Telos Corp: Form 10-K for the period ended Dec 31, 2024

Business Overview

Telos Corporation is a Maryland corporation headquartered in Ashburn, Virginia. Telos Corporation, together with its subsidiaries (the "Company" or "Telos" or "We"), offers technologically advanced, software-based security solutions that empower and protect the world's most security-conscious organizations against rapidly evolving, sophisticated and pervasive threats. Our portfolio of security products, services and expertise endows our customers with capabilities to reach new markets, serve their stakeholders more effectively, and successfully defend the nation or their enterprise with confidence in their security and privacy.

Our mission is to protect people, organizations, and information through trusted solutions that proactively manage risk, compliance, and persistent digital identity. We do this by developing robust, reliable, and uncompromising solutions for our customers, creating a workplace that engages and inspire our employees, and providing value to our shareholders to ensure a lasting legacy of excellence. In the current global environment, our mission is more critical than ever. The emergence of each new information and communications technology ("ICT") introduces new vulnerabilities, as security is still too often overlooked in solution development. Networks and applications meant to enhance productivity and profitability often jeopardize an organization due to poor planning, misconfiguration, or an unknown gap in security. Ransomware, insider threats, cybercrime, and advanced persistent threats continue to menace public and private enterprises across all industries.

Cybersecurity, cloud security, and enterprise security of the modern organization share much in common, yet also call for a diverse range of skills, capabilities, and experience in order to meet the requirements of security-conscious customers. Our vision is to create a more secure, interconnected world as the trusted leader in innovative digital security solutions that safeguard people, organizations, and information. Decades of experience in developing, orchestrating, and delivering solutions across these three domains give us the vision and the confidence to provide solutions that empower and protect the enterprise at an integrated, holistic level. Our experience in addressing challenges in one area of an enterprise helps us meet requirements in others. We understand that a range of complementary capabilities may be needed to solve a single challenge, and we also recognize when a single solution might address multiple challenges. Our security solutions span these three domains: cybersecurity, cloud security and enterprise network security.

Our Business Segments

We conduct our business through two reportable and operating segments: Security Solutions and Secure Networks. These segments enable the alignment of our strategies and objectives and provide a framework for the timely and rational allocation of resources within the line of business.

Additional information regarding our segments is presented in Note 18 – Segment Information to the consolidated financial statements at Item 8 of this Form 10-K.

Security Solutions Segment:

The Security Solutions segment focuses on cybersecurity, cloud, identity solutions, and secure messaging. Cybersecurity solutions help our customers ensure the ongoing security, integrity and compliance of their on-premises and related cloud-based systems by reducing threats and vulnerabilities to foil cyber adversaries before they can attack. Our security engineers and subject matter experts assess our customers' cybersecurity environments and design, engineer, and operate systems needed to strengthen their cybersecurity postures. Our cloud solutions leverage the specialized skills and experience needed to help our customers plan, engineer, execute, and accelerate secure cloud migrations while assuring ongoing management and security of enterprise cloud technology environments. Our identity solutions deliver digital identity, biometric, and nationwide enrollment services and address Know Your Customer and identity management challenges for enterprises working within regulated and critical infrastructure environments. Our secure messaging services are used to securely transmit messages that provide direction and establish a formal position, commitment, or responses requiring the authority of an organization. Security Solutions represented 71% and 53% of total revenues for fiscal years 2024 and 2023, respectively.

The Security Solutions segment offers the following solutions and services:

• Xacta®:

Xacta® is a premier platform for enterprise cyber risk management and security compliance automation, delivering security awareness for systems in the cloud, on-premises, and in hybrid and multi-cloud environments. Xacta delivers automated cyber risk and compliance management solutions to large commercial and government enterprises. Across the United States ("U.S.") federal government, Xacta is a leading commercial cyber risk and compliance management solution. With use cases including cyber risk management, risk remediation management, security authorization, compliance management, audit management, inventory management, vulnerability management, continuous compliance monitoring, and vendor and supply chain risk management, Xacta administers the key elements of more than 100 leading regulations and policies for IT security compliance, including the National Institute of Standards and Technology ("NIST") Risk Management Framework ("RMF"), RMF for Department of Defense ("DoD") IT, Committee on National Security Systems Instruction No. 1253, NIST Cybersecurity Framework, the Federal Risk and Authorization Management Program ("FedRAMP") and the DoD's Cybersecurity Maturity Model Certification ("CMMC") program.

• Cybersecurity Services:

We offer solutions and services for the full cybersecurity lifecycle, including Risk Management Framework ("RMF") consulting services, assessment and compliance, engineering and evaluation, operations, and penetration testing. With a pedigree in information and cybersecurity that spans three decades, our multi-certified cybersecurity personnel provide services and solutions that deliver continuous security assurance for business, government, and public sector critical infrastructure.

• Telos Automated Message Handling System ("Telos AMHS™"):

Telos AMHS is a web-based organizational message distribution and management solution for mission-critical communications; the recognized gold standard for organizational messaging in the U.S. government. Telos AMHS is used by military field operatives for critical communications on the battlefield using the Defense Information System Agency's Organizational Messaging Service and its specialized communications protocols. Telos AMHS is also used by the Intelligence Community ("IC") for timely situational awareness and assessment reporting utilizing the Director of National Intelligence's Information Transport Service, Organizational Messaging data standards and computing infrastructure. Because Telos AMHS supports timely and reliable delivery for authoritative communications, its uses include terrorist warnings, "eyes-only" messages, military execution orders, intelligence information, overflight clearances, and Emergency Action Messages for nuclear command and control. Information exchanged at this level and for these purposes requires operational requirements for time-sensitive, guaranteed delivery, precedence, high availability, and reliability.

• Digital Identity Solutions:
• IDTrust360® is an enterprise digital trusted identity risk platform for extending flexible hybrid cloud identity services. This platform is enabled for mobile, enterprise environments and custom digital identity services that mitigate threats by integrating advanced technologies that fuse biometrics, credentials, and other identity-centric data used to continuously monitor trust. IDTrust360 is a commercially owned and operated platform with direct interfaces to the Federal Bureau of Investigation's ("FBI") criminal records, Department of Homeland Security's ("DHS") terrorist watch list service, U.S. Department of Treasury's pay.gov, other government identity risk management systems, and numerous commercial identity, intelligence, and risk-based data sources. We actively engage with federal customers to integrate vital event records, government identification document records, and other fingerprint-based biometric records hosted across multiple agencies. This enables Telos to offer NIST-compliant digital identity services aligned with federal security mandates.
• ONYX®, a mobile touchless fingerprint software development kit, enables secure biometric authentication by leveraging standard smartphone cameras to capture and process high-quality fingerprint images without physical contact. It uses artificial intelligence (“AI”) neural networks for finger detection and automatic acquisition, along with a patented image processing algorithm to generate precise, machine-matchable fingerprints. Targeting markets such as financial services, healthcare, government, and enterprise security, ONYX is ideally suited for use cases including mobile banking, field identification for law enforcement, telemedicine identity verification, secure access control, and remote onboarding. Its value proposition lies in delivering a cost-effective, scalable, and user-friendly biometric solution that eliminates the need for specialized hardware, enhances security with liveness detection, and supports seamless integration across iOS and Android platforms, empowering organizations to strengthen identity management and combat fraud efficiently

Telos’ sovereign, reusable Identity-as-a-Service Solution ("IDaaS") is designed for the use of government agencies, mobile network operators, banking organizations and others who need to incorporate a zero-trust method of identity verification into existing know-your-customer and onboarding processes, while striving to remain in front of international data protection and privacy regulations. This user-controlled system empowers individuals to hold and manage their own identity data, presenting it securely to relying parties or verifiers while ensuring trust through server-side biometric authentication powered by our proprietary ONYX technology. Organizations leveraging the IDaaS solution offered by Telos save on the cost and effort of onboarding new users without worrying about the complexities of verifying individual identities. The solution provides fully proofed and vetted reusable identities to reduce risk across all identity-related enterprise events, and fosters trust across markets such as financial services, healthcare, government, and enterprise security for use cases like digital wallets, remote onboarding, and secure access control. We maintain government certifications and designations that distinguish Telos ID, including TSA PreCheck® enrollment provider, Aviation Channeling Services provider, FBI-approved Channeler, and Financial Industry Regulatory Authority Electronic Fingerprint Submission provider.

Secure Networks Segment:

With a focus on enterprise security, the Secure Networks segment provides secure networking architectures and solutions to our customers through secure mobility solutions and network management and defense services. Our net-centric solutions enable collaboration and connectivity to increase efficiency, reduce costs, and improve mission outcomes. Telos provides an extensive range of wired and wireless, fixed and deployable, classified and unclassified voice, data, and video secure network solutions and services to support defense and civilian missions. Our capabilities include network design, operations and sustainment, system integration and engineering, network security and compliance, deployable comms, service desk, defensive cyber operations, and program management. Secure Networks represented 29% and 47% of total revenues for the years ended December 31, 2024 and 2023, respectively.

The Security Networks segment offers the following solutions and services:

• Secure Mobility:

We offer solutions for business and government that enable work off-premise and minimize operational and security concerns across and beyond the enterprise. Our secure mobility team brings credentials to every engagement, supplying deep expertise and experience, highly desirable clearances and industry-recognized certifications for network engineering, mobility, and security. We also offer secure mobility professional services, such as consulting and deployment services, to deliver integrated communications solutions that meet even the most complex needs of civilian, defense, and commercial customers.

• Network Management and Defense:

We provide services for operating, administrating, and defending complex enterprise networks and services for defensive cyber operations. Our diverse network management and defense capabilities address common and uncommon requirements in many industries and disciplines, from military to government agencies. Telos network engineers, security specialists, and program managers are experienced with advanced DoD and federal networks and are certified in the leading tools, technologies, and best practices for network management and administration. We ensure the consistency and continuity of network management services required in today's mission-critical network environments.

Drivers for Future Growth

We are pursuing multiple strategies in order to grow our business, which include:

• Ramp our pre-existing programs. Capitalizing on organic growth opportunities is a key to our core business. Our strategy includes increasing the scope of our existing contracts through renewal or expansion of our offerings.
• Rebuild our contract vehicles portfolio. Notable contracts with our key customers, mainly U.S. federal government agencies, require bidders to be pre-approved on registered contract vehicles. We strive to have prime or subcontractor positions on a wide range of contracts to allow our customers and potential customers an opportunity to access our solutions and services through Indefinite Delivery / Indefinite Quantity ("IDIQ") and definite contract vehicles.
• Broaden our reach within the U.S. federal government. We have historically focused on the U.S. federal government and believe we are an established leader in providing security solutions to federal agencies. Nonetheless, we believe the U.S. federal government continues to represent a significant growth opportunity, and we expect to continue to invest in products and solutions to serve additional customers within the U.S. federal government.

For example, Xacta is included on DHS's Continuous Diagnostics and Mitigation Approved Product List to provide federal agencies with innovative security tools, which we believe presents us with an excellent opportunity to pursue contracts with additional federal agencies. In addition, Xacta is available for use in the Amazon Web Services ("AWS") GovCloud (U.S.), Oracle and Azure Government.

• Leverage our diverse security solutions to target market expansion. Our offerings are designed to have broad applications and include cloud and network security risk and compliance, secure messaging, and identity vetting through biometric capture and analysis. We believe we are well-positioned to sell our capabilities into a dynamic and growing commercial opportunity set and will continue innovating to address emerging and unique requirements.

For example, we have leveraged core Xacta functionality to meet the needs of large financial services and customer relationship management ("CRM") firms. We have also leveraged our U.S. federal government identity management qualifications to improve the speed and accuracy of vetting results for more than 100 airports, air carriers, and general aviation operators across the country. We intend to continue innovating and developing additional offerings for cloud, mobile, and Internet of Things ("IoT") devices.

• Pursue strategic investments and partnerships. We believe that our markets remain fragmented, with many niche players providing limited product solutions targeting narrow customer segments. Given the breadth of our solution set and our customer end markets, we believe we are well-positioned to opportunistically invest in and/or build partnerships with smaller companies, and incorporate their technology or deploy their solutions across a larger customer set. We believe a targeted and opportunistic investment strategy will be a force multiplier for our organic growth opportunity.
• Invest strategically into groundbreaking research and development for our intellectual property. We believe artificial intelligence – large language models can offer an unparalleled advantage to our customers in automation and cost savings, a cornerstone of our Xacta platform. Telos has begun making strategic investments to bring meaningful AI capabilities to our platform.

Our Customers

Our primary customers include the U.S. federal government, large commercial businesses, state and local governments, and international customers. Our consolidated revenues are largely attributable to prime contracts or subcontracts with our contractors engaged in work for the U.S. government, with the remaining attributable to state and local governments, and commercial markets.

Our U.S. federal government customers include the DoD, the IC, and multiple civilian and public sector agencies, including DHS, the U.S. Department of Justice, the U.S. Department of Energy, the U.S Department of the Treasury, the U.S. Social Security Administration, the U.S. Environment Protection Agency, and more. These customers have a number of subsidiary agencies with separate budgets and procurement functions. Our contracts may be with the highest level of these agencies or with the subsidiary agencies of these customers.

Our commercial customers include some of the largest technology, communications, and professional services companies in the U.S.

Sales and Marketing

As part of our sales and marketing investments, we also make corporate investments in functional areas such as contracts, solution architects, lead generation tools, and operations to ensure our back-office systems and processes scale for business growth.

Sales

We sell our products and services leveraging a direct sales approach, with a small subset being executed through a handful of partner organizations. Our customer acquisition success extends to commercial customers and vendors seeking to do business with the U.S. federal government, however our largest portion of revenue lies with the U.S. government itself.

Our sales strategy is to establish a customer foothold with one of our solutions and work to achieve rapid success. We then leverage this customer relationship to generate interest in other solutions from the Telos portfolio. We have a variety of upsell opportunities that allow us to expand our presence within a customer account.

Much of our business is awarded through the submission of formal competitive bids; however, a portion of our revenue is awarded through limited competition or sole-source contracts.

Partner Organizations

Our sales team works with partner organizations like AWS, Microsoft Azure, and IBM to pursue mutual customers and leverage their marketplace platforms and marketing programs.

Marketing

We build market awareness of Telos and our solutions through a variety of marketing programs, including regular briefings with industry analysts, public relations activities, trade show exhibitions, speaking engagements, and digital marketing. We will continue investing in these activities and targeting additional vertical-specific content creation, targeted advertising and brand awareness campaigns, social media campaigns, and search engine marketing.

Our sales team works hand in hand with our marketing team and various subject matter experts to develop targeted awareness campaigns for our various solutions that generate valuable leads and contacts.

Research and Development

We developed proprietary software-based solutions in various platforms related to security and cyber risk management. We invest substantial resources in research and development to innovate new solutions, enhance our offerings and grow opportunities by developing new features and modules for our existing platforms. See Note 2 - Significant Accounting Policies (under the caption "Research and Development") included in our notes to consolidated financial statements.

We are leveraging our improved agile innovation and rapid automated development practices to rapidly establish prototypes that we can fully test for suitability and to pre-establish enterprise risk level across a variety of government networks and clouds. We are committed to and view our continued investment in research and development as a key factor to our long-term business success.

Human Capital Resources

As of December 31, 2024, we had 519 employees, of which 504 were full-time employees. As of December 31, 2024, approximately 89% of our workforce was located in the United States. Approximately 294 of our U.S.-based employees held U.S. security clearances, and 26% self-identified as veterans of U.S. military service as of that date. Our employees are not represented by a labor union or covered by a collective bargaining agreement. We have not experienced any work stoppages, and we consider relations with our employees to be good.

Telos places a strong emphasis on supporting our people. Our management team is committed to maintaining a corporate culture that fosters mutual respect and job satisfaction for our people while delivering innovation and value to customers and shareholders. This commitment is reflected in our core values:

Always with integrity, at Telos we:

Build trusted relationships,

Work hard together,

Design and deliver superior solutions, and

Have fun doing it.

These values are woven throughout the fabric of Telos; they are reflected in our hiring practices, reinforced regularly, and reviewed during appraisals. Employees are encouraged to challenge themselves and each other to exhibit the core values in all activities.

Our employees are given avenues of communication and interaction should they observe activities inconsistent with our core values. While employees are encouraged first to speak openly about any issues, a 24/7 hotline provides an opportunity to express concerns anonymously.

We consider the foundational value of integrity to be a non-negotiable requirement of employment, and an expectation of suppliers, partners, and our customers. We guard our reputation and will take necessary action to protect it. An essential part of our brand promise is always to engage employees, customers, partners, suppliers, and investors with integrity.

As part of our effort to improve our disclosures around human capital issues, we provided a public report pursuant to the Sustainability Accounting Standards Board ("SASB") Software & IT Service Standard, which addresses, in part, metrics relating to recruiting and managing a global, diverse and skilled workforce.

Talent Acquisition and Retention

We operate in a very competitive environment for talent. To ensure we can attract the most well-qualified employees, we employ strategic sourcing methods, innovative recruitment campaigns, and inclusive outreach initiatives to attract a diverse pool of candidates. This involves leveraging various channels, such as job boards, social media platforms, and diversity-focused partnerships, to engage with candidates from different backgrounds and experiences.

We continuously make improvements to our employee value proposition, including enhancements on benefits available to employees, increasing paid time off and parental leave, accelerating the vesting period for stock matched by the Company in employees' 401(k) plans, instituting a new performance management program, and various supplemental programs to support our employees' physical, mental and financial well-being.

In addition, at Telos, we help our employees succeed by providing flexibility in where and how they work. The employees' ability to work remotely or in a hybrid arrangement is a strategy that helps us attract, hire and retain the best people, regardless of their specific location. This strategy increases employee empowerment and satisfaction, drives efficiency, and enables us to hire from a broad and diverse talent pool.

We are committed to providing a work environment free of discrimination and harassment, where our employees can do their best work, bring their whole selves to work, feel supported, and in turn, support others. We strive to create a working environment where everyone feels included and respected and has an equal opportunity to contribute. We promote collaboration and encourage employees to maximize their potential by bringing varied views, experiences, and perspectives to their work. Our objective is to continue to improve our hiring, development, training, advancement, and retention of talent and to foster a synergistic environment at Telos.

Seasonality

We generally experience seasonality due to our key customers' fiscal year ends and procurement cycles. We derive a substantial portion of our revenue from the U.S. government, whose fiscal year ends on September 30 of each year, which may impact our third fiscal quarter. In addition, our quarterly results may be impacted by the number of working days in a given quarter. See "Risk Factors — We are subject to the seasonality of U.S. government spending."

Government Contracts and Regulation

Our business is heavily regulated, and we must comply with and are affected by laws and regulations relating to the formation, administration and performance of U.S. government and other contracts. U.S. government contracts generally are subject to the Federal Acquisition Regulation ("FAR") and Defense Federal Acquisition Regulation Supplement ("DFARS"), which sets forth policies, procedures and requirements for acquiring goods and services by the U.S. government, and agency-specific regulations that implement or supplement the FAR or DFARS. These regulations impose a broad range of requirements, many of which are unique to government contracting, including various procurement, security, contract pricing and cost, contract termination, and adjustments and audit requirements. These laws and regulations, among other things:

• Impose specific and unique cost accounting practices that may differ from Generally Accepted Accounting Principles in the United States of America ("U.S. GAAP" or "GAAP") and therefore require reconciliation;
• Define allowable and unallowable costs and otherwise govern our right to reimbursement under various cost-type U.S. government contracts;
• Require compliance with U.S. government Cost Accounting Standards;
• Require reviews by the Defense Contract Audit Agency, Defense Contract Management Agency and other U.S. government agencies for compliance with government requirements for a contractor's business system; and
• Restrict the use and dissemination of, and require the protection of, unclassified contract-related information and information classified for national security purposes and the export of certain products and technical data.

U.S. government customers employ several contracting methods to purchase services and products. Budgetary pressures and reforms in the procurement process have caused many U.S. government customers to increasingly purchase services and products using contracting methods that allow them to select multiple contract winners or pre-qualify certain contractors to provide services or products on established general terms and conditions rather than through single-award contracts. The predominant contracting methods through which U.S. government agencies procure services and products include definitive award contracts, IDIQ contracts, Blanket Purchase Agreements ("BPAs"), U.S. General Service Administration ("GSA") schedule contracts and other transactional agreements ("OTA").

Government contracts are subject to congressional funding. Consequently, at the outset of a program, a contract is usually partially funded, and Congress annually determines if additional funds are to be appropriated to the contract. All of our government customers have the right to terminate their contract with us at their convenience or in the event that we default. Most of our contracts have cancellation terms that permit us to recover all or a portion of our incurred costs and fees for work performed where the U.S. government issues a termination for convenience.

A portion of our business is classified by the U.S. government and cannot be specifically described. The operating results of these classified programs are included in our consolidated financial statements.

These regulations and risks are described in more detail below under Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

Environmental, Social, and Governance Matters

We strive to operate our business in an environmentally responsible manner and in support of sustainable long-term financial performance. Our Environmental, Social and Governance ("ESG") task force is charged with addressing climate and environmentally-related risks and opportunities, including our publicly-disclosed climate transition plan. The Company publicly reports certain climate change-related information via CDP and provides public sustainability disclosures using the SASB Software & IT Service Standard. By making these disclosures, however, we have not concluded that the information disclosed is material to our business and this information is not incorporated by reference into and is not a part of this Annual Report on Form 10-K. The Board of Directors authorized the Nominating and Corporate Governance Committee to oversee the Company's ESG efforts, which include climate-related risks and opportunities.

See Item 1A, "Risk Factors," for discussion of risks related to global climate and ESG matters.

Company Website and Available Information

Our corporate headquarters is located at 19886 Ashburn Road, Ashburn, Virginia 20147, and our telephone number is (703) 724-3800. Our website can be accessed at www.telos.com (http://www.telos.com), which contains information about our Company and operations. Through a link on the Investor Relations section of our website, copies of each of our filings with the U.S. Securities and Exchange Commission ("SEC") can be viewed and downloaded free of charge as soon as reasonably practicable after the reports and amendments are electronically filed with or furnished to the SEC. The information on our website is not incorporated by reference into and is not part of this Annual Report on Form 10-K.

The SEC also maintains a website (www.sec.gov (http://www.sec.gov)) that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC, including Telos.

In your evaluation of the Company and business, you should carefully consider the risks and uncertainties as described below, together with the information included elsewhere in this Annual Report on Form 10-K and other documents we file with the SEC. These factors, as well as additional risks and uncertainties not currently known to us or that we currently believe are immaterial, may currently have, or may have, a significant impact on our business, operating results or financial condition. Actual results could differ materially from those projected in the forward-looking statements contained in this Form 10-K as a result of the risk factors discussed below and elsewhere in this Form 10-K.

Business and Operational Risks

Our business could be negatively affected by cyber or other information security breaches, threats or other disruptions.

We routinely experience cybersecurity threats, threats to our information technology infrastructure and attempts to gain access to our sensitive information, as do our customers, suppliers, prime and subcontractors, and joint venture partners. We experience similar security threats at customer sites that we operate and manage as a contractual requirement. The threats we face vary from attacks common to most industries to more advanced and persistent, highly organized adversaries who target us because we protect national security information. While we have security measures in place to protect our data and the data of our customers or end-users of our services, our services and underlying infrastructure may in the future be materially breached or compromised as a result of the following:

• Third-party attempts to fraudulently induce employees or customers into disclosing sensitive information such as user names, passwords or other information to gain access to our customers' data, our data or our IT systems;
• Efforts by individuals or groups of hackers and sophisticated organizations, including state-sponsored organizations or nation-states;
• Cyberattacks on our internally built infrastructure;
• Vulnerabilities resulting from enhancements and updates to our existing solutions;
• Vulnerabilities in the products or components across the broad ecosystem that our services operate in or are dependent on;
• Vulnerabilities existing within newly acquired or integrated technologies and infrastructures;
• Vulnerabilities existing within third-party software or services that we employ;
• Attacks on, or vulnerabilities in, the many different underlying networks and services that power the Internet that our products depend on, most of which are not under our control or the control of our vendors, partners, or customers; and
• Employee or contractor errors or intentional acts that compromise our security systems.

To the extent possible, these risks are mitigated by our ability to maintain and improve information security governance policies, enhanced processes and internal security controls, including our ability to escalate and respond to known and potential risks. Although we have developed systems and processes designed to assess, identify, and manage material cybersecurity risks, we can provide no assurances that such systems and processes will provide absolute security. In the normal course of business, we are the target of malicious cyberattack attempts. To date, any such attempts have not been material to us, including to our reputation or business operations, or had a material financial impact, but there can be no assurance that future cyberattacks will not be material.

A security breach or incident could result in unauthorized parties obtaining access to, or the denial of authorized access to, our IT systems or data, or our customers' systems or data, including intellectual property, proprietary, sensitive, or other confidential information. A security breach or incident could result in the unauthorized disclosure of large quantities of our customers' personally identifiable information. A security breach could also result in a loss of confidence in the security of our services, damage our reputation, negatively impact our future sales, disrupt our business and lead to increases in insurance premiums and legal and financial exposure and liability. Finally, the detection, prevention and remediation of known or potential security vulnerabilities, including those arising from third-party hardware or software, may result in additional financial burdens due to additional direct and indirect costs, such as additional infrastructure capacity spending to mitigate any system degradation.

If our customers do not renew their subscriptions or contracts for our solutions and services and expand our relationships with them, our revenue could decline and our results of operations would be adversely impacted.

To continue to maintain and grow our business, it is important that our existing customers renew their subscriptions or contracts for our solutions and services when existing contract terms expire. Our customers have no obligation to renew or extend their subscriptions or contracts for our solutions or services after the expiration of the contractual periods, which vary in length, and in the normal course of business, some customers have elected not to renew or extend. It is difficult to predict attrition rates given the varying needs of our customer base. Our attrition rates may increase or fluctuate as a result of a number of factors, including customer dissatisfaction with our services, customers' spending levels, mix of customer base, decreases in the number of users at our customers, competition, pricing increases or changes, and deteriorating general economic conditions or budgetary constraints.

Our future success also depends in part on our ability to expand our relationships with our current customers by selling additional features, solutions and services, more subscriptions or enhanced editions of our solutions and services. This may also require increasingly sophisticated and costly sales efforts that are targeted at senior leaders. Similarly, the rate at which our customers purchase new or enhanced solutions and services depends on a number of factors, some of which are beyond our control.

If our efforts to maintain and expand our relationships with our existing customers are not successful, our business could be harmed.

The U.S. government may terminate, cancel, delay, modify or curtail our contracts at any time prior to completion and, if we do not replace them, this may adversely affect our future revenues and could adversely impact our earnings.

Many of the U.S. government programs in which we participate, both as a contractor or subcontractor, extend for several years and include one or more base years and one or more option years. These programs are typically funded on an annual basis. Under these contracts, the U.S. government generally has the right not to exercise options to extend or expand our contracts and may otherwise terminate, cancel, modify or curtail our contracts at its convenience.

First, the process may be delayed or disrupted. Changes in congressional schedules, administration priorities, negotiations for program funding levels or unforeseen world events can interrupt the funding for a program or contract. Second, funds for multi-year contracts can be changed in subsequent years in the appropriations process. In addition, the U.S. government has increasingly relied on IDIQ contracts and other procurement vehicles that are subject to a competitive bidding and funding process even after the award of the basic contract, adding an element of uncertainty to future funding levels. Delays in the funding process or changes in funding or funding priorities can impact the timing of available funds or can lead to changes in program content, delay or termination at the government's convenience.

Any decisions by the U.S. government to not exercise contract options or to terminate, cancel, delay, modify or curtail our major programs or contracts would adversely affect our revenues, revenue growth and profitability.

Federal government spending reductions, workforce changes, and policy shifts may impact our existing operations and future opportunities for new contracts.

Uncertainty exists regarding how future budget and program decisions will unfold, including the spending priorities of the new U.S. presidential administration and Congress, and what challenges budget reductions will present for us and our industry generally. The current administration's efforts to reduce the size and spending of the federal government pose several potential risks to our operations. The focus on reducing government spending may lead to fewer contracts being awarded, reduced contract values, or delays in the awarding of contracts. Changes in federal priorities may result in a shift away from governance, risk and compliance software solutions, cybersecurity, and digital identity services, potentially reducing demand for our offerings.

Budgetary constraints and spending freezes may lead to delays in contract awards and renewals, as well as modifications or terminations of existing contracts. This could disrupt our revenue streams and require adjustments to our operations and workforce. As federal agencies adjust their spending priorities, there may be a reduction in new business opportunities, limiting our growth prospects and market expansion efforts.

Terminations, reductions in force, and hiring freezes within federal agencies may lead to a loss of institutional knowledge and expertise, resulting in delays or disruptions in project execution. Workforce shortages may also affect contract management and oversight, impacting the quality and timeliness of our service delivery.

The uncertainty surrounding federal budget allocations, workforce changes, and policy shifts may hinder our ability to execute long-term strategic initiatives and build and maintain long-term relationships with key government stakeholders. As federal agencies face staffing challenges and budget constraints, there may be increased competition among contractors for limited government resources and attention, leading to more stringent contract terms and lower profit margins.

We continue to monitor these developments closely and are actively engaging with stakeholders to mitigate potential adverse impacts. However, there can be no assurance that we will be able to fully offset the effects of any reductions in federal government spending, workforce changes, or policy shifts on our business operations and customer relationships.

We are dependent on a few key customer contracts for a significant portion of our future revenue, and a significant reduction in goods and services or delay in implementation to one or more of these contracts would reduce or delay our future revenue and could materially affect our anticipated operating results.

A small number of our large customer contracts are expected to comprise a significant portion of our future revenue. Our business will likely be harmed if any of our key customer contracts generate less revenue than we forecast, and the termination or delay of a large contract or multiple contracts could have a material adverse effect on our revenue and profitability. Adverse events affecting the programs subject to these contracts, such as a significant decline in the traveling public or any significant supply chain delay, could also negatively affect our ability to process transactions under those contracts, which could adversely affect our revenue and the results of operations.

A failure to attract, train, retain and motivate key and skilled employees, including key members of our management team, would adversely affect our ability to execute our strategy and may disrupt our operations.

Our business relies heavily upon the expertise and services of our employees. Our success depends upon the continued services of our highly qualified and experienced executive officers and other key members of management. From time to time, there may be changes in our executive management team resulting from the hiring or departure of executives. Such changes in our executive management team may be disruptive to our business.

We are also substantially dependent on the continued service of our existing highly trained and skilled personnel, particularly our business development and operations group, because of the complexity of our services and technologies. The technology industry is subject to substantial and continuous competition for engineers and other subject matter experts with high levels of experience in designing, developing and managing software, cybersecurity, and Internet-related services, as well as competition for sales executives, data scientists and operations personnel. Competition for skilled personnel is intense and many U.S. government programs also require contractors to have security clearances, which can be difficult and time-consuming to obtain.

We may not be successful in attracting and retaining qualified personnel. From time to time, we have experienced, and we expect to continue to experience, difficulty in hiring, developing, integrating and retaining highly skilled employees with appropriate qualifications. These difficulties may be amplified by evolving restrictions on immigration, travel, or the availability of visas for skilled technology workers. These difficulties could be further amplified by the high cost of living in the Washington D.C. metropolitan area, where our headquarters is located. If we fail to attract new personnel or fail to retain and motivate our current key employees or group, our business and future growth prospects could be severely harmed.

Due to the competitive bidding process to obtain U.S. government contracts, both upon initial issuance and re-competition, and the likelihood of bid protest, we may be unable to achieve or sustain revenue growth and profitability.

Many of our U.S. government contracts are awarded through a competitive bidding process upon initial award and renewal, and we expect this will continue. There is often significant competition and pricing pressure as a result of this process. The competitive bidding process presents a number of risks, including the following:

• From time to time we expend substantial funds and time to prepare bids and proposals for contracts that are ultimately awarded to one of our competitors;
• From time to time we are unable to accurately estimate the resources and costs that will be required to perform any contract we are awarded, which results in substantial cost overruns and decreased margins;
• From time to time we encounter expense and delay when our competitors protest or challenge awards of contracts, and any such protest or challenge could result in a requirement to resubmit bids on modified specifications or in the termination, reduction or modification of the awarded contract;
• From time to time the protest of contracts awarded to us results in the delay of program performance and the generation of revenue while the protest is pending; and
• From time to time we are not given the opportunity to re-compete for U.S. government contracts previously awarded to us, and we may incur expenses to protest such a decision and ultimately may not succeed in competing for or winning such contract renewal.

The U.S. government contracts for which we compete typically have multiple option periods, and if, as happens from time to time, we fail to win a contract or a task order, we generally will be unable to compete again for that contract for several years. If we fail to win new contracts or to receive renewal contracts upon re-competition, it may result in additional costs and expenses and possible loss of revenue, and we will not have an opportunity to compete for these contract opportunities again until such contracts expire.

Our competitive position and future profitability depend, in part, on our ability to develop new technologies.

Our ability to increase revenue from existing customers and attract new customers will depend, in part, on our ability to anticipate and respond effectively to rapid technological changes and market developments. Virtually all of the products we produce and sell are highly engineered and require sophisticated manufacturing and system integration techniques and capabilities. The government market in which we primarily operate is characterized by rapidly changing technologies. The product or program needs of our government and commercial customers change and evolve regularly. Accordingly, our future performance in part depends on our ability to identify emerging technological trends, devote adequate research and development resources, develop and manufacture competitive products, and bring those products to market quickly at cost-effective prices. If we fail to effectively anticipate, identify and respond to these changes in product or program needs in a timely manner, our business could be negatively impacted. Likewise, if we are unable to develop new products that meet customers' changing needs, future sales and earnings may be adversely affected.

Our financial results may fluctuate due to increasing variability in our security solutions' sales and implementation cycles.

We market the majority of our security solutions directly to U.S. government customers. The sale and implementation of our services to these entities typically involves a lengthy education process and a significant technical evaluation and commitment of capital and other resources, which adds uncertainty to our sales cycle. This process is also subject to the risk of delays associated with customers' internal budgeting and other procedures for approving large capital expenditures, deploying new technologies within their networks and testing and accepting new technologies that affect key operations.

As a result, the sales and implementation cycles associated with certain of our services can be difficult to predict and lengthy. Our quarterly and annual operating results could be materially harmed if orders forecasted for a specific customer for a particular period of time are not realized.

Failure to effectively develop and execute our sales and business development capabilities will harm our ability to grow our business.

Our ability to increase our customer base and achieve broader market acceptance of our solutions and services depends, to a significant extent, on our ability to perform at a high level in our business development, growth, sales and marketing operations and activities. We believe that selling and marketing our security solutions requires advanced sales skills, customer relationships and technical knowledge to generate interest and to effectively communicate our solutions or services to new markets.

We may not achieve anticipated revenue growth from our growth team if we are unable to hire and develop talented business development and sales personnel, if our new business development and sales personnel are unable to achieve desired productivity levels in a reasonable period of time, or if we are unable to retain our existing sales force.

We depend on computing infrastructure operated by third parties to support some of our solutions and customers, and to help complete critical business functions. Any errors, disruption, performance problems, or failure in their or our operational infrastructure could adversely affect our business, financial condition, and results of operations.

We rely on the technology, infrastructure, and software applications of certain third parties in order to host or operate certain key platform features or functions of our business. Additionally, we rely on third-party computer hardware and cloud capabilities in order to deliver our solutions and services. Our business is dependent on the integrity, security and efficient operation of this technology and infrastructure, and we do not necessarily control the operation or data security of the third parties we utilize.

If any of these third-party services experience errors, disruptions, security issues, or other performance deficiencies; if they are updated such that our solutions become incompatible; if these services, software, or hardware fails or becomes unavailable due to extended outages, interruptions, defects, or otherwise; or if they are no longer available on commercially reasonable terms or prices (or at all), these issues could result in errors or defects in our solutions, failure of our solutions to perform, decline in our revenue and margins, damage to our reputation and brand, exposure to legal or contractual liability, increase in our expenses, and interruption in our ability to manage our operations. In addition, our processes for managing our sales and servicing our customers could be impaired until equivalent services or technology, if available, are identified, procured, and implemented, all of which may take significant time and resources, increase our costs, and could adversely affect our business. Many of these third-party providers attempt to impose limitations on their liability for such errors, disruptions, defects, performance deficiencies, or failures, and if enforceable, we may have additional liability to our customers or third-party providers.

Furthermore, our solutions are, in many cases, important or essential to our customers' operations, including, in some cases, their cybersecurity or oversight and compliance programs, and subject to service level agreements. Any interruption in our service, whether as a result of an internal or third-party issue, could damage our brand and reputation, cause our customers to terminate or not renew their contracts with us or decrease the use of our solutions and services, require us to indemnify our customers against certain losses, result in our issuing credit or paying penalties or fines, subject us to other losses or liabilities, cause our solutions to be perceived as unreliable or unsecured, and prevent us from gaining new or additional business from current or future customers, any of which could harm our business, financial condition, and results of operations.

Moreover, to the extent that we do not effectively address capacity constraints, upgrade our systems as needed, and continually develop our technology and network architecture to accommodate actual and anticipated changes in technology, our business, financial condition, and results of operations could be adversely affected. The provisioning of additional cloud hosting capacity requires lead time. These third parties have no obligation to renew their agreements with us on commercially reasonable terms, or at all. If these third parties increase pricing terms, terminate or seek to terminate our contractual relationship, establish more favorable relationships with our competitors, or change or interpret their terms of service or policies in a manner that is unfavorable with respect to us, we may be required to transfer to other cloud providers or invest in a private cloud. In that case, we could incur significant costs and experience possible service interruption in connection with doing so, or risk loss of customer contracts if they are unwilling to accept such a change.

A failure to maintain our relationships with our third-party providers (or obtain adequate replacements), and to receive services from such providers that do not contain any material errors or defects, could adversely affect our ability to deliver effective products and solutions to our customers and adversely affect our business and results of operations.

We depend on third parties for certain operational services and components of our products in order to fully perform under our contracts, and the failure or disruption of a third party to perform these services could have an adverse impact on our business.

We rely on subcontractors and other suppliers to provide materials, major components and subsystems for our products or to perform a portion of the services that we provide to our customers. Occasionally, we rely on only one or two sources of supply, which, if disrupted, could have an adverse effect on our ability to meet our commitments to customers. We depend on these subcontractors and suppliers to fulfill their contractual obligations in a timely and satisfactory manner in full compliance with customer requirements. If one or more of our suppliers or subcontractors is unable to satisfactorily provide on a timely basis the agreed-upon supplies or perform the agreed-upon services per its contractual obligations, our ability to perform our obligations as a contractor may be adversely affected, and we may be exposed to liability.

Failure to adequately protect our intellectual property, technologies and proprietary rights could harm our business, competitive position, financial condition, and results of operations.

Our success depends, in part, on our internally developed technologies, patents and other intellectual property. Despite our precautions, it may be possible for a third party to copy or otherwise obtain and use our trade secrets or other forms of intellectual property without authorization. Furthermore, the laws of foreign countries may not protect our proprietary rights in those countries to the same extent U.S. law protects these rights in the United States. In addition, it is possible that others may independently develop substantially equivalent intellectual property. If we do not effectively protect our intellectual property, our business could suffer.

To protect our intellectual property rights, we may be required to spend significant resources to monitor and protect our rights. In the future, we may have to resort to litigation to enforce our intellectual property rights, protect our trade secrets, or determine the validity and scope of the proprietary rights of others. Regardless of outcome, this type of litigation could result in substantial costs and diversion of management and technical resources. The inability to adequately protect and enforce our intellectual property and other proprietary rights could seriously harm our business, results of operations and financial condition.

Our earnings and profitability may vary based on the mix of our contracts and may be adversely affected by our failure to estimate and manage costs, time, and resources accurately.

Generally, our customer contracts are either firm-fixed-price ("FFP") or cost-reimbursable. Under FFP contracts, which represented approximately 75% of our 2024 revenues, we receive a fixed price irrespective of the actual costs we incur, and consequently, we carry the burden of any cost overruns. Due to their nature, fixed-price contracts inherently have more risk than cost-reimbursable contracts, particularly fixed-price development contracts where the costs to complete the development stage of the program can be highly variable, uncertain and difficult to estimate. Under cost-reimbursable contracts, subject to a contract-ceiling amount in certain cases, we are reimbursed for allowable costs and paid a fee, which may be fixed or performance-based. If our costs exceed the contract ceiling and are not authorized by the customer or are not allowable under the contract or applicable regulations, we may not be able to obtain reimbursement for all such costs and our fees may be reduced or eliminated. In addition, because many of our contracts involve advanced designs and innovative technologies, we may experience unforeseen technological difficulties and cost overruns.

Under both types of contracts, we must accurately estimate the likely volume of work that will occur, costs and resource requirements involved, and assess the probability of completing individual transactions or milestones within the contracted time period and amount to maximize or earn profit on these contracts. In addition, some of our contracts have provisions relating to cost controls and audit rights, and if we fail to meet the terms specified in those contracts, we may not realize their full benefits. Cost overruns or poor cost controls could lower earnings, or may incur a net loss on a contract, and cause a negative impact on our results of operations.

We will face risks associated with the growth of our business in new commercial markets and with new customer verticals, and we may not be able to achieve organic growth nor have the necessary resources to dedicate to the overall growth of our business.

To increase our revenue and achieve and maintain profitability, we plan to expand our operations in new commercial markets, including those where we may have limited operating experience, and may be subject to increased business, technology and economic risks that could affect our financial results. In the future, we may increasingly focus on commercial customers, including in the banking, financial services, healthcare, manufacturing, telecommunication, airlines and aerospace, insurance, retail, transportation, shipping and logistics, and energy industries, as well as other critical infrastructure industries. Entering new verticals and expanding in the verticals in which we are already operating will continue to require significant resources and there is no guarantee that such efforts will be successful or beneficial to us.

Although sales to a new customer have often led to additional sales to the same customer or similarly situated customers, it is uncertain we will achieve the same penetration and organic growth in the future, and our reputation, business, financial condition, and results of operations could be negatively impacted. As we expand into and within new and emerging markets and heavily regulated industry verticals, we will likely face additional regulatory scrutiny, risks, and burdens from the governments and agencies that regulate those markets and industries.

Failure to deliver high-quality technical support services may adversely affect our relationships with our customers and our financial results.

Our customers depend on our support organization to resolve technical issues relating to our solutions and offerings. We may be unable to respond quickly enough to accommodate short-term increases in customer demand for support services. Increased customer demand for these services, without corresponding revenues, could increase costs and adversely affect our operating results. In addition, our sales process is highly dependent on the reputation of our solutions, support and positive recommendations from our existing customers. Failure to maintain high-quality technical support, or a market perception that we do not maintain high-quality support, could adversely affect our reputation, our ability to sell our offerings to existing and prospective customers, and our business, operating results and financial position.

Our growth depends, in part, on the success of our strategic relationship with our partner organizations.

To grow our business, we will continue to build, grow and maintain relationships with third parties, such as partner organizations, that provide complementary cybersecurity offerings. Identifying partners and negotiating relationships with them requires significant time and resources. The relationship we have with our partners, and that our partners have with our customers, provides our customers with enhanced value for our solutions and services.

Our agreements with our partners are generally non-exclusive; therefore, our partners may offer customer solutions from several companies, including solutions and services that compete with ours. If our partners do not effectively market and sell our solutions or services, or use greater efforts to market and sell their solutions or those of our competitors, or fail to meet the needs of our customers, or if we are unsuccessful in establishing or maintaining our relationships with our partners, our ability to compete in the marketplace or to grow our revenue could be impaired, and our results of operations could be adversely affected.

If we are unable to license third-party technology that is used in our products and services to perform key functions, the loss could have an adverse effect on our revenues.

We currently incorporate technology that we license from third parties, including software, into our solutions. The third-party technology licenses we use may not continue to be available on commercially reasonable terms or at all. Our business could suffer if we lost the right to use these technologies. Additionally, if we are unable to license technology from third parties, we may be forced to acquire or develop alternative technology, which we may be unable to do in a commercially feasible manner or at all, and may require us to use alternative technology of lower quality or performance standards. As a result, our margins and results of operations could be significantly harmed.

A third party could claim that the licensed software infringes a patent or other proprietary right. Litigation between the licensor and a third party or between a third party and us could lead to royalty obligations for which we are not indemnified or for which indemnification is insufficient, or we may not be able to obtain any additional license on commercially reasonable terms or at all. The loss of, or our inability to obtain or maintain, any of these technology licenses could delay the introduction of new products or services until equivalent technology, if available, is identified, licensed and integrated.

The inability to set optimal pricing structures for our solutions and services could adversely impact our business, financial condition and results of operations.

From time to time, we change our pricing model in response to competition, global economic conditions, and general reductions in our customers' spending levels, pricing studies, or changes in how our solutions are broadly consumed. Similarly, as we introduce new products and services, or as a result of the evolution of our existing solutions and services, we may have difficulty determining the appropriate price structure for our products and services. Further, as new and existing competitors introduce new products or services that compete with ours, or revise their pricing structures, we may be unable to attract new customers at the same price or based on the same pricing model as we have used historically. Moreover, as we continue to target selling our solutions and services to larger organizations, these larger organizations may demand substantial price concessions. We may also need to change pricing policies to accommodate government pricing guidelines for our contracts with federal, state, local, and foreign governments and government agencies.

If we are unable to modify or develop pricing models and strategies that are attractive to existing and prospective customers, while enabling us to significantly grow our sales and revenue relative to our associated costs and expenses in a reasonable period of time, our business, financial condition, and results of operations may be adversely impacted.

Sales to customers outside the United States expose us to risks inherent in international operations.

We sell our services outside the United States and are subject to unique risks and challenges associated with international business. These risks and challenges include, but are not limited to, (a) compliance with governmental laws and regulations, (b) foreign business practices, (c) tax environments, (d) protection of our intellectual property, and (e) regional economic and geopolitical conditions.

Although our international operations have historically generated a small proportion of our revenues, any of these factors could negatively impact our business and results of operations. In addition, these factors may also negatively impact our ability to successfully expand into emerging market countries, where we have little or no operating experience, where it can be costly and challenging to establish and maintain operations, including hiring and managing required personnel, and difficult to promote our brand, and where we may not benefit from any first-to-market advantage or otherwise succeed.

We may be subject to legal proceedings, regulatory disputes and governmental inquiries that could materially harm our business, operating results, and financial condition.

From time to time, in the ordinary course of business, we have been involved in legal proceedings and, in the future, may be subject to lawsuits, claims, government investigations and other proceedings. These may include lawsuits and claims related to securities compliance, contracts, subcontracts, intellectual property, employment and wage claims, and other matters. Our business may be adversely affected by the outcome of legal proceedings and other contingencies that cannot be predicted with certainty. Those contingencies include, but are not limited to, the cost of litigation and unpredictable court decisions. Adverse outcomes with respect to litigation, or a government inquiry, or any of these legal proceedings may result in significant settlement costs or judgments, penalties and fines, or harm our reputation, all of which could negatively affect our business, results of operations and financial conditions.

Potential future acquisitions, strategic investments, partnerships, divestitures, mergers or joint ventures may subject us to significant risks, any of which could harm our business.

We have in the past acquired, and may in the future seek to acquire or invest in complementary businesses, products or technologies to enhance our technical capabilities or otherwise capture growth opportunities.

Our long-term strategy may include identifying and acquiring, partnering with, investing in or merging with suitable candidates on acceptable terms, or divesting of certain business lines or activities. Partnerships, mergers, joint ventures, acquisitions, and divestitures include a number of risks and present financial, managerial and operational challenges, including but not limited to:

• Diversion of management attention from running our existing business;
• Possible material weaknesses in internal control over financial reporting;
• Increased expenses, including legal, administrative and compensation expenses related to newly hired or terminated employees;
• Increased costs to integrate the technology, personnel, customer base and business practices of the acquired company with us;
• Potential exposure to material liabilities not discovered in the due diligence process;
• Potential adverse effects on reported operating results due to possible write-down of goodwill and other intangible assets associated with acquisitions; and
• Unavailability of acquisition financing or unavailability of such financing on reasonable terms.

Any acquired business, technology, service or product could significantly underperform relative to our expectations and may not achieve the benefits we expect from possible acquisitions. For all these reasons, our pursuit of an acquisition, partnership, investment, divestiture, merger, or joint venture could cause its actual results to differ materially from those anticipated and/or negatively affect our business.

Public confidence in, and acceptance of, identity platforms and biometrics generally, and our solutions specifically, will be a key factor in our business’s continued growth.

Our future profitability will depend, in part, on public confidence in and acceptance of identity platforms and biometrics generally. Continued acceptance of identity platforms and biometric information as a secure and reliable method to identify individuals, mitigate risk and minimize fraud is an important factor in our continued growth. While both identity platforms and biometrics have become more widely adopted, they may not achieve universal acceptance. The attractiveness of our solutions to our customers is impacted by a number of factors, including the willingness of individuals to provide their personal information, including biometric information, to private or governmental entities, the level of confidence that such information can be stored safely and securely, and trust that such information will not be misused or breached. Certain individuals may never accept the use of biometrics as being safe. If identity platforms and biometrics do not achieve universal acceptance, or our solutions are not competitive with our industry players, our growth could be limited, which could materially adversely affect our business, results of operations and financial condition.

On the other hand, any negative associations or perceptions with our solutions or biometrics could impede our business growth and could adversely affect our business, results of operations and financial condition. Likewise, any breaches of our information technology systems, particularly on the use and collection of biometric information, may subject us to significant reputational, financial, legal or operational consequences.

Any decline or disruption in the travel industry could materially adversely affect our business, results of operations and financial condition.

One of our growth strategies is to increase revenue from our TSA PreCheck enrollment offerings. Accordingly, our performance is dependent in part on the strength of the travel industry. Our revenue is therefore susceptible to declines in or disruptions to leisure and business travel that may be caused by factors entirely out of our control, including, but not limited to, prolonged extreme weather, natural or man-made disasters, travel-related health concerns (including pandemics and epidemics or other outbreak of contagious diseases), restrictions related to travel, stay-at-home orders, wars and military actions, terrorist attacks, sources of political uncertainty or political events, protests, foreign policy changes, regional hostilities, general economic conditions (such as a recession or inflation), changes in regulations, labor unrest or travel-related accidents. Because these events or concerns, and the full impact of their effects, are largely unpredictable, they can dramatically and suddenly affect travel behavior and other activities by consumers, and therefore demand for our TSA PreCheck services, which could materially adversely affect our business, results of operations and financial condition. Additionally, as the Real ID Act will require passengers having compliant identification to travel by air in the United States by May 7, 2025, such regulation, if not extended, may decrease the number of travelers with compliant identification and, therefore, negatively impact the demand for our PreCheck services, which could materially adversely affect our business, results of operations and financial condition.

Actions that we are taking to restructure our business to improve profitability may not be as effective as anticipated.

We committed to a restructuring plan to streamline our workforce and realign our cost structure with the volume of our business. We executed the restructuring plan in early 2023, incurring restructuring-related costs, including employee severance and related benefit costs and external consulting and advisory fees related to the implementation of the restructuring plan. In addition, we undertook another restructuring action in the third quarter of 2024 in an effort to optimize our strategic priorities, and incurred severance and related benefit costs. We may be unable to realize the expected improved profitability and efficiency from our restructuring efforts.

We are subject to payment processing risk.

In certain instances, our customers pay for our products and services using their credit or debit cards as a payment method. Under this arrangement, we rely on third-party systems to process payments. Acceptance and processing of these payment methods are subject to certain rules and regulations, and require payment of interchange and other fees. The increases in payment processing fees, any disruption in our payment processing systems, material changes in the payment network, delays in receiving payments from third-party payment processors, or changes to rules or regulations concerning payment processing could adversely impact our results of operations.

Goodwill and intangible assets represent significant assets on our balance sheet and any impairment on these assets could negatively impact our results of operations, and shareholders' equity.

As of December 31, 2024, goodwill and intangible assets, net was 31% of our total assets. Goodwill and intangible assets are tested for impairment whenever events or changes in circumstances indicate that the carrying value may not be recoverable, and at least annually in the case of goodwill. The impairment test is based on several factors, estimates and assumptions requiring judgment. Adverse changes in macroeconomic conditions, industry and market consideration, overall financial performance, market capitalization and relevant entity-specific events could result in an impairment of goodwill and intangible assets.

For instance, in the third quarter of 2024, we decided to discontinue the development and/or sale of all or part of certain solutions for selected capitalized software projects, and certain projects which we ceased to use before the end of its useful life. As a result, we recognized an impairment loss on intangible assets of $11.7 million as of December 31, 2024. Any future impairment of goodwill and intangible assets could have a negative impact on our results of operations and shareholders' equity in the period in which they are recognized.

Artificial Intelligence is an emerging technology and may involve significant risks and uncertainties.

The field of AI is characterized by rapid technological advancements and is subject to significant risks and uncertainties. Our future success is dependent on our ability to develop, integrate, and effectively utilize AI technologies especially in our Xacta solution. Given that this is a new and complex technology, we may face challenges related to the designing, developing, and implementing AI processes and procedures, including the risk of unforeseen operational failures. Further, this technology is subject to evolving industry standards and regulatory constraints. Failures to effectively address these risks and uncertainties may materially and adversely affect our business and results of operations.

Industry, Legal and Regulatory Risks

The business environment in which we operate is highly competitive, and we may not be able to compete successfully against existing or future competitors.

We operate in an intensely competitive market and diverse industry segment, and we expect competition to increase in the future from established businesses and new market entrants. Based on our current market analysis, no single company or small group of companies is in a dominant competitive position. Some large competitors offer capabilities in a number of markets that overlap many of the same areas in which we offer services, while certain companies are focused upon only one or a few of such markets. Some firms that compete with us in multiple areas include large, established defense contractors. In addition, we compete with smaller specialty companies, including risk and compliance management companies, organizational messaging companies, and security consulting organizations, and companies that provide secure network offerings. If we are unable to anticipate or react to these challenges or do not compete effectively, our competitive position could weaken and could result in a decline in revenue or reduced revenue growth, price reductions or reduced gross margins, and loss of market share, all of which could adversely affect our business.

A decline in the federal budget, changes in spending or budgetary priorities of the U.S. government, a prolonged U.S. government shutdown or delays in contract awards may significantly and adversely affect our future revenues, cash flow and financial results.

Our customers are substantially U.S. government agencies. The customer relationship with the U.S. government involves certain unique risks. The programs we participate in must compete with other programs and policy imperatives during the budget and appropriations process.

If government funding relating to our contracts with the U.S. government becomes unavailable, or is reduced or delayed, or planned orders are reduced, our contracts or subcontracts may be terminated or adjusted by the U.S. government or the prime contractor. Our operating results could also be adversely affected by spending caps or changes in the budgetary priorities of the U.S. government, as well as delays in program starts or the award of contracts or task orders under contracts.

In recent years, U.S. government appropriations have been affected by larger U.S. government budgetary issues and related legislation. As a result, DoD funding levels have fluctuated and have been difficult to predict. Future spending levels are subject to a wide range of factors, including Congressional action. In addition, over the last few years, the U.S. government has been unable to complete its budget process before the end of its fiscal year, resulting in a series of continuing resolutions to extend sufficient funds only for U.S. government agencies to continue operating. Moreover, the national debt threatened to reach the statutory debt ceiling, and such an event in future years could result in the U.S. government defaulting on its debts.

As a result, government spending levels are difficult to predict beyond the near term due to numerous factors, including the external threat environment, future government priorities and the state of government finances. Significant changes in government spending or changes in U.S. government priorities, policies and requirements could have a material adverse effect on our results of operations, financial condition or liquidity.

We are subject to the seasonality of U.S. government spending.

We derive a substantial portion of our revenues from U.S. government contracting, and as a result, we are subject to the annual seasonality of U.S. government purchasing. Because the U.S. government fiscal year ends on September 30, it is common for U.S. government agencies to award extra tasks in the weeks immediately prior to the end of its fiscal year in order to avoid the loss of unexpended fiscal year funds. As a result of this seasonality, we have historically experienced higher revenues in the second half of our fiscal year, with the pace of orders typically substantially reduced during the first half of our fiscal year.

We are required to comply with stringent, complex and evolving laws, rules, regulations and standards, as well as contractual obligations relating to privacy, data protection and security, technology protection, and other matters. Any actual or perceived failure to comply with these requirements could have a material effect on our business.

We are subject to a variety of local, state, national, and international laws and directives and regulations in the United States and abroad that involve matters central to our business, including privacy and data protection, data security, data storage, retention, transfer and deletion, technology protection, and personal information. Foreign data protection, data security, privacy, and other laws and regulations can impose different obligations or be more restrictive than those in the United States. These U.S. federal, state and foreign laws and regulations, which, depending on the regime, may be enforced by private parties or government entities, are constantly evolving and can be subject to significant change, and they are likely to remain uncertain for the foreseeable future. In addition, the application, interpretation, and enforcement of these laws and regulations are often uncertain, and may be interpreted and applied inconsistently from country to country and inconsistently with our current policies and practices. A number of proposals are pending before U.S. federal, state, and foreign legislative and regulatory bodies that could significantly affect our business.

The overarching complexity of privacy and data protection laws and regulations around the world pose a compliance challenge that could manifest in costs, damages, or liability in other forms as a result of failure to implement proper programmatic controls, failure to adhere to those controls, or the malicious or inadvertent breach of applicable privacy and data protection requirements by us, our employees, our business partners, or our customers.

In addition to government regulation, self-regulatory standards and other industry standards may legally or contractually apply to us, be argued to apply to us, or we may elect to comply with such standards or to facilitate our customers' compliance with such standards. Because privacy, data protection, and information security are critical competitive factors in our industry, we may make statements on our website, in marketing materials, or in other settings about our data security measures and our compliance with, or our ability to facilitate our customers' compliance with, these standards.

We also expect that there will continue to be new proposed laws and regulations concerning privacy, data protection, and information security, and we cannot yet determine the impact such future laws, regulations and standards, or amendments to or re-interpretations of existing laws and regulations, industry standards, or other obligations may have on our business. New laws, amendments to or re-interpretations of existing laws and regulations, industry standards, and contractual and other obligations may require us to incur additional costs and restrict our business operations. As these legal regimes relating to privacy, data protection, and information security continue to evolve, they may result in ever-increasing public scrutiny and escalating levels of enforcement and sanctions. Furthermore, because the interpretation and application of laws, standards, contractual obligations and other obligations relating to privacy, data protection, and information security are uncertain, these laws, standards, and contractual and other obligations may be interpreted and applied in a manner that is, or is alleged to be, inconsistent with our data management practices, our policies or procedures, or the features of our solutions. If so, in addition to the possibility of fines, lawsuits, and other claims, we could be required to fundamentally change our business activities and practices or modify our solutions, which could have an adverse effect on our business. We may be unable to make such changes and modifications in a commercially reasonable manner or at all, and our ability to fulfill existing obligations, make enhancements, or develop new solutions and features could be limited. Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations, and policies that are applicable to the businesses of our customers may limit the use and adoption of, and reduce the overall demand for, our solutions.

These existing and proposed laws and regulations can be costly to comply with and can make our solutions and services less effective or valuable, delay or impede the development of new products, result in negative publicity, increase our operating costs, require us to modify our data handling practices, limit our operations, impose substantial fines and penalties, require significant management time and attention, or put our data or technology at risk. Any failure or perceived failure by us or our solutions to comply with U.S. or applicable foreign laws, regulations, directives, policies, industry standards, or legal obligations relating to privacy, data protection, or information security, or any security incident that results in loss of or the unauthorized access to, or acquisition, use, release, or transfer of, personal information, personal data, or other customer or sensitive data or information may result in governmental investigations, inquiries, enforcement actions and prosecutions, private claims and litigation, indemnification or other contractual obligations, other remedies, including fines or demands that we modify or cease existing business practices, or adverse publicity, and related costs and liabilities, which could significantly and adversely affect our business and results of operations.

We are subject to substantial oversight from federal agencies that have the authority to suspend our ability to bid on contracts.

As a U.S. government contractor, we are subject to oversight by many agencies and entities of the U.S. government that may investigate and make inquiries about our business practices and conduct audits of contract performance and cost accounting. Depending on the results of any such audits and investigations, the U.S. government may make claims against us. Under U.S. government procurement regulations and practices, an indictment of a U.S. government contractor could result in that contractor being fined and/or suspended for a period of time from eligibility for bidding on, or for the award of, new U.S. government contracts. A conviction could result in debarment for a specified period of time, and debarment could materially and negatively affect our business and operating results.

We are subject to governmental export and import controls that could impair our ability to compete in international markets and subject us to liability if we are not in full compliance with applicable laws.

Some of our solutions are subject to export and import controls, including, without limitation, the Department of State's Directorate of Defense Trade Controls, the Commerce Department's Export Administration Regulations, U.S. Customs regulations and various economic and trade sanctions regulations established by the Treasury Department's Office of Foreign Assets Control. If we fail to comply with these U.S. export control laws and import laws, we and certain of our employees could be subject to substantial civil or criminal penalties, including the possible loss of export or import privileges; fines, which may be imposed on us and responsible employees or managers; and, in extreme cases, the incarceration of responsible employees or managers. Obtaining the necessary authorizations, including any required license, may be time-consuming, is not guaranteed and may result in the delay or loss of sales opportunities.

Furthermore, the U.S. export control laws and economic sanctions laws prohibit the shipment of certain products and services to U.S. embargoed or sanctioned countries, governments and persons. Even though we take precautions to prevent our solutions from being provisioned or provided to U.S. sanctions targets in violation of applicable regulations, our solutions could be provisioned to those targets despite such precautions. Any such sales could have negative consequences, including government investigations, penalties and reputational harm. Changes in our solutions or changes in export and import regulations may create delays in the introduction, sale and deployment of our solutions in international markets or prevent the export or import of our solutions to certain countries, governments or persons altogether. Any decreased use of our solutions or limitation on our ability to export or sell our solutions may adversely affect our business, financial condition and results of operations.

Risks Related to Our Financial Reporting and Common Stock

We may fail to meet our publicly announced guidance and other expectations about our business and operating results, which may cause our stock price to decline.

From time to time, we release guidance in our quarterly earnings conference calls, quarterly earnings releases, or otherwise, regarding our future performance that represents our management's estimates as of the date of release. This guidance, which includes forward-looking statements, is based on projections prepared by our management. Projections are based upon a number of assumptions and estimates that, while presented with numerical specificity, are inherently subject to significant business, economic and competitive uncertainties and contingencies, many of which are beyond our control and are based upon specific assumptions with respect to future business decisions, some of which will change. Our aim is to state possible outcomes as high and low ranges to provide a sensitivity analysis as variables are changed but are not intended to imply that actual results could not fall outside of the suggested ranges. The principal reason that we release guidance is to provide a basis for our management to discuss our business outlook with analysts and investors. We do not accept any responsibility for any projections or reports published by any such third parties.

Guidance is necessarily speculative in nature, and it can be expected that some or all of the assumptions underlying the guidance furnished by us will not materialize or will vary significantly from actual results. Accordingly, our guidance is only an estimate of what management believes is realizable as of the date of release. Any failure to successfully implement our operating strategy or the occurrence of any of the events or circumstances beyond our control could result in the actual operating results being different from our guidance, and the differences may be adverse and material. In light of the foregoing, investors are urged not to rely upon our guidance when making an investment decision regarding our common stock.

Furthermore, if we make downward revisions to our previously announced guidance, or if our publicly announced guidance of future operating results fails to meet the expectations of securities analysts, investors or other interested parties, the price of our common stock may decline.

Our quarterly operating results fluctuate and may fall short of prior periods, our projections or the expectations of securities analysts or investors, which could adversely affect the trading price of our stock.

Our operating results have fluctuated from quarter to quarter at points in the past, and they may do so in the future. Therefore, the results of any one quarter may not be a reliable indication of results to be expected for any other quarter or for any year. If we fail to increase our results over prior periods, to achieve our projected results or to meet the expectations of securities analysts or investors, our stock price may decline, and the decrease in the stock price may be disproportionate to the shortfall in our financial performance. Results may be affected by various factors, including those described in these risk factors.

We cannot guarantee that our share repurchase program will be fully implemented or that it will enhance long-term stockholder value.

In May 2022, our Board of Directors approved a share repurchase program ("SRP") for the repurchase of up to $50.0 million of our outstanding shares of our common stock. As of December 31, 2024, approximately $38.7 million remained available under the stock repurchase program. The repurchase program has no termination date and may be suspended for periods, amended or discontinued at any time. We are not obligated to repurchase a specified number or dollar value of shares. Share repurchases under the program will be made from time to time in private transactions or open market purchases, as permitted by securities laws and other legal requirements. There can be no guarantee about the timing of our share repurchases, or that the volume of such repurchases will increase. The stock repurchase program could affect the price of our common stock, increase volatility, diminish our cash reserves, and even if fully implemented may not enhance long-term stockholder value.

If we fail to maintain an effective system of internal control, our ability to produce timely and accurate financial statements or comply with applicable regulations could be impaired.

We are subject to the reporting requirements of the Exchange Act, the Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley Act”), the rules and regulations of Nasdaq, and other securities rules and regulations that impose various requirements on public companies. Our management and other personnel devote substantial time and resources to comply with these rules and regulations. Such compliance has increased, and will continue to increase, our legal, accounting and financial compliance costs, makes some activities more difficult, time-consuming and costly, and places significant strain on our personnel, systems and resources. The Sarbanes-Oxley Act requires, among other things, that we maintain effective disclosure controls and procedures and internal control over financial reporting, and to report any material weaknesses in such internal control.

We are continuing to develop and refine our disclosure controls, internal control over financial reporting and other procedures that are designed to ensure information required to be disclosed by us in our consolidated financial statements and in the reports that we file with the SEC is recorded, processed, summarized and reported within the time periods specified in SEC rules and forms, and information required to be disclosed in reports under the Exchange Act is accumulated and communicated to our principal executive and financial officers. Our current controls and any new controls we develop may become inadequate because of changes in conditions in our business. Additionally, to the extent we acquire other businesses, the acquired company may not have a sufficiently robust system of internal controls and we may uncover new deficiencies. Weaknesses in our internal controls may be discovered in the future. Any failure to develop or maintain effective controls, or any difficulties encountered in their implementation or improvement, could harm our results of operations, may result in a restatement of our consolidated financial statements for prior periods, could cause us to fail to meet our reporting obligations, and could result in an adverse opinion regarding our internal control over financial reporting from our independent registered public accounting firm, and lead to investigations or sanctions by regulatory authorities. Any failure to maintain effective disclosure controls and internal control over financial reporting could have a material and adverse effect on our business and results of operations and could cause a decline in the price of our stock.

Section 404 of the Sarbanes-Oxley Act requires our management to certify financial and other information in our quarterly and annual reports and provide an annual management report on the effectiveness of our internal control over financial reporting. We are also required to have our independent registered public accounting firm attest to, and issue an opinion on, the effectiveness of our internal control over financial reporting. If we are unable to assert that our internal control over financial reporting is effective, or if, when required, our independent registered public accounting firm is unable to express an opinion on the effectiveness of our internal control over financial reporting, we could lose investor confidence in the accuracy and completeness of our financial reports, which would cause the price of our common stock to decline.

General Risk Factors

If our judgments or estimates relating to our critical accounting policies are based on assumptions that change or prove to be incorrect, our results of operations could be adversely affected.

The preparation of our consolidated financial statements in conformity with U.S. GAAP requires management to make judgments, estimates, and assumptions that affect the amounts reported in the consolidated financial statements and accompanying notes. We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, the results of which form the basis for making judgments about the carrying values of assets, liabilities, and equity, and the amount of revenue and expenses that are not readily apparent from other sources. Our results of operations may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our results of operations to fall below the expectations of securities analysts and investors, resulting in a decline in the trading price of our common stock. Significant judgments, estimates, and assumptions used in preparing our consolidated financial statements include, or may in the future include, those related to revenue recognition, goodwill and other long-lived assets, and income taxes.

Weakened global economic conditions may adversely affect our industry, business, operating results and financial condition.

Our overall performance depends in part on worldwide economic and geopolitical conditions. The United States and other key international economies have experienced cyclical downturns from time to time in which economic activity was impacted by falling demand for a variety of goods and services, restricted credit, poor liquidity, reduced corporate profitability, volatility in credit, equity and foreign exchange markets, bankruptcies and overall uncertainty with respect to the economy. These economic conditions can arise suddenly and the full impact of such conditions can remain uncertain at any point in time. In addition, geopolitical developments, such as the invasion of Ukraine by Russia and the conflict in Gaza, can increase levels of political and economic unpredictability globally and increase the volatility of global financial markets. Moreover, these conditions can affect the rate of information technology spending and could adversely affect our customers' ability or willingness to purchase our solutions and services, delay prospective customers' purchasing decisions, reduce the value or duration of their subscription contracts, or affect attrition rates, all of which could adversely affect our future sales and operating results.

Our systems and the third-party systems upon which we and our customers rely are also vulnerable to damage or interruption from catastrophic occurrences or events outside our control.

Our systems and the third-party systems upon which we and our customers rely are also vulnerable to damage or interruption from catastrophic occurrences, telecommunication failures, cybersecurity threats, social unrest, geopolitical and similar events, or acts of misconduct. Despite any precautions we may take, the occurrence of a catastrophic disaster or other unanticipated problems at our or our third-party vendors' hosting facilities, or within our systems or the systems of third parties upon which we rely, could result in interruptions, performance problems, or failure of our infrastructure, technology, or solutions, which may adversely impact our business. In addition, our ability to conduct normal business operations could be severely affected. In the event of significant physical damage to one of these facilities, it may take a significant period of time to achieve full resumption of our services, and our disaster recovery planning may not account for all eventualities. In addition, any negative publicity arising from these disruptions could harm our reputation and brand and adversely affect our business.

We may also be impacted by natural disasters, wars, terrorist attacks, power outages, public health crises (epidemics or pandemics), or other events outside our control. If major disasters such as earthquakes, floods, hurricanes, tornadoes, fires, or other events occur, or our information system or communications network breaks down, operates improperly, or is unusable, our headquarters and other facilities may be seriously damaged, or we may have to stop or delay production and delivery of our solutions and services.

Although we maintain crisis management and disaster response plans, such events could make it difficult or impossible for us to deliver our solutions and services to our customers, and could decrease demand for our offerings. We may incur shutdowns, delays, disruptions or expenses relating to such events outside of our control, which could have a material adverse impact on our business, operating results and financial condition. Moreover, any significant natural disaster, pandemic, or other catastrophic or force majeure events could affect our personnel, supply chain, or service providers' ability to provide materials and perform services on a timely basis. Acts of terrorism and other geopolitical unrest could also potentially cause disruptions in our business or the business of our supply chain, services providers, or the economy as a whole. Because we do not carry insurance for all these possible losses, and significant recovery time could be required to resume operations, our financial condition and operating results could be materially adversely affected by such an event outside our control.

Increased scrutiny of our environmental, social and governance responsibilities may result in additional costs and risks, and may adversely impact our reputation, employee retention, and willingness of customers and suppliers to do business with us.

Investor advocacy groups, institutional investors, investment funds, proxy advisory services, stockholders, and customers are increasingly focused on companies' ESG practices. Additionally, public interest and legislative pressure related to public companies' ESG practices continue to change. If our ESG practices fail to meet regulatory requirements or investor or other industry stakeholders' evolving expectations and standards for responsible corporate citizenship in areas including environmental stewardship, support for local communities, Board of Director and employee diversity, human capital management, employee health and safety practices, product quality, supply chain management, corporate governance and transparency and employing ESG strategies in our operations, our brand, reputation and employee retention may be negatively impacted and customers and suppliers may be unwilling to do business with us. In addition, as we work to align our ESG practices with industry standards, we may expand our disclosures in these areas and doing so may result in additional costs and require additional resources to monitor, report, and comply with our various ESG practices. If we fail to adopt ESG standards or practices as quickly as stakeholders desire, report on our ESG efforts or practices accurately, or satisfy the expectations of stakeholders, our reputation, business, financial performance and growth may be adversely impacted.

Changes in accounting principles or their application to us could result in unfavorable accounting charges or effects, which could adversely affect our results of operations and growth prospects.

We prepare consolidated financial statements in accordance with U.S. GAAP. In particular, we make certain estimates and assumptions related to the adoption and interpretation of these principles, including the recognition of our revenue and the accounting of our stock-based compensation expense with respect to our consolidated financial statements. If these assumptions turn out to be incorrect, our revenue or our stock-based compensation expense could materially differ from our expectations, which could have a material adverse effect on our financial results. A change in any of these principles or guidance, or in their interpretations or application to us, may have a significant impact on our reported results, as well as our processes and related controls, and may retroactively affect previously reported results or our forecasts, which may negatively impact our financial statements. For example, any recent new standards issued by the Financial Accounting Standards Board could materially impact our consolidated financial statements. The adoption of these new standards may potentially require enhancements or changes in our processes or systems and may require significant time and cost on behalf of our financial management. This may, in turn, adversely affect our results of operations and growth prospects.

Global climate-related risks could negatively affect our business.

There are inherent climate-related risks wherever business is conducted. Access to clean water and reliable energy in the communities where we conduct our business, whether for our offices, vendors, customers or other stakeholders, is a priority. Any of our primary locations may be vulnerable to the adverse effects of climate change. Climate-related events, including the increasing frequency of extreme weather events and their impact on U.S. critical infrastructure, have the potential to disrupt our business, our third-party suppliers, or the operations and business of our customers, and may cause us to experience higher attrition, losses and additional costs to maintain or resume operations.

Increased public awareness and concern regarding global climate change may result in state, federal or international requirements to reduce or mitigate global warming, such as the imposition of carbon pricing mechanisms or stricter limits on greenhouse gas emissions. If environmental or climate-change laws or regulations are adopted or changed that impose significant new costs, operational restrictions or compliance requirements upon our business or our products, they could increase our capital expenditures, reduce our margins and adversely affect our financial position.

In addition, our reputation and client relationships may be damaged as a result of our practices related to climate change, including our involvement, or our clients' involvement, in certain industries or projects associated with causing or exacerbating climate change, as well as any decisions we make to continue to conduct or change our activities in response to considerations relating to climate change.

The Company’s processes to assess, identify, and manage material cybersecurity risks

We developed an ISO/IEC 27001-certified Information Security Management System (“ISMS”) designed to enhance our corporate security measures, identify and mitigate information security risks, and protect and preserve the confidentiality, integrity, and continued availability of all information owned by the Company and that of its customers and suppliers in our control. Our ISO certification can be verified on the BSI Group website using certificate number IS 649202.

Our ISMS includes developing, implementing, and continually improving policies and procedures designed to safeguard information and ensure the availability of critical data and systems. These policies cover areas such as requiring secure coding practices and a secure development lifecycle process, monthly information security awareness training for all employees and enhanced training for specialized personnel, review and assessment by external, independent third parties, who certify and report on our weaknesses and internal response preparedness for the entire Company, and the performance of daily vulnerability scanning of our network infrastructure as well as annual third-party penetration testing.

Our cybersecurity risk assessment, identification, and management process consists of a dedicated Governance Risk and Compliance ("GRC") team, within our Information Security organization, that implements a repeatable, ISO/IEC 27001-compliant methodology to asses and track cybersecurity risk. This team, reporting to and working with the Chief Information Security Officer ("CISO"), identifies, tracks, and updates cybersecurity risks that threaten the Company directly and through third parties. The GRC team collaborates closely with risk owners throughout the Company, vendors, and suppliers, working with them in an effort to ensure their risks are identified, documented, and mitigated in a timely fashion.

In addition to our active ISO/IEC 27001 certification, the Company also assesses itself against the National Institute of Standards and Technology Special Publication 800-171 as required by the Defense Federal Acquisition Regulation Supplement. In accordance with our ISMS, we also actively monitor known threats that could affect our products and services and work with our suppliers to provide us with real-time reports of threats or vulnerabilities that may affect our enterprise-wide systems. Our program also includes a cyber incident response plan that provides controls and procedures for timely and accurate reporting of any material cybersecurity incident, as well as a business continuity plan that is designed to provide a clear framework for how the Company can continue in the event of any significant disruption in an effort to ensure that we can offer the same level of security, support, and excellence to all our customers. In the normal course, our Security and GRC teams engage assessors, consultants, and other third parties to assist in various cyber-related matters. For example, to maintain our ISO certification, the Company utilizes an external third party to conduct yearly audits of its ISMS. Our Information Security organization also leverages third-party advisors, as appropriate, for various tasks, such as conducting annual third-party penetration testing.

We conduct an enterprise risk assessment that includes an assessment of cybersecurity risk in context with other enterprise-level risks. Furthermore, our CISO and our General Counsel regularly discuss cybersecurity risk mitigation. We carry errors and omissions insurance that provides some protection against the potential losses arising from a cybersecurity incident. For additional information regarding potential cybersecurity risks, see relevant business and operational risks under Item 1A, "Risk Factors," of this Annual Report on Form 10-K.

In the last three years, we have not experienced a material information security breach incident or any penalties or settlements related to the same, and the expenses we have incurred from information security breach incidents were immaterial.

Management’s role and expertise in assessing and managing material cybersecurity risks

Our Information Security team, led by our CISO, is responsible for assessing and managing material cybersecurity risks. Certifications held by the Information Security team include CompTIA A+, Network+, Security+, CyberSecurity Analyst+ ("CYSA+"), Pentest+, Advanced Security Practitioner ("CASP"), EC-Council Certified Ethical Hacker ("CEH"), Certified Security Analyst ("ECSA"), Computer Hacking Forensic Investigator ("CHFI"), Associate Chief Information Security Officer ("ACCISO"), CMMC-AB Registered Practitioner ("RP"), ISC2 Certified Information Systems Security Professional ("CISSP"), Systems Security Certified Practitioner ("SSCP"), ISACA Certified Information Security Manager ("CISM"), PCAP – Certified Associate Python Programmer, & eLearnSecurity Junior Penetration Tester ("eJPT"). Our CISO’s background includes over 18 years of experience in IT and Information Security. His formal education includes a Master’s degree in Cybersecurity and Information Assurance and a Bachelor’s degree in Computer Forensics. Certifications held by the CISO include CompTIA A+, Network+, & Security+, Microsoft Technology Associate ("MTA"), CMMC-AB RP, ISO 27001 Certified Lead Implementer Professional, EC-Council CEH & CHFI, ISACA Certified Data Privacy Solutions Engineer ("CDPSE") & Certified Information Security Manager ("CISM"), ISC2 CISSP, and Offensive Security Certified Professional ("OSCP"). Our CISO reports to our Chief Information Technology Officer ("CITO"), who in turn reports to our Chief Executive Officer ("CEO"). Each of our CITO and our CEO have extensive experience in cybersecurity matters.

Our CISO provides reports to the Audit Committee of our Board of Directors on a standing basis at each Audit Committee meeting, and as otherwise requested by the Chair of the Audit Committee or as determined necessary by the CISO or other members of senior management. The CISO is personally involved in, and responsible for, the risk assessment, identification and management process described above.

Board of Director’s oversight of cybersecurity risks

The Board of Directors has oversight responsibility with respect to risk management and reviews matters with management as part of management’s regular Board reporting. The Board of Directors has delegated responsibility for information security and cybersecurity risk oversight to the Audit Committee. In accordance with its charter, the Audit Committee discharges these responsibilities through various processes, including the option to use third-party advisers as and when it deems appropriate, and discusses with management the Company’s major policies with respect to risk assessment and risk management. The Audit Committee regularly reports the results of these discussions to the Board of Directors. As noted above, the CISO reports to the Audit Committee at each regular Audit Committee meeting on the status of cybersecurity risk assessment, identification and management, as well as reporting information security incidents as they occur, if material, and providing periodic briefings about our information security program, our internal response preparedness, and assessments led by outside advisors. The Chair of the Audit Committee, in turn, reports on these topics to the Board of Directors as and when deemed necessary and/or material. Overall, our Board contains two directors with work experience related to cybersecurity issues or oversight.

We lease approximately 191,700 square feet of space for our corporate headquarters, integration facility, and primary service depot in Ashburn, Virginia. The lease expires in May 2029.

We leased additional office space in facilities located in Maryland, Florida and Nevada under various leases expiring through July 2027.

We believe that the current space is substantially adequate to meet our operating requirements.

Information regarding legal proceedings may be found in Note 19 – Commitments and Contingencies to the Consolidated Financial Statements.

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with our consolidated financial statements and the related notes to consolidated financial statements included in Part II, Item 8 of this Annual Report on Form 10-K ("10-K"). In addition to historical financial information, the following discussion and analysis contain forward-looking statements that involve risks, uncertainties and assumptions. Our actual results and timing of selected events in future periods may differ materially from those anticipated or implied in these forward-looking statements as a result of many factors, including those discussed under Item 1A, "Risk Factors," and elsewhere in this 10-K. See also "Special Note Regarding Forward-Looking Statements" at the beginning of this 10-K.

In this section, we discuss our financial condition, changes in financial condition and results of operations for the year ended December 31, 2024, compared to the year ended December 31, 2023.

Overview

For an overview of our business, including our business segments and a discussion of the services and products we provide, see Item 1, "Business" of this 10-K. Additional information regarding our segments is also presented in Note 18 – Segment Information to the consolidated financial statements at Item 8 of this 10-K.

As discussed under Item 1A, "Risk Factors," we derive a substantial portion of our revenues from contracts and subcontracts with the U.S. government. Our revenues are generated from a number of contract vehicles and task orders. The U.S. government has increasingly relied on contracts that are subject to a competitive bidding process (including IDIQ, GSA schedules, OTA, and other multi-award contracts), resulting in greater competition and increased pricing pressure. We expect that a majority of the business that we seek in the foreseeable future will be awarded through a competitive bidding process.

Over the past several years we have sought to diversify and improve our operating margins through the evolution of our business from an emphasis on product reselling to that of an advanced solutions technologies provider. Although we continue to offer resold products through our contract vehicles or our prime partners' contracts, we focused on the transformation and growth on selling our software and service solutions, as well as designing and delivering Telos manufactured and branded technologies. We believe our contract portfolio is characterized as having low to moderate financial risk due to the limited number of long-term fixed-price development contracts. Our firm-fixed-price activities consist primarily of contracts for products and services at established contract prices. For 2024 and 2023, the Company's revenue derived from firm-fixed-price contracts was 75% and 79%, respectively; time-and-material contracts was 15% and 9%, respectively; and cost-plus contracts revenue was 10% and 12%, respectively.

Our business performance is affected by the overall level of U.S. government spending and the alignment of our offerings and capabilities with the budget priorities of the U.S. government. Approximately 88% of our revenues were generated from U.S. government agencies in fiscal year 2024. In addition, our overall performance depends, in part, on global economic and geopolitical conditions. Adverse changes in fiscal and economic conditions could materially impact our business. Some changes that could adversely impact our business include the implementation of future spending reductions, government shutdown and supply chain challenges. Despite the budget and competitive pressure affecting the industry, we believe we are well-positioned to expand existing customer relationships and benefit from opportunities that we have not previously pursued.

Business Environment

U.S. Budget

In March 2024, the U.S. President proposed the annual appropriations for Fiscal Year ("FY") 2025 to fit within the tight caps set as part of the prior year's debt ceiling agreements. The FY2025 budget request included $850 billion for the DoD base budget, in alignment with levels agreed to in the Fiscal Responsibility Act ("FRA") of 2023. This proposed budget will enable the DoD to make the investments necessary to execute the Administrations' 2022 National Security Strategy and 2022 National Defense Strategy. The President's FY2025 budget also proposed several increases for new, key cyber programs and initiatives. For FY2025, the White House had directed agencies to prioritize cyber investments in "secure by design" technologies and the modernization of legacy technology. In the wake of the President's Executive Order ("EO") on artificial intelligence last fall, the 2025 budget proposal includes plenty of AI-related spending, much of which intersects with cybersecurity and AI safety.

Congress was unable to enact any of its annual appropriations bills before the start of FY2025, which began on October 1, 2024. Instead, on December 20, 2024, the U.S. House and Senate passed a second Continuing Resolution ("CR") to extend federal spending and avert a government shutdown through March 14, 2025. The CR keeps the government operating at FY2024 funding levels, and ensures the federal government can receive adequate funding to operate for the duration of the CR. The current CR provides $888 billion in base defense funding for 2025, an amount exceeding the $850 billion cap on such funding established under the FRA. As of January 6, 2025, $12 billion in Defense funding was designated as an emergency requirement, and is not constrained by the caps established by the FRA.

Appropriators in both chambers had been hoping to at least reach a topline spending agreement, but the momentum for a deal was derailed after the new Administration issued a slew of EOs since inauguration, including an order to freeze funding on several federal programs. While the Cybersecurity and Infrastructure Security Agency ("CISA") is viewed as vital for national security purposes and its programs will still continue, the new Administration has sworn to reduce the size and scope of CISA.

Of note, the CR did not address the federal debt ceiling, which is the limit that Congress imposes on the federal budget for authorized spending. In January 2025, the federal debt limit was reinstated at $36.1 trillion to accommodate borrowing since its suspension through FRA. Until Congress acts to modify the limit, the Treasury Department relies on the available cash on hand and invoked authorities to use extraordinary measures to continue paying its debt obligations, without jeopardizing the "full faith and credit" of the U.S. government.

While there is no clear path to approval of the FY2025 budget, failure to do so poses uncertainty about actual funding and will impact federal customers' ability to move forward on their planned expenditures in FY2025.

Cybersecurity Landscape

The scope of cybersecurity is on the cusp of transformative changes. Cyber threats are not just escalating in frequency but are also becoming more sophisticated, thus challenging traditional security standards. In this rapidly evolving cybersecurity landscape, the need for vigilant defense is vital, and cybersecurity is a priority for organizations to mitigate their risk and keep safe from threats and exploitation. Understanding the threat environment and the impending trends (both current and future) is a matter of foresight and is crucial in designing effective security strategies. The DoD continues to invest in cybersecurity programs to protect the nation from malicious cyber actors and cyber campaigns. These investments strengthen cyber protection standards for the defense industrial base and cybersecurity of DoD networks. With this growing threat, below are some trends to consider when looking at the cybersecurity landscape:

Emerging Cyber and Counterintelligence Threats: The proposed FY2025 budget expands the Department of Justice’s ("DOJ") ability to pursue threats through investments in the FBI’s cyber and counterintelligence investigative capabilities. These investments sustain the FBI’s cyber intelligence, counterintelligence, and analysis capabilities and include funding to enhance those cyber response and counterintelligence capabilities. The budget also includes funding to expand a new section within the DOJ’s National Security Division to focus on cyber threats. These investments align with the National Cybersecurity Strategy that emphasizes a whole-of-nation approach to addressing ongoing cyber threats. Finally, the budget also provides for the DOJ to support the implementation of Executive Order 14110, “Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence.”

Rising Threats, Rising Liability: Ransomware remains arguably the most severe cyber threat to enterprises in the commercial, state, and local government and education sectors. Phishing is one of the top distribution channels for ransomware. Modern phishing attacks have become adept at bypassing traditional security measures, using more personalized and technically advanced tactics to deceive users. One reason for the rise of ransomware attacks is that it is exceedingly profitable for cybercriminals, and ransomware victims generally settle the ransom rather than restoring the system from backups or dealing with the fallout from a data breach. Aside from the financial costs of paying the ransom and restoring the system, the consequences of a successful ransomware attack can include damage to the organization's reputation, stolen sensitive data being used for malicious purposes, and loss of business.

The Nation's Critical Systems Are Still at Risk: Critical infrastructure and industrial IoT are among the categories at greatest risk of cyberattacks. The IoT continues its rapid growth, interconnecting an increasing number of devices. However, this expansion brings with it a host of security challenges. The wide range of IoT devices make them attractive targets for cyberattacks, and their interrelated nature can lead to pervasive vulnerabilities.

Navigating a Changing Regulatory Landscape and Compliance: The regulatory landscape governing cybersecurity is developing swiftly. Over time, the government mandates stronger security in highly regulated industries. These government initiatives and audit fatigue continue to burden highly regulated organizations, with automation solutions recognized as the most effective remedy for the many repetitive and redundant tasks that security compliance requires.

Additionally, the SEC adopted new rules on cybersecurity risk management, strategy, governance and incident disclosure by public companies. The required reporting of this information leads many companies to proactively establish policies that will improve their cyber risk management posture and enable them to better withstand heightened public and regulatory scrutiny.

Identity Assurance and Privacy Protection are Essential for Today's Enterprises: Identity and access management continue to be a major cybersecurity concern for organizations and individuals that need to ensure their security and protect their privacy. Trusted identities are essential to confidence in IT and physical security strategies and to the success of Zero Trust security models and architectures. The shift to a Zero Trust framework represents a fundamental change in approach to cybersecurity, focusing on identity and access management, continuous monitoring and robust authentication mechanisms to establish a secure digital environment.

Enhancing Identity Security: The shift towards biometric authentication methods is redesigning identity verification in the digital domain. Integrating biometrics with multi-factor authentication can provide a robust defense against unauthorized access.

Artificial Intelligence: AI is set to play a critical role in cybersecurity. Cybercriminals are using AI to launch more sophisticated attacks that can quickly adapt to changing environments, making detection harder. AI's advanced data analysis capabilities are increasingly used for defensive measures over time. To protect against AI-powered cyberattacks, organizations must stay vigilant and adopt advanced cybersecurity tools and techniques that can detect and respond to these threats in a timely manner before they cause damage. The proposed FY2025 budget provides $455 million to extend the frontiers of AI for science and technology and to increase AI’s safety, security, and resilience. These investments enhance the DoD’s computing capabilities and support the development of AI testbeds to build foundation models for energy security, national security, and climate resilience as well as tools to evaluate AI capabilities to generate outputs that may represent nuclear, nonproliferation, biological, chemical, critical-infrastructure, and energy security threats or hazards.

Key Performance Measures

The primary financial performance measures we use to manage our business and monitor results of operations are revenue, gross profit, and Adjusted EBITDA. We evaluate our results of operations by considering the drivers causing changes in these measures. We evaluate significant trends and fluctuations in our contract portfolio over time due to contract awards and completions, changes in customer requirements and changes in the volume of product and software sales.

Backlog

Backlog is also a useful measure in developing our annual budgeted revenue by estimating for the upcoming year our continuing business from existing customers and active contracts. We consider backlog, both funded and unfunded (as explained below), other expected annual renewals, and expansion planned by our current customers.

Total backlog consists of the aggregate contract revenues remaining to be earned by us at a given time over the life of our contracts, whether funded or unfunded. Funded backlog consists of the aggregate contract revenues remaining to be earned at a given time, which, in the case of U.S. government contracts, means that they have been funded by the procuring agency. Unfunded backlog is the difference between total backlog and funded backlog and includes potential revenues that may be earned if customers exercise delivery orders and/or renewal options to continue these contracts.

Based on historical experience, we generally assume option year renewals to be exercised. Most of our customers fund contracts on the basis of one year or less, and, as a result, funded backlog is generally expected to be earned within one year from any point in time, whereas unfunded backlog is expected to be earned over a longer period.

(in thousands)

Increases in backlog is a result of the award of new contracts and the renewal or extension of existing contracts. Reductions in backlog arise from the completion or the early termination of contracts. See the relevant industry, legal and regulatory risks under Item 1A, "Risk Factors," of this 10-K. We believe that comparisons of backlog period-to-period are difficult. We also believe that it is difficult to predict future revenue solely based on analysis of backlog. The actual timing of revenue from projects included in backlog will vary.

Financial Highlights

A number of factors have affected our fiscal year 2024 results, the most significant of which we have listed below. More details on these changes are presented below within our "Results of Operations" section.

• The decline in year-over-year revenue was primarily driven by the successful completion of certain programs and ramp-down of programs in Secure Networks without corresponding new business wins to backfill completed programs.
• Growth in TSA PreCheck revenue partially offset the year-over-year revenue decline and was driven by the increase in our enrollment locations and a full year of renewal operations as compared to only a partial year in fiscal year 2023.
• The reduction in gross margin was mainly driven by the impact of an impairment loss on intangible assets of $5.3 million and higher amortization of software development costs. This was partially offset by a more favorable program mix.
• The assessment of our cost structure and investment priorities in fiscal year 2024 led to restructuring actions and the discontinued development and/or sale of selected solutions or parts of solutions that were not generating acceptable returns. These initiatives resulted in a $1.3 million restructuring charge and a $11.7 million of non-cash impairment of software development costs.
• Lower year-over-year gross profit was partially offset by reduced operating expenses.

Results of Operations

Consolidated Results

Table MD&A 2: Consolidated Financial Results Comparison

(dollars in thousands)

Our business segments have different factors driving revenue fluctuations and profitability. The discussion of the changes in our net revenue and profitability is covered in greater detail under the section that follows: "Segment Results." We generate revenue from the delivery of products and services to our customers. Cost of sales, for both products and services, consists of labor, materials, subcontracting costs and an allocation of indirect costs.

Operating Expenses: Operating expenses decreased by 3% in 2024, compared to 2023. Research and development expenses decreased by $3.3 million in 2024, compared to 2023, primarily due to the discontinued development of selected solutions or parts of solutions associated with the restructuring plan and lower stock-based compensation expenses. Selling, general and administrative expenses decreased by $5.5 million in 2024, compared to 2023, primarily due to decreased cash incentive compensation expenses. These reductions were partially offset by an increase in impairment loss on intangible assets of $5.9 million.

Other income: Other income decreased by 40% in 2024, compared to 2023, primarily due to the gain on early extinguishment of other financing obligation of $1.4 million in 2023, without a similar gain in 2024. The remaining variance is attributable to decreased dividend income from money market placements.

Segment Results

The accounting policies of each business segment are the same as those followed by the Company as a whole. Management evaluates business segment performance based on gross profit.

Table MD&A 3: Security Solutions Segment - Financial Results Comparison

(dollars in thousands)

Security Solutions segment revenue decreased by 1% in 2024, compared to 2023, primarily due to the reduction in revenue from a long-term program, the completion of a short-term program in the prior year and the sale of a non-recurring perpetual license in the prior year, partially offset by the growth in the TSA PreCheck program.

Security Solutions segment gross profit decreased by 30% in 2024, compared to 2023, and gross margin decreased from 51.2% in 2023 to 36.1% in 2024, primarily due to the impairment loss on intangible assets in 2024, higher amortization of software development costs, and program mix within the portfolio.

Table MD&A 4: Secure Networks Segment - Financial Results Comparison

(dollars in thousands)

Secure Networks segment revenue decreased by 54% in 2024, compared to 2023, primarily due to the successful completion of certain programs and ramp-down of certain programs without corresponding new business wins to backfill completed programs.

Secure Networks segment gross profit decreased by 49% in 2024, compared to 2023, primarily due to lower revenues. By contrast, the segment gross margin increased from 19.6% in 2023 to 21.4% in 2024, primarily due to a favorable program mix and strong program management.

Non-GAAP Measures

In addition to our results determined in accordance with U.S. GAAP, we believe the non-GAAP financial measures of EBITDA, Adjusted EBITDA, EBITDA Margin, Adjusted EBITDA Margin, Adjusted Net Loss, Adjusted Earnings Per Share ("EPS"), Adjusted Gross Profit, Adjusted Gross Margin, Cash Gross Profit, Cash Gross Margin and Free Cash Flow are useful in evaluating our operating and cash flow performance. We believe that this non-GAAP financial information, when taken collectively with our GAAP results, may be helpful to readers of our financial statements because it provides consistency and comparability with past financial performance and assists in comparisons with other companies, some of which use similar non-GAAP financial information to supplement their GAAP results. The non-GAAP financial information is presented for supplemental informational purposes only, should not be considered a substitute for financial information presented in accordance with GAAP, and may be different from similarly-titled non-GAAP measures used by other companies. A reconciliation is provided below for each of these non-GAAP financial measures to the most directly comparable financial measure stated in accordance with GAAP.

We believe these non-GAAP financial measures facilitate comparison of our operating and cash performance on a consistent basis between periods by excluding certain items that may, or could, have a disproportionately positive or negative impact on our results of operations in any particular period. When viewed in combination with our results prepared in accordance with GAAP, these non-GAAP financial measures help provide a broader picture of factors and trends affecting our results of operations.

EBITDA, Adjusted EBITDA, EBITDA Margin and Adjusted EBITDA Margin

EBITDA, Adjusted EBITDA, EBITDA Margin and Adjusted EBITDA Margin are supplemental measures of operating and cash flow performance that are not made under GAAP and do not represent, and should not be considered as an alternative to net (loss) income as determined by GAAP. We define EBITDA as net (loss) income, adjusted for non-operating (income) expense, interest expense, provision for (benefit from) income taxes, and depreciation and amortization. We define Adjusted EBITDA as EBITDA, adjusted for stock-based compensation expense, impairment loss on intangible assets, and restructuring expenses (adjustments). We define EBITDA Margin as EBITDA as a percentage of total revenue. We define Adjusted EBITDA Margin as Adjusted EBITDA as a percentage of total revenue.

We believe that EBITDA, EBITDA Margin, Adjusted EBITDA and Adjusted EBITDA Margin provide the Board of Directors, management and investors with clear representation of our core operating performance and trends, provide greater visibility into the long-term financial performance of the Company, and eliminate the impact of items that do not relate to the ongoing operating performance of the business. Further, Adjusted EBITDA is used by the Board of Directors and management to prepare and approve our annual budget, and from time to time, to evaluate the performance of certain management personnel when determining incentive compensation.

Table MD&A 5: Reconciliation of Net Loss to EBITDA and Adjusted EBITDA; Net Loss Margin to EBITDA Margin and Adjusted EBITDA Margin

(dollars in thousands)

(1) The stock-based compensation adjustment to EBITDA is made up of stock-based compensation expense for the awarded service-based restricted stock units ("RSUs"), performance-based restricted stock units ("PSUs"), stock options, and other sources. Stock-based compensation expense for the awarded RSUs, PSUs and stock options was $19.4 million and $22.9 million for fiscal years 2024 and 2023, respectively. Stock-based compensation expense from other sources was $2.1 million and $1.5 million for the fiscal years 2024 and 2023, respectively. The other source of stock-based compensation consists of accrued compensation, which the Company intends to settle in shares of the Company's common stock. However, it is the Company's discretion whether this compensation will ultimately be paid in stock or cash. The Company has the right to dictate the form of these payments up until the date at which they are paid. Any change to the expected payment form would result in a change in estimate that would add back to Adjusted EBITDA.

(2) Due to its immaterial amount, the impairment loss on intangible assets of $0.5 million for fiscal year 2023 was reported as part of depreciation and amortization in 2023.

(3) The restructuring expenses include severance and other related benefit costs (including outplacement services and continuing health insurance coverage), external consulting and advisory fees related to implementing the restructuring plan.

Adjusted Net Loss and Adjusted EPS

Adjusted Net (Loss) Income and Adjusted EPS are supplemental measures of operating and cash flow performance that are not made under GAAP and do not represent, and should not be considered as alternatives to, net (loss) income and earnings per share as determined by GAAP. We define Adjusted Net (Loss) Income as net (loss) income, adjusted for non-operating (income) expense, stock-based compensation expense, impairment loss on intangible assets, and restructuring expenses (adjustments). We define Adjusted EPS as Adjusted Net (Loss) Income divided by the weighted-average number of common shares outstanding for the period.

Adjusted Net (Loss) Income and Adjusted EPS provide the Board of Directors, management and investors with clear representation of our core operating performance and trends, provide greater visibility into the long-term financial performance of the Company, and eliminate the impact of items that do not relate to the ongoing operating performance of the business.

Table MD&A 6: Reconciliation of Net Loss and GAAP EPS to Non-GAAP Adjusted Net Loss and Adjusted EPS

(in thousands, except per share data)

(1) The stock-based compensation adjustment to EBITDA is made up of stock-based compensation expense for the awarded service-based RSUs, PSUs, stock options, and other sources. Stock-based compensation expense for the awarded RSUs, PSUs and stock options was $19.4 million and $22.9 million for fiscal years 2024 and 2023, respectively. Stock-based compensation expense from other sources was $2.1 million and $1.5 million for the fiscal years 2024 and 2023, respectively. The other source of stock-based compensation consists of accrued compensation, which the Company intends to settle in shares of the Company's common stock. However, it is the Company's discretion whether this compensation will ultimately be paid in stock or cash. The Company has the right to dictate the form of these payments up until the date at which they are paid. Any change to the expected payment form would result in a change in estimate that would add back to Adjusted Net Loss.

(2) Due to its immaterial amount, the impairment loss on intangible assets of $0.5 million for fiscal year 2023 was reported as part of depreciation and amortization in 2023.

(3) The restructuring expenses include severance and other related benefit costs (including outplacement services and continuing health insurance coverage), external consulting and advisory fees related to implementing the restructuring plan.

Adjusted Gross Profit, Cash Gross Profit, Adjusted Gross Margin and Cash Gross Margin

Adjusted Gross Profit, Cash Gross Profit, Adjusted Gross Margin and Cash Gross Margin are supplemental measures of operating and cash flow performance that are not made under GAAP and do not represent, and should not be considered as alternatives to gross profit and gross margin as determined by GAAP. We define Adjusted Gross Profit as gross profit, plus stock-based compensation expense, impairment loss on intangible assets, and restructuring expenses charged under cost of sales. We define Adjusted Gross Margin as Adjusted Gross Profit as a percentage of total revenue. We define Cash Gross Profit as Adjusted Gross Profit, plus depreciation and amortization. We define Cash Gross Margin as Cash Gross Profit as a percentage of total revenue.

Adjusted Gross Profit, Cash Gross Profit, Adjusted Gross Margin and Cash Gross Margin provide management and investors with a clear representation of the core economics of gross profit and gross margin without the impact of non-cash expenses and sunk costs expended.

Table MD&A 7: Reconciliation of Gross Profit to Adjusted Gross Profit and Cash Gross Profit; Gross Margin to Adjusted Gross Margin and Cash Gross Margin

(dollars in thousands)

35

Free Cash Flow

Free Cash Flow is a supplemental measure of operating and cash flow performance that is not made under GAAP and does not represent, and should not be considered as an alternative to, net cash flow (used in) provided by operating activities, as determined by GAAP. We define Free Cash Flow as net cash (used in) provided by operating activities, less net purchases of property and equipment, and capitalized software development costs.

We use Free Cash Flow to understand the cash flows that directly correspond with our operations and the investments we must make in those operations, using a methodology that combines operating cash flows and capital expenditures. Further, Free Cash Flow may be useful to management and investors in evaluating the Company's operating and cash flow performance and liquidity, and to evaluate the performance of certain management personnel when determining incentive compensation.

Table MD&A 8: Reconciliation of Net Cash (Used in) Provided by Operating Activities to Free Cash Flow

(in thousands)

EBITDA, Adjusted EBITDA, EBITDA Margin, Adjusted EBITDA Margin, Adjusted Net Loss, Adjusted EPS, Adjusted Gross Profit, Adjusted Gross Margin, Cash Gross Profit, Cash Gross Margin and Free Cash Flow each have limitations as an analytical tool, and you should not consider any of them in isolation, or as a substitute for analysis of our results as reported under GAAP. Among other limitations, each of EBITDA, Adjusted EBITDA, EBITDA Margin, Adjusted EBITDA Margin, Adjusted Net Loss, Adjusted EPS, Adjusted Gross Profit, Adjusted Gross Margin, Cash Gross Profit, Cash Gross Margin and Free Cash Flow does not reflect our cash expenditures, or future requirements, for capital expenditures or contractual commitments, does not reflect the impact of certain cash and non-cash charges resulting from matters we consider not to be indicative of our ongoing operations, and does not reflect income tax expense or benefit. Other companies in our industry may calculate Adjusted EBITDA, Adjusted EBITDA Margin, Adjusted Net Loss, Adjusted EPS, Adjusted Gross Profit, Adjusted Gross Margin, Cash Gross Profit, Cash Gross Margin and Free Cash Flow differently than we do, which limits their usefulness as comparative measures. Because of these limitations, neither EBITDA, Adjusted EBITDA, EBITDA Margin, Adjusted EBITDA Margin, Adjusted Net Loss, Adjusted EPS, Adjusted Gross Profit, Adjusted Gross Margin, Cash Gross Profit, Cash Gross Margin nor Free Cash Flow should be considered as a replacement for gross profit, gross margin, net (loss) income, earnings per share or net cash flows (used in) provided by operating activities, as determined by GAAP, or as a measure of our profitability. We compensate for these limitations by relying primarily on our GAAP results and using non-GAAP measures only for supplemental purposes.

Liquidity and Capital Resources

Our primary sources of liquidity are cash on hand, future operating cash flows, and, if needed, borrowings under our $30.0 million senior secured revolving credit facility, with an expansion feature of up to $30.0 million of additional revolver capacity. While a variety of factors related to sources and uses of cash, such as timeliness of accounts receivable collections, vendor credit terms, or significant collateral requirements, ultimately impact our liquidity, such factors may or may not have a direct impact on our liquidity.

As of December 31, 2024, we had cash and cash equivalents of $54.6 million and our working capital was $69.3 million.

We place a strong emphasis on liquidity management. This focus gives us the flexibility for capital deployment while preserving a strong balance sheet to position us for future opportunities. We believe we have adequate funds on hand to execute our financial and operating strategy. Our overall financial position and liquidity are strong. Although no assurances can be given, we believe the available cash balances and access to our revolving credit facility are sufficient to maintain the liquidity we require to meet our operating, investing and financing needs for the next 12 months.

(in thousands)

For the year ended December 31, 2024, net cash used in operating activities was $25.9 million, compared with net cash provided by operating activities of $1.6 million in 2023, an increase in cash outflow of $27.5 million compared year over year. The change in cash flow from operating activities is primarily driven by the Company's operating losses, the timing of receipts of customer payments, and the timing of payments to vendors and employees, adjusted for certain non-cash items that do not impact cash flows from operating activities.

Net cash used in investing activities for the years ended December 31, 2024, increased by $1.3 million in cash outflow compared to the same period in 2023, primarily due to the cash outflow from the purchase of an investment of $3.0 million in 2024, with no similar transaction in 2023. This is partially offset by a decrease of $1.7 million in capital expenditures in 2024.

For the year ended December 31, 2024, net cash used in financing activities was $2.0 million, compared to $6.2 million in 2023. This is primarily attributable to decreases in payments of tax withholding related to the net share settlement of equity awards of $0.5 million in 2024, compared with $3.7 million in 2023, and a $0.6 million payment for the Diamond Fortress Technologies ("DFT") holdback in February 2023, with no similar payment in 2024.

Commitments from Contractual Obligations

The Company does not have any other material cash requirements from contractual obligations. As of December 31, 2024, we had contractual commitments to make payments under existing lease obligations on various office space and equipment under non-cancelable operating and finance leases, and an obligation under a service agreement. We reported current and long-term lease liabilities; see Note 13 - Leases in the consolidated financial statements within this 10-K.

Table MD&A 10: Contractual Obligations

(in thousands)

There were no outstanding commitments that were considered material for capital expenditures on December 31, 2024.

From time to time, we may be subject to various audits, reviews, investigations, lawsuits and claims related to our business. See Note 19 - Commitments and Contingencies to the consolidated financial statements within this Annual Report for further discussion of other commitments and contingencies.

Revolving Credit Facility

On December 30, 2022, we entered into a senior secured credit facility with JPMorgan Chase Bank, N.A. ("Credit Agreement") that provides for a $30.0 million senior secured revolving credit facility, with the option of issuing letters of credits thereunder and with an uncommitted expansion feature of up to $30.0 million of additional revolver capacity, maturing on December 30, 2025. On April 12, 2023, we amended our Credit Agreement and revised certain provisions on the terms of the covered collateral. See Note 10 - Debt and Other Obligations to the consolidated financial statements contained within this Annual Report for additional information.

The Credit Agreement contains customary terms and conditions, including certain covenant requirements. As of December 31, 2024, there were no outstanding balances under the revolving credit facility and we were in compliance with all covenants contained in the Credit Agreement.

Other Financing Obligations

In November 2022, we entered into a Master Purchase Agreement ("MPA") with a third party for $9.1 million relating to software licenses under a specific delivery order with a customer, resulting in proceeds from other financing obligations. On February 9, 2023, when the third-party buyer notified us that it would not exercise the option period, we transferred all the rights, title and interest in the underlying licenses in exchange for the extinguishment of the outstanding financing obligations. The extinguishment of the other financing obligations resulted in a gain of $1.4 million in 2023. See Note 10 – Debt and Other Obligations to the consolidated financial statements combined within this Annual Report for a detailed discussion of our debt financing arrangements.

Under the MPA, if the customer terminates the delivery order for non-renewal and the buyer reasonably concludes that the customer's actions constitute grounds for filing a claim, the buyer and Telos will cooperate in preparing such a claim. During the third quarter of 2024, the buyer, through Telos, filed a claim against the customer.

Critical Accounting Policies and Estimates

The preparation of consolidated financial statements in conformity with U.S. GAAP requires management to make estimates and assumptions that affect the amounts reported. In preparing these financial statements, management has made its best estimates and judgments of certain amounts included in the consolidated financial statements, giving due consideration to materiality. Management evaluates these estimates and assumptions on an ongoing basis. Our estimates and assumptions have been prepared on the basis of the most current reasonably available information, and may change in the future as more current information is available.

Management believes that our critical accounting policies are those that are both material to the presentation of our financial condition and results of operations and require management's most difficult, subjective and complex judgments. Typically, the circumstances that make these judgments difficult, subjective and complex have to do with making estimates about the effect of matters that are inherently uncertain; as a result, actual results could differ from those estimates.

The critical accounting policies requiring estimates, assumptions, and judgments that we believe have the most significant impact on our consolidated financial statements in fiscal year 2024 are described below. This is not intended to be a comprehensive list of all significant accounting policies that are more fully described in the notes to consolidated financial statements contained within this report.

Revenue Recognition

Although most of our revenue is recognized concurrently with billing or with the passage of time, some of our revenue requires us to make estimates. The timing of the satisfaction of performance obligations varies across our businesses due to our diverse product and service mix, customer base, and contractual terms. Significant judgment can be required in determining certain performance obligations, and these determinations could change the amount of revenue and profit recorded in a given period. Our contracts may have a single performance obligation or multiple performance obligations. When there are multiple performance obligations within a contract, we allocate the transaction price, net of any discounts, to each performance obligation based on the standalone selling price of the product or service underlying each performance obligation. The standalone selling price is either based on estimated or actual costs plus a reasonable profit margin or the observable price of a good or service when Telos sells that good or service separately in similar circumstances and to similar customers. The transaction price for our contracts represents our best estimate of the consideration we will receive and includes assumptions regarding variable consideration, as applicable. The transaction price is allocated to each distinct performance obligation within the contract and recognized as revenue when, or as, the performance obligation is satisfied.

Our contracts may also include various types of variable considerations such as claims (i.e., indirect rate or other equitable adjustments) or incentive fees and we include estimated amounts in the transaction price to the extent it is probable that a significant reversal of cumulative revenue recognized will not occur. The estimated amounts are based on an assessment of our anticipated performance and all other information that is reasonably available to us.

For contracts where revenue is recognized over time, we recognize revenue based on progress towards completion of the performance obligation, using costs incurred to date relative to the total estimated cost at completion to measure progress on a proportional performance basis for our contracts. Due to the nature of the work required to be performed on certain contracts, the estimation of total revenue and cost at completion is complex, subject to many variables and requires significant judgment. Contract estimates are based on various assumptions, including labor and subcontractor costs, materials and other direct costs and the complexity of the work to be performed. A significant change in one or more of these estimates could affect the profitability of our contracts. We review and update our contract-related estimates regularly and recognize adjustments in estimated profit on contracts on a cumulative catch-up basis, which may result in an adjustment increasing or decreasing revenue to date on a contract in a particular period that the adjustment is identified. Revenue and profit in future periods of contract performance are recognized using the adjusted estimate. As a result of the changes in contract estimates, we recorded immaterial catch-up revenue adjustments during the year ended December 31, 2024, and 2023.

Goodwill and Other Long-Lived Assets

We evaluate the impairment of goodwill and other long-lived assets in accordance with Accounting Standards Codification ("ASC") 350, "Intangibles – Goodwill and Other." Management annually reviews goodwill and other long-lived assets for impairment or whenever events or changes in circumstances indicate the carrying amount may not be recoverable. If we determine that the carrying value of the goodwill and other long-lived assets may not be recoverable, we will record an impairment charge for the amount by which the carrying value of the goodwill and other long-lived assets exceeds its fair value.

Goodwill is not amortized, but rather tested for potential impairment as of December 31 each year. The goodwill impairment test is performed at the reporting unit level. Accounting requirements provide that a reporting entity may perform an optional qualitative assessment on an annual basis to determine whether events occurred or circumstances changed that would more likely than not reduce the fair value of a reporting unit below its carrying amount. If an initial qualitative assessment identifies that it is more likely than not that the fair value of a reporting unit is less than its carrying amount, or the optional qualitative assessment is not performed, a quantitative analysis is performed.

In testing goodwill for impairment, we first assess the qualitative factors to determine whether the existence of events or circumstances leads to a determination that it is more likely than not that the fair value of a reporting unit is less than its carrying value. If, after the assessment, we determine that an impairment indicator exists, we perform the quantitative goodwill impairment test. The Company performs the quantitative goodwill impairment test by calculating the fair value of the reporting unit and comparing it to its respective carrying value including goodwill. If the fair value is less than the carrying value, the amount of impairment expense is equal to the difference between the reporting unit's fair value and the reporting unit's carrying value.

Determining the fair value of a reporting unit requires management's judgment and involves the use of significant estimates and assumptions, including forecasted revenue, operating margins, capital expenditures, and selection and use of an appropriate discount rate commensurate with the risk inherent in each of our reporting units' current business models. We utilize the weighted average cost of capital as derived by certain assumptions specific to our facts and circumstances as the discount rate. Our estimate of cash flows and discount rate are subject to change due to the economic environment. A relatively small change in the underlying assumptions, including if the financial performance of the reporting unit does not meet expectations in future years, may cause a change in the results of the impairment assessment in future periods and, as such, could result in goodwill impairment.

For fiscal year 2024, we performed a qualitative assessment of our reporting units and determined that it is more likely than not that the estimated fair value of the reporting units exceeds their carrying value and thus, we did not proceed to the two-step goodwill impairment test.

Due to the nature of our business and other factors described in Item 1A, "Risk Factors," of this Annual Report on Form 10-K, the profitability of our individual reporting units may periodically be affected by downturns in customer demand, operational challenges, and other factors. If material adverse conditions occur that impact one or all of our reporting units, our determination of future fair value might not support the carrying amount of our reporting units, and the related goodwill may be impaired. We will continue to monitor any changes to our assumptions and will evaluate goodwill as deemed warranted during future periods.

We amortize intangible assets over their respective estimated useful lives, and review them for impairment whenever events or changes in business circumstances indicate the carrying value may not be recoverable.

We evaluated our intangible assets for potential impairment. As a result of the assessment, we identified conditions demonstrating an impairment of certain software development costs. An impairment charge of $11.7 million and $0.5 million was recorded in the consolidated statements of operations for the years ended December 31, 2024, and 2023, respectively.

For further discussion of the methods used and factors considered in our estimates as part of the impairment testing for goodwill and intangible assets, see Note 2 - Significant Accounting Policies on Goodwill and Intangible Assets, Note 7 - Goodwill and Note 8 - Intangible Assets, Net to the consolidated financial statements contained within this Annual Report.

Income Taxes

We account for income taxes in accordance with ASC 740, "Income Taxes." Our income tax expense, deferred tax assets and liabilities, and liabilities for unrecognized tax benefits reflect our best estimate of current and future taxes to be paid. We record net deferred assets to the extent we believe these assets will more likely than not be realized. The realizability of net deferred tax assets is based on all available evidence, including future taxable income projections, tax planning strategies, and reversal of taxable temporary differences. We regularly review our deferred tax assets for recoverability and establish a valuation allowance when management believes it is more likely than not that such asset will not be recovered, taking into consideration historical operating results, expectations of future earnings, tax planning strategies and the expected timing of the reversals of existing temporary differences.

Recent Accounting Pronouncements

See Note 2 - Significant Accounting Policies of the consolidated financial statements contained within this Annual Report for a discussion of recently issued accounting pronouncements.

In the normal course of business, we are exposed to a variety of financial risks, such as interest rate risk, foreign currency translation risk, and counterparty risk, which can affect our operations and profitability.

Our cash and cash equivalents include highly liquid investments that have a maturity of three months or less at the date of purchase, and would not be significantly affected by increases or decreases in interest rates, mainly due to the short-term nature of these instruments. The majority of our business is transacted in U.S. dollars, and the impact of the foreign currency fluctuation as we report for our foreign subsidiary upon translation of its financials into U.S. dollars was insignificant. Further, we do not enter into financial instruments for trading purposes.

Evaluation of Disclosure Controls and Procedures

Our management, with the participation of our principal executive officer (our Chairman and Chief Executive Officer) and principal financial officer (our Executive Vice President and Chief Financial Officer), has evaluated the effectiveness of our disclosure controls and procedures (as defined in Rules 13a-15(e) or 15d-15(e) under the Securities Exchange Act of 1934) as of December 31, 2024. Based upon that evaluation, our principal executive officer and principal financial officer have concluded that our disclosure controls and procedures are effective to ensure that information required to be disclosed by us in the reports that we file or submit under the Securities Exchange Act of 1934 is recorded, processed, summarized and reported within the time periods specified in the rules and forms of the SEC. These disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed by us in the reports that we file or submit under the Securities Exchange Act of 1934 is accumulated and communicated to our management, including our principal executive officer and our principal financial officer, as appropriate to allow timely decisions regarding required disclosure.

Management's Report on Internal Control over Financial Reporting

Our management is responsible for establishing and maintaining adequate internal control over financial reporting. Internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with GAAP.

Our internal control over financial reporting includes those policies and procedures that:

a. Pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of our assets;

b. Provide reasonable assurance that transactions are recorded properly to allow for the preparation of financial statements in accordance with U.S. GAAP and that our receipts and expenditures are being made only in accordance with authorizations of our management and directors; and

c. Provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of our assets that could have a material effect on the consolidated financial statements.

Internal control over financial reporting includes the controls themselves, monitoring and internal auditing practices and actions taken to correct deficiencies as identified.

Our management, with the participation of the Chief Executive Officer and Chief Financial Officer, has evaluated the effectiveness of our internal control over financial reporting as of December 31, 2024, based on the framework established in the 2013 Internal Control – Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission. Our management has assessed in its evaluation the effectiveness of our internal control over financial reporting as of December 31, 2024, and has concluded that our internal control over financial reporting was effective.

PricewaterhouseCoopers LLP, an independent registered public accounting firm, audited our consolidated financial statements and our internal control over financial reporting, and the firm’s report on our internal control over financial reporting are included in Item 8 of this Annual Report on Form 10-K.

Although our management, including the Chief Executive Officer and the Chief Financial Officer, is responsible for establishing and maintaining adequate internal control over financial reporting, because of inherent limitations, our management does not expect that our internal controls over financial reporting will prevent or detect all errors and all fraud. Also, projections of any evaluation of effectiveness in such assessment to future periods are subject to the risk that controls may be inadequate because of changes in conditions or that the degree of compliance with the policies or procedures may deteriorate.

Changes in Internal Control over Financial Reporting

There were no changes in our internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) identified in connection with the evaluation of our internal control that occurred during the quarter ended December 31, 2024, that have materially affected, or are reasonably likely to materially effect, our internal control over financial reporting.