SDCH 10-K & 10-Q changes, risk factors and insider trading

Summary of Risk Factors

The following list provides a summary of risk factors discussed in further detail below:

Risks Related to Our Business and Results of Operations

Risks Related to Our Industry

Risks Related to Our Intellectual Property

Risks Related to Cyberattacks

Risks Related to Regulations and Our Compliance with Such Regulations

Risks Related to Our Financial Position and Need for Capital

Risks Related to Our Common Stock

Inflation and related geo-political events increase the risk that we are unable to achieve and maintain profitable operations.

Our business may be affected by general economic, political, and market conditions, including any resulting negative impact on spending by our clients and customers. Some of our clients may view our services as a discretionary purchase and may in the future reduce their spending on our services during an economic downturn, especially in the event of a prolonged recessionary period. Concerns about inflation, rising interest rates, unemployment trends, geopolitical issues, including wars and other armed conflicts, global health epidemics and other highly communicable diseases, bank insolvency and related uncertainty and volatility in the financial services industry, or a widespread economic slowdown or recession (in the United States or internationally) have led to, and could continue to lead to, increased market volatility and economic uncertainty, which could cause current and prospective customers and clients to delay, decrease, or cancel purchases of our services, or delay or default on their payment obligations. As a result, our business, results of operations, and financial condition may be significantly affected by changes in the economy generally.

Our success depends significantly upon our present management, most notable our Chief Executive Officer, Brian Haugli, and our Chief Financial Officer, Ryan Polk, who are involved in the development of our products as well as in our strategic planning and operations. All of our officers and key personnel are at-will employees. In addition, many of our key technologies and systems are custom-made for our business by our key personnel. The loss of key personnel, including key members of our management team, as well as certain of our key marketing, sales, product development, or technology personnel, could disrupt our operations and have an adverse effect on our ability to grow our business. Additionally, we will need to adapt and respond to frequently changing circumstances that may impact our workforce, such as natural disasters or pandemics, or our ability to maintain an effective workforce may be impacted.

To execute our business plan, we must attract and retain highly qualified personnel. Competition for these employees is intense, and we may not be successful in attracting and retaining qualified personnel. We have experienced, and we may continue to experience, difficulty in hiring and retaining highly skilled employees with appropriate qualifications.

If we are less successful in our recruiting efforts, or if we are unable to retain key existing employees, our ability to develop and deliver successful products and services will be adversely affected. Effective succession planning is also important to our long-term success. Our failure to ensure effective transfer of knowledge and smooth transitions involving key employees could hinder our strategic planning and execution.

If we are unable to develop new and enhanced products and services, or if we are unable to continually improve the performance, features, and reliability of our existing products and services, our competitive position would weaken, and our business and operating results could be adversely affected.

Our future success depends on our ability to effectively respond to evolving threats to consumers and potential customers, as well as competitive technological developments and industry changes, by developing or introducing new and enhanced products and services on a timely basis. In the past, Cipherloc incurred significant research and development expenses. As a result of the Business Combination, we expect to continue to incur research and development expenses as we strive to remain competitive and as we focus on organic growth through internal innovation. If we are unable to anticipate or react to competitive challenges or if existing or new competitors gain market share in any of our markets, our competitive position would weaken, and we could experience a decline in our revenues and net income, which could adversely affect our business and operating results. Additionally, we must continually address the challenges of dynamic and accelerating market trends, increasingly sophisticated cyber-attacks and intrusions and competitive developments. Customers may require features and capabilities that our current products do not have. Our failure to develop new products and improve our existing products to satisfy customer preferences and needs and effectively compete with other market offerings in a timely and cost-effective manner will harm our ability to retain our customers (if any) and the ability of our licensees or resellers to retain their customers, and to create or increase demand for our products, which may adversely impact our operating results. The development and introduction of our new or enhanced products will involve a significant commitment of time and resources and will be subject to a number of risks and challenges, including but not limited to:

If we are not successful in managing these risks and challenges, or if our new or improved products and services are not technologically competitive in the market, or do not achieve market acceptance, our business and operating results would be adversely affected, our market share would decline, and our margins would contract.

Our operating results may vary significantly from period to period and have been unpredictable, which has and might continue to cause the market price of our common stock to be volatile.

Our operating results, in particular, our revenues, gross margins, operating margins, and operating expenses, have historically varied significantly from period to period, and we expect such variation to continue as a result of a number of factors, many of which are outside of our control and may be difficult to predict, including:

Any one of the factors above, or the cumulative effect of some of the factors referred to above, may result in significant fluctuations in our operating results including our revenue and net income. This variability and unpredictability could result in our failure to meet our revenue, margin, or other operating result expectations, or those of securities analysts or investors for a particular period. If we fail to meet or exceed such expectations for these or any other reasons, the market price of our common stock could decline substantially, and we could face costly lawsuits, including securities class action suits.

We anticipate that our future revenue and operating results will depend significantly on our ability to retain clients and customers and our ability add new clients and customers. In addition, we may not be able to predict or anticipate accurately future trends in retention or effectively respond to such trends. Our retention rates may decline or fluctuate due to a variety of factors, including the following:

If we do not retain our existing clients and customers, or add new clients and customers, we may not generate revenue and/or our revenue may grow more slowly than expected, or decline, and our operating results and gross margins will be negatively impacted. In addition, our business and operating results may be harmed if we are unable to increase our retention rates or if they decline.

We also must continually add new clients and customers, both to replace those who cancel or elect not to renew their agreements with us and to grow our business beyond our current level. If we are unable to attract new clients and customers in numbers greater than the number that cancel or elect not to renew their agreements with us, our client base will decrease, and our business, operating results, and financial condition would be adversely affected.

We face intense competition, especially from larger, well-established companies, and we may lack sufficient financial or other resources to maintain or improve our competitive position.

The market for cybersecurity technologies is intensely competitive, and we expect competition to increase in the future from established competitors and new market entrants. Our main competitors fall into three categories:

Our current and proposed products and services face, and will continue to face, intense competition from larger and smaller companies, as well as from academic and research institutions. We compete in an industry that is characterized by: (i) rapid technological change, (ii) evolving industry standards, (iii) emerging competition, and (iv) new service and product introductions. Our competitors have existing products and technologies that will compete with our products and technologies and may develop and commercialize additional products and technologies that will compete with our products and technologies. Some of these new products and services may have functionality that ours do not have. Because many competing companies and institutions have greater financial resources than us, they may be able to: (i) provide broader services and product lines, and (ii) fully develop and deploy new products faster than we can with their larger and broader resources. Our competitors also generally have greater development capabilities than we do and have greater experience in undertaking testing of products, obtaining regulatory approvals, and manufacturing and marketing their products. They may also have greater name recognition and better access to customers, clients, licensees, and resellers than we do. Our chief services competitors include companies such as Optiv, NCC, Coalfire, PwC, EY, Deloitte, and GuidePoint. Our primary product competitors for Enclave are companies such as Perimeter 81, Zscaler, Palo Alto, and Illumio.

Many of our existing competitors have, and some of our potential competitors may have, substantial competitive advantages such as:

In addition, some of our larger competitors have substantially broader and more diverse product and service offerings, which may make them less susceptible to downturns in a particular market and allow them to leverage their relationships based on other services and products or incorporate functionality into existing services and products to gain business in a manner that discourages users from purchasing our services, products and subscriptions, including through selling at zero or negative margins, offering concessions, product bundling, or closed technology platforms. Many of our smaller competitors that specialize in providing protection from a single type of security threat are often able to deliver these specialized cybersecurity or security products to the market more quickly than we can.

Organizations that use legacy products and services may believe that these products and services are sufficient to meet their security needs, or that our platform only serves the needs of a portion of the cybersecurity technology market. Accordingly, many organizations have invested substantial personnel and financial resources to design and operate their networks and have established deep relationships with other providers of cybersecurity services and products. As a result, these organizations may prefer to purchase from their existing suppliers rather than add or switch to a new supplier such as us, regardless of product performance, features, or greater services offerings, or may be more willing to incrementally add solutions to their cybersecurity infrastructure from existing suppliers than to replace it wholesale with our solutions.

Conditions in our market could change rapidly and significantly because of technological advancements, partnering or acquisitions by our competitors, or continuing market consolidation. New start-up companies that innovate and large competitors that are making significant investments in research and development may invent similar or superior services, products, and technologies that compete with our services and products. Some of our competitors have made or could make acquisitions of businesses that may allow them to offer more directly competitive and comprehensive solutions than they had previously offered and adapt more quickly to innovative technologies and changing needs. Our current and potential competitors may also establish cooperative relationships among themselves or with third-parties that may further enhance their resources and reduce their expenses. These competitive pressures in our market or our failure to compete effectively may result in price reductions, fewer orders, reduced revenue and gross margins, and loss of market share. Any failure to meet and address these factors could materially harm our business and operating results.

A network or data security incident may allow unauthorized access to our or our end users’ network or data, harm our reputation, create additional liability and adversely impact our financial results.

Increasingly, companies are subject to a wide variety of attacks on their networks on an ongoing basis. In addition to traditional computer “hackers” malicious code (such as viruses and worms), phishing attempts, employee theft or misuse, and denial of service attacks, sophisticated nation-state and nation-state supported actors engage in intrusions and attacks (including advanced persistent threat intrusions) and add to the risks to internal networks, cloud deployed enterprise and customer-facing environments and the information they store and process. Despite significant efforts to create security barriers to such threats, it is virtually impossible for us to entirely mitigate these risks. We, and our third-party software and service providers, may face security threats and attacks from a variety of sources. Our data, corporate systems, third-party systems and security measures and/or those of our licensees, resellers, clients, customers, software providers, independent contractors, employees, end users may be breached due to the actions of outside parties, employee error, malfeasance, a combination of these, or otherwise, and, as a result, an unauthorized party may obtain access to our or our customers’ data. Furthermore, as a provider of cybersecurity technologies, we may be a more attractive target for such attacks. A breach in our data security or an attack against our service availability, or that of our third-party service providers, could impact our networks or networks secured by our services, products and subscriptions, creating system disruptions or slowdowns and exploiting security vulnerabilities of our services, products, and the information stored on our networks or those of our third-party service providers could be accessed, publicly disclosed, altered, lost, or stolen, which could subject us to liability and cause us financial harm. Any actual or perceived breach of network security in our systems or networks, or any other actual or perceived data security incident we or our third-party service providers suffer, could result in damage to our reputation, negative publicity, loss of channel partners, licensees, resellers, clients, customers, and sales, loss of competitive advantages over our competitors, increased costs to remedy any problems and otherwise respond to any incident, regulatory investigations and enforcement actions, costly litigation, and other liability. In addition, we may incur significant costs and operational consequences of investigating, remediating, eliminating, and putting in place additional tools and devices designed to prevent actual or perceived security incidents, as well as the costs to comply with any notification obligations resulting from any security incidents. Any of these negative outcomes could adversely impact the market perception of our services, products and customer and investor confidence in our company and, moreover, could seriously harm our business or operating results.

It is essential to our business strategy that our technology and network infrastructure remain secure and are perceived by any clients and customers we have, and others, to be secure. Despite security measures, however, any network infrastructure may be vulnerable to cyber-attacks by hackers and other security threats. We may face cyber-attacks that attempt to penetrate our network security, sabotage or otherwise disable our research, products and services, misappropriate our proprietary information, or that of our licensees and resellers, or their or our customers and partners, which may include personally identifiable information, or cause interruptions of our internal systems and services. Any cyber-attacks could negatively affect our reputation, damage our network infrastructure and our ability to deploy our products and services, harm our business relationships, and expose us to financial liability.

Our services, products, systems, and website and the data on these sources may be subject to intentional disruption that could materially harm our reputation and future sales.

Despite our precautions and ongoing investments to protect against security risks, data protection breaches, cyber-attacks, and other intentional disruptions of our products and services, we expect to be an ongoing target of attacks specifically designed to impede the performance and availability of our offerings and harm our reputation as a company. Similarly, experienced computer programmers or other sophisticated individuals or entities, including malicious hackers, state-sponsored organizations, and insider threats including actions by employees and third-party service providers, may attempt to penetrate our network security or the security of our systems and websites and misappropriate proprietary information or cause interruptions of our services. This risk has increased as more individuals are working from home and utilize home networks for the transmission of sensitive information. Such attempts are increasing in number and in technical sophistication, and if successful could expose us and the affected parties to risk of loss or misuse of proprietary or confidential information or disruptions of our business operations. While we engage in a number of measures aimed to protect against security breaches and to minimize problems if a data breach were to occur, our information technology systems and infrastructure may be vulnerable to damage, compromise, disruption, and shutdown due to attacks or breaches by hackers or due to other circumstances, such as error or malfeasance by employees or third-party service providers or technology malfunction. The occurrence of any of these events, as well as a failure to promptly remedy these events should they occur, could compromise our systems, and the information stored in our systems could be accessed, publicly disclosed, lost, stolen, or damaged. Any such circumstance could adversely affect our ability to attract and maintain licensees and resellers, and/or for us or our licensees and resellers to retain customers, as well as strategic partners, cause us to suffer negative publicity, and subject us to legal claims and liabilities or regulatory penalties. In addition, unauthorized parties might alter information in our databases, which would adversely affect both the reliability of that information and our ability to market and perform our services. Techniques used to obtain unauthorized access or to sabotage systems change frequently, are constantly evolving and generally are difficult to recognize and react to effectively. We may be unable to anticipate these techniques or to implement adequate preventive or reactive measures. Several recent, highly publicized data security breaches at other companies have heightened consumer awareness of this issue and may embolden individuals or groups to target our systems or those of our licensees, resellers, or strategic partners, or our or their customers.

Our products are complex and operate in a wide variety of environments, systems and configurations, which could result in failures of our products to function as designed and negatively impact our brand recognition and reputation.

Because we offer very complex products, errors, defects, disruptions, or other performance problems with our products may and have occurred. For example, we may experience disruptions, outages, and other performance problems due to a variety of factors, including infrastructure changes, human or software errors, capacity constraints due to an overwhelming number of users accessing our websites simultaneously, fraud, or security attacks. In some instances, we may not be able to identify the cause or causes of these performance problems within an acceptable period of time. Interruptions in our products could impact our revenues or cause licensees, resellers, clients, and customers to cease doing business with us. Our operations are dependent upon our ability to protect our technology infrastructure against damage from business continuity events that could have a significant disruptive effect on our operations. We could potentially lose end user/customer data or experience material adverse interruptions to our operations or delivery of products and services to our clients in a disaster recovery scenario. Further, our business would be harmed if any of these types of events caused our licensees, resellers, or customers, or our licensees’ and resellers’ customers or potential customers, to believe that our products are unreliable. We believe that our brand recognition and reputation are critical to retaining existing licensees, resellers, clients and customers, and attracting new licensees, resellers, clients, and customers. Furthermore, negative publicity, whether or not justified, relating to events or activities attributed to us, our employees, our strategic partners, our affiliates, or others associated with any of these parties, may tarnish our reputation and reduce the value of our brands. Damage to our reputation may reduce demand for our products and have an adverse effect on our business, operating results, and financial condition. Moreover, any attempts to rebuild our reputation and restore the value of our brands after such an event may be costly and time-consuming, and such efforts may not ultimately be successful.

If our products and services do not work properly, our business, financial condition and financial results could be negatively affected, and we could experience negative publicity, declining sales, and legal liability.

We produce complex products that incorporate leading-edge technology that must operate in a wide variety of technology environments. Software may contain defects or “bugs” that can interfere with expected operations in these varying technological environments. There can be no assurance that our testing programs will be adequate to detect all defects prior to the product being introduced, which might decrease customer satisfaction with our products and services. The product reengineering cost to remedy a product defect could be material to our operating results. Our inability to cure a product defect could result in the temporary or permanent withdrawal of a product or service, negative publicity, damage to our reputation, failure to achieve market acceptance, lost revenue and increased expense, any of which could have a material adverse effect on our business, financial condition and financial results.

Outages or problems with systems and infrastructure supplied by third-parties could negatively affect our business, financial condition and financial results.

Our business relies on third-party suppliers of the telecommunications infrastructure. We, our clients and customers and our licensees and resellers, and their customers, will use various communications service suppliers and the global internet to provide network access between our data centers and our customers and end-users of our services. If those suppliers do not enable us to provide our clients and customers, or our licensees’ and resellers’ customers with reliable, real-time access to our systems (to the extent required), we may be unable to gain or retain clients, customers, licensees and resellers. These suppliers periodically experience outages or other operational problems as a result of internal system failures or external third-party actions. Supplier outages or other problems could materially adversely affect our business, financial results and financial condition.

Current global financial conditions and recent market events have been characterized by increased volatility, and the resulting tightening of the credit and capital markets has reduced the amount of available liquidity and overall economic activity. We cannot guarantee that debt or equity financing, or the ability to generate cash from operations, will be available or sufficient to meet or satisfy our initiatives, objectives or requirements. Our inability to access sufficient amounts of capital on terms acceptable to us for our operations will negatively impact our business, prospects, liquidity and financial condition.

If we experience delays and/or defaults in payments, we could be unable to recover all expenditures.

Because of the nature of our contracts, at times we will commit resources to projects prior to receiving payments from the counterparty in amounts sufficient to cover our expenditures on projects as they are incurred. Delays in payments may require us to make a working capital investment. Defaults by any of our clients, customers, licensees, and resellers could have a significant adverse effect on our revenues, profitability and cash flow. Our clients, customers, licensees, and resellers may in the future default on their obligations to us or them due to bankruptcy, lack of liquidity, operational failure or other reasons deriving from the current general economic environment. If a client, customer, or licensee defaults on its obligations to us or our licensee, or a licensee or reseller defaults in its payments to us, it could have a material adverse effect on our business, financial condition, results of operations or cash flows.

We plan to grow aggressively and, if successful, our future growth may provide challenges to our organization, requiring us to expand our personnel and our operations. Future growth may strain our infrastructure, operations and other managerial and operating resources. If our business resources become strained, our earnings may be adversely affected, and we may be unable to increase revenue growth. Further, we may undertake contractual commitments that exceed our labor resources, which could also adversely affect our earnings and our ability to increase revenue growth.

Our growth depends in part on the success of our strategic relationships with third-parties.

In order to grow our business, we anticipate that we will need to continue to depend on our relationships with third-parties, including our technology providers. Identifying such third-parties, and negotiating and documenting relationships with them, requires significant time and resources. Our competitors may be effective in providing incentives to third-parties to favor their products or services over utilization of our products and services. In addition, acquisitions of our business partners by our competitors could result in a decrease in the number of our current and potential clients, customers, licensees, resellers, and end users. If we are unsuccessful in establishing or maintaining our relationships with third-parties, our ability to compete in the marketplace or to grow our revenue could be impaired and our results of operations may suffer. Even if we are successful, we cannot assure you that these relationships will result in increased use of our products or increased revenue.

As a company offering a wide range of products and services, we are regularly subject to actual and threatened claims, litigation, reviews, investigations, and other proceedings, including proceedings relating to goods and services offered by us and by third-parties, and other matters. Any of these types of proceedings, including currently pending proceedings as discussed herein, may have an adverse effect on us because of legal costs, disruption of our operations, diversion of management resources, negative publicity, and other factors. The outcomes of these matters are inherently unpredictable and subject to significant uncertainties. Determining legal reserves and possible losses from such matters involves judgment and may not reflect the full range of uncertainties and unpredictable outcomes. Until the final resolution of such matters, we may be exposed to losses in excess of the amount recorded, and such amounts could be material. Should any of our estimates and assumptions change or prove to have been incorrect, it could have a material effect on our business, consolidated financial position, results of operations, or cash flows. In addition, it is possible that a resolution of one or more such proceedings, including as a result of a settlement, could require us to make substantial future payments, prevent us from offering certain products or services, require us to change our business practices in a manner materially adverse to our business, requiring development of non-infringing or otherwise altered products or technologies, damaging our reputation, or otherwise having a material adverse effect on our operations.

As of September 30, 2024, our executive officers and directors owned approximately 46.0% of the Company’s total issued and outstanding shares. Because of this voting control through share ownership by the executive officers and directors, these individuals, acting as a group, have significant influence over corporate actions requiring a shareholder vote, including the selection of our directors, who in turn approve all executive officers, authorizing change-in-control transactions, amendments to our Articles of Incorporation, and other significant corporate matters. The interests of our executive officers and directors may differ from the interests of other stockholders with respect to the issuance of shares, business transactions with or sales to other companies, selection of future officers and directors and other business decisions. The minority stockholders will have no way of overriding the decisions made by our executive officers and directors acting as a group.

We face intense competition.

We expect to experience intense competition across all markets for our products and services. Our competitors that are focused on narrower product lines may be more effective in devoting technical, marketing, and financial resources to compete with us. In addition, barriers to entry in our businesses generally are low, and products and services, once developed, can be distributed broadly and quickly at a relatively low cost. Open-source software vendors are devoting considerable efforts to developing software that mimics the features and functionality of our current and anticipated products. These competitive pressures may result in decreased sales volumes, price reductions, and/or increased operating costs, such as for marketing and sales incentives, resulting in lower revenue, gross margins, and operating income.

Delays in product development schedules may adversely affect our revenues.

The development of cybersecurity products and services is a complex and time-consuming process. New products and services can require long development and testing periods. Future revenues may include the sale of new products and services that may not yet be developed. Significant delays in product development, including quality assurance testing or significant problems in creating new products and services, could adversely affect our revenue recognition from new products and services. Revenue in certain reporting periods could be lower than anticipated because product development problems could cause the loss of a competitive sale transaction, a delay in invoicing a client, customer, licensee, or reseller or the renegotiation of terms to retain a sale transaction.

The cybersecurity technologies market has grown quickly and is expected to continue to evolve rapidly. Moreover, many of our potential licensees and resellers and their customers operate in markets characterized by rapidly changing technologies and business plans, which require them to add numerous network access points and adapt increasingly complex enterprise networks, incorporating a variety of hardware, software applications, operating systems, and networking protocols. If we fail to accurately predict potential changing needs and emerging technological trends in the cybersecurity technology industry, including in the areas of mobility, virtualization, and cloud computing, our business could be harmed. If we experience unanticipated delays in the availability of new services, products, platform features, and subscriptions, or fail to meet expectations for such availability, our competitive position, financial results, and business prospects will be harmed.

Additionally, we must commit significant resources to developing new products and services before knowing whether our investments will result in services, products, subscriptions, and features that the market will accept. The success of new platform features depends on several factors, including appropriate new product definition, differentiation of new services, products, subscriptions, and platform features from those of our competitors, and market acceptance of these products, services and platform features. Moreover, successful new product introduction and transition depends on a number of factors including, our ability to manage the risks associated with new product production ramp-up issues, the availability of application software for new products, and the risk that new products may have quality or other defects or deficiencies, especially in the early stages of introduction. We cannot assure you that we will successfully identify opportunities for new products and services, develop and bring new products and subscriptions to market in a timely manner, or achieve market acceptance of our products and subscriptions, or that products, subscriptions, and technologies developed by others will not render our products, subscriptions, or technologies obsolete or noncompetitive.

Actual, possible, or perceived defects or vulnerabilities in our products or services, the failure of our products or services to detect or prevent a security breach, or the misuse of our products could harm our reputation and divert resources.

Because our products and services are complex, they may contain defects or errors that are not detected until after their commercial release and deployment. Defects or vulnerabilities may impede or block network traffic, cause our products or services to be vulnerable to electronic break-ins or cause them to fail to help secure networks. We are also susceptible to errors, defects, vulnerabilities, or attacks that may arise at, or be inserted into our products, which are out of our control. Different users deploy and use cybersecurity products in different ways, and certain deployments and usages may subject our products to adverse conditions that may negatively impact the effectiveness and useful lifetime of our products. Our networks and products, including any cloud-based technology we utilize, could be targeted by attacks specifically designed to disrupt our business and harm our reputation. Our products may not prevent all security threats. Because the techniques used by computer hackers to access or sabotage networks change frequently and generally are not recognized until launched against a target, we may be unable to anticipate these techniques. An actual, possible, or perceived security breach or infection of the network of one of the users of our products, regardless of whether the breach is attributable to the failure of our products or services to prevent the security breach, could adversely affect the market’s perception of our security products and services and, in some instances, subject us to potential liability that is not contractually limited. We may not be able to correct any security flaws or vulnerabilities promptly, or at all. Our products may also be misused by potential end users or third-parties who obtain access to our products. For example, our products could be used to censor private access to certain information on the internet. Such use of our products for censorship could result in negative press coverage and negatively affect our reputation, even if we take reasonable measures to prevent any improper shipment of our products or if our products are being used improperly or provided by an unauthorized third-party.

Any actual, possible, or perceived defects, errors or vulnerabilities in our products and services, or misuse of our products and services, could result in:

Risks Related to Our Intellectual Property

Our proprietary rights may be difficult to enforce, which could enable others to copy or use aspects of our products without compensating us.

1. Securing new vCISO clients

2. Adding new Cybersecurity Software and Services offerings

3. Increasing adoption of Cybersecurity Software, including Enclave and Services offerings at vCISO clients We internally report our revenue using two categories. The first, “vCISO Services,” captures the revenue the Chief Information Security Officer services that we provide to our clients on a “virtual” or outsourced basis, thus the acronym “vCISO.” Services delivered by SideChannel through our team of vCISOs include assessing the cybersecurity risk profile, implementing policies and programs to mitigate risks, and managing the day-to-day tasks to ensure compliance with the adopted cybersecurity framework. Most of our clients use our vCISO services.

vCISO engagements typically include a fixed monthly subscription fee with durations longer than twelve (12) months. Hourly rates for vCISO time and material projects range from $350 to $450. Each of our vCISOs is generally embedded into the C-suite executive teams of two (2) to four (4) of our clients.

Our second revenue category encompasses an array of Cybersecurity Software and Services that our clients deem necessary to protect their digital assets. These augment our vCISO offering and include a full range of other cybersecurity products and services delivered through a team of security engineers along with a network of third-party service providers and value-added resellers (“VARs”). Commercial relationships with third-party service providers and VARs provide SideChannel with additional internal capabilities to mitigate cybersecurity risks. We earn licensing revenue from software contracts and commissions from third-party service provider partnerships which are included in this revenue category.

During September 2022 we announced a proprietary product called Enclave which simplifies important cybersecurity tasks called “asset inventory,” and “microsegmentation.” Enclave seamlessly combines access control, microsegmentation, encryption and other secure networking concepts to create a comprehensive solution. It allows Information Technology to easily segment the enterprise network, place the right staff in those segments and direct traffic.

The growth in vCISO Services reflects both growth in clients served and an increase in revenue per client. Cybersecurity Software & Services revenue grew from 2023 to 2024 primarily because of an increase in the use of these services by existing Cybersecurity Software and Services clients and secondarily because of an expansion of the services and software offered.

Gross Margins. Gross margins decreased to 47.7% in fiscal year 2024 from 50.7% in fiscal year 2023, which we attribute to lower utilization of our service delivery team employees and an increase in revenue from third-party software and services which have a lower gross margin.

Operating Expenses. Total operating expenses during fiscal year 2024 were $4.5 million compared to fiscal year 2023 total operating expenses of $5.6 million excluding $214 thousand of prior year acquisition costs and intangible asset impairment of $4.9 million. In May 2023, we began eliminating operating expenses which, combined with our increase in gross profit, have enabled us to lower our breakeven revenue point and attain positive cash flow from operations during fiscal year 2024. The operating expense reductions were achieved by staff reductions in all areas of the business and the elimination of non-essential third-party supplier relationships.

Intangible Asset Impairment. The intangible asset impairment was zero ($0) for the year ended September 30, 2024, and $4.9 million for the prior year. We recorded a finite-lived intangible asset of $4.9 million as a result of acquiring Enclave in the Business Combination. Our impairment testing indicated the full value of this finite-lived intangible asset should be impaired as of September 30, 2023. Incurring impairment neither indicated a decrease in our emphasis on Enclave as a key initiative nor did it suggest a lack of market interest in the product.

Business Combination related costs. Business Combination related costs were zero ($0) in fiscal year 2024 and $214 thousand for the year ended September 30, 2023, which are attributed to an increase in the Second Tranche shares due to the Closing Working Capital Adjustment from the Business Combination.

Financing Activities. We paid a $50 thousand note to Akash Desai in December 2023. The note was related to a December 2021 agreement for the redemption of Mr. Desai’s interest in SideChannel LLC. The December 2023 payment completed our obligations to Mr. Desai.

General and Administrative Expenses. Our general and administrative expenses were $724 thousand for the three months ended March 31, 2026, compared to $655 thousand for the three months ended March 31, 2025, representing an increase of $69 thousand or 10.5%. The increase was the result of higher personnel and public entity expenses as well as the impact of the elimination of our allowance for doubtful accounts in 2025, which was not the case in 2026, partially offset by lower consulting, legal, and amortization costs in the current fiscal year.

Research and Development Expenses. Our research and development expenses were $179 thousand for the three months ended March 31, 2026, compared to $120 thousand for the three months ended March 31, 2025, representing an increase of $59 thousand or 49.2% due to an increase in employees and compensation.

Six Months Ended March 31, 2026, Compared to Six Months Ended March 31, 2025

Revenue. Our revenue was $3.4 million for the six months ended March 31, 2026, compared to $3.8 million for the six months ended March 31, 2025, representing a decrease of $452 thousand or 11.9%. This decrease was primarily due to the loss of clients with higher than average contract value.

Gross Profit. Our gross profit was $1.8 million and gross margin was 52.3% for the six months ended March 31, 2026, compared to $1.8 million and gross margin was 47.7% for the six months ended March 31, 2025. The increase in our gross margin was the result of Enclave, which has a high gross margin, contributing a larger percentage of our revenue in the six months ended March 31, 2026, than for the six months ended March 31, 2025. Additional factors contributing to our gross margin increase in the six months ended March 31, 2026, were improved utilization of service delivery employees in the current fiscal year compared to the prior fiscal year.

Operating Expenses. Operating expenses increased $518 thousand or 24.9% for the six months ended March 31, 2026, compared to the six months ended March 31, 2025. The changes for each operating expense area are discussed below.

General and Administrative Expenses. Our general and administrative expenses were $1.4 million for the six months ended March 31, 2026, compared to $1.3 million for the six months ended March 31, 2025, representing an increase of $85 thousand or 6.5%. The increase was the result of higher personnel expenses as well as the impact of the elimination of our allowance for doubtful accounts in 2025, which was not the case in 2026, partially offset by lower consulting, legal, and amortization costs in the current fiscal year.