KALTURA INC

Current report

If we or our third-party service providers experience a security breach, data loss or other compromise, including if unauthorized parties obtain access to our customers’ data, our reputation may be harmed, demand for our platform, products and solutions may be reduced, and we may incur significant liabilities.

Current report

Our IT Systems, and those of third-party providers we rely on, involve the collection, storage, processing, transmission, and other use of data, including certain proprietary, confidential, sensitive, and Personal Information of ours and our customers (collectively, “Confidential Information”).

Current report

Cyberattacks are expected to accelerate on a global basis in frequency and magnitude as threat actors are becoming increasingly sophisticated in using techniques and tools-including artificial intelligence-that circumvent security controls, evade detection and remove forensic evidence. As a result, we face numerous and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of Confidential Information and our IT Systems, business platform, products and solutions. Additionally, the use of AI, Gen-AI and large language models (“LLMs”), including those of third parties, by us, our customers that host files in our environment, or other third parties, is expected to pose new or unknown cybersecurity risks and challenges, including increasing data leakage and data compromise risks.

Current report

Any security breach, data loss, or other compromise, including those resulting from a cybersecurity attack, social engineering, phishing attack, human or technological error, or any unauthorized access, unauthorized usage (including malfeasance by insiders), malware (including ransomware), malicious code, or misconfigurations, bugs or other vulnerabilities in commercial software that is integrated into our (or our suppliers’ or service providers’) IT Systems, products or services, virus or similar breach or disruption could result in the loss or destruction of or unauthorized access to, or use, alteration, disclosure, or acquisition of, Confidential Information, damage to our reputation, litigation (such as class actions), regulatory investigations and enforcement actions, reputational harm, loss of existing or future customers, imposition of fines, or other liabilities. These attacks may come from diverse threat actors, such as individual hackers, hacktivists, criminal groups, and state-sponsored organizations. For example, ransomware attacks, including those from organized criminal threat actors, nation-states, and nation-state supported actors, are becoming increasingly prevalent and severe, and can lead to significant interruptions in our operations, loss of data and income, reputational loss, diversion of funds, and may result in fines, litigation and unwanted media attention. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting payments.

Current report

If our security measures are breached as a result of third-party action, employee error or negligence, a defect or bug in our offerings or those of our third-party service providers or customers using our platforms, malfeasance or otherwise and, as a result, someone obtains unauthorized access to any data, including our Confidential Information or that of our customers, or other persons, or any of these types of information is lost, destroyed, or used, altered, disclosed, or acquired without authorization, our reputation may be damaged, our business may suffer, we may be subject to regulatory investigations, and we could incur significant liability, including significant incident response, system restoration or remediation and future compliance costs, insurance costs, and penalties or fines under applicable data privacy and security laws and regulations. Even the perception of inadequate security may damage our reputation and negatively impact our ability to win new customers and retain and receive timely payments from existing customers. We experience cyber-attacks and other security incidents of varying degrees from time to time, and future incidents or threat actors' successful attacks may result in significant liability, costs, and reputational harm.

Current report

Moreover, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, effectively protect our IT Systems and Confidential Information. Additionally, there can be no assurance that our cybersecurity measures and tools will not be circumvented or penetrated by attackers or would keep pace with the constantly evolving threats in a timely manner.For example, use of AI Technologies by threat actors may make any existing vulnerabilities easier to expose and exploit. We are unable to comprehensively apply patches or confirm that measures are in place to mitigate all such vulnerabilities, or that patches will be applied before vulnerabilities are exploited by a threat actor. We could be required to expend significant capital and other resources to protect against and address any data security incident or breach, which may not be covered or fully covered by our insurance and which may involve payments for investigations, forensic analyses, regulatory compliance, breach notification, legal advice, public relations advice, system repair or replacement, data recovery or other services. The successful assertion of one or more large claims against us that exceeds our available insurance coverage, or results in changes to our insurance policies (including premium increases or the imposition of large deductible or co-insurance requirements), could have an adverse effect on our business. In addition, we cannot be sure that our existing insurance coverage will continue to be available on economically reasonable terms or at all or that our insurers will not deny coverage as to any future claim.

Current report

In addition, we do not directly control content that our customers store or use in our products. If our customers use our products for the transmission or storage of Confidential Information, including such information about individuals, and our security measures are or are believed to have been breached as a result of third-party action, employee error, malfeasance or otherwise, our reputation could be damaged, our business may suffer, and we could incur significant liability, including related to breach notification and incident response.

Current report

We engage third-party vendors and service providers to store and otherwise process some of our and our customers’ data, including Confidential Information. Our vendors and service providers, including providers of open source platforms, may also be the targets of cyberattacks, malicious software, phishing schemes, and fraud.

Current report

Our ability to monitor our vendors and service providers’ data security is limited, and, in any event, third parties may be able to circumvent those security measures, resulting in the unauthorized access to, misuse, acquisition, disclosure, loss, alteration, or destruction of our and our customers’ data, including Confidential Information and other information about individuals. Any such unauthorized access could materially adversely affect our business, operating results, and financial condition.

Current report

Data security breaches could also expose us to liability under various laws and regulations across jurisdictions and increase the risk of litigation and governmental or regulatory investigation.

Current report

Due to concerns about data security and integrity, a growing number of legislative and regulatory bodies have adopted breach notification and other requirements in the event that information subject to such laws is accessed by unauthorized persons and additional regulations regarding security of such data are possible. We may need to notify governmental authorities and affected individuals with respect to such incidents. For example, laws in the EU and UK and all 50 U.S. states may require businesses to provide notice to regulators and/or individuals whose Personal Information has been disclosed as a result of a data security breach. Complying with such numerous and complex regulations in the event of a data security breach would be expensive and difficult, and failure to comply with these regulations could subject us to regulatory scrutiny and additional liability. We may also be contractually required to notify regulators, customers or other counterparties of a security incident, including a data security breach. Regardless of our contractual protections, any actual or perceived data security breach, or breach of our contractual obligations, could harm our reputation and brand, expose us to potential liability or require us to expend significant resources on data security and in responding to any such actual or perceived breach.

Current report

Techniques used to sabotage or obtain unauthorized access to systems or networks are constantly evolving and, leveraging more sophisticated techniques and tools (including artificial intelligence) and, in some instances, are not identified until after they have been launched against a target. We and our service providers may be unable to anticipate these techniques, react in a timely manner, or implement adequate preventative and mitigating measures.

Current report

If we or our cybersecurity solutions providers are unable to efficiently and effectively maintain and upgrade our system safeguards, we may incur unexpected costs and certain of our systems may become more vulnerable to unauthorized access or disruption. Any of the foregoing could have a material adverse effect on our business, including our financial condition, results of operations and reputation.

Current report

We are subject to stringent and changing laws, regulations, standards, and contractual obligations related to privacy, data protection, and data security. Our actual or perceived failure to comply with such obligations could adversely affect our business

Current report

We receive, collect, store, process, transfer, share and otherwise use or host Personal Information, including data relating to users of our offerings, our employees and contractors, and other persons. We have legal and contractual obligations regarding the protection of confidentiality and appropriate use of certain data, including Personal Information and other sensitive information about individuals. We are subject to numerous federal, state, local, and international laws, directives, and regulations regarding privacy, data protection, and data security and the collection, storing, sharing, use, processing, transfer, disclosure, disposal, and protection of Personal Information and other data, the scope of which are changing, subject to differing interpretations, and may be inconsistent among jurisdictions or conflict with other legal and regulatory requirements. We are also subject to certain contractual obligations to customers and other third parties related to privacy, data protection and data security. The regulatory framework for privacy, data protection and data security worldwide is, and is likely to remain for the foreseeable future, uncertain, complex and lacking worldwide unified standards, and it is possible that these or other actual or alleged obligations may be interpreted and applied in a manner that we do not anticipate or that is inconsistent from one jurisdiction to another and may conflict with other legal obligations or our practices. Further, any significant change to applicable laws, regulations or industry practices regarding the collection, use, retention, hosting, security, processing, transfer or disclosure of Personal Information, or their interpretation, or any changes regarding the manner in which the consent of users or other data subjects for the collection, use, retention, security, processing, transfer or disclosure of such Personal Information must be obtained, could increase our costs and require us to modify our services and features, possibly in a material manner, which we may be unable to complete, and may limit our ability to receive, collect, store, host, process, transfer, and otherwise use user data or develop new services and features. Further, there has been a substantial increase in legislative activity and regulatory focus on data privacy and security in the United States and elsewhere, including in relation to cybersecurity incidents. In addition, some such requirements place restrictions on our ability to process Personal Information across our business or across country borders.

Current report

In the United States, the FTC and many state attorneys general are interpreting federal and state consumer protection laws to impose standards for the online collection, use, dissemination, and security of data. Such standards require us to publish statements that describe how we handle Personal Information and choices individuals may have about the way we handle their Personal Information.

Current report

If such information that we publish is considered untrue or inaccurate, we may be subject to government claims of unfair or deceptive trade practices, which could lead to significant liabilities and consequences. Moreover, according to the FTC, violating consumers’ privacy rights or failing to take appropriate steps to keep consumers’ Personal Information secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act.

Current report

State consumer protection laws provide similar causes of action for unfair or deceptive practices. Further, data privacy advocates and industry groups have regularly proposed and sometimes approved, and may propose and approve in the future, self-regulatory standards with which we must legally comply or that contractually apply to us.

Current report

Our communications with our clients are subject to certain laws and regulations, including the Controlling the Assault of Non-Solicited Pornography and Marketing Act (the “CAN-SPAM Act”), the Telephone Consumer Protection Act (the “TCPA”), and the Telemarketing Sales Rule and analogous state laws, that could expose us to significant damages awards, fines and other penalties that could materially impact our business. For example, the TCPA imposes various consumer consent requirements and other restrictions in connection with certain telemarketing activity and other communication with consumers by phone, fax or text message. The CAN-SPAM Act and the Telemarketing Sales Rule and analogous state laws also impose various restrictions on marketing conducted use of email, telephone, fax or text message.

Current report

As laws and regulations, including FTC enforcement, rapidly evolve to govern the use of these communications and marketing platforms, the failure by us, our employees or third parties acting at our direction to abide by applicable laws and regulations could adversely impact our business, financial condition and results of operations or subject us to fines or other penalties.

Current report

In addition, the Video Privacy Protection Act (“VPPA”), which restricts the disclosure of consumers’ video viewing information, and state wiretapping statutes, such as the California Invasion of Privacy Act (“CIPA”), have become the basis for a significant increase in class action litigation targeting companies that deliver video content online or deploy cookies and similar tracking technologies. Given the nature of our business and our use of cookies and similar technologies, we may be exposed to claims under these or similar statutes. Such claims could result in class action litigation and statutory damages, which could adversely affect our business, financial condition, and results of operations.

Current report

Various other U.S. federal privacy laws are relevant to our business, including the Family Educational Rights and Privacy Act (“FERPA”) and the Children’s Online Privacy Protection Act (“COPPA”), While we are not directly subject to FERPA or COPPA, our contracts with certain educational institution customers impose obligations on us related to FERPA and COPPA. Any actual or perceived failure to comply with these laws could result in a costly investigation or litigation resulting in potentially significant liability, injunctions and other consequences, loss of trust by our users, and a material and adverse impact on our reputation and business.

Current report

In addition, many state legislatures have adopted legislation that regulates how businesses operate online, including measures relating to privacy, data security, and data breaches. For example, the CCPA, provides data privacy rights for California residents and imposes operational requirements on covered companies, such as obligations to provide disclosures to California residents and receive and respond to data privacy rights requests. The CCPA marked the beginning of a trend toward more stringent data privacy legislation in the United States, which could also increase our potential liability and adversely affect our business, with “copycat” laws or other similar laws being passed or proposed in numerous states across the country.

Current report

This legislation may add additional complexity, variation in requirements, restrictions, and potential legal risk, require additional investment in resources to compliance programs, could impact strategies and availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies.

Current report

In addition, in the EU and the UK, we are subject to the European Union General Data Protection Regulation (the “EU GDPR”) and to the United Kingdom General Data Protection Regulation and UK Data Protection Act 2018 (collectively, the “UK GDPR”) (the EU GDPR and UK GDPR together referred to as the “GDPR”).

Current report

The GDPR imposes comprehensive data privacy compliance obligations in relation to our collection, use, sharing, disclosure and other processing of Personal Information, including a principle of accountability and the obligation to demonstrate compliance through policies, procedures, training and audit.

Current report

Among other requirements, the GDPR regulates the transfer of Personal Information outside of the European Economic Area (“EEA”) and the UK to third countries that have not been found to provide adequate protection for such Personal Information, including the United States.

Current report

We are certified under the EU-US Data Privacy Framework (“DPF”) and currently rely on the DPF and on the UK Extension to the DPF to transfer Personal Information from the EEA and the UK to our affiliates in the United States and other DPF-certified entities in the United States.

Current report

We also rely on the EU standard contractual clauses (“SCCs”) and the UK Addendum to the SCCs, as relevant, to transfer Personal Information outside the EEA and the UK to countries other than the United States and to entities in the United States not certified under the DPF.

Current report

Recent legal developments in Europe, including decisions from the Court of Justice of the European Union and regulatory guidance from regulators in the EEA and UK, have created complexity and uncertainty regarding data transfers, and we expect this legal complexity and uncertainty to continue. In particular, we expect international transfers to the United States and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators. As the regulatory guidance and enforcement landscape in relation to data transfers continue to develop, we could suffer additional costs, complaints and/or regulatory investigations or fines; we may have to stop using certain tools and vendors, implement alternative data transfer mechanisms and/or take additional compliance and operational measures; and/or it could otherwise affect the manner in which we provide our services, and could adversely affect our business, operations and financial condition.

Current report

Since we are subject to the supervision of relevant data protection authorities under both the EU GDPR and the UK GDPR, we could be fined under each of these regimes independently in respect of the same breach. Penalties for certain breaches are up to the greater of €20 million / GBP 17.5 million or 4% of global annual turnover for the preceding financial year for the most serious violations. The GDPR also provides for a right to compensation for material or non-material damage claimed by individuals. In addition to the foregoing, a breach of the GDPR could result in regulatory investigations, reputational damage, orders to cease or change our processing of our data, enforcement notices and/or assessment notices (for a compulsory audit).

Current report

We are also subject to evolving EU and UK privacy laws on cookies, tracking technologies and e-marketing. Recent European court and regulator decisions are driving increased attention to cookies and tracking technologies. If the trend of increasing enforcement by regulators of the strict approach to opt-in consent for all but essential use cases, as seen in recent guidance and decisions continues, this could lead to additional costs, require systems changes, limit the effectiveness of our marketing and personalization activities, divert the attention of our technology personnel, adversely affect our margins, increase costs and subject us to additional liabilities. There can be no assurances that we will be successful in our efforts to comply with such laws; violations of such laws could result in regulatory investigations, fines, orders to cease or change our use of such technologies, as well as civil claims including class actions, and reputational damage.

Current report

EU data-related laws apply to some of our offerings, including the EU Data Act, which established new requirements for providers of data processing services (including cloud and SaaS, among other service models) in the EU. The EU Data Act requires providers to facilitate customers switching to other providers or solutions and port their data within certain timeframes; remove technical, contractual, and commercial obstacles to service switching; and include certain mandatory terms in customer contracts, amongst other requirements. Failure to comply with the EU Data Act can result in regulatory enforcement and fines, civil claims, and reputational damage. The EU Data Act, together with developing guidance in this area, may require changes to our customer contracts, operations, and business practices, increase our compliance costs, require adjustments to our financial measurements and reporting practices, and adversely affect our financial condition, business, and operations. We are continuing to monitor the application and impact of the EU Data Act as further guidance, practice and enforcement trends emerge.

Current report

Additionally, as our products and services continue to evolve, we may be subject to certain cybersecurity and technology regulations in the EU and UK, including the UK Network and Information Systems Regulations, the EU Network and Information Systems Directive 2 as transposed into member state law, the Cyber Resilience Act, and the Digital Operational Resilience Act. These laws impose various obligations, including in relation to implementing cybersecurity risk measures, ensuring the security and integrity of our products and services, and reporting of security incidents and vulnerabilities to competent regulators. To the extent these laws apply to us, a failure to comply could result in regulatory enforcement and fines, reputational damage, and/or require us to change our business practices, products and services.

Current report

We may be subject to online content regulations, and our actual or perceived failure to comply with applicable regulations could adversely affect our business.

Current report

The EU, UK and certain other jurisdictions have enacted, or may enact in the future, regulations that may govern the content that we or our users share or make available via the solutions we offer. In the EU, the Digital Services Act (the “DSA”) sets out rules regarding, in addition to other related matters, the potential liability of providers of certain online solutions for content shared or made available via those solutions. In the United Kingdom, the Online Safety Act 2023 (the “OSA”) similarly imposes requirements on providers of certain online user-to-user (and search) services to protect users from illegal and harmful content. The DSA and OSA may increase our compliance costs, expose us to potential regulatory action and liability and/or require changes to our user interfaces, processes, operations, and business practices, which may adversely affect our ability to attract, retain, and provide our services to customers, and may otherwise adversely affect our business, results of operations, and financial condition. Failure to comply with the DSA can result in fines of up to 6% of total annual worldwide turnover and recipients of services have the right to seek compensation from providers in respect of damage or loss suffered due to infringement by the provider to comply with the DSA. Failure to comply with the OSA can result in fines of up to 10% of total annual worldwide turnover or GBP 18 million (whichever is greater).

Current report

We may face risks associated with our use of certain AI and machine learning model technologies and compliance with the evolving regulatory framework around AI development and use.

Current report

We have developed, integrated and interfaced, and continue to develop, integrate and interface, certain AI-based solutions, applications and features as part of our offerings, including through our acquisitions of eSelf and PathFactory. The underlying AI algorithms, digital processing or software, analyze and processes video and audio content, processes, and use of our products by developers, administrators and users, while performing intellectual processes characteristic of intelligent beings, such as deep learning, natural language processing, reasoning, discovering meaning, generalizing, processing, summarizing and representing knowledge, planning, and learning from past experience. The technologies and solutions pursued by us include also generative AI, namely, a type of artificial intelligence technology that can produce various types of content or data, such as text, images, videos, audio, synthetic data or other media, using generative models ,as well as agentic AI capabilities that can take actions or execute workflows with limited human involvement. Artificial intelligence and machine learning are rapidly evolving fields of study, and bear risks associated with the introduction of new technologies and the lack of learning curve and technology maturity. Thus, the Company cannot assure nor guarantee the accuracy of any output generated therefrom or other results obtained from use thereof, or that actions taken by agentic features will be appropriate or as intended . Given the probabilistic nature of machine learning and AI, use of such AI processing and tools may in some situations result in an inaccurate output.

Current report

If our solutions (including those of our vendors and subcontractors) fail to perform as intended, our business, financial condition, and results of operations would be adversely affected. In addition, although the Company seeks, in accordance with its policies and customer agreements, to limit its retention and use of its customers' contents or metadata provided or uploaded by them or otherwise generated from their use of the Company's AI tools, and does not use its customers' data or content for the creation of any AI-output for other users of the Company's systems and solutions, the processing of its customers' data may nonetheless result in the creation of residual know how, experience and information, statistical models, and training of deep learning, algorithms, simulations, statistics, predictability and other AI features and capabilities. If we fail to establish processes, policies, rules and contractual frameworks to avoid misuse or unauthorized use of our customers data, or to establish and secure the Company's rights with respect to its own developments, technologies and AI products and tools, or if evolving regulation of AI and machine learning model technologies would develop differently from our standards and policies, and as a consequence we may suffer claims for intellectual property infringement, misuse or abuse, then our business, financial condition, and results of operations would be adversely affected.

Current report

The regulatory framework around the development and use of machine learning, AI and automated decision making is rapidly evolving, and many federal, state and foreign government bodies and agencies have introduced and/or are currently considering additional laws and regulations. For example, in the United States,the regulatory framework for AI Technologies faces significant uncertainty. At the federal level, Congress has yet to enact meaningful AI legislation. Instead, federal policy on AI has been shaped by a series of executive orders that have shifted priorities and requirements substantially depending on the administration in power. Any such changes at the federal level could require us to expend significant resources to modify our products, services, or operations to ensure compliance or remain competitive.