of such customers and, therefore, lead to reductions in their level of business with us.
The following legal and regulatory developments also could have a material adverse effect on our business, financial condition, or results of operations:
amendment, enactment or interpretation of laws and regulations that restrict the access and use of personal information and reduce the availability or effectiveness of our solutions or the supply of data available to customers;
changes in public perception or the position of government actors in favor of further restrictions on information collection and sharing, which may lead to regulations that prevent full utilization of our solutions;
failure of customers, resellers, distributors, strategic business partners, or vendors to comply with laws or regulations, where these third parties' failures could reflect negatively on us or require us to cease or limit our business with them;
failure of our solutions to comply with current laws and regulations; and
failure of our solutions to adapt to changes in the regulatory environment in an efficient, cost-effective manner.
Changes in applicable legislation or regulations that restrict or dictate how we collect, maintain, combine, and disseminate information could adversely affect our business, financial condition or results of operations. In the future, we may be subject to significant additional expense to ensure continued compliance with applicable laws and regulations and to investigate, defend or remedy actual or alleged violations. Any failure by us to comply with applicable laws or regulations could also result in significant liability to us, including liability to private plaintiffs as a result of individual or class action litigation, or may result in the cessation of our operations or portions of our operations or impositions of fines and restrictions on our ability to carry on or expand our operations. Moreover, our compliance with privacy laws and regulations and our reputation depend in part on our customers’ adherence to privacy laws and regulations and their use of our services in ways consistent with consumer expectations and regulatory requirements. Certain of the laws and regulations governing our business are subject to interpretation by judges, juries, and administrative entities, creating substantial uncertainty for our business. We cannot predict what effect the interpretation of existing or new laws or regulations may have on our business.
The outcome of litigation, inquiries, investigations, examinations, or other legal proceedings in which we are involved, in which we may become involved, or in which our customers or competitors are involved, could subject us to significant monetary damages or restrictions on our ability to do business .
Legal proceedings arise as part of the normal course of our business. These may include actions between us and a current or former employee, actions between us and a current or former customer, individual consumer cases, class action lawsuits and inquiries, investigations, examinations, regulatory proceedings, or other actions brought by federal (e.g., the FTC) or state (e.g., state attorneys general) authorities. The scope and outcome of these proceedings is often difficult to assess or quantify. Plaintiffs in lawsuits may seek recovery of large amounts and the cost to defend such litigation may be significant. There may also be adverse publicity and uncertainty associated with investigations, litigation, and orders (whether pertaining to us, our customers or our competitors) that could decrease customer acceptance of our services or result in material discovery expenses. In addition, a court-ordered injunction or an administrative cease-and-desist order or settlement may require us to modify our business practices or may prohibit conduct that would otherwise be legal and in which our competitors may engage. Many of the technical and complex statutes to which we are subject, including state and federal financial privacy requirements, may provide for civil and and may permit consumers to maintain individual or class action lawsuits us and obtain statutorily prescribed . Additionally, our customers might face similar proceedings, actions, or inquiries which could affect their business and, in turn, our ability to do business with those customers.
While we maintain various insurance policies that we believe provide us with suitable coverage and protection in the event of litigation or other legal proceedings, those policies may contain exclusions or limitations, resulting in some cases in us retaining all or a portion of the risk of loss.
While we do not believe that the outcome of any pending or threatened legal proceeding, investigation, examination, or supervisory activity will have a material adverse effect on our financial position, such events are inherently uncertain and adverse outcomes could result in significant monetary damages, penalties, or injunctive relief against us. Furthermore, we review legal proceedings and claims on an ongoing basis and follow appropriate accounting guidance, including Accounting Standards Codification (“ASC”) 450, “ Contingencies ,” when making accrual and disclosure decisions. We establish accruals for those contingencies where the incurrence of a loss is probable and can be reasonably estimated, and we disclose the amount accrued and the amount of a reasonably possible loss in excess of the amount accrued, if such disclosure is necessary for our financial statements to not be misleading. To estimate whether a contingency should be accrued by a charge to income, we evaluate, among other factors, the degree of probability of an outcome and the ability to make a reasonable estimate of the amount of the . We do not record liabilities when the likelihood that the liability has been incurred is probable, but the amount cannot be reasonably estimated.
Our bylaws designate the Court of Chancery of the State of Delaware as the sole and exclusive forum for certain actions, including derivative actions, which could limit a stockholder’s ability to bring a claim in a judicial forum that it finds favorable for disputes with the Company and its directors, officers, other employees, or the Company's stockholders, and may discourage lawsuits with respect to such claims.
Unless we consent in writing to the selection of an alternative forum, the sole and exclusive forum for (i) any derivative action or proceeding brought against or on behalf of the Company, (ii) any action asserting a claim of breach of a duty owed by any current or former director, officer, other employee or stockholder of the Company to the Company or the Company’s stockholders, (iii) any action asserting a claim arising pursuant to any provision of the Delaware General Corporation Law, (iv) any action as to which the Delaware General Corporation Law confers jurisdiction upon the Court of Chancery in the State of Delaware, or (v) any action asserting a claim governed by the internal affairs doctrine, shall, to the fullest extent permitted by law, be the Court of Chancery in the State of Delaware (or, only if the Court of Chancery in the State of Delaware declines to accept jurisdiction over a particular matter, any state or federal court located within the State of Delaware). However, Section 27 of the Exchange Act creates exclusive federal jurisdiction over all suits brought to enforce any duty or liability created by the Exchange Act or the rules and regulations thereunder, and as such, the exclusive jurisdiction clauses set forth above would not apply to such suits. Furthermore, Section 22 of the Securities Act of 1933, as amended (the "Securities Act") provides for concurrent jurisdiction for federal and state courts over all suits brought to enforce any duty or liability created by the Securities Act or the rules and regulations thereunder, and as such, the jurisdiction clauses set forth above would not apply to such suits.
Although we believe the exclusive forum provision benefits us by providing increased consistency in the application of Delaware law for the specified types of actions and proceedings, this provision may limit a stockholder’s ability to bring a claim in a judicial forum that it finds favorable for disputes with the Company and its directors, officers, or other employees, and may discourage lawsuits with respect to such claims.
Business and Operations Risks
Our future operating results remain uncertain.
We need to generate greater revenue from the sale of our products and services if we are to sustain profitability. If we are unable to generate greater revenue, we may not be able to continue to achieve profitability and generate positive cash flow from operations in the future
We depend, in part, on strategic alliances and joint ventures to grow our business. If we are unable to develop and maintain these strategic alliances and joint ventures, our growth may be adversely affected.
An important focus of our business is to identify business relationships that can enhance our services, enable us to develop solutions that differentiate us from our competitors, drive users to our websites and monetize our data. We have entered into several alliance agreements or license agreements with respect to certain of our datasets and services and may enter into similar agreements in the future. These arrangements may require us to restrict our use of certain of our technologies or datasets among certain customer industries, restrict content on our websites, or grant licenses on terms that ultimately may prove to be unfavorable to us, any of which could adversely affect our business, financial condition or results of operations. Relationships with our alliance agreement partners may include risks due to incomplete information regarding the marketplace and commercial strategies of our partners, and our alliance agreements or other licensing agreements may be the subject of contractual disputes. If we or our alliance agreements’ partners are not in maintaining or commercializing the agreements’ services, such commercial could affect our business.
If we consummate any future acquisitions, we will be subject to the risks inherent in identifying, acquiring, and operating a newly acquired business .
We may, in the future, acquire additional businesses, which we believe could complement or expand our current business or offer growth opportunities. We may experience difficulties in identifying potential acquisition candidates that complement our current business at appropriate prices, or at all. We cannot assure you that our acquisition strategy will be successful. We may spend significant management time and resources in analyzing and negotiating acquisitions or investments that are not consummated. Furthermore, the ongoing process of integrating an acquired business is distracting, time consuming, expensive, and requires continuous optimization and allocation of resources. Additionally, if we use stock as consideration, this would dilute our existing shareholders and if we use cash, this would reduce our liquidity and impact our financial flexibility. We may seek debt financing for particular acquisitions, which may not be available on commercially reasonable terms, or at all. We face the risks associated with the business acquisition strategy, including:
the potential disruption of our existing businesses, including the diversion of management attention and the redeployment of resources;
entering new markets or industries in which we have limited prior experience;
our failure in due diligence to identify key issues specific to the businesses we seek to acquire or the industries or other environments in which they operate, or, failure to protect against contingent liabilities arising from those issues;
unforeseen, hidden, or fraudulent liabilities;
our difficulties in integrating, aligning and coordinating organizations which will likely be geographically separated and may involve diverse business operations and corporate cultures;
our difficulties in integrating and retaining key management, sales, research and development, production, and other personnel;
the potential loss of key employees, customers, or distribution partners of the acquired business;
our difficulties in incorporating the acquired business into our organization;
the potential loss of customers, resellers, distributors, strategic business partners, or suppliers;
our difficulties in integrating or expanding information technology systems and other business processes to accommodate the acquired business;
the risks associated with integrating financial reporting and internal control systems, including the risk that significant deficiencies or material weaknesses may be identified in acquired entities;
the potential for future impairments of goodwill and other intangible assets if the acquired business does not perform as expected;
the inability to obtain necessary government approvals for the acquisition, if any; and
our successfully operating the acquired business.
If we cannot overcome these challenges, we may not realize actual benefits from past and future acquisitions, which will impair our overall business results. If we complete an investment or acquisition, we may not realize the anticipated benefits from the transaction.
Our relationships with key customers may be materially diminished or terminated, which could adversely affect our business, financial condition, and results of operations.
We have established relationships with a number of customers, many of whom could unilaterally terminate their relationship with us or materially reduce the amount of business they conduct with us at any time. Market competition, customer requirements, customer financial condition, and customer consolidation through mergers or acquisitions also could adversely affect our ability to continue or expand these relationships. There is no guarantee that we will be able to retain or renew existing agreements, maintain relationships with any of our customers on acceptable terms or at all, or collect amounts owed to us from insolvent customers. The loss of one or more of our major customers could adversely affect our business, financial condition and results of operations.
If we lose the services of key personnel, it could adversely affect our business.
Our future success depends, in part, on our ability to attract and retain key personnel. Our future also depends on the continued services of Derek Dubner, our Chief Executive Officer and Chairman, James Reilly, our President, Daniel MacLachlan, our Chief Financial Officer, and other key employees in all areas of our organization, each of whom is important to the management of certain aspects of our business and operations and the development of our strategic direction, and each of whom may be difficult to replace. The loss of the services of these key individuals and the process to replace these individuals would involve significant time and expense and could significantly delay or prevent the achievement of our business objectives.
Further, the FTC and certain other government entities have indicated a desire to limit the allowability of agreements that are designed to prevent employees from competing with their former employers. If the enforceability of these types of “non-compete” agreements is affected by future lawmaking or regulatory action, it may impede our ability to ensure that former employees, who received training and experience through their employment with us, refrain from using their knowledge of our business and operations to compete with us.
Our revenue is concentrated in the U.S. market across a broad range of industries. When these industries or the broader financial markets experience a downturn, demand for our services and revenue may be adversely affected.
Our customers, and therefore our business and revenue, sometimes depend on favorable macroeconomic conditions and are impacted by the availability of credit, the level and volatility of interest rates, inflation, tariffs, employment levels, consumer confidence, and housing demand. In addition, a significant amount of our revenue is concentrated in the U.S. market across a broad range of industries. Our customer base suffers when financial markets experience volatility, illiquidity, and disruption, which has occurred in the past and which could reoccur. Such market developments, and the potential for increased and continuing disruptions going forward, present considerable risks to our business and operations. Changes in the economy have resulted, and may continue to result, in fluctuations in volumes, pricing, and operating margins for our services. The imposition of tariffs by the United States on foreign goods, tensions over the imposition of such tariffs, and (both actual and anticipated) retaliation from other countries may exasperate these issues. This, in turn, may lead to a decline in the volume of services we provide to our customers in the banking or financial industry, or other industries that are affected by these types of . If businesses in these industries experience economic , we cannot you that we will be to generate future revenue growth and these types of could impact our revenue and results of operations.
We could lose our access to data sources which could prevent us from providing our services.
Our products and services depend extensively upon continued access to and receipt of data from external sources, including data received from strategic partners and various government and public record databases. In some cases, we compete with our data suppliers. Our data suppliers could stop providing data, impose more stringent contractual restrictions on our use of data, provide untimely data or increase the costs for their data for a variety of reasons, including a perception that our systems are insecure as a result of a data security breach, budgetary constraints, a desire to generate additional revenue, or for regulatory or competitive reasons. We could also become subject to increased legislative, regulatory, or judicial restrictions or mandates on the collection, disclosure, or use of such data, in particular if such data is not collected by our providers in a way that allows us to legally use the data. If we were to lose access to this external data or if our access or use were restricted or were to become less economical or desirable, our ability to provide services could be negatively impacted, which would adversely affect our reputation, business, financial condition, and results of operations. We cannot provide assurance that we will be in maintaining our relationships with these external data source providers or that we will be to continue to obtain data from them on acceptable terms or at all. Furthermore, we cannot provide assurance that we will be to obtain data from alternative sources if our current sources become .
The foregoing risks are heightened with respect to our largest data supplier, with whom we have expanded our relationship while securing favorable business terms over the years. If we are unable to maintain our current relationship with our largest data supplier, the term of our agreement with which was extended during 2025 through April 30, 2031, our ability to provide services could be negatively impacted, as we would need to secure comparable data on similar terms, which would require significant time, expense, and resources, and may in the short-term adversely affect our reputation, business, financial condition, and results of operations and, if we are unable to establish a similar relationship with other data suppliers over time, could have a long-term material impact on our business and financial condition. Also see “Concentration of Suppliers” above.
We must adequately protect our intellectual property in order to prevent loss of valuable proprietary information.
We rely primarily upon a combination of patent, copyright, trademark, and trade secret laws, as well as other intellectual property laws, and confidentiality procedures and contractual agreements, such as non-disclosure agreements, to protect our proprietary technology. However, unauthorized parties may attempt to copy or reverse engineer aspects of our products or services or to obtain and use information that we regard as proprietary. Policing unauthorized use of our products or services is difficult, and we cannot be certain that the steps we have taken will prevent misappropriation of our intellectual property. If the protection of our intellectual property proves to be inadequate or unenforceable, others may be able to use our proprietary developments without compensation to us, resulting in potential cost advantages to our competitors.
Some of our systems and technologies are not covered by any copyright, patent, or patent application. We cannot guarantee that: (i) our intellectual property rights will provide us with a competitive advantage; (ii) our ability to assert our intellectual property rights against potential competitors or to settle current or future disputes will be effective; (iii) our intellectual property rights will be enforced in jurisdictions where competition may be intense or where legal protection may be weak; (iv) any of the patent, trademark, copyright, trade secret or other intellectual property rights that we presently employ in our business will not lapse or be invalidated, circumvented, challenged, or abandoned; (v) competitors will not design around our protected systems and technology; or (vi) that we will not lose the ability to assert our intellectual property rights against others.
Policing unauthorized use of our proprietary rights can be difficult and costly. Litigation, while it may be necessary to enforce or protect our intellectual property rights, could result in substantial costs and diversion of resources and management attention and could adversely affect our business, even if we are successful on the merits.
Additionally, third parties may independently develop intellectual property similar to ours, but without use of our trade secrets or proprietary information. In such cases, the value of our intellectual property may be diminished but we will lack any enforceable right or remedy.
We face intense competition from both start-up and established companies that may have significant advantages over us and our products.
The market for our products and services is intensely competitive. There are numerous companies competing with us in various segments of the data and analytics sector, and their products and services may have advantages over our products and services in areas such as conformity to existing and emerging industry standards, the use of artificial intelligence, performance, price, ease of use, scalability, reliability, flexibility, product features, and technical support.
Our principal competitors in the data and analytics sector include RELX Group (LexisNexis), TransUnion, and Thomson Reuters. Current and potential competitors may have one or more of the following significant advantages:
greater financial, technical, and marketing resources;
better name recognition;
more comprehensive solutions;
better or more extensive cooperative relationships; and
larger customer base.
We cannot assure you that we will be able to compete successfully with our existing or new competitors. Some of our competitors may have, in relation to us, one or more of the following: longer operating histories, longer-standing relationships with end-user customers, and greater customer service, public relations and other resources. As a result, these competitors may be able to more quickly develop or adapt to new or emerging technologies and changes in customer requirements, or devote greater resources to the development, promotion, and sale of their products and services. Additionally, it is likely that new competitors or alliances among existing competitors could emerge and rapidly acquire significant market share.
There may be further consolidation in our end-customer markets, which may adversely affect our revenue.
There has been, and we expect there will continue to be, merger, acquisition, and consolidation activity in our customer markets. If our customers merge with, or are acquired by, other entities that are not our customers, or that use fewer of our services, our revenue may be adversely impacted. In addition, industry consolidation could affect the base of recurring transaction-based revenue if consolidated customers combine their operations under one contract, since many of our contracts provide for volume discounts. In addition, our existing customers might leave certain geographic markets, which would no longer require them to purchase certain products from us and, consequently, we would generate less revenue than we currently expect.
To the extent the availability of free or relatively inexpensive consumer and/or business information increases, the demand for some of our services may decrease.
Public and commercial sources of free or relatively inexpensive consumer and business information have become increasingly available, and this trend is expected to continue. Public and commercial sources of free or relatively inexpensive consumer and/or business information may reduce demand for our services. To the extent that our customers choose not to obtain services from us and instead rely on information obtained at little or no cost from these public and commercial sources, our business, financial condition, and results of operations may be adversely affected.
If our newer products do not achieve market acceptance, revenue growth may suffer.
Our products and solutions may experience varying sales cycles depending on industry, customer size, and implementation complexity, and in certain markets competitors may have longer operating histories or more established customer relationships. Accordingly, we may not achieve the meaningful revenue growth needed to sustain operations. We cannot provide any assurances that sales of our newer products will continue to grow or generate sufficient revenues to sustain our business. If we are unable to recognize revenues due to longer sales cycles or other problems, our results of operations could be adversely affected.
We have not yet received broad market acceptance for our newer products. We cannot assure you that our present or future products will achieve market acceptance on a sustained basis. In order to achieve market acceptance and achieve future revenue growth, we must introduce complementary products, incorporate new technologies into existing product lines, and design and develop and successfully commercialize higher performance products in a timely manner. We cannot assure you that we will be able to offer new or complementary products that gain market acceptance quickly enough to avoid decreased revenues during current or future product introductions or transitions.
Our products and services can have long sales and implementation cycles, which may result in substantial expenses before realizing any associated revenue.
The sale and implementation of our products and services to large companies and government entities typically involves a lengthy education process and a significant technical evaluation and commitment of capital and other resources. This process is also subject to the risk of delays associated with customers’ internal budgeting and other procedures for approving capital expenditures, and testing and accepting new technologies that affect key operations. As a result, sales and implementation cycles for our products and services can be lengthy, and we may expend significant time and resources before we receive any revenues from a customer or potential customer. Our quarterly and annual operating results could be adversely affected if orders forecast for a specific customer and for a particular period are not realized.
If our outside service providers and key vendors are not able to or do not fulfill their service obligations, our operations could be disrupted and our operating results could be harmed.
We depend on a number of service providers and key vendors such as telecommunication companies, software engineers, cloud providers, data processors, and software and hardware vendors, who are critical to our operations. These service providers and vendors are involved with our service offerings, communications and networking equipment, computer hardware and software and related support and maintenance. Although we have implemented service-level agreements and have established monitoring controls, our operations could be disrupted if we do not successfully manage relationships with our service providers, if they do not perform or are unable to perform agreed-upon service levels, or if they are unwilling to make their services available to us at reasonable prices. If our service providers and vendors do not perform their service obligations, it could adversely affect our reputation, business, financial condition, and results of operations.
Consolidation in the data and analytics sector may limit market acceptance of our products and services.
Several of our competitors have acquired companies with complementary technologies in the past. We expect consolidation in the industries we serve to continue in the future. These acquisitions may permit our competitors to accelerate the development and commercialization of broader product lines and more comprehensive solutions than we currently offer. Acquisitions of vendors or other companies with whom we have a strategic relationship by our competitors may limit our access to commercially significant technologies and/or data. Further, business combinations are creating companies with larger market shares, customer bases, sales forces, product offerings and technology and marketing expertise, which may make it more difficult for us to compete.
We may incur substantial expenses defending the Company against claims of infringement.
There are numerous patents held by many companies relating to the design and manufacture of data and analytics solutions. Third parties may claim that our products and/or services infringe on their intellectual property rights. Any claim, with or without merit, could consume management’s time, result in costly litigation, cause delays in sales or implementation of products or services, or require entry into royalty or licensing agreements. In this respect, patent and other intellectual property litigation is becoming increasingly more expensive in terms of legal fees, expert fees, and other expenses. Royalty and licensing agreements, if required and available, may be on terms unacceptable to us or detrimental to our business. Moreover, a successful claim of product infringement against us or our failure or inability to license the infringed or similar technology on commercially reasonable terms could our business.
Environmental issues, including any future reporting obligations in connection with environmental issues, may adversely impact our business and operations.
Extreme weather events and natural disasters may disrupt our operations or those of our customers and suppliers. These events may become more frequent and more severe as a result of climate change, and the long-term impacts to the economy and our industry are unknown. While we maintain business continuity and disaster recovery plans, we cannot be certain that those plans will be effective. Even if we are unaffected by an extreme weather event or natural disaster, or recover from one quickly, our customers or suppliers may be more severely impacted, thereby affecting their ability to continue to do business with us.
Risks Related to Our Common Stock
Our stock price has been and may continue to be volatile, and the value of an investment in our common stock may decline.
The trading price of our common stock has been and is likely to continue to be highly volatile and could be subject to wide fluctuations in response to various factors, some of which are beyond our control. These factors could include:
additions or departures of key personnel;
changes in laws or regulations affecting our industry;
changes in earnings estimates or recommendations by securities analysts;
the increasing prominence of new technologies, including AI, in the markets in which we compete;
any major change in our Board of Directors or management;
general economic conditions and slow or negative growth of our markets; and
political instability, natural disasters, pandemics, war, and/or events of terrorism.
From time to time, we estimate the timing of the accomplishment of various commercial and other product development goals or milestones. Also, from time to time, we expect that we will publicly announce the anticipated timing of some of these milestones. All of these milestones are based on a variety of assumptions. The actual timing of these milestones can vary dramatically compared to our estimates, in some cases for reasons beyond our control. If we do not meet these milestones as publicly announced, our stock price may decline.
In addition, the stock market has experienced extreme price and volume fluctuations that have often been unrelated or disproportionate to the operating performance of publicly traded companies. Broad market and industry factors may seriously affect the market price of companies’ stock, including ours, regardless of actual operating performance. These fluctuations may be even more pronounced in the trading market for our stock. In addition, in the past, following periods of volatility in the overall market and the market price of a particular company’s securities, securities class action litigation has often been instituted against these companies. This litigation, if instituted against us, could result in substantial costs and a diversion of our management’s attention and resources.
Future issuances of shares of our common stock in connection with acquisitions or pursuant to our stock incentive plans could have a dilutive effect on your investment.
Since the Spin-off and through December 31, 2025, we issued an aggregate of 4,182,714 shares of our common stock in connection with vesting of awards made under the Red Violet, Inc. 2018 Stock Incentive Plan, as amended and restated (the “2018 Plan”), 972,971 shares of which were retired and cancelled. Also, as of December 31, 2025, 63,717 shares underlying awards made under the 2018 Plan have vested but the delivery has been deferred by the recipients, and an additional 769,227 shares underlying awards made under the 2018 Plan are scheduled to vest and be delivered through 2030. Pursuant to the 2018 Plan, our Board of Directors may grant stock options, restricted stock units (“RSUs”), or other equity awards to our directors and employees. Future stock incentive plans may also allow our Board of Directors to issue these equity awards to our directors and employees. When these awards vest or are exercised, the issuance of shares of common stock underlying these awards will have a dilutive effect on our common stock. Future acquisitions may involve the issuance of our common stock as payment, in part or in full, for the business or assets acquired. The benefits derived by us from an acquisition might not exceed the dilutive effect of the shares issued as part of the acquisition. Additionally, we filed a shelf registration statement on Form S-3, which was declared effective on November 25, 2025 (the "Shelf Registration Statement"), allowing us to offer and sell our registered common stock, preferred stock, debt securities, depository shares, warrants and/or units from time to time pursuant to one or more offerings of up to $150.0 million. While we have not issued any shares under the Shelf Registration Statement, any issuance could have a dilutive effect. Future issuances of our common stock or other equity securities, or the perception that such sales may occur, could affect the trading price of our common stock and our ability to raise capital through future offerings of shares or equity securities. No prediction can be made as to the effect, if any, that future sales of common stock or the availability of common stock for future sales will have on the trading price of our common stock.
The concentration of our stock ownership may limit individual stockholder ability to influence corporate matters.
As of December 31, 2025, officers and directors of the Company owned approximately 9% of our common stock (approximately 10% on a fully diluted basis). As a result, these stockholders may be in a position to exert significant influence over all matters requiring stockholder approval, including the election of directors and determination of significant corporate actions. The interests of these stockholders may not always coincide with the interests of other stockholders, and these stockholders may act in a manner that advances their interests and not necessarily those of other stockholders, and might affect the prevailing market price for our securities.
We are a “smaller reporting company,” and the reduced disclosure requirements applicable to smaller reporting companies may make our common stock less attractive to investors.
We are a “smaller reporting company” and may continue to be a smaller reporting company if either (i) the market value of our stock held by non-affiliates is less than $250.0 million or (ii) our annual revenue is less than $100.0 million during the most recently completed fiscal year and the market value of our stock held by non-affiliates is less than $700.0 million. As a smaller reporting company, we may continue to rely on exemptions from certain disclosure requirements that are available to smaller reporting companies. Specifically, we may choose to present only the two most recent fiscal years of audited financial statements in our Annual Report on Form 10-K and, similar to emerging growth companies, smaller reporting companies have reduced disclosure obligations regarding executive compensation. We cannot predict if investors will find our common stock less attractive because we may rely on these exemptions. If some investors find our common stock less attractive as a result, there may be a less active trading market for our common stock and our stock price may be more volatile.
We expect that we may need additional capital in the future; however, such capital may not be available to us on reasonable terms, if at all, when or as we require additional funding. If we issue additional shares of our common stock or other securities that may be convertible into, or exercisable or exchangeable for, our common stock, our existing stockholders would experience further dilution.
While we may need additional capital in the future, we cannot be certain that it will be available to us on acceptable terms when required, or at all. Disruptions in the global equity and credit markets may limit our ability to access capital. Since the Spin-off and through December 31, 2025, we issued an aggregate of 1,233,915 shares of our common stock in connection with registered direct offerings. To the extent that we raise additional funds by issuing equity securities, our shareholders would experience dilution, which may be significant and could cause the market price of our common stock to decline significantly. Any debt financing, if available, may restrict our operations. If we are unable to raise additional capital when required or on acceptable terms, we may have to significantly delay, scale back or discontinue certain operations. Any of these events could significantly harm our business and prospects and could cause our stock price to decline.
There is no assurance that we will continue to declare or pay dividends on our common stock in the future.
On December 3, 2024, we declared a special cash dividend of $0.30 per share on our common stock (the "Dividend") to shareholders of record as of January 31, 2025. The Dividend, totaling $4.2 million, was paid on February 14, 2025. However, there is no assurance that we will continue to declare or pay cash dividends in the future. Any future dividend payments are within the discretion of our Board of Directors and will depend upon, among other things, our results of operations, working capital requirements, capital expenditure requirements, financial condition, level of indebtedness, any contractual restrictions with respect to payment of dividends, business opportunities, anticipated cash needs, provisions of applicable law, and other factors that our Board of Directors may deem relevant.
Ite m 1B. Unresolved Staff Comments.
None.
Item 1C. Cybersecurity .
Risk Management and Strategy
We have implemented and maintained a comprehensive information security program designed to protect the confidentiality, integrity, and availability of our critical systems and information, as well as to identify, assess, manage, mitigate, and respond to cybersecurity threats. Our systems and processes are assessed by independent third parties for compliance with: the International Standard
Organization (“ISO”) 27001:2022; System and Organization Controls (“SOC”) 2, Type 2; and Payment Card Industry Data Security Standards (“PCI DSS”) Level 1.
Our information security program includes the following key elements to help identify, manage, mitigate, and respond to cybersecurity threats:
Risk assessments —We conduct annual enterprise-wide risk assessments designed to identify material cybersecurity risks to our operations, quantify the impact and probability of each identified risk, develop and implement mitigating controls, and reassess previously identified risks on an ongoing basis.
Testing —We conduct monthly vulnerability assessments and annual penetration testing of our systems and controls to identify and remediate potential vulnerabilities. Our testing program includes both automated scanning and manual security assessments performed by qualified internal and external security professionals.
Technical safeguards —We utilize multiple layers of technical safeguards designed to protect our information systems from cybersecurity threats, including network security controls, endpoint protection, data encryption, access controls, and security monitoring tools. We regularly review and update our technical safeguards in accordance with industry best practices and evolving threat landscapes.
Business continuity and disaster recovery planning —We maintain comprehensive business continuity and disaster recovery plans that are tested at least annually to ensure our ability to maintain critical operations and recover from potential disruptions, including those resulting from cybersecurity incidents.
Cybersecurity Incident Response —We maintain a cybersecurity incident response plan that governs the identification, containment, investigation, remediation, and reporting of cybersecurity incidents. We have designated an Incident Response Team with clearly defined roles and responsibilities, including escalation procedures to senior management and legal counsel for potentially material incidents. Our incident response procedures include protocols for timely communication with affected parties and regulatory authorities as required.
Cybersecurity insurance —We maintain cybersecurity insurance coverage designed to mitigate financial risks associated with cybersecurity incidents, including costs related to incident response, forensic investigation, legal expenses, regulatory fines, and business interruption.
Employee training and awareness programs —We provide mandatory annual cybersecurity training to all employees designed to help identify, avoid, and mitigate cybersecurity threats. Our training program includes insider threat awareness, simulated phishing exercises, secure coding practices for development personnel, and role-specific security training tailored to employee responsibilities. Additionally, our training program includes education on the secure and responsible use of AI and generative AI tools, covering topics such as data privacy considerations, prohibited uses of confidential information in AI systems, output validation requirements, and compliance with our AI usage policies.
Third-party risk management — We maintain a third-party risk management program designed to identify, assess, manage, and mitigate risks associated with our vendors, service providers, and other third parties. This program includes security assessments of vendors prior to engagement, contractual security requirements, and ongoing monitoring of vendors with access to our systems or sensitive data.
We regularly review our information security program and associated policies, making periodic updates as we deem necessary and appropriate in accordance with recognized best practices and standards.
Governance
Our information security program and cyber risk management program is managed and overseen by Jeff Dell, our Chief Information Officer (“CIO”) and a team of information security personnel reporting to the CIO. Our CIO reports directly to the CEO and is responsible for the assessment and management of material risks for cybersecurity threats. Mr. Dell brings over 30 years of experience in information technology and information security, working as an executive within data-driven companies for the last 25 years, including serving as CIO since our formation in August 2017 and continuing through our Spin-off from cogint. Mr. Dell holds a Bachelor of Science in Business from Arizona State University and has earned GCIA, GCWN, GWAPT and CISSP certifications. For additional information regarding Mr. Dell’s business experience, see Part 1, Item 1 Business – Information About Our Executive Officers included in this Annual Report.
Management holds monthly Information Security Management System (ISMS) meetings which include stakeholders, senior management as well as the CIO and other key individuals reporting to the CIO. Cybersecurity risks, threats, and vulnerabilities, as well as existing mitigating controls, are discussed in ISMS meetings. Our CIO also provides quarterly reports of our information security and IT compliance program, as well as any material cybersecurity risks, to the Board of Directors .
We did not experience a material cybersecurity incident during the year ended December 31, 2025, which has materially affected or is reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, the possibility of future cybersecurity incidents, as well as cybersecurity and technology risks more generally, could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. See “Item 1A. Risk Factors – Cybersecurity and Technology Risks” for more information.
