DIGI INTERNATIONAL INC

Current report

Artificial intelligence (“AI”) tools may enable threat actors to discover and exploit vulnerabilities in our products and infrastructure, and to conduct more sophisticated attacks, faster than we are able to respond.

Current report

Frontier AI models offered by major developers, as well as various open-source models that are more difficult for governments to regulate, are increasingly capable of automating vulnerability discovery, accelerating the development of exploits, and identifying security weaknesses across complex product portfolios at a speed and scale that was not previously achievable. Nation-state actors and other sophisticated threat actors may also use these AI tools to enhance or automate additional attack vectors, including AI-generated phishing and social engineering campaigns, deepfake-based impersonation, and agentic AI systems capable of executing multi-stage attacks, such as ransomware or extortion campaigns, with limited human involvement. We believe this represents a material change in the threat environment facing many companies, including those like ours that develop and sell networked hardware and software products.

Current report

Our product portfolio includes devices across a range of patchability profiles. Some products support over-the-air updates; others require full firmware replacement; others depend on OEM licensees to develop and distribute patches to end customers; and a legacy population of devices cannot be fully remediated through software updates at all. Our reliance on OEM licensees and other third parties to develop, test, and distribute patches may also expose us to additional supply-chain risk, as AI tools may similarly accelerate the discovery and exploitation of vulnerabilities in third-party components and dependencies that are outside our direct control. In an environment where the window between vulnerability identification and active exploitation may be materially shorter than it has historically been, our ability to respond to newly discovered vulnerabilities across all affected products and internal systems within committed timeframes cannot be guaranteed.

Current report

Several of our management platforms are cloud-based and operate at a layer above individual devices, aggregating access across many devices and customers. A security incident affecting any one of these platforms could affect multiple enterprise customers simultaneously, which is categorically different in scope and consequence from a device-level vulnerability. Our incident response protocols, contractual commitments, and insurance coverage may not fully account for this concentration risk, and any resulting fines, penalties, or damages may not be fully covered by our insurance policies.

Current report

The volume of vulnerabilities identified across our product lines and internal systems may also increase materially as AI-assisted discovery tools become more widely available to both security researchers and malicious actors. Our ability to triage, assess, and remediate vulnerabilities at elevated volume while meeting existing customer service-level agreement (SLA) commitments and regulatory reporting obligations (such as the EU Cyber Resilience Act reporting requirements effective September 2026) may be constrained by available internal resources and the architectural limitations described above. If we are unable to respond to vulnerabilities at the pace the current threat environment demands, we may face increased costs, customer attrition, contractual liability, regulatory investigations or actions, litigation, regulatory penalties, loss of revenue or profits, loss of customers or sales, and reputational harm.