Cyber Security Cloud , Inc.

The cybersecurity market is prone to demand fluctuations driven by new threats and technological innovation, and the pace of market growth may differ from the Group's assumptions. As the market is still in its early stages, there are many uncertain factors, and if the development of products and services fails to keep pace with technological change, competitiveness may decline, potentially affecting the Group's business and performance. As a countermeasure, the Group strives to maintain competitiveness through the development of new technologies by R&D personnel and the dissemination of information through various media.

The cybersecurity market is attracting attention as a growth market, and the number of new entrants is increasing. There is a risk that the Group's competitiveness may decline if competing companies offer equivalent functionality for free or at low cost. Even if the Group's services are superior in terms of functionality, users may choose competing products due to price competition, which would directly affect sales and earnings. The Group seeks to differentiate itself by leveraging its accumulated know-how, data, and technology to respond to customer needs.

Due to the increasing sophistication of cyberattack techniques, the Group cannot guarantee that its services will block 100% of unauthorized access. If a security incident occurs regarding a customer's information assets, there is a risk of loss of trust or claims for damages, regardless of whether the cause is attributable to the Group. The Group seeks to limit this risk by clearly stating disclaimers in its terms of use and contracts, but complete avoidance is difficult.

The Group's business depends on internet communication networks and servers operated by hosting service providers. If a network disconnection or server failure occurs due to a natural disaster, accident, unauthorized access, or other cause, there is a risk that services may be interrupted for a prolonged period. Service interruption could lead to loss of customer trust and contract cancellations, potentially having a significant impact on the Group's business and performance. The Group has implemented measures such as system redundancy, vulnerability assessments, and defenses against unauthorized access, but complete prevention cannot be guaranteed.

Despite having obtained ISO/IEC 27001 certification and implementing information security measures such as access control and log management, if damage from a cyberattack or an information leak caused by an employee occurs, there is a risk of damage from the misuse of confidential information, increased response costs, and loss of credibility. Given the nature of the Group as a security company, an incident involving itself could have a particularly serious impact on customer trust. The Group strives for prevention through thorough moral education and the introduction of security systems.

Due to the nature of the monthly subscription-based service, a certain level of cancellations occurs every year due to changes in customers' business environments or switching to competitors, and the Group incorporates a certain level of cancellations into its budget and business plans. If cancellations exceed expectations due to a decline in competitiveness or troubles, recurring revenue (MRR) could decrease significantly, potentially affecting the Group's business and performance. The Group continues efforts to maintain a low cancellation rate through initiatives to improve customer satisfaction.

The Group's service development relies heavily on the technical capabilities of its employees (engineers), and stably securing excellent engineers is a critical issue for business continuity. If recruitment and training do not proceed as planned, or if talent outflow progresses, the smooth provision of services and proactive order-taking activities could be hindered, potentially affecting the Group's business and performance. The Group seeks to strengthen its talent base through continuous recruitment activities and employee training.

The Group has been advancing overseas expansion, having established a U.S. subsidiary in September 2018 and a Singapore subsidiary in May 2024, but there are potential risks such as changes in local laws and regulations, changes in social conditions, fluctuations in exchange rates, and the risk that services may not be accepted in local markets. If these risks are not adequately addressed, losses in overseas operations or withdrawal costs could arise, potentially affecting the business and performance of the Group as a whole.

The Group's services incorporate open source software (OSS), and if there is a major change to an OSS license, discovery of a third-party rights infringement, or discovery of a bug, program correction expenses and response costs may arise, making it difficult to continue providing the service. In addition, if the Group unknowingly infringes on a third party's intellectual property rights, there is a risk of being subject to royalty demands or claims for damages. The Group addresses this through investigative responses in cooperation with experts, license management, and consideration of alternative software.

The Group began returning profits to shareholders from FY2024 (ending December 2024) and plans to pay a dividend of ¥5.00 per share for FY2025 (ending December 2025). However, due to sudden changes in the business environment, unexpected investment opportunities, fluctuations in performance, and other factors, it may become difficult to pay stable dividends, or the dividend amount may decrease. The Group's policy is to prioritize securing retained earnings for growth investments and M&A aimed at achieving its FY2030 financial targets (net sales of ¥20.0 billion, operating profit of ¥4.0 billion), and balancing shareholder returns with growth investment remains a challenge.