CISO Global, Inc.: Form 10-K for the period ended Dec 31, 2025

Unless otherwise indicated or the context requires otherwise, the terms “we,” “us,” “our,” and “our company” refer to CISO Global, Inc., a Delaware corporation, and our wholly owned subsidiaries. Unless otherwise specified, all dollar amounts are expressed in United States dollars.

Our Business

General

Our company is a leading cybersecurity, compliance, and software firm composed of highly trained and seasoned security professionals. We collaborate with clients to enhance or establish a stronger cybersecurity posture within their organizations. Cybersecurity, also referred to as computer or information technology security, protects computer systems and networks from data breaches, hardware damage, software compromise, and service disruptions.

The cybersecurity industry faces a significant supply and demand imbalance, with greater demand for services than the market can supply in terms of expert, seasoned compliance and cybersecurity professionals. To address this, we prioritize identifying, attracting, and retaining top cybersecurity and compliance talent. Our strategy includes acquisitions, direct hiring, and employee incentivization through stock options to ensure retention. We continuously seek culturally aligned cyber talent. We have invested in enterprise solutions, executive leadership, and our proprietary software to integrate our acquisitions into a unified ecosystem. This ecosystem is designed to foster cross-pollination of solutions, promote additional revenue opportunities and enhance recurring revenue. By emphasizing a security-aware workforce culture, we aim to become trusted advisors, providing tailored, product-agnostic cybersecurity solutions that align with our clients’ security needs, financial realities, and strategic goals. Our comprehensive cybersecurity services span compliance, cybersecurity, and culture. These services include compliance consulting, secured managed services, Security Operations Center (SOC) services, virtual Chief Information Security Officer (vCISO) services, incident response, certified forensics, technical assessments, and cybersecurity training. We believe culture forms the foundation of successful cybersecurity programs. To support this, we have developed MCCP+ (“Managed Compliance & Cybersecurity Provider + Culture”), a holistic solution combining all four pillars under one roof, delivered by a dedicated team of subject matter experts. Our proprietary software further enhances this offering by streamlining compliance management, threat detection, and response capabilities, ensuring a faster and more effective security posture for our clients. We differentiate ourselves through a technology-agnostic approach and a relentless focus on acquiring high-demand cybersecurity talent, expanding both service capabilities and global reach. Paired with our proprietary CISO software, which enhances threat visibility and accelerates incident response, we strive to deliver unparalleled value to clients. This strategy aims to drive scalable growth, strengthen recurring revenue streams, and position us as a leader in a market facing a critical cybersecurity talent shortage. Our integrated service model enhances our ability for revenue capture and operational efficiency, which has the ability to result in improved profitability and stronger client retention. Clients benefit from streamlined engagements with a single provider addressing a broad range of needs, leading to faster problem resolution and superior outcomes compared to multi-vendor approaches. We believe this fosters long-term client partnerships.

We aim to further differentiate ourselves through our staffing model: our employees are dedicated partners, not consultants, available under recurring monthly contracts. This structure helps mitigate the challenges associated with hiring experienced cybersecurity professionals. By integrating our team of industry and subject matter experts into clients’ operations — supported by our proprietary software — we offer a robust, embedded cybersecurity solution that continuously adapts to evolving threats.

Our technology-agnostic stance allows us to work compatibly with almost any business, regardless of existing systems or tools. Clients retain the flexibility to select the best technologies for their needs without impacting their relationship with us.

Building a world-class technology team with industry-specific expertise remains a cornerstone of our strategy. We will continue acquiring top cybersecurity talent to expand our services and geographical footprint, reinforcing our ability to deliver exceptional results for clients. Our goal remains to stay ahead of emerging threats and regulatory changes, ensuring our clients’ safety, compliance, and success — with our proprietary software serving as a vital tool to support ongoing security, compliance, and operational excellence.

Cybersecurity Landscape: A Market Poised for Growth

As global connectivity accelerates, cyberattacks have emerged as one of the most pressing threats to enterprise and personal data, driving unprecedented economic losses. Cybersecurity Ventures projected global damages from cybercrime will propel global spending on cybersecurity products and services to $1 trillion (USD) annually by 2031. Ransomware remains one of the fastest-growing attack types, with incidents expected to occur every two seconds, inflicting an estimated $265 billion in annual damages by 2031 — a dramatic rise from $20 billion and an attack every 11 seconds in 2021. In parallel, an Accenture survey reports that 68% of business leaders perceive increasing cybersecurity risks. Reflecting this urgency, global cybersecurity spending is forecasted to surpass $520 billion annually (USD) by 2026, up from $260 billion in 2021. Despite this investment surge, the talent gap remains a critical constraint. According to The New York Times and Cybersecurity Ventures, 3.5 million cybersecurity roles remain unfilled — a disparity expected to have persisted through 2025.

Market Drivers: Regulation and Cyber Insurance

Heightened cyber risks have triggered a wave of regulatory reforms and tighter cyber insurance standards. Governments worldwide are enforcing more rigorous cybersecurity mandates, while insurers have raised premium costs and minimum underwriting criteria. This evolving landscape compels organizations to prioritize cybersecurity investments to maintain compliance, secure coverage, and safeguard their operations.

Strategic Market Leadership and Growth Potential

We are uniquely positioned to capitalize on this rapidly expanding market, offering end-to-end cybersecurity services with substantial opportunities for sustained growth and value creation. Key differentiators include:

• Proven Acquisition Strategy: Through numerous strategic acquisitions, we have integrated top-tier talent and broadened our capabilities, creating a comprehensive service portfolio aligned with market demands.
• Expansive Client Portfolio: Serving more than 437 clients across diverse sectors, we are strategically positioned to drive revenue growth through cross-selling and upselling high-value services.
• Robust Channel and Partnership Ecosystem: We have cultivated an extensive network of partners, supported by comprehensive training, enablement resources, and marketing content
• Innovation and Intellectual Property Development: Our proprietary technologies and intellectual property provide a competitive edge, enabling deeper penetration into existing accounts, expansion into new markets, and enhanced partner collaboration opportunities.

Investor Value Proposition: Positioned for Scalable, Long-Term Success

The evolving cybersecurity landscape presents a dynamic, high-growth market ripe with opportunity. As threats intensify and regulatory pressures mount, businesses require an agile, trusted cybersecurity partner. Our proven mergers and acquisitions track record, expansive client base, channel-first approach, and intellectual property-driven innovation uniquely position us for scalable growth and market leadership.

We remain steadfast in our commitment to innovation and operational excellence — empowering organizations to stay resilient and secure in an increasingly complex digital ecosystem.

Cybersecurity Offerings

We offer a comprehensive suite of cybersecurity services designed to safeguard our clients’ digital assets and ensure compliance with applicable industry standards and regulations. Our offerings fall into three main categories: Security Managed Services, Professional Services, and Cybersecurity Software.

Security Managed Services

Our Security Managed Services aims to deliver proactive, scalable, and resilient cybersecurity solutions tailored to meet evolving threat landscapes and regulatory requirements.

Compliance Services

We assist clients in implementing and maintaining appropriate security controls, prioritizing risk mitigation strategies, and help ensure continuous compliance with key industry frameworks and regulations, including the following:

• Cybersecurity Maturity Model Certification (“CMMC”);
• Federal Risk and Authorization Management Program;
• Federal Information Security Modernization Act (“FISMA”);
• Health Insurance Portability and Accountability Act of 1996 (“HIPAA”);
• Health Information Trust Alliance;
• Import Export Code;
• International Organization for Standardization; and
• National Institute of Standards and Technology.

Our team of certified experts provides ongoing monitoring, assessment, and advisory services to help clients navigate the complexities of regulatory compliance and mitigate operational risks.

Cyber Defense Operation

Our U.S.-based, 24/7 SOC leverages advanced technology and expert analysis to provide real-time threat detection, response, and mitigation. Core capabilities include the following:

• Managed Detection and Response (“MDR”);
• Extended Detection and Response (“XDR”);
• Security Information and Event Management (“SIEM”); and
• Patch and Vulnerability Management.

These services support comprehensive threat visibility, rapid incident response, and continuous improvement of clients’ security postures, helping to minimize downtime and reduce the potential impact of cyberattacks.

Secured Managed Services

Our integrated Secured Managed Services offering combines a robust portfolio of cybersecurity capabilities, including the following:

• Secure network architecture design and management;
• Proprietary cybersecurity software solutions;
• SOC-driven monitoring and response services;
• Regulatory compliance support;
• Incident remediation and recovery teams; and
• Advanced firewall and perimeter security management.

Our experienced engineers and cybersecurity architects support clients with secure cloud migrations, infrastructure modernization, and tailored risk mitigation strategies — helping enable operational resilience and business continuity.

Professional Services

Our Professional Services division helps deliver comprehensive cybersecurity solutions designed to mitigate risk, enhance resilience, and protect organizational value.

Incident Response and Digital Forensics

Leveraging advanced threat intelligence and real-world adversarial techniques, our elite cybersecurity team specializes in swiftly identifying, containing, and eradicating cyberattacks. We conduct discreet, environment-wide investigations to assess breach scope, minimize operational disruption, and remediate persistent threats — positioning us as the trusted partner when others fail.

Security Testing and Training

We empower organizations to proactively strengthen their cyber defenses through rigorous security assessments, including red team and purple team penetration testing, simulated attack exercises, and specialized cybersecurity training. Our programs include industry-recognized certifications such as CMMC, CompTIA, and ISC2, driving measurable improvements in cybersecurity posture and regulatory readiness.

Cybersecurity Software

We offer a comprehensive suite of proactive cybersecurity software solutions designed to protect organizations from evolving cyber threats. Our offerings encompass advanced threat detection, proactive monitoring, and robust risk management to help ensure enterprise security and compliance.

CISO Edge

CISO Edge is an artificial intelligence (“AI”)-driven cloud security solution that provides comprehensive protection across cloud-first, hybrid, and remote environments. Purpose-built for large enterprises, government entities, and high-value networks, CISO Edge is designed to defend against sophisticated cyber threats, including ransomware and AI-powered exploits

CHECKLIGHT® Security Monitoring

CHECKLIGHT® is a proactive security monitoring software that is designed to detect potential threats to endpoints and alerts users before attacks can take hold, thereby reducing the impact of breaches. It identifies malicious software such as phishing attacks, malware, ransomware, and viruses. Since its inception, CHECKLIGHT® has maintained a record of detecting all breaches, providing organizations with confidence in their endpoint security, and is backed by a financial warranty.

Argo Security Management

Argo is a security management platform that aggregates and curates all security data across various services, including SIEM, MDR, XDR, governance, risk, compliance, and more. This centralized approach is designed to enhance the effectiveness of security teams by providing environment-wide cybersecurity visibility through a customizable dashboard, enabling better-informed decisions.

Through these innovative software solutions, we aim to empower organizations to enhance their cybersecurity measures, protect critical assets, and maintain compliance in an ever-evolving threat landscape.

Growth Strategy

We are executing a phased growth strategy designed to position our company as a leading provider of end-to-end cybersecurity solutions. Our strategy is built upon strategic acquisitions, development of proprietary intellectual property, and a focus on scalable growth. We aim to leverage our expertise and advanced technology offerings to drive both organic growth and market expansion, thereby creating value for our investors.

Phase I: Foundation of Expertise through Strategic Acquisitions

In Phase I, we established a solid foundation of cybersecurity expertise by acquiring niche companies with unparalleled capabilities in various cybersecurity domains. These acquisitions have significantly expanded our talent pool and technical expertise, positioning us as a leading cybersecurity provider. The acquired talent spans across the United States, with deep domain knowledge in key cybersecurity areas including the following:

• Risk and Compliance;
• Cyber Defense Operations;
• Security Testing and Training; and
• Secure IT and Architecture.

This diverse expertise, coupled with leadership from seasoned industry executives, has enabled us to address the complex and rapidly evolving cybersecurity needs of organizations across various sectors.

Phase II: Expanding Service Offerings and Capitalizing on Cross-Selling Opportunities

Phase II of our growth strategy focused on leveraging the synergies from our numerous historical acquisitions to expand service offerings to existing clients. Despite having only penetrated approximately 20% of our 437 clients for multiple services, we saw significant opportunities for cross-selling and upselling. This presented a substantial revenue growth opportunity as we expanded our service offerings across our client base.

Additionally, we have been building and expanding a strong channel and partnership ecosystem. This ecosystem provides value-added training, support, and partner marketing content. Our growing network of partnerships enhances our ability to acquire new clients while fostering long-term relationships with existing ones.

Intellectual Property Development and Innovation

A key element of Phase II was the development of proprietary intellectual property that addresses the evolving cybersecurity challenges facing enterprises. We invested heavily in the development of software-first technologies, leveraging cutting-edge advancements such as machine learning (“ML”), AI, deep learning, neural networks, and proprietary DarkNet threat intelligence. These technologies are foundational to our offerings, providing differentiated solutions that drive effectiveness, resilience, and advanced threat mitigation for our clients.

Phase III: Scaling Through Product-Led Growth and Scalable Technology Solutions

In Phase III, in 2026, our primary focus will shift toward fueling organic growth through the commercialization and scaling of our proprietary intellectual property. We plan to accelerate growth through product-led strategies, optimizing the user experience and enabling hands-free purchasing via digital interfaces. We believe this approach will allow us to expand our client base while reducing the demand on our services team, driving efficiency and scalability.

As we expand our technology offerings, we anticipate increasing revenue and operating margins concurrently. The scalability of our intellectual property-driven solutions positions us to capture a larger share of the cybersecurity market while maintaining high levels of profitability.

Intellectual Property Suite and Future Growth

At the heart of our strategy is a comprehensive suite of proprietary software solutions, incorporating AI, neural networks, and the latest algorithms. These technologies are designed to address the most pressing cybersecurity challenges facing enterprises today, positioning us at the forefront of the cybersecurity industry.

Through these efforts, we aim to deliver sustainable, long-term growth while continuing to provide our clients with best-in-class cybersecurity solutions. Our continued investment in intellectual property and innovative technologies are key drivers of value creation for our investors as we scale our business and expand our market presence.

Our intellectual property suite includes the following:

ARGO Security Management – A security management platform that is able to aggregate, then curate security data in real time from a client’s entire environment, including network asset information, currently deployed cyber tools, SOC, vulnerability management, secure managed IT and penetration testing data.

CISO Edge Cloud Security Platform – A cloud-first security solution designed to protect users from untrusted and malicious online threats. CISO Edge uses advanced AI deep learning as well as artificial neural networks to provide advanced threat detection and monitoring.

CHECKLIGHT® Security Monitoring – A powerful, proactive security monitoring software that detects potential threats to networks and provides advance alerts so attacks can’t take hold. Relying on the same cybersecurity software engine used by several federal agencies, it identifies unauthorized processes associated with fraudulent phishing attacks, hacking, imposter scams, malware, ransomware, and viruses, and provides a financial warranty

DISC Next Gen VPN – A token exchange-protected remote access solution that replaces traditional VPN connections with enhanced security and access verification.

Skanda Breach Assessment Tool – A next-generation, analysis tool that applies AI-based automation and ML technologies, which looks beyond vulnerabilities identified by most other technology to deliver continuous security assessments.

Our Corporate and Acquisition History

We were formed on March 5, 2019, as a Delaware corporation. Our principal offices are located at 6900 East Camelback Road, Suite 900, Scottsdale, Arizona 85251.

On October 2, 2019, we filed a registration statement on Form 10-12G with the Securities and Exchange Commission (“SEC”) to effect registration of our common stock, par value $0.00001 per share, under the Exchange Act. The registration statement became effective on December 1, 2019.

On February 29, 2024, our board of directors approved a 1-for-15 reverse stock split of our common stock. The record date for the reverse stock split was the close of business on March 7, 2024, with share distribution occurring on March 8, 2024. As a result of the reverse stock split, stockholders received one share of CISO Global, Inc. common stock, par value $0.00001, for each 15 shares they held as of the record date. All share and per share amounts have been retroactively restated for the effects of this reverse stock split. Common stock underlying our outstanding warrants, convertible notes, and options have also been adjusted, and the conversion and exercise prices have also been adjusted.

We have substantially expanded our business in recent years through a number of acquisitions that enhanced our product offerings.

The following table sets forth certain information regarding such acquisitions:

(1) Prior to our acquisition of GenResults, GenResults was wholly owned by an entity affiliated with David G. Jemmett, our Chief Executive Officer and a director of our company. Due to the companies being under common control, we accounted for the acquisition as a reorganization.

(2) At the time of the VCAB Merger, VCAB was subject to a bankruptcy proceeding and had minimal assets, no equity owners, and no liabilities, except for approximately 1,500 holders of Class 5 Allowed General Unsecured Claims and a holder of allowed administrative expenses (collectively the “Claim Holders”). Pursuant to the terms of the VCAB Merger, and in accordance with the bankruptcy plan, we issued an aggregate of 133,334 shares of our common stock (the “Plan Shares”) to the Claim Holders as full settlement and satisfaction of their respective claims. As provided in the bankruptcy plan, the Plan Shares were issued pursuant to Section 1145 of the United States Bankruptcy Code. We entered into the VCAB Merger to increase our stockholder base to, among other things, assist us in satisfying the listing standards of a national securities exchange.

(3) Entities were disposed of on July 1, 2024. See Note 4 to our consolidated financial statements appearing elsewhere in this Annual Report on Form 10-K.

While acquisitions have contributed to our growth in prior years, we did not complete any acquisitions during the years ended December 31, 2025 and 2024.

Customers

Our past acquisitions have resulted in expansion of our customer base and increased usage within existing customers. For the year ended December 31, 2025, one customer represented approximately 10% of our total revenue as presented in the consolidated statements of operations and comprehensive loss. For the year ended December 31, 2024, there were no customers that represented 10% or more of our total revenue as presented in the consolidated statements of operations and comprehensive loss.

As of December 31, 2025, the same customer that represented approximately 10% of total revenue accounted for approximately 17% of our accounts receivable balance. As of December 31, 2024, two customers represented approximately 13% and 11%, respectively, of our accounts receivable balance.

Cybersecurity Market Analysis

The cybersecurity market is highly fragmented, characterized by a diverse landscape of established industry leaders and emerging security product vendors. While competition within traditional endpoint and IT operations markets remains significant, we anticipate encountering new competitors as we strategically expand into adjacent markets, thereby increasing our total addressable market.

We believe our competitive positioning is strengthened by several key differentiators, including:

• Frontline Intelligence and Expertise: Our extensive experience in investigating and remediating complex cyber incidents, equips us with real-time threat intelligence and practical insights. This knowledge directly informs and enhances our solutions, providing customers with proactive, resilient cybersecurity strategies.
• Comprehensive, Integrated Solutions: Our platform integrates a broad suite of SaaS offerings, helping enable clients to seamlessly unify threat detection, incident response, and cybersecurity validation. This streamlined approach helps reduce complexity and operational overhead compared to competitors that rely on disjointed point solutions.
• Ease of Deployment and Versatility: Our solutions are designed to integrate into diverse IT environments, supporting hybrid, on-premises, and cloud architectures. This flexibility ensures accelerated time-to-value for clients and minimizes disruption during deployment.
• Reputation and Consulting Expertise: Our globally recognized consulting organization enhances our market credibility. By leveraging insights derived from high-profile incident response engagements, we continuously refine our services, positioning us to deliver superior outcomes for customers.
• Strategic Acquisition Strategy: As a cybersecurity consolidator, we prioritize identifying and acquiring strategic targets that align with our commitment to service quality, technological innovation, and geographical expansion. Our track record of successful mergers and acquisitions has enabled us to broaden our service portfolio, extend market reach, and capture operational efficiencies, positioning us as a leading force in market consolidation.

Despite these advantages, many of our competitors maintain substantially greater financial, technical, and operational resources, along with broader brand recognition, larger sales and marketing infrastructures, deeper customer relationships, more extensive distribution channels, and mature intellectual property portfolios. Additionally, cloud-based service providers introduce increased competition, transcending geographic limitations.

We remain committed to leveraging our core strengths, including frontline expertise, integrated solutions, and a disciplined acquisition strategy — to expand our market presence, drive sustainable growth, and create long-term value for our stockholders.

Intellectual Property

Our intellectual property portfolio is a critical component of our competitive advantage and long-term business strategy. We rely on a combination of trademarks, patents, copyrights, trade secrets, license agreements, intellectual property assignment agreements, confidentiality procedures, non-disclosure agreements, and employee non-disclosure and invention assignment agreements to secure and enforce our proprietary rights. While these legal protections are important, we believe our success is more significantly driven by the expertise and ingenuity of our workforce, alongside the functionality and continuous innovation embedded in our solutions. We are committed to expanding and strengthening our intellectual property portfolio to support our products, services, research and development efforts, and other strategic initiatives. Where appropriate and financially prudent, we intend to pursue additional intellectual property protections to enhance our market position and safeguard our technology.

As we continue to grow and achieve greater market visibility, we anticipate increased competition and the potential for third parties to develop solutions that may attempt to replicate or infringe upon our proprietary technologies. Additionally, large and established companies within the cybersecurity sector maintain extensive patent portfolios and are frequently involved in both offensive and defensive intellectual property litigation. From time to time, we may face allegations of intellectual property infringement from such companies or from non-practicing entities. These claims may target us directly, or indirectly affect our business by targeting our channel partners, cloud service providers, or customers — parties to whom we have contractual indemnification obligations. If a third party successfully asserts an intellectual property infringement claim against us, we could face significant financial and operational consequences, including the inability to market or deliver certain products or services, the necessity to allocate resources toward developing non-infringing alternatives, or the obligation to pay substantial damages, including enhanced damages for willful infringement in the United States. Additionally, we could be required to enter into costly licensing agreements or settlement arrangements. We cannot guarantee that our current or future products and services will not be found to infringe upon third-party intellectual property rights. Defending against intellectual property-related claims, regardless of merit, can be time-consuming, expensive, and disruptive to our business. We intend to vigorously protect and enforce our intellectual property rights where necessary to preserve our competitive position and long-term financial performance. However, there can be no assurance that we will succeed in these efforts or that our intellectual property protections will be sufficient to prevent competitors from developing similar technologies or services that may diminish our market share or revenue potential.

Government Regulation

We are not aware of any specific regulations that govern cybersecurity firms or the areas in which we operate. While there are a few federal cybersecurity regulations, they govern industries that we serve and exist to focus on specific industries.

Three of the main cybersecurity regulations are HIPAA, the Cybersecurity Maturity Model Certification (CMMC) program, and the 2002 Homeland Security Act, which included FISMA. These regulations mandate that healthcare organizations, financial institutions, federal contractors, and federal agencies, should protect their systems and information. FISMA, which applies to every government agency, requires the development and implementation of mandatory policies, principles, standards, and guidelines on information security. However, the regulations do not address numerous computer related industries, such as Internet Service Providers and software companies. Furthermore, the regulations do not specify what cybersecurity measures must be implemented and require only a “reasonable” level of security. In addition, the National Cybersecurity Division is another regulatory body that is a division of the Office of Cybersecurity & Communications within the U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency.

Human Capital Management

Our future success relies on our ability to continually attract, hire, and retain top-tier talent, particularly within our senior management, engineering, and technical teams. As a leader in the highly competitive cybersecurity industry, securing skilled personnel is essential to maintaining our position at the forefront of innovation and incident response.

Competing for Top Talent

We recognize that the cybersecurity landscape is evolving rapidly, and the demand for specialized expertise continues to grow. To remain competitive, we have designed comprehensive compensation and benefits programs that address the diverse needs of our global workforce. In addition to competitive salaries, our offerings include performance-based incentive plans, pensions, healthcare and insurance coverage, paid time off, and family leave. These benefits are tailored to meet regional requirements and employment classifications, ensuring flexibility and relevance.

Retention Through Recognition and Rewards

To retain our most valuable contributors — particularly senior leaders and key technical personnel — we strategically deploy equity-based grants with thoughtful vesting schedules. This approach aligns employee success with company performance, fostering long-term commitment and engagement.

Prioritizing Employee Well-being

The success of our business is inherently tied to the well-being of our people. We are steadfast in our commitment to fostering a healthy, safe, and supportive work environment. Our people are our greatest asset. By cultivating an environment where talent thrives, supported by competitive rewards, opportunities for growth, and a commitment to well-being, we help ensure our continued leadership in cybersecurity and incident response.

Environmental, Social, and Governance Efforts

Environmental Commitment

We are committed to protecting the environment and attempt to mitigate any negative impact of our operations. We monitor resource use, improve efficiency, and at the same time reduce our emissions and waste.

Social Responsibility

We are a trusted cybersecurity expert providing safe, efficient, and sustainable services to our existing and new communities. Our success is the direct result of the dedication and strength of our team and promotes diversity, integrity, inclusion, reliability, and accountability. We believe that a combination of diverse team members and an inclusive culture contributes to our success. Each member is a valued part of our team bringing a diverse perspective to help grow business and achieve our goals. Our tradition of serving employees, customers, and investors is at the core of our culture. For third-party vendor selection and oversight, we have standard operating procedures that apply to employees and subcontractors who, on our behalf, oversee and conduct technical protocols.

Employees

As of December 31, 2025, we had approximately 125 full-time-equivalent employees. In addition, we utilize independent contractors for projects of short duration or where specialized knowledge or experience is needed for a complex project. We are not dependent on any independent contractor, and we believe adequate replacements would be available in the event any such independent contractor becomes unavailable to us. We believe our relations with our employees is good.

Available Information

Our Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, our proxy and information statements and all amendments to those reports will be available free of charge through our website at www.ciso.inc (http://www.ciso.inc) as soon as practicable after such material is electronically filed with, or furnished to, the SEC. Except as otherwise stated in these documents, the information contained on our website or available by hyperlink from our website is not incorporated by reference into this report or any other documents we file, with or furnish to, the SEC.

Implications of Being an Emerging Growth Company

We qualify as an “emerging growth company” as the term is used in The Jumpstart Our Business Startups Act of 2012 (the “JOBS Act”), and therefore, we may take advantage of certain exemptions from various public company reporting requirements, including:

• a requirement to only have two years of audited financial statements and only two years of related selected financial data and management’s discussion and analysis;
• exemption from the auditor attestation requirement on the effectiveness of our internal controls over financial reporting;
• reduced disclosure obligations regarding executive compensation; and
• exemptions from the requirements of holding a nonbinding advisory stockholder vote on executive compensation and any golden parachute payments.

We may take advantage of these provisions for up to five years after our first public equity sale or such earlier time that we are no longer an emerging growth company. We would cease to be an emerging growth company if we have more than $1.07 billion in annual revenue, issue more than $1.0 billion of non-convertible debt over a three-year period, or become a large accelerated filer. So long as we remain an emerging growth company, we may choose to take advantage of some, but not all, of the available benefits of the JOBS Act. We have taken advantage of some of the reduced reporting requirements in our filings. Accordingly, the information contained herein may be different than the information you receive from other public companies in which you hold stock. In addition, the JOBS Act provides that an emerging growth company can delay adopting new or revised accounting standards until such time as those standards apply to private companies. We have elected to avail ourselves of this exemption from new or revised accounting standards and, therefore, we will not be subject to the same new or revised accounting standards as other public companies that are not emerging growth companies.

An investment in our common stock involves a number of very significant risks. Readers of this Annual Report on Form 10-K should carefully consider the following risks and uncertainties in addition to other information in this Annual Report on Form 10-K in evaluating our company and its business before purchasing shares of our common stock. Our business, operating results and financial condition could be seriously harmed due to any of the following risks. An investor in our common stock could lose all or part of their investment due to any, or a combination of these risks.

Risk Factor Summary

Risks Related to Our Business and Industry

• We will need to raise capital to realize our business plan and growth strategy, the failure of which could adversely impact our operations.
• We incurred significant operating losses during the years ended December 31, 2025 and December 31, 2024, and we have limited cash flow. Unless we increase revenue and cash flow or raise additional capital, we may be unable to take advantage of any acquisition opportunities that arise or expand our business, all of which could adversely impact us.
• We will need to improve the size and capabilities of our organization, and we may experience difficulties in managing this growth.
• We depend on key personnel who would be difficult to replace, and our business plans will likely be harmed if we lose their services or cannot hire additional qualified personnel.
• We operate in an industry that is experiencing a shortage of qualified compliance and cybersecurity professionals. If we are unable to recruit and retain key management and technical and sales personnel, our business would be negatively affected.
• We depend on independent contractors to provide certain services for which we do not have the expertise internally. Any compromise in the service quality may delay our business processes and cause economic loss.
• We have acquired multiple businesses. Our growth strategy is driven by successful acquisitions and integration of additional businesses that provide comparable or complementary services.
• Our business strategy may impose limitations in our ability to accurately forecast future revenue and operating results.
• Our sales cycles can be long and unpredictable, and our sale efforts require considerable time and expense.
• Because we recognize revenue from subscriptions to our solutions over the term of the subscription, downturns or upturns in new business will not be immediately reflected in our operating results.
• Our dependence on a significant customer for a material portion of our revenue and accounts receivable exposes us to risks that could have a material adverse effect on our business, financial condition, and results of operations.
• We provide service level commitments under some of our customer contracts. If we fail to meet these contractual commitments, we could be obligated to provide partial refunds, or our customers could be entitled to terminate their contracts and our business would suffer.
• Our future results may be affected by various legal and regulatory proceedings and legal compliance risks, including those involving intellectual property, governmental regulations, the U.S. Foreign Corrupt Practices Act, and other anti-bribery, anti-corruption, or other matters.
• We may be subject to risks from operating internationally.
• Our operations in certain emerging markets expose us to political, economic and regulatory risks.
• Adverse economic conditions in the United States may adversely impact our business and operating results.
• We may not be successful in our artificial intelligence initiatives, which could adversely affect our business, reputation, or financial results.
• The use of AI technology in our IT infrastructure could improve internal process but poses security and privacy risks.
• Breaches of network or information technology security could have an adverse effect on our business.
• If we fail to meet our service level obligations under our service level agreements, we may be subject to certain penalties and could lose clients.
• The nature of our business involves significant risks and uncertainties that may not be covered by insurance or indemnification.
• We indemnify our officers and directors against liability to us and our security holders, and such indemnification could increase our operating costs.
• Our industry is highly competitive, and there is no assurance that we will compete successfully.
• Our success depends on our ability to protect our intellectual property and our proprietary technologies.
• Increasingly complex cybersecurity regulations and standards may have significant impact on our business, and it may require us to substantially invest in our development capabilities to meet compliance requirements and may negatively impact our ability to offer certain services and remain profitable.
• We may become subject to disputes, including litigation, that could negatively impact our business, profitability, and financial condition.
• If we incur additional debt, we will be subject to restrictive covenants and debt service obligations that could negatively impact our operations.
• The requirements of being a public company, including compliance with the reporting requirements of the Exchange Act and the requirements of the Sarbanes-Oxley Act and Nasdaq, may strain our resources, increase our costs and divert management’s attention, and we may be unable to comply with these requirements in a timely or cost-effective manner.
• The preparation of our financial statements involves use of estimates, judgments, and assumptions, and our financial statements may be materially affected if our estimates prove to be inaccurate.
• The auditor’s opinion on our audited consolidated financial statements for the year ended December 31, 2025, included in this annual report on Form 10-K, contain an explanatory paragraph relating to our ability to continue as a going concern.

Risks Related to Our Common Stock

• The market price of our common stock is volatile and may fluctuate in a way that is disproportionate to our operating performance.
• Future sales of shares of our common stock by existing stockholders could depress the market price of our common stock.
• 16-
• Provisions in our amended and restated certificate of incorporation, as amended (our ‘certificate of incorporation”), our second amended and restated by-laws (our “by-laws”) and Delaware law might discourage, delay, or prevent a change in control of our company or changes in our management and, therefore, depress the trading price of our common stock.
• Our ability to access the full amount available under the purchase agreement with B. Riley is not guaranteed, and our broad discretion over the use of any proceeds we receive may not result in improved financial performance or stockholder value.
• The issuance and potential conversion of Series B Preferred Stock may adversely affect our common stockholders and the market price of our common stock, and our obligation to redeem shares of Series B Preferred Stock upon certain triggering events could materially harm our liquidity and financial condition.
• FINRA sales practice requirements may limit a stockholder’s ability to buy and sell our stock.
• If we issue additional shares in the future, it will result in a dilution of our existing stockholders.
• We are eligible to be treated as an “emerging growth company,” as defined in the JOBS Act, and we cannot be certain if the reduced disclosure requirements applicable to emerging growth companies will make our common stock less attractive to investors.
• Our directors, a former director, a consultant, and an executive officer beneficially own a substantial majority of our outstanding capital stock and will have the ability to control our affairs.
• Our failure to meet the continued listing requirements of Nasdaq could result in a delisting of our common stock.
• We do not intend to pay dividends on our common stock.
• Our business could be negatively impacted by stockholder activism.
• Our share price may be volatile, and you may be unable to sell your shares.

Risks Related to Our Business and Industry

We will need to raise capital to realize our business plan and growth strategy, the failure of which could adversely impact our operations.

Our growth strategy focuses on expanding our client base and increasing consolidated revenue through strategic acquisitions and seamless integration of businesses offering complementary cybersecurity services. As of December 31, 2025, our business has not yet achieved profitability. To reach profitability and sustain long-term growth, we require adequate funding, significant revenue growth, and continued successful integration of our acquisitions. As of March 27, 2026, we maintained cash resources of approximately $1,013,225.

We plan to fund operations through a combination of available net operating cash flows and future capital raises, which may include issuing equity or other securities. This approach may result in dilution for existing stockholders. Any newly issued securities may carry rights, preferences, or privileges that differ from those of our existing common stock.

We incurred significant operating losses during the years ended December 31, 2025 and December 31, 2024, and we have limited cash flow. Unless we increase revenue and cash flow or raise additional capital, we may be unable to take advantage of any acquisition opportunities that arise or expand our business, all of which could adversely impact us.

We incurred losses from operations of $8,785,052 and $14,589,635 for the years ended December 31, 2025 and December 31, 2024, respectively, and net losses of $8,073,930 and $24,243,919 for those same periods. As of December 31, 2025, we had cash and cash equivalents of $1,695,994, current assets of $3,264,224, and current liabilities of $7,738,489, resulting in a working capital deficit of $4,474,265. Our limited cash position and working capital deficit present meaningful constraints on our ability to fund operations, pursue strategic opportunities, or respond to unanticipated adverse business developments. We cannot predict with certainty when, or whether, we will achieve sustained positive cash flow from operations or profitability. Our strategy to address these losses includes strengthening revenue and improving operational efficiencies across the business, but there can be no assurance these measures will be sufficient or successful. Our cash balance of $1,695,994 may be insufficient to fund operations for an extended period, particularly if revenue growth does not materialize as anticipated or if unexpected expenses arise. Any future financing may involve significant dilution to existing stockholders or impose restrictive covenants that limit our operational flexibility. Our constrained liquidity position could also prevent us from pursuing strategic opportunities or retaining key personnel critical to executing our business plan.

We will need to improve the size and capabilities of our organization, and we may experience difficulties in managing this growth.

As we shift our growth strategy from acquisition-driven expansion to a focus on organic growth, we recognize the importance of effectively integrating and scaling our operations. This transition requires the careful alignment of managerial, operational, sales, marketing, financial, and other key functions across the organization. Successfully managing these dynamics is critical to sustaining our growth trajectory and enhancing long-term stockholder value.

Our ability to achieve future growth will depend on the following factors:

• Attracting, integrating, developing, and retaining skilled personnel across all functions, with a particular focus on building a strong, high-performing salesforce and expanding our cybersecurity expertise.
• Executing efficient post-acquisition integration processes where applicable, while maintaining cost discipline and optimizing operational performance.
• Strengthening our operational, financial, and management systems to support scalability, ensure transparency, and improve overall business performance.
• 17-

We anticipate that these growth initiatives will place increasing demands on our management team, including the need to balance day-to-day operational responsibilities with the strategic oversight required to guide expansion. As our leadership team continues to evolve, limited long-term experience working together may present challenges to operational cohesion.

We depend on key personnel who would be difficult to replace, and our business plans will likely be harmed if we lose their services or cannot hire additional qualified personnel.

Our business is significantly dependent on the continued efforts and abilities of our senior management and executive officers. The loss of services of one or more of these key individuals, or our inability to attract, train, and retain key personnel, could materially disrupt our operations, delay strategic initiatives, and hinder our ability to execute our business plan.

At present, we do not maintain key man insurance for any members of our senior management or key personnel. The competition for qualified management and personnel, particularly those with specialized expertise in the cybersecurity industry, is intense. If we were to lose the services of any of our key executives, or if we are unable to successfully recruit, retain, and develop personnel with the necessary skills and industry knowledge, our ability to continue executing on our acquisition strategy and service program development could be adversely impacted. Furthermore, such a loss could have a significant effect on our ability to maintain and grow client relationships, which may negatively impact our financial performance and long-term prospects. We recognize the critical importance of having a strong and capable leadership team to execute our business strategy. As such, we continue to explore options for mitigating these risks, including potential investments in succession planning and talent development. However, there can be no assurance that we will be successful in securing or retaining the right talent, and any failure to do so may materially affect our ability to achieve our objectives.

We operate in an industry that is experiencing a shortage of qualified compliance and cybersecurity professionals. If we are unable to recruit and retain key management and technical and sales personnel, our business would be negatively affected.

To execute our growth strategy, attracting and retaining highly skilled compliance and cybersecurity experts remains critical. The demand for these professionals is intense, particularly given the global shortage of talent with the technical and strategic expertise required to deliver exceptional services to our clients.

Our competitors, many with greater resources, also seek to recruit skilled professionals, and compensation packages—particularly stock options and other equity incentives—often play a significant role in attracting candidates. We are mindful of the importance of offering competitive compensation, but recognize that fluctuations in stock value can impact this dynamic. We continually evaluate our compensation strategies to ensure they align with market trends and support our long-term growth objectives.

We depend on independent contractors to provide certain services for which we do not have the expertise internally. Any compromise in the service quality may delay our business processes and cause economic loss.

While we are not dependent on any one contractor, we currently rely, and for the foreseeable future will continue to rely, on certain independent organizations, advisors, and consultants to provide certain services. There can be no assurance that the services of these independent organizations, advisors, and consultants will continue to be available to us on a timely basis when needed, or that we can find qualified replacements. In addition, if we are unable to effectively manage our outsourced activities or if the quality or accuracy of the services provided by consultants is compromised for any reason, some of our business activities may be delayed or terminated, and we may not be able to mitigate negative impacts or otherwise advance our business. There can be no assurance that we will be able to manage our existing consultants or find other competent outside contractors and consultants on economically reasonable terms, if at all. If we are not able to effectively expand our organization by hiring new employees and expanding our groups of consultants and contractors, we may not be able to successfully implement the tasks necessary to further expand and, accordingly, may not achieve our business goals.

We have acquired multiple businesses. Our growth strategy is driven by successful acquisitions and integration of additional businesses that provide comparable or complementary services.

We have completed the acquisition and integration of several complementary businesses, and we intend to consider opportune additional potential strategic transactions that enhance stockholder value, which could involve acquisitions of businesses or assets, joint ventures, or investments in businesses or technologies that expand, complement, or otherwise relate to our business. We may also consider, from time to time, opportunities to engage in joint ventures or other business collaborations with third parties. Should our relationships fail to materialize into significant agreements, or should we fail to work efficiently with these companies, we may lose sales and marketing opportunities and our business, results of operations, and financial condition could be adversely affected.

Any business acquisition creates risks such as, among others: (i) the need to integrate and manage the businesses acquired with our own business; (ii) additional demands on our resources, systems, procedures, and controls; (iii) disruption of our ongoing business; and (iv) diversion of management’s attention from other business concerns. Moreover, these transactions could involve: (a) substantial investment of funds or financings by issuance of debt or equity securities; (b) substantial investment with respect to technology transfers and operational integration; or (c) the acquisition or disposition of lines of businesses. Also, such activities could result in one-time charges and expenses and have the potential to either dilute the interests of our existing stockholders or result in the issuance of, or assumption of debt. Such acquisitions, investments, joint ventures, or other business collaborations may involve significant commitments of financial and other resources. Any such activities may not be successful in generating revenue, income, or other returns, and any resources we committed to such activities will not be available to us for other purposes. Moreover, if we are unable to access the capital markets on acceptable terms or at all, we may not be able to consummate acquisitions, or may have to do so on the basis of a less than optimal capital structure. Our inability to take advantage of growth opportunities or address risks associated with acquisitions or investments in businesses may negatively affect our operating results. Additionally, any impairment of goodwill or other intangible assets acquired in an acquisition or in an investment, or charges to earnings associated with any acquisition or investment activity, may materially reduce our earnings. Future acquisitions or joint ventures may not result in their anticipated benefits and we may not be able to properly integrate acquired technologies or businesses with our existing operations or successfully combine personnel and cultures. Failure to do so could deprive us of the intended benefits of those acquisitions.

Our business strategy may impose limitations on our ability to accurately forecast future revenue and operating results.

Our operating results are subject to a variety of factors that could cause our financial performance to fluctuate significantly. These factors include, but are not limited to, fluctuations in client demand, competitive pricing pressures, debt servicing obligations, and general economic conditions. Our ability to achieve consistent revenue growth is highly dependent on several key elements, including:

• Client Demand and Sales Targets: We may experience variability in our sales performance, which could affect our ability to meet financial targets. This is especially true if new service offerings receive a poor response from clients or if client acquisition costs rise due to increased competition in the market.
• Competition and Market Positioning: Intense competition within the cybersecurity and managed IT services sector can lead to downward pressure on pricing, potentially affecting our profitability. If we are unable to maintain or grow our market share through innovation or service differentiation, our financial performance could be negatively impacted.
• Organic Growth Strategy: Our growth is largely dependent on our ability to expand our client base and increase revenue from existing clients through organic growth. We face risks associated with the execution of this strategy, including the challenge of effectively scaling our operations to meet increasing demand and the potential for higher-than-expected client acquisition costs.
• Economic Trends: General economic conditions, including changes in client spending patterns or economic downturns, may adversely impact demand for our services, which could result in lower revenue growth or even a decline in revenue.
• Operational and Execution Risks: We may encounter unexpected operational or execution challenges, such as the inability to hire and retain top talent or issues related to service delivery, which could disrupt our growth trajectory. Additionally, changes in regulatory requirements or industry standards could affect our operations and increase compliance costs.
• Debt Servicing: As we grow, we may incur additional debt to fund our operations or invest in new capabilities. This could result in increased interest expenses and the need to meet debt covenants, which may limit our financial flexibility and affect our ability to pursue growth initiatives.

While we have a robust strategy in place to manage and mitigate these risks, there can be no assurance that we will successfully navigate the challenges associated with organic growth. We cannot guarantee that our efforts will result in sustainable revenue growth, improved profitability, or the achievement of long-term financial objectives.

Our sales cycles can be long and unpredictable, and our sales efforts require considerable time and expense.

Our sales cycles are often long and unpredictable, and our sales efforts require significant time, resources, and investment. These factors introduce considerable uncertainty into our ability to forecast revenue and operating results. Specifically:

• Length and Unpredictability of the Sales Cycle: The sales cycle for our solutions, particularly with large enterprises and government entities, can be extended due to the complex nature of the solutions we provide. These customers typically require a significant amount of time to evaluate, test, and qualify our solutions before committing to a purchase or expansion of the relationship. In light of current macroeconomic conditions, we have observed an increase in the length of the sales cycle, primarily driven by heightened cost-consciousness around IT budgets. As a result, prospective customers may delay or prolong their decision-making process, making it challenging to predict when, or if, a sale will be finalized.
• Challenges in Securing Sales: Our sales efforts, which are carried out by both our direct sales team and channel partners, involve substantial time and expense. We invest considerable resources in developing relationships with customers, coordinating account penetration, and driving overall market development. However, there is no guarantee that these efforts will result in a sale. The purchasing decisions for security solutions are often subject to budget constraints, multiple levels of approval, and unanticipated delays in administrative and processing steps, all of which contribute to the difficulty in predicting the timing of sales.
• Impact on Financial Performance: Given the length and unpredictability of our sales cycles, we may face challenges in accurately forecasting revenue, particularly for large and government accounts. The failure to close sales after investing significant resources in a lengthy sales process could have a material adverse effect on our business, operating results, and financial condition.

Considering these factors, we cannot guarantee that we will successfully close sales in the anticipated timeframes, and the uncertainty surrounding our sales cycle may affect our ability to achieve our revenue and financial objectives.

Our dependence on a significant customer for a material portion of our revenue and accounts receivable exposes us to risks that could have a material adverse effect on our business, financial condition, and results of operations.

For the year ended December 31, 2025, one customer accounted for approximately 10% of our total revenue as reflected in our consolidated statements of operations and comprehensive loss, and that same customer represented approximately 17% of our accounts receivable balance as of December 31, 2025. We may be unable to retain a significant customer if it determines to switch to a competitor offering lower prices or more favorable terms, elects to bring in-house the products or services we currently provide, or experiences a deterioration in its own financial condition or business operations that reduces its demand for our offerings. A significant customer may also seek to renegotiate its contractual arrangements with us on terms less favorable to us, including seeking price reductions or extended payment terms, which could adversely affect our revenue and margins. If a significant customer were acquired by, or merged with, another company, the acquiring entity may have existing vendor relationships that displace ours, further reducing or eliminating revenue from that customer. A loss of or significant reduction in business from a significant customer would likely cause an immediate and material decline in our revenue and operating results, and we may be unable to replace that revenue in a timely manner or at all given the lead time typically required to onboard new customers of comparable size. The concentration of accounts receivable from a single customer further increases our exposure to credit risk, as any failure by that customer to pay amounts owed to us could materially adversely affect our cash flow and liquidity.

Because we recognize revenue from subscriptions to our solutions over the term of the subscription, downturns or upturns in new business will not be immediately reflected in our operating results.

We recognize revenue from customer subscriptions ratably over the term of their agreement, which generally span one to three years. As a result, a significant portion of the revenue we report in any given period is derived from the recognition of deferred revenue related to agreements entered into in prior periods. This model presents the following risks:

• Delayed Impact of Sales Fluctuations: Any increase or decrease in new sales or renewals in a given period will not be immediately reflected in our revenue for that period. Instead, the financial impact of these changes will be realized in future periods as the associated deferred revenue is recognized. Consequently, fluctuations in sales or renewals, particularly during periods of economic uncertainty, may not be fully captured in our reported revenue until later, making it more difficult to assess our immediate financial performance.
• Renewal Rates and Sales Cycles: Our revenue is also influenced by the rate of renewals, which can be unpredictable. A decline in renewals or a decrease in new sales would not immediately impact our reported revenue but could affect future revenue recognition. Conversely, an increase in sales or renewals will positively impact our future revenue but may not be reflected immediately in the current period’s results.
• Operational Adjustments and Cost Structure: The delayed recognition of revenue can also affect our ability to quickly adjust our cost structure. In the event of a significant downturn in sales or renewals, we may be unable to immediately reduce costs in line with revenue reductions, which could negatively affect our profitability and financial condition.

As a result of these factors, our ability to manage and adjust our operations in response to changes in sales or renewals may be hindered, potentially leading to variability in our financial results from period to period. We may also face challenges in maintaining profitability if revenue trends do not align with our cost structure adjustments.

We provide service level commitments under some of our customer contracts. If we fail to meet these contractual commitments, we could be obligated to provide partial refunds, or our customers could be entitled to terminate their contracts and our business would suffer.

Certain of our customer agreements include service level commitments, which specify the availability and performance of our solutions and support services. Failure to meet these commitments could have a material adverse effect on our business. The following outlines key risks associated with our service level commitments:

• Failure to Meet Service Level Commitments: Our infrastructure, or that of our third-party hosting service providers, could experience disruptions, impacting the performance and availability of our solutions. If we fail to meet the agreed-upon service levels, we may be required to provide affected customers with credits, partial refunds, or even allow them to terminate their contracts. Although we have not experienced any material failures to meet our service level commitments to date, any significant downtime or poor performance beyond agreed-upon service levels could negatively impact our reputation, customer retention, and financial results.
• Adverse Business Impact: Any failure to meet service levels could result in substantial operational challenges, including loss of customer trust, which would adversely affect our business, operating results, and financial condition. We may also face increased costs related to crediting or refunding customers or managing customer contract terminations.

Our business is subject to the risks of warranty claims from real or perceived defects in our solutions or their misused by our customers or third parties and provisions in certain agreements potentially expose us to substantial liability and other losses.

Our solutions are subject to warranty claims arising from real or perceived defects or misuse by our customers or third parties. The following risks are associated with potential liability claims:

• Product Liability and Warranty Claims: We are subject to risks of liability for errors, defects, or failures in our solutions. While we generally have limitations of liability provisions in our contracts, they may not fully shield us from claims under federal, state, or local laws, or unfavorable judicial decisions. We may also be exposed to product liability claims, especially if our solutions are found to be defective or cause harm to customers.
• Indemnification and Legal Risks: We provide limited indemnification to customers, partners, and other third parties for losses arising from third-party intellectual property claims related to our solutions. We also offer limited liability for certain breaches of confidentiality and limited liability for breaches of our master service agreements. While we have not incurred any material costs due to such indemnification claims to date, as we continue to expand, the frequency and cost of indemnity claims may increase, leading to significant legal expenses, damages, or licensing fees. We may also be required to stop using technology found to infringe upon third-party rights, which could disrupt our business operations.
• Intellectual Property Infringement: If we are found to be infringing on a third party’s intellectual property rights, we could face substantial damages and legal costs. Additionally, we may need to obtain licenses for certain technologies, which may not be available on favorable terms or at all. The inability to secure necessary licenses could limit our ability to deliver solutions or features to our customers and harm our competitive position.
• Unauthorized Use of Solutions: Our solutions may be misused by customers or third parties for purposes other than what they were intended for, which could expose us to liability claims. Although we maintain insurance to mitigate certain risks, our coverage may not fully protect us from the claims asserted against us. Even unsuccessful claims could result in significant litigation costs, diversion of management resources, and reputational harm.
• Impact of Warranty and Insurance Coverage: We offer limited warranties to some customers, which are subject to certain conditions. If our insurance providers fail to fulfill their obligations, or if we cease offering warranties, we may face significant expenses or lose customer trust. This could negatively impact our ability to attract and retain customers, and harm our business, operating results, and financial condition.

We continue to monitor and manage these risks, but there can be no assurance that our efforts will prevent material adverse impacts on our business.

Additionally, our solutions may be used by our customers and other third parties who obtain access to our solutions for purposes other than for which our solutions was intended. We maintain insurance to protect against claims associated with our products and services, but our insurance coverage may not adequately cover the claims asserted against us. In addition, even claims that ultimately are unsuccessful could result in our expenditure of funds in litigation, divert management’s time and other resources, and harm our business and reputation. We have offered our customers of CHECKLIGHT® a limited financial warranty, subject to certain conditions. Any failure or refusal of our insurance providers to provide the expected insurance benefits to us after we have remediated warranty claims would cause us to incur significant expense or cause us to cease offering warranties which could damage our reputation, cause us to lose customers, expose us to liability claims by our customers, negatively impact our sales and marketing efforts, and have an adverse effect on our business, operating results, and financial condition. Further, although the terms of the warranty do not allow those customers to use warranty claim payments to fund payments to persons on the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC), list of Specially Designated Nationals and Blocked Persons or who are otherwise subject to U.S. sanctions, we cannot assure you that all of our customers will comply with our warranty terms or refrain from taking actions, in violation of our warranty and applicable law.

Our future results may be affected by various legal and regulatory proceedings and legal compliance risks, including those involving intellectual property, governmental regulations, the U.S. Foreign Corrupt Practices Act, and other anti-bribery, anti-corruption, or other matters.

Our business is subject to various legal and regulatory proceedings, and we face compliance risks in multiple areas, including intellectual property, governmental regulations, and international anti-bribery and anti-corruption laws. These risks may adversely impact our business and financial results. Specifically:

• Legal and Compliance Risks: We may be involved in legal or regulatory proceedings related to intellectual property disputes, compliance with the U.S. Foreign Corrupt Practices Act, anti-bribery, anti-corruption laws, and other regulatory matters. Due to the inherently unpredictable nature of litigation and regulatory actions, the outcomes of these proceedings may differ from our expectations. Developments such as significant rulings, settlements, or changes in laws may lead us to revise our estimates of liabilities and insurance requirements. An adverse ruling or unfavorable regulatory development could result in significant charges that would materially impact our results of operations and cash flows.
• Regulatory Uncertainty: As regulations evolve, particularly in relation to intellectual property and international compliance standards, we could face additional legal challenges or expenses related to these matters. The resolution of any significant legal dispute or regulatory matter could have a substantial impact on our financial position and operations.

We may be subject to risks from operating internationally.

We may seek to expand our operations in international markets, which may expose us to a variety of risks. Our international business growth is subject to numerous challenges, including:

• Compliance with Foreign Regulations: Operating in foreign markets requires compliance with a complex and constantly changing landscape of tax, legal, accounting, and regulatory requirements. These challenges could result in increased costs and operational difficulties as we navigate diverse legal systems and business practices across multiple jurisdictions.
• Geopolitical and Economic Risks: International operations expose us to political, social, and economic instability, including risks arising from war, terrorism, or conflicts such as the ongoing military tensions between Russia and Ukraine, and in the Middle East. These geopolitical risks could disrupt our operations, harm our ability to conduct business, and negatively impact market conditions for our services.
• Changes in Trade Policies: Modifications in trade policies, tariffs, and taxes in the United States or other national governments could disrupt market access and increase the cost of doing business in certain regions. We must continuously monitor and adapt to these regulatory shifts to maintain our competitiveness in foreign markets.
• Market Acceptance and Expansion: Expanding into foreign markets requires the development of superior products and services that meet local demand. We must gain market acceptance while also expanding our offerings efficiently. Failures in product adaptation or local market penetration could impede our international growth.
• Non-Compliance with International Laws: Operating in multiple countries exposes us to the risk of non-compliance with a broad range of laws, including anti-corruption, export control, and anti-boycott regulations. Non-compliance could lead to significant legal penalties and reputational damage.
• Sovereign Risk: We face increased sovereign risk, particularly in emerging markets where there is a greater risk of government defaults, economic deterioration, or downgrades in credit ratings. These factors could destabilize markets in which we operate, affecting our operations and financial performance.
• Logistical and Communication Challenges: Operating internationally involves logistical complexities, such as managing supply chains, communication across time zones, and coordinating activities in diverse business environments. These challenges can disrupt our operations and delay service delivery.
• Contractual and Currency Risks: International contracts are subject to interpretation under foreign laws, which can create risks in the event of a dispute. Additionally, fluctuations in currency exchange rates, devaluations, or conversion restrictions could impact the value of our revenues and costs, potentially resulting in financial losses.

Any of these factors could have a material adverse effect on our reputation, financial condition, results of operations, and stock price. The risks associated with operating internationally are inherent and may increase as we expand into new markets.

Our operations in certain emerging markets expose us to political, economic, and regulatory risks.

Our growth strategy includes expanding operations in emerging markets. While these markets present significant growth opportunities, they also introduce a variety of risks that could adversely affect our business and financial results. The key risks associated with our expansion in emerging markets include:

• Political and Economic Volatility: Emerging markets often experience greater political and economic instability compared to more established markets. This volatility can lead to unpredictable changes in market conditions, regulatory environments, and business operations. Political upheaval, economic downturns, or social unrest could disrupt our ability to operate efficiently in these regions, adversely impacting sales, revenues, and overall business performance.
• Currency Fluctuations and Infrastructure Risks: Emerging markets may be more susceptible to currency fluctuations and devaluations, which could affect the value of our revenue and expenses in these regions. Additionally, these markets often have less developed infrastructure, increasing the risk of operational disruptions, such as supply chain delays or labor shortages, which could negatively affect our ability to deliver services effectively.
• Compliance with Anti-Corruption Laws: In many emerging markets, business practices that may not be permissible in more established markets, such as improper payments or bribes to government officials, can be more prevalent. We are subject to stringent anti-corruption laws, including the U.S. Foreign Corrupt Practices Act, the U.K. Bribery Act, and local anti-bribery laws in the countries where we operate. These laws prohibit improper payments to government officials, including in relation to obtaining permits or conducting other business activities. Non-compliance with these laws could result in severe civil and criminal penalties, which could damage our reputation and adversely impact our financial condition, operating results, and stock price.
• Legal and Regulatory Risks: The legal and regulatory environments in emerging markets can be unpredictable and subject to rapid changes. Non-compliance with local laws or failure to navigate these complex legal systems effectively could lead to regulatory fines, penalties, or reputational harm. These risks are heightened in countries with weak rule of law or inconsistent enforcement of regulations.

Failure to manage political, economic, and regulatory risks in emerging markets could have a material adverse impact on our ability to achieve sales targets, grow our business, and maintain profitability in these regions. The risks associated with expanding into emerging markets may result in unanticipated costs, operational disruptions, or financial losses, which could negatively affect our financial condition, results of operations, cash flows, and stock price.

Adverse economic conditions in the United States may adversely impact our business and operating results.

Our operations, demand for services, and overall business performance are subject to general macroeconomic conditions, which can fluctuate and present significant risks to our financial performance. Key macroeconomic factors such as higher interest rates, inflation, recessions, or economic slowdowns—whether in the United States or globally—could adversely affect our business operations, customer demand, and financial results. The key risks include the following:

• Inflationary Pressures: The United States and global markets have experienced volatility due to rising interest rates and inflationary pressures. Inflation rates in the United States have remained above the Federal Reserve’s inflation target since the second half of 2021, contributing to increased costs for goods, services, and labor. While our business has not yet been materially impacted by these inflationary pressures, we cannot predict the future impact on our operations. If inflation continues or worsens, it may lead to higher operational costs, which could reduce our profitability and adversely affect our business.
• Geopolitical Instability: The escalation of geopolitical tensions, including the conflicts between Russia and Ukraine and in the Middle East, has created ongoing instability in global markets. These factors may disrupt supply chains, elevate costs, and reduce consumer and business confidence, which could negatively affect demand for our products and services.
• Economic Slowdowns and Recession: A slowdown in economic activity or a recession, whether domestic or global, could lead to reduced spending by businesses and consumers. If our customers face decreased consumer demand, higher operational costs, or increased regulatory burdens, they may choose to reduce or postpone their spending on our products and services. Certain discretionary services may be deprioritized, leading to a decline in sales and potentially adversely affecting our operating results.
• Credit Availability: Adverse economic conditions may impact the availability of credit for our customers. If customers experience difficulty accessing credit, they may be unable or unwilling to invest in our products and services, potentially leading to delayed or lost sales opportunities. This could affect our revenue and growth prospects.
• Impact on Business Relationships: Economic downturns could also affect the third parties with whom we have business relationships, including suppliers, service providers, and partners. If these third parties experience financial difficulties or operational disruptions, it could impede our ability to execute on business opportunities and growth initiatives, adversely affecting our operations and long-term strategic goals.

The unpredictability of macroeconomic conditions makes it difficult to accurately forecast and plan for future business activities. Adverse economic conditions may lead to changes in customer behavior, demand patterns, and spending priorities, all of which could have a negative effect on our ability to achieve growth and maintain profitability. In the event of future economic slowdowns or disruptions, we may face challenges in sustaining growth or expanding our business in the manner anticipated.

We may not be successful in our artificial intelligence initiatives, which could adversely affect our business, reputation, or financial results.

AI presents new risks and challenges that may affect our business. We have made, and expect to continue to make, investments to integrate AI and ML technology into our solutions. AI presents risks, challenges, and potentially unintended consequences that could impact our ability to effectively use AI successfully in our business. Given the nature of AI technology, we face an evolving regulatory landscape and significant competition from other companies. Our AI efforts may not be successful, and our competitors may incorporate AI into their products more quickly or more successfully than us, which could impair our ability to compete effectively, reduce demand for our products and services and adversely affect our financial results. Increased competition from other companies implementing AI more effectively or rapidly could impact customer preferences and reduce demand for our products or services. Data practices by us or others, AI governance, AI development and validation practices that result in controversy could also impair the acceptance of AI solutions. This in turn could undermine confidence in the decisions, predictions, analysis, and effectiveness of our AI-related initiatives. In addition, vulnerabilities within our AI systems or solutions may be identified by competitors, researchers, or malicious actors before we detect or remediate them, which could result in security incidents, reputational damage, or loss of customer confidence.

The rapid evolution of AI, including potential government regulation of AI, may require significant additional resources related to AI in our solutions. Our AI-related initiatives may result in new or enhanced governmental or regulatory scrutiny, including regarding the use of AI in our solutions and the marketing of products using AI, litigation, customer reporting or documentation requirements, ethical or social concerns, or other complications The use of AI also brings ethical issues related to privacy, surveillance and consent of use, as well as potential for bias and discrimination. Any of the foregoing could adversely affect our business, reputation, or financial results.

The use of AI technology in our IT infrastructure could improve internal process but poses security and privacy risks.

The adoption of AI in internal processes presents an opportunity to bolster decision making, productivity and customer satisfaction, but the new technology poses risks. AI can be exploited by hackers and malicious actors to develop advanced cyberattacks, bypass security measures, and exploit system vulnerabilities including potentially identifying weaknesses in our systems before we become aware of or can remediate them. The use of AI involves handling large amounts of data. If the security measures around the usage of AI are insufficient, there’s risk of data breaches, leading to unauthorized access to sensitive information. Failure to comply with data protection regulations can result in legal consequences. The intellectual property risks associated with AI include uncertainties around the ownership of AI-generated works, potential infringement of existing patents and copyrights, unauthorized use of third-party data, and exposure of proprietary algorithms or trade secrets. Dependence on AI systems or AI vendors means that any downtime or outages can disrupt business operations. Usage of our confidential data to train AI models by us or our vendors could result in legal risk, especially if it involves customer data. Other risks that have been observed in AI models and documentation, include risks related to bias, discrimination, job displacements and violating human rights.

Breaches of network or information technology security could have an adverse effect on our business.

Cybersecurity threats, including cyber-attacks or breaches of our network or IT security, could have a material adverse effect on our operations, financial condition, and reputation. The nature of our business exposes us to various risks related to network security breaches, which could disrupt both our own operations and the operations of our clients. Key risks include the following:

• Cybersecurity Threats and Liabilities: Cyber-attacks or other breaches of network or IT security could result in significant disruptions to our systems, causing equipment failures, service interruptions, or damage to systems and data. If our security measures are compromised, it could lead to misappropriation of proprietary information or sensitive customer and employee data. Such incidents could expose us to substantial liabilities, potentially exceeding the coverage provided by our insurance policies, and cause financial losses or operational setbacks.
• Damage to Reputation and Market Share Loss: A security breach could also damage our brand and reputation, particularly given the nature of our industry, where security is a critical competitive factor. Even short periods of operational downtime could result in a loss of market share to competitors, as clients may lose confidence in our ability to protect their data and systems.
• Indirect Effects on Clients: Our IT infrastructure’s security threats could also affect our clients indirectly. A compromise of our systems may impact their operations or lead to the unauthorized access to their proprietary or personal information. This could damage our clients’ trust in our services, which could have a cascading effect on our relationships and business performance.
• Ongoing Security Challenges: As cybersecurity threats evolve rapidly, new methods of breach may emerge that we are not able to anticipate or defend against immediately, especially now with state and foreign governments that are adversaries and employ hackers or bad actors. We may be unable to implement timely security measures to mitigate these risks, and in some cases, we may not be able to fully determine the extent to which new threats can bypass our defenses. This presents a significant challenge in maintaining the integrity of our security systems.
• Legal and Regulatory Risks: If we fail to adequately protect sensitive information, we could face legal consequences, including lawsuits, regulatory penalties, or damage claims, particularly if our clients or relevant authorities question the effectiveness of our threat detection and mitigation measures. These legal proceedings could expose us to significant financial and reputational risks.
• Potential Lawsuits and Liability: Our services are designed to protect clients from cyber-attacks and other security breaches. However, if our clients experience losses from cyber-attacks, including lost profits or other indirect damages, they may seek to hold us liable through lawsuits. While our service agreements typically include liability limitations, these provisions may not be enforceable in all cases. In the event of litigation, we could face substantial damage awards, which may exceed our insurance coverage and significantly impact our financial position.

A security breach, failure to protect sensitive information, or liability arising from a breach could have a material adverse effect on our business, operating results, financial condition, and prospects. We may incur significant legal, remediation, and security costs, and any reputational damage could undermine our business relationships and market position.

If we fail to meet our service level obligations under our service level agreements, we may be subject to certain penalties and could lose clients.

We have entered into service level agreements (“SLAs”) with many of our managed services clients, under which we guarantee specified levels of service availability. These arrangements require us to estimate and meet service delivery standards, including uptime and system performance, to ensure client satisfaction. The following risks are associated with the SLAs:

• Penalties and Cost Overruns: If we fail to meet our service level obligations, we may be subject to financial penalties, which could result in higher-than-expected costs. These penalties, along with any potential requirements for remediation, may negatively affect our profitability and operating margins.
• Client Loss and Revenue Impact: Failure to meet SLAs could result in client dissatisfaction, potentially leading to the termination of contracts or a reduction in client spending. The loss of clients due to unmet service expectations could significantly reduce our revenue and impact the stability of our future cash flows.
• Reputational Damage: Our ability to deliver on service level commitments is central to maintaining strong relationships with our clients. If we fail to meet our SLAs, our reputation may suffer, potentially leading to a loss of future business, difficulty attracting new clients, and challenges in retaining existing ones.
• Operational and Financial Risks: The financial and operational consequences of failing to meet service level commitments could lead to a deterioration in our gross and operating margins. Additionally, the resources required to address service failures and mitigate customer dissatisfaction could divert attention from other key business priorities, further impacting our overall performance.

If we fail to fulfill our SLAs, it could result in material financial costs, including penalties, client churn, and reputational damage, which would adversely affect our business, operating results, financial condition, and prospects.

The nature of our business involves significant risks and uncertainties that may not be covered by insurance or indemnification.

We provide services in circumstances where insurance or indemnification may not be available or may be insufficient to cover operational risks and other uncertainties that we face. Our existing insurance coverages may not fully protect us against the risks associated with the delivery of our services, and additional insurance may not be available on favorable terms, or at all. The following risks are associated with our insurance coverage:

• Liabilities in Excess of Coverage: Liabilities or claims arising from our services in excess of available indemnity or insurance coverage could materially harm our financial condition, cash flows, and operating results. If we are unable to obtain sufficient coverage for potential claims, the financial impact could be significant.
• Reputational Damage: Even if a claim is fully covered or insured, it could still harm our reputation in the marketplace. A negative perception resulting from claims, regardless of the outcome, could undermine client confidence and make it more difficult for us to compete effectively.
• Cost and Management Distraction: The defense of claims, even if ultimately unsuccessful, can be costly and time-consuming. It could divert management’s attention away from key business operations and strategic initiatives, which could affect our ability to execute on our business plan and impact overall operational performance.

The occurrence of claims or liabilities for which we do not have adequate insurance or indemnification could have a material adverse effect on our business, operating results, financial condition, and prospects. Furthermore, the associated reputational risks and management distraction could hinder our ability to maintain growth and profitability.

We indemnify our officers and directors against liability to us and our security holders, and such indemnification could increase our operating costs.

Our certificate of incorporation and bylaws allow us to indemnify our officers and directors against claims associated with carrying out the duties of their offices. Our bylaws also allow us to reimburse them for the costs of certain legal defenses. Insofar as indemnification for liabilities arising under the Securities Act may be permitted to our officers, directors, or control persons, the SEC has advised that such indemnification is against public policy and is therefore unenforceable.

Our industry is highly competitive, and there is no assurance that we will compete successfully.

Our business operates in a highly competitive landscape, and our current and potential competitors vary significantly by size, service offerings, and geographic location. Our competitors include technology companies, consulting firms, telecommunication companies, technology resellers, hardware and software providers, and other entities. Many of these competitors have established relationships within specific industries or have developed a reputation for expertise in particular sectors of the cybersecurity market, including services, software, and hardware.

Primary factors influencing competition in our market include security, reliability, and functionality; customer service and technical expertise; reputation and brand recognition; financial strength; the breadth of products and services offered; price; and scalability. However, many of our competitors possess substantial advantages in these areas, including the following:

• Financial and Operational Resources: Many of our competitors have greater financial, technical, and marketing resources. They may be able to deploy more significant resources in research and development, marketing, and sales, which could allow them to adapt more rapidly to emerging technologies or shifts in customer demands.
• Market Positioning: Competitors may have entrenched relationships within specific industries or have gained extensive reputation and brand recognition, positioning them as leaders in the market.
• Pricing and Product Bundling: Some of our competitors may be able to offer more favorable pricing or bundle products and services in ways that provide them with a competitive price advantage. Additionally, they may be able to maintain a lower cost structure, making it difficult for us to compete on price.
• Mergers, Acquisitions, and Alliances: Competitors may also benefit from strategic acquisitions, partnerships, or other alliances, allowing them to offer complementary products and services or achieve greater operational efficiencies.

Some of our competitors are better positioned to:

• Rapidly develop and deploy new products and services.
• Offer lower prices or more attractive pricing packages.
• Devote greater resources to sales and marketing efforts, including providing more incentives to channel partners.

As a result, competition in our industry could lead to several adverse outcomes for our business, including a loss of customers, reduced revenue, increased expenses, or pressure on our margins. These factors could adversely affect our business, financial condition, operating results, and long-term growth prospects.

Our success depends on our ability to protect our intellectual property and our proprietary technologies.

We rely on trade secrets to protect our intellectual property, proprietary technology, and processes, which we have developed or may develop in the future. However, there can be no assurance that confidentiality obligations will always be honored or that others will not independently develop similar or superior technology. The protection of intellectual property and proprietary technology through trade secret claims has become increasingly contentious, with more companies pursuing litigation to protect their rights or for competitive reasons, even when the claims may be unsubstantiated. The prosecution or defense of intellectual property claims can be costly and unpredictable, particularly given the evolving legal landscape. We may also face claims from other parties alleging infringement on their intellectual property or technology, which could adversely affect our business.

Increasingly complex cybersecurity regulations and standards may have significant impact on our business, and it may require us to substantially invest in our development capabilities to meet compliance requirements and may negatively impact our ability to offer certain services and remain profitable.

Cybersecurity legislation at the federal and state levels continues to evolve as lawmakers respond to the growing threat landscape. Multiple bills and resolutions are currently being considered, which may lead to new regulations, including cybersecurity standards and compliance requirements. Our expansion strategy, which includes acquisitions of other cybersecurity service providers, may be impacted by these regulations. We may be required to dedicate significant resources to ensure our services comply with diverse state-level requirements, potentially delaying service launches or limiting the scope of certain offerings. Non-compliance with these regulations could result in legal actions, increased costs, and operational disruptions, which would negatively impact our financial results.

We may become subject to disputes, including litigation, that could negatively impact our business, profitability, and financial condition.

We may become involved in disputes with third parties, which could result in litigation. Whether or not a dispute leads to litigation, significant resources—both management time and financial—may be required to resolve the issue. This could detract from our ability to focus on business operations. Any resolution could involve the payment of damages or other significant costs, and may involve restrictive terms that limit our operational flexibility. Prolonged or unfavorable legal disputes could materially harm our financial condition, profitability, and overall business performance.

If we incur additional debt, we will be subject to restrictive covenants and debt service obligations that could negatively impact our operations.

If we incur additional debt to fund operations or acquisitions, we will be subject to debt service obligations, including interest and principal payments. Debt agreements often contain restrictive covenants that may limit our operational flexibility and impose financial constraints. A default under any debt agreement could accelerate repayment and result in a judgment against us, potentially leading to the foreclosure of assets, which would materially adversely affect our business, financial condition, or results of operations.

The requirements of being a public company, including compliance with the reporting requirements of the Exchange Act and the requirements of the Sarbanes-Oxley Act and Nasdaq, may strain our resources, increase our costs, and divert management’s attention, and we may be unable to comply with these requirements in a timely or cost-effective manner.

As a public company, we are subject to the reporting requirements of the Exchange Act, and the corporate governance standards of the Sarbanes-Oxley Act and Nasdaq. We have a limited operating history as a public company, and these requirements may place a strain on our management, systems, and resources. In addition, we have incurred, and expect to continue to incur, significant legal, accounting, insurance, and other expenses. The Exchange Act requires us to file annual, quarterly, and current reports with respect to our business and financial condition within specified time periods and to prepare a proxy statement with respect to our annual meeting of stockholders. The Sarbanes-Oxley Act requires that we maintain effective disclosure controls and procedures and internal control over financial reporting. Nasdaq requires that we comply with various corporate governance requirements. To maintain and improve the effectiveness of our disclosure controls and procedures and internal control over financial reporting and comply with the Exchange Act and Nasdaq requirements, significant resources and management oversight are required. This may divert management’s attention from other business concerns and lead to significant costs associated with compliance, which could have a material adverse effect on us and the market price of our common stock. The expenses incurred by public companies generally for reporting and corporate governance purposes have been increasing. We expect these rules and regulations to continue to increase our legal and financial compliance costs and to make some activities more time-consuming and costly. These laws and regulations could also make it more difficult or costly for us to obtain certain types of insurance, including director and officer liability insurance, and we may be forced to accept reduced policy limits and coverage or incur substantially higher costs to obtain the same or similar coverage. These laws and regulations could also make it more difficult for us to attract and retain qualified persons to serve on our Board of Directors or its committees or as our executive officers. Advocacy efforts by stockholders and third parties may also prompt even more changes in governance and reporting requirements. We cannot predict or estimate the amount of additional costs we may incur or the timing of these costs. Furthermore, if we are unable to satisfy our obligations as a public company, we could be subject to delisting of our common stock, fines, sanctions, other regulatory action, and potentially civil litigation.

The preparation of our financial statements involves the use of estimates, judgments, and assumptions, and our financial statements may be materially affected if our estimates prove to be inaccurate.

Financial statements prepared in accordance with accounting principles generally accepted in the United States require the use of estimates, judgments, and assumptions that affect the reported amounts. Different estimates, judgments, and assumptions reasonably could be used that would have a material effect on the financial statements, and changes in these estimates, judgments, and assumptions are likely to occur from period to period in the future. These estimates, judgments, and assumptions are inherently uncertain, and, if they prove to be wrong, then we face the risk that charges to income will be required.

The auditor’s opinion on our audited consolidated financial statements for the year ended December 31, 2025, included in this annual report on Form 10-K, contain an explanatory paragraph relating to our ability to continue as a going concern.

The auditor’s opinion on our audited consolidated financial statements for the year ended December 31, 2025 includes an explanatory paragraph stating that our losses and negative cash flows from operations and uncertainty in generating sufficient cash to meet our operating obligations raise substantial doubt about our ability to continue as a going concern. While we are pursuing a variety of funding sources and transactions that could raise capital, there can be no assurances that we will be successful in these efforts or will be able to resolve our liquidity issues or eliminate our operating losses. If we are unable to obtain sufficient funding, we would need to significantly reduce our operating plans and curtail some or all of our strategic plans. Accordingly, our business, prospects, financial condition, and results of operations will be materially and adversely affected, and we may be unable to continue as a going concern. If we are unable to continue as a going concern, we may have to liquidate our assets and may receive less than the value at which those assets are carried on our audited consolidated financial statements, and it is likely that investors will lose all or a part of their investment. If we seek additional financing to fund our business activities in the future and there remains substantial doubt about our ability to continue as a going concern, investors or other financing sources may be unwilling to provide additional funding on commercially reasonable terms or at all.

Risks Related to our Common Stock

The market price of our common stock is volatile and may fluctuate in a way that is disproportionate to our operating performance.

The market price of our common stock may experience significant volatility due to a variety of factors, including, but not limited to:

• sales or potential sales of substantial amounts of our common stock;
• announcements about us or about our competitors or new product introductions;
• the loss or unanticipated underperformance of our global distribution channels;
• litigation and other developments relating to our patents or other proprietary rights or those of our competitors;
• conditions in the cybersecurity and IT services industries;
• governmental regulation and legislation;
• variations in our anticipated or actual operating results;
• changes in securities analysts’ estimates of our performance, or our failure to meet analysts’ expectations;
• foreign currency values and fluctuations; and
• overall political and economic conditions, including internation developments.

Many of these factors are beyond our control. In addition to recent events, the stock markets have historically experienced substantial price and volume fluctuations. These fluctuations often have been unrelated or disproportionate to the operating performance of these companies. These broad market and industry factors could reduce the market price of our common stock, regardless of our actual operating performance.

Future sales of shares of our common stock by existing stockholders could depress the market price of our common stock.

We had an aggregate of 44,671,637 issued and outstanding shares of common stock as of December 31, 2025. Approximately 29,099,985 shares were held in street name. The remainder of the outstanding shares may be sold, subject to certain volume limitations, pursuant to Rule 144 or other available exemptions. Also, in the future, we may issue additional securities in connection with financings and acquisitions. The amount of our common stock issued in connection with an investment or acquisition could constitute a material portion of our then outstanding stock. Due to these factors, sales of a substantial number of shares of our common stock in the public market could occur at any time. These sales, or the perception in the market that the holders of a large number of shares intend to sell shares, could reduce the market price of our common stock.

Provisions in our certificate of incorporation, our by-laws, and Delaware law might discourage, delay, or prevent a change in control of our company or changes in our management and, therefore, depress the trading price of our common stock.

Provisions of our certificate of incorporation, our by-laws, and Delaware law may have the effect of deterring unsolicited takeovers or delaying or preventing a change in control of our company or changes in our management, including transactions in which our stockholders might otherwise receive a premium for their shares over then current market prices. In addition, these provisions may limit the ability of stockholders to approve transactions that they may deem to be in their best interests. These provisions include the ability of our Board of Directors to designate the terms of and issue new series of preferred stock without stockholder approval, which could include the right to approve an acquisition or other change in our control or could be used to institute a rights plan, also known as a poison pill, that would work to dilute the stock ownership of a potential hostile acquirer, likely preventing acquisitions that have not been approved by our Board of Directors. The existence of the forgoing provisions and anti-takeover measures could limit the price that investors might be willing to pay in the future for shares of our common stock. They could also deter potential acquirers of our company, thereby reducing the likelihood that an investor in our company could receive a premium for their common stock in an acquisition.

Our Board of Directors is expressly authorized to make, alter, or repeal our by-laws by majority vote, while such action by stockholders would require a super majority vote.

These anti-takeover provisions and other provisions under Delaware law could discourage, delay, or prevent a transaction involving a change in control of our company, including actions that our stockholders may deem advantageous, or negatively affect the trading price of our stock. These provisions could also discourage proxy contests and make it more difficult for stockholders to elect directors of their choosing and cause us to take other corporate actions they desire.

Our ability to access the full amount available under the purchase agreement with B. Riley is not guaranteed, and our broad discretion over the use of any proceeds we receive may not result in improved financial performance or stockholder value.

On September 24, 2025, we entered into a purchase agreement with B. Riley Principal Capital, LLC (“B. Riley”), pursuant to which we have the right to sell up to $15.0 million of our Series B Preferred Stock over an eighteen-month period. Our ability to sell shares of Series B Preferred Stock under the purchase agreement is subject to a number of conditions and limitations, and there can be no assurance that we will be able to satisfy such conditions or that such limitations will not prevent us from accessing all or a meaningful portion of the $15.0 million available. As of March 20, 2026, we have sold to B. Riley 2,396 shares of Series B Preferred Stock, or $2.3 million. If we are unable to continue accessing capital under the purchase agreement, we may be required to seek alternative financing arrangements, curtail or delay our operations, or otherwise be unable to execute our business plan, any of which could have a material adverse effect on our business, financial condition, and results of operations.

The issuance and potential conversion of Series B Preferred Stock may adversely affect our common stockholders and the market price of our common stock, and our obligation to redeem shares of Series B Preferred Stock upon certain triggering events could materially harm our liquidity and financial condition.

The Series B Preferred Stock issued under the purchase agreement to B. Riley carries rights, preferences, and privileges senior to those of our common stock, including with respect to dividends, liquidation, and other matters, which may adversely affect the rights and economic interests of our common stockholders. The ongoing potential for conversion of Series B Preferred Stock into common stock may create downward pressure on the market price of our common stock, and anti-dilution or other protective provisions associated with the Series B Preferred Stock could further dilute the holdings of existing common stockholders. Potential investors may perceive the overhang of shares issuable upon conversion as a negative factor, which could reduce demand for and depress the trading price of our common stock. Under the terms of our Series B Certificate of Designations, we are required to redeem all or a portion of the outstanding shares of Series B Preferred Stock upon the occurrence of certain triggering events, including if our common stock is delisted or suspended from Nasdaq, if the holder is prohibited from converting any portion of the Series B Preferred Stock for eighteen months following issuance due to the Exchange Cap (as defined in the purchase agreement), or if the market price of our common stock falls and remains below $0.40, the minimum conversion price, for ten consecutive trading days. Our obligation to make such redemptions could require us to use a substantial portion of our available cash or to seek additional sources of financing on potentially unfavorable terms. If we do not have sufficient cash on hand or are unable to obtain adequate financing, we may be unable to meet our redemption obligations, which could result in a default under the Series B Certificate of Designations and may have other material adverse consequences. The requirement to redeem shares of Series B Preferred Stock may also limit our ability to deploy cash for other purposes, such as funding operations, investing in our business, or pursuing strategic opportunities, and could negatively impact our financial condition, results of operations, and the market value of our common stock.

FINRA sales practice requirements may limit a stockholder’s ability to buy and sell our stock.

The Financial Industry Regulatory Authority, Inc. (“FINRA”) has adopted rules that require that, in recommending an investment to a client, a broker-dealer must have reasonable grounds for believing that the investment is suitable for that customer. Prior to recommending speculative low-priced securities to their non-institutional customers, broker-dealers must make reasonable efforts to obtain information about the customer’s financial status, tax status, investment objectives, and other information. Under interpretations of these rules, FINRA believes that there is a high probability that speculative low-priced securities will not be suitable for certain customers. FINRA requirements will likely make it more difficult for broker-dealers to recommend that their customers buy our common stock, which may have the effect of reducing the level of trading activity in the shares, resulting in fewer broker-dealers may be willing to make a market in our shares, potentially reducing a stockholder’s ability to resell shares of our common stock.

If we issue additional shares in the future, it will result in a dilution of our existing stockholders.

On January 12, 2026, we filed a certificate of amendment with the Secretary of State of the State of Delaware to amend our certificate of incorporation to increase the number of authorized shares of common stock from 300,000 to 1,300,000,000. We have also authorized the issuance of up to 50,000,000 shares of preferred stock. Our Board of Directors may choose to issue some or all of such shares to acquire one or more companies and to fund our overhead and general operating requirements. The issuance of any such shares will reduce the book value per share and may contribute to a reduction in the market price of the outstanding shares of our common stock. If we issue any such additional shares, such issuance will reduce the proportionate ownership and voting power of all current stockholders. Further, such issuance may result in a change of control of our company.

We are eligible to be treated as an “emerging growth company,” as defined in the JOBS Act, and we cannot be certain if the reduced disclosure requirements applicable to emerging growth companies will make our common stock less attractive to investors.

We are an “emerging growth company,” as defined in the JOBS Act. For as long as we continue to be an emerging growth company, we may take advantage of exemptions from various reporting and other requirements that are applicable to other public companies that are not emerging growth companies, including (i) not being required to comply with the auditor attestation requirements of Section 404(b) of the Sarbanes-Oxley Act, (ii) reduced disclosure obligations regarding executive compensation in our periodic reports and proxy statements, and (iii) exemptions from the requirements of holding a nonbinding advisory vote on executive compensation and stockholder approval of any golden parachute payments not previously approved. We could be an emerging growth company for up to five years, although circumstances could cause us to lose that status earlier. In addition, Section 107 of the JOBS Act provides that an emerging growth company can take advantage of the extended transition period provided in Section 7(a)(2)(B) of the Securities Act for complying with new or revised accounting standards that have different effective dates for public and private companies until those standards apply to private companies. We have elected to take advantage of the extended transition period for complying with the revised accounting standards. As a result, our financial statements may not be comparable to companies that comply with effective dates generally applicable to public companies. Investors may find our common stock less attractive because we may rely on these exemptions, reduced reporting requirements, and extended transition periods. If investors find our common stock less attractive as a result of any of the foregoing, there may be a less active trading market for our common stock and our stock price may be more volatile or may decrease.

Our directors, a former director, a consultant and an executive officer beneficially own a substantial majority of our outstanding capital stock and will have the ability to control our affairs.

Our directors, a former director, a consultant, and an executive officer, beneficially own approximately 34.47% of our outstanding capital stock. By virtue of these holdings, they effectively control the election of the members of our Board of Directors, our management, and our affairs and may prevent us from consummating corporate transactions such as mergers, consolidations, or the sale of all or substantially all of our assets that may be favorable from our standpoint or that of our other stockholders.

Our failure to meet the continued listing requirements of Nasdaq could result in a delisting of our common stock.

On December 30, 2025, we received a letter from the listing qualifications staff of Nasdaq providing notification that the bid price of our common stock had closed below $1.00 per share for the previous 33 consecutive business days and our common stock no longer meets the minimum bid price requirement for continued listing under Nasdaq Listing Rule 5550(a)(2). In accordance with Nasdaq Listing Rule 5810(c)(3)(A), we have 180 calendar days or until June 29, 2026, to regain compliance. To regain compliance, the closing bid price of our common stock must be $1.00 per share or more for a minimum of 10 consecutive business days at any time before June 29, 2026.

If we do not regain compliance with Rule 5550(a)(2) by June 29, 2026, we may be eligible for an additional 180 calendar day compliance period. To qualify, we would need to meet the continued listing requirement for market value of publicly held shares and all other initial listing standards for the Nasdaq Capital Market, with the exception of the minimum bid price requirement, and would need to provide written notice of our intention to cure the deficiency during the second compliance period, by effecting a reverse stock split, if necessary. However, if it appears to the Staff that we will not be able to cure the deficiency, or if we are otherwise not eligible, Nasdaq would notify us that our securities would be subject to delisting. In the event of such notification, we may appeal the staff’s determination to delist our securities, but there can be no assurance the staff would grant our request for continued listing.

The Nasdaq notification has no immediate effect on the listing of our common stock on the Nasdaq Capital Market. We intend to actively monitor the bid price of our common stock and our minimum market value of listed securities and will consider options available to us to achieve compliance with the Nasdaq listing rules. There can be no assurance that we will be able to regain compliance with the minimum bid price requirement or will otherwise be in compliance with the other listing standards for the Nasdaq Capital Market.

In the event that we again become non-compliant with Rule 5550(a)(2) and cannot re-establish compliance within the required timeframe, or we otherwise cannot comply with the continued listing standards of Nasdaq, our common stock could be delisted from Nasdaq, which could have a material adverse effect on our financial condition, and which would cause the value of our common stock to decline. If our common stock is not eligible for listing or quotation on another market or exchange, trading of our common stock could be conducted in the over-the-counter market or on an electronic bulletin board established for unlisted securities such as the Pink Sheets or the OTC Bulletin Board. In such event, it would become more difficult to dispose of, or obtain accurate price quotations for, our common stock, and there would likely be a reduction in our coverage by security analysts and the news media, which could cause the price of our common stock to decline further. In addition, it may be difficult for us to raise additional capital if we are not listed on a national securities exchange.

We do not intend to pay dividends on our common stock.

We have never paid any cash dividends, and currently do not intend to pay any dividends on our common stock for the foreseeable future. We intend to retain any future earnings to the extent necessary to develop and expand our business. Payment of cash dividends, if any, will depend, among other factors, on our earnings, capital requirements, and the general operating and financial condition, and will be subject to legal limitations on the payment of dividends out of paid-in capital. Because we do not intend to declare dividends, any gain on an investment in our company will need to come through an increase in the stock price. This may never happen, and investors may lose all of their investment.

Our business could be negatively impacted by stockholder activism.

In recent years, stockholder activists have become involved in numerous public companies. Stockholder activists frequently propose to involve themselves in the governance, strategic direction, and operations of companies. Stockholder activists have also become increasingly concerned with companies’ efforts with respect to environmental, sustainability and governance standards. Responding to actions by activist stockholder, such as requests for special meetings, potential nominations of candidates for election to our Board of Directors, requests to pursue a strategic combination or other transaction, or other special requests may disrupt our business and divert the attention of management and employees. In addition, any perceived uncertainties as to our future direction resulting from such a situation could result in the loss of potential business opportunities, be exploited by our competitors, cause concern to our current or potential customers, and make it more difficult to attract and retain qualified personnel and business partners, all of which could negatively impact our business. Stockholder activism could result in substantial costs. In addition, actions of activist stockholder may cause significant fluctuations in our stock price based on temporary or speculative market perceptions or other factors that do not necessarily reflect the underlying fundamentals of our business.

Our share price may be volatile, and you may be unable to sell your shares.

The trading price of our common stock is likely to be highly volatile and these fluctuations could cause you to lose all or part of your investment in our common stock. Since shares of our common stock were sold in our initial public offering in January 2022 at a price of $75.00 per share, the reported high and low sales prices of our common stock ranged from $0.26 to $138.15 per share through March 20, 2026. Factors that may cause the market price of our common stock to fluctuate include:

• price and volume fluctuations in the overall stock market from time to time;
• significant volatility in the market price and trading volume of technology companies in general, and of companies in our industry;
• actual or anticipated changes in our results of operations or fluctuations in our operating results;
• whether our operating results meet the expectations of securities analysts or investors;
• failure of securities analysts to initiate or maintain coverage of our company, changes in financial estimates or ratings by any securities analysts who follow our company, or our failure to meet the estimates or the expectations of investors;
• announcements of new products or technologies, commercial relationships, acquisitions, or other events by us or our competitors;
• actual or anticipated developments in our competitors’ businesses or the competitive landscape generally;
• actual or perceived privacy or data security incidents;
• litigation involving us, our industry or both;
• regulatory developments in the United States, foreign countries, or both;
• general economic conditions and trends;
• the commencement or termination of any share repurchase program;
• new laws or regulations or new interpretations of existing laws or regulations applicable to our business;
• the availability of our services, security breaches or perceived security breaches, and vulnerabilities;
• changes in accounting standards, policies, guidelines, interpretations, or principles;
• actions instituted by activist stockholder or others;
• major catastrophic events, including those resulting from war, incidents of terrorism, outbreaks of pandemic diseases, such as COVID-19, or responses to these events;
• sales of large blocks of our stock; or
• departures of key personnel.

In addition, if the market for technology stocks or the stock market in general experiences a loss of investor confidence, the trading price of our common stock could decline for reasons unrelated to our business, operating results or financial condition. The trading price of our common stock might also decline in reaction to events affecting other companies in our industry even if these events do not directly affect us.

In the past, following periods of volatility in the market price of a company’s securities, securities class action litigation has often been brought against that company. If our stock price is volatile, we may become the target of securities litigation, which could result in substantial costs and a diversion of management’s attention and resources.

We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from multiple sources. Teams of dedicated security professionals oversee cybersecurity risk management and mitigation, incident prevention, detection, and remediation. Leadership for these teams are professionals with deep cybersecurity expertise across multiple industries, including our Chief Information Security Officer. Our executive leadership team, along with input from the above teams, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the company.

As part of our cybersecurity risk management system, our incident management teams track and log security incidents across our company and our customers to remediate and resolve any such incidents. Significant incidents are reviewed by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment and then reported to designated members of our senior management. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions. Our management apprises our independent registered public accounting firm of matters and any relevant developments. The Audit Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and reports any findings and recommendations, as appropriate, to the full Board for consideration. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Chief Information Security Officer.

Our Chief Information Security Officer is accountable for our overall cybersecurity program in partnership with other business leaders. Our Chief Information Security Officer has extensive experience leading global technology and IT organizations. Team members and outside experts supporting our program have relevant education and information, including security for larger multi-national, publicly traded companies. Our Chief Information Security Officer has leading security certifications, including Certified Information Systems Security Professional (CISSP), memberships in professional associations in the International Information System Security Certification Consortium and Information Systems Security Association, an MBA in Management of Technology, and expertise in private, public and governmental entities. Our information security team remains abreast of the latest cybersecurity advancements, staying informed about potential threats and emerging risk management strategies. This continuous learning is vital for proactively preventing, detecting, mitigating, and remediating cybersecurity incidents. Our information security team is responsible for implementing and supervising processes for ongoing monitoring of our information systems, incorporating advanced security measures and regular system audits to pinpoint vulnerabilities. In the event of a cybersecurity incident, our information security team employs a well-defined incident response plan, comprising immediate actions to minimize impact and long-term strategies for remediation and prevention of future incidents. Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including because of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity-related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.

Our corporate headquarters is in Scottsdale, Arizona where we currently lease approximately 3,300 square feet of office space. We lease one additional office, which we believe is not material to our operations.

We believe our existing facilities are sufficient for our current needs. Although we have recently closed or consolidated certain of our facilities, in the future, we may need to add new facilities or expand our existing facilities to meet our evolving business needs.

The following Management’s Discussion and Analysis of Financial Condition and Results of Operations should be read in conjunction with our consolidated financial statements and the related notes contained elsewhere in this Annual Report and is intended to provide information necessary to understand our audited consolidated financial statements for the year ended December 31, 2025 compared to the year ended December 31, 2024 and highlight certain other information which will enhance a reader’s understanding of our financial condition, changes in financial condition, and results of operations. In particular, the discussion is intended to provide an analysis of significant trends and material changes in our financial position and the operating results of our business during the year ended December 31, 2025 compared to the year ended December 31, 2024. These historical consolidated financial statements may not be indicative of our future performance. This Management’s Discussion and Analysis of Financial Condition and Results of Operations contains numerous forward-looking statements, all of which are based on our current expectations and could be affected by the uncertainties and risks described throughout this filing, particularly in “Item 1A. Risk Factors.”

Our Business

We provide a comprehensive suite of cybersecurity consulting and related services built on four critical pillars: Proprietary Software Stack, Compliance, Cybersecurity, and Organizational Culture.

Our services include managed security, compliance assessments, Security Operations Center (SOC) support, virtual Chief Information Security Officer (vCISO) services, incident response, digital forensics, technical assessments, and cybersecurity training. We have developed a unique offering called MCCP+, which integrates all four pillars through a dedicated team of subject matter experts.

Unlike many cybersecurity firms focused on specific technologies or services, we remain technology-agnostic. Our approach is centered around building a world-class team of cybersecurity and compliance experts with diverse skill sets, enabling us to provide truly holistic solutions that address the chronic shortage of highly skilled cybersecurity professionals.

The Proprietary Software Stack is foundational to our approach. We have developed a comprehensive suite of proprietary software solutions powered by machine learning, artificial intelligence (AI), and dark web threat intelligence. These multilayered technologies enhance our cybersecurity effectiveness, improve organizational resilience, and offer real-time insights to our clients, enabling them to stay ahead of evolving threats.

We also emphasize Compliance, working with clients to ensure they meet industry regulations and standards. Compliance assessments, audits, and adherence to best practices are integrated into our services, helping organizations safeguard sensitive information and minimize risk.

The Cybersecurity pillar includes advanced threat detection, incident response, and ongoing risk assessments to protect client systems, networks, and data from evolving cyber threats. Our team applies cutting-edge tools and methodologies to proactively defend against potential breaches, minimizing downtime and mitigating damage.

Finally, we focus on Organizational Culture, recognizing that a strong security-first mindset is essential for resilience. By working with clients to cultivate a culture of security, we help them make security an integral part of their operations, improving both their overall security posture and return on cybersecurity investments.

With a comprehensive portfolio of scalable intellectual property solutions, proprietary software stack, and an end-to-end team of experts, we are well-positioned for organic growth. By optimizing the user experience and leveraging digital interfaces, we can expand our client base without overburdening our service team. This scalability will enable us to drive increased revenue and profit margins concurrently.

Financial Highlights

Our operating results for the year ended December 31, 2025 included the following:

• Total current liabilities reduced by $17,217,158 to $7,738,489 as compared to December 31, 2024 of $24,955,647.
• Total gross profit increased to $6,819,977 for the year ended December 31, 2025 as compared to $4,507,645 for the year ended December 31, 2024.
• Reduced our loss from operations to $8,785,052 for the year ended December 31, 2025, as compared to $14,589,635 for the year ended December 31, 2024.

Results of Operations

Comparison of the Year Ended December 31, 2025, to the Year Ended December 31, 2024

Our financial results for the year ended December 31, 2025 are summarized as follows in comparison to the year ended December 31, 2024:

• 37-

Revenue

Security managed services revenue decreased by $3,986,159, or 14%, for the year ended December 31, 2025, as compared to the year ended December 31, 2025, primarily due to loss of several higher-revenue customers, partially offset by newly acquired customers.

Professional services revenue decreased by $309,958, or 12%, for the year ended December 31, 2025, as compared to the year ended December 31, 2024, primarily due to fewer customer projects.

Cybersecurity software revenue increased by $151,420, or 34%, for the year ended December 31, 2025, as compared to the year ended December 31, 2024, primarily due to the initial launch of our suite of internally developed cybersecurity software products.

Expenses

Cost of Revenue

Security managed services cost of revenue decreased by $1,973,745, or 21%, for the year ended December 31, 2025, as compared to the year ended December 31, 2024, primarily due to lower personnel related costs resulting from a reduction in headcount, as well as reduced costs related to the management of service vendors associated with our existing client base.

Professional services cost of revenue decreased by $234,798, or 50%, for the year ended December 31, 2025, as compared to the year ended December 31, 2024, due to decreased use of consultants.

Cybersecurity software cost of revenue increased by $82,820, or 69%, for the year ended December 31, 2025, as compared to the year ended December 31, 2024, primarily due to the initial launch of our suite of internally developed cybersecurity software products.

Cost of payroll decreased by $1,590,759, or 13%, for the year ended December 31, 2025, as compared to the year ended December 31, 2024, due to headcount reductions.

Stock-based compensation decreased by $2,740,547, or 63%, for the year ended December 31, 2025, as compared to the year ended December 31, 2024, primarily due to significantly lower grant date fair values on equity awards issued during the year, despite a higher number of grants. The decrease also reflects the impact of forfeitures of options by terminated employees, which reduced recognized expense.

Operating Expenses

Professional fees increased by $311,611, or 23%, for the year ended December 31, 2025, as compared to the year ended December 31, 2024, due to an increase in legal and accounting fees.

Advertising and marketing expenses increased by $1,012,140, or 100%, for the year ended December 31, 2025, as compared to December 31, 2024, due to marketing efforts initiated in 2025.

Selling, general, and administrative expenses decreased $2,488,649, or 19%, for the year ended December 31, 2025, as compared to the year ended December 31, 2024, primarily due to reductions in headcount during 2024 resulting in lower costs for compensation and leases in 2025.

Stock-based compensation expenses decreased by $2,327,353, or 50%, for the year ended December 31, 2025, as compared to the year ended December 31, 2024, primarily due to significantly lower grant date fair values on equity awards issued during the year, despite a higher number of grants. The decrease also reflects the impact of forfeitures of options by terminated employees, which reduced recognized expense.

Other Income (Expense)

The gain on extinguishment of convertible notes was $4,432,434 for the year ended December 31, 2025 due to the conversion of certain convertible notes into shares of our common stock and Series A Preferred Stock during 2025.

The loss on issuance of convertible notes was $1,022,650 during the year ended December 31, 2024 due to our costs associated with issuing the convertible notes exceeding the fair value of such convertible notes.

The change in fair value of derivative liability increased by $6,060,693 during the year ended December 31, 2025, as compared to the year ended December 31, 2024. This increase was primarily due to changes in significant valuation inputs—such as the market price of CISO common stock—used in estimating the fair value of the derivative liability following the issuance of the related convertible notes payable in December 2024 and January 2025, as well as the subsequent conversion of certain convertible notes into shares of our common stock in 2025. The estimated fair value of the conversion feature of the derivative liability is based on Monte Carlo simulations, a valuation model.

Interest expense increased by $5,616,622 for the year ended December 31, 2025, as compared to the year December 31, 2024, primarily due to the accretion of convertible notes payable and the amortization of debt issuance costs associated with the issuance of certain convertible notes payable during December 2024 and January 2025.

Working Capital

Our working capital as of December 31, 2025, as compared to our working capital as of December 31, 2024, is summarized as follows:

The decrease in current assets is primarily due to the $67,272 increase in prepaid expenses and other current assets being more than offset by decreases in accounts receivable and prepaid cost of revenue of $636,460 and $263,927, respectively. Accounts receivable and prepaid cost of revenue decreased due to collection efforts and lower revenue in 2025. Prepaid expenses increased due to increased prepaid marketing expenses.

The decrease in current liabilities is primarily due to decreases in accounts payable, accrued expenses and other current liabilities, debt obligations, and the derivative liability of $5,359,450, $9,425,380, and $2,102,927, respectively. During the year ended December 31, 2025, we paid down accounts payable, accrued expenses, other current liabilities and loans payable outstanding, certain convertible notes payable were converted into shares of our common stock and Series A Preferred Stock, and the derivative liability was derecognized as a result of the conversion of the notes payable.

Cash Flows

Our cash flows for the year ended December 31, 2025, as compared to our cash flows for the year ended December 31, 2024, can be summarized as follows:

Operating Activities

Net cash used in operating activities was $7,971,902 for the year ended December 31, 2025 and was primarily due to cash used to fund a net loss of $8,073,930, adjusted for non-cash expenses in the aggregate of $5,070,143 and additional cash decreases from changes in the levels of operating assets and liabilities in the aggregate of $4,968,115, primarily as a result of a decrease in accounts payable, accrued expenses, and other current liabilities. Net cash used in operating activities was $3,841,706 for the year ended December 31, 2024 and was primarily due to cash used to fund a net loss of $24,243,919, adjusted for non-cash expenses in the aggregate of $17,100,898 and additional cash increases from changes in the levels of operating assets and liabilities in the aggregate of $3,301,315, primarily as a result of an increase in accounts receivable, accounts payable and accrued expenses, and deferred revenue.

Investing Activities

Net cash used in investing activities were $7,491 and $83,095 for the years ended December 31, 2025 and 2024, respectively, which were due to cash paid to purchase property and equipment.

Financing Activities

Net cash provided by financing activities for the year ended December 31, 2025 was $8,682,798, which was primarily due to $2,816,075 cash received from the sale of our common stock, $1,774,935 cash received from the sale of our Series B Preferred Stock, $1,949,999 from the exercise of warrants, cash received from borrowings on our convertible loans payable and line of credit (net of debt issuance costs) of $23,072,983, offset by $20,934,296 in repayments of our loans payable and line of credit.

Net cash provided by financing activities for the year ended December 31, 2024 was $3,914,162, which was primarily due to $154,947 cash received from the sale of our common stock, cash received from borrowings on our loans, line of credit, and convertible notes payable (net of debt issuance costs) of $10,984,412, offset by $7,225,197 in repayment of our loans payable and line of credit.

Liquidity and Capital Resources

The accompanying consolidated financial statements have been prepared on a going concern basis, which contemplates the realization of assets and satisfaction of liabilities in the normal course of business. For the year ended December 31, 2025, we incurred a net loss of $8,073,930, reported cash used in operations of $7,971,902, and expect to incur further losses through the end of 2026. Further, we have a working capital deficit of $4,474,265 as of December 31, 2025. As a result, substantial doubt about our ability to continue as a going concern exists. The Company’s ability to fund ongoing operations is highly dependent upon raising additional capital through the issuance of equity securities and issuing debt or other financing vehicles. We are evaluating strategies to obtain the required additional funding for future operations. These strategies may include obtaining equity financing, issuing debt or entering into other financing arrangements, and restructuring operations to grow revenues and decrease expenses.

Series A Preferred Stock

On August 4, 2025, we entered into Exchange Agreements with each of the Holders. Pursuant to the Exchange Agreements, the Holders exchange certain outstanding convertible notes payable with aggregate principal and accrued interest of approximately $9,297,894 (collectively, the “Exchange Notes”) for an aggregate of 9,297,894 newly authorized shares of Series A Preferred Stock. Upon the closing of the transactions contemplated by the Exchange Agreements, the Exchange Notes were cancelled, and the Holders relinquished all rights, powers, privileges, remedies, or interest under such securities. On November 6, 2025, we converted all 9,297,894 outstanding shares of Series A Preferred Stock, together with $222,815 in accrued and unpaid dividends to 9,520,709 shares of common stock.

Series B Preferred Stock

On September 24, 2025, we entered into a Preferred Equity Purchase Agreement (the “Purchase Agreement”) with B. Riley Principal Capital I (“B. Riley”), an affiliate of B.Riley Securities, Inc. (“BRS”), pursuant to which we will have the right to issue and sell to B. Riley, and B. Riley must purchase from us, up to $15.0 million of shares of our newly authorized Series B Convertible Preferred Stock, par value $0.00001 per share (the “Series B Preferred Stock”). As of the issuance of these consolidated financial statements, B. Riley has purchased $2.3 million of the $15.0 million of shares of Series B Preferred Stock. Such sales of Series B Preferred Stock by us to B. Riley, if any, will be subject to certain limitations and conditions set forth in the Purchase Agreement, and may occur from time to time, at our sole discretion, over the 18-month period commencing September 24, 2025 and terminating on the earliest of (i) March 24, 2027, (ii) the date on which B. Riley shall have made payment of the aggregate purchase price equal to $15.0 million. In no event may we issue or sell to B. Riley under the Purchase Agreement shares of our Series B Preferred Stock that are convertible into an aggregate number of shares of common stock exceeding a customary 9.99% beneficial ownership limitation.

July 2025 Prospectus

On June 26, 2025, we filed a replacement shelf registration statement on Form S-3 (that was deemed effective on July 7, 2025) (“July 2025 Prospectus”) that contains two prospectuses:

1) a base prospectus that covers the potential offering, issuance, and sale from time to time of our common stock, preferred stock, warrants, debt securities, and units in one or more offerings with total proceeds of up to $100,000,000; and

2) a sales agreement prospectus covering the potential offering, issuance, and sale from time to time of shares of our common stock having aggregate gross sales proceeds of up to $10,380,600 pursuant to our At-the-Market (“ATM”) sales agreement, dated June 14, 2022, with BRS, Stifel, Nicolaus & Company, Incorporated and Boustead Securities, LLC.

In no event will we sell securities under this registration statement with a value exceeding more than one-third of our “public float” (the aggregate market value of our common stock and any other equity securities that we may issue in the future that are held by non-affiliates) in any 12-calendar month period so long as our public float remains below $75 million.

There can be no assurance that we will be able to obtain additional liquidity when needed or under acceptable terms, if at all. As such, we may be unable to access further equity or debt financing when needed. The ability for us to continue as a going concern is dependent upon our ability to successfully implement our strategies and eventually attain profitable operations. The accompanying consolidated financial statements do not include any adjustments to the carrying amounts or classification of assets, liabilities, and reported expenses that may be necessary if we are unable to continue as a going concern.

On December 30, 2025, we received a letter from the listing qualifications staff of Nasdaq providing notification that the bid price of our common stock had closed below $1.00 per share for the previous 33 consecutive business days and our common stock no longer meets the minimum bid price requirement for continued listing under Nasdaq Listing Rule 5550(a)(2). In accordance with Nasdaq Listing Rule 5810(c)(3)(A), we have 180 calendar days or until June 29, 2026, to regain compliance. To regain compliance, the closing bid price of our common stock must be $1.00 per share or more for a minimum of 10 consecutive business days at any time before June 29, 2026.

If we do not regain compliance with Rule 5550(a)(2) by June 29, 2026, we may be eligible for an additional 180 calendar day compliance period. To qualify, we would need to meet the continued listing requirement for market value of publicly held shares and all other initial listing standards for the Nasdaq Capital Market, with the exception of the minimum bid price requirement, and would need to provide written notice of our intention to cure the deficiency during the second compliance period, by effecting a reverse stock split, if necessary. However, if it appears to the Staff that we will not be able to cure the deficiency, or if we are otherwise not eligible, Nasdaq would notify us that our securities would be subject to delisting. In the event of such notification, we may appeal the staff’s determination to delist our securities, but there can be no assurance the Staff would grant our request for continued listing.

The Nasdaq notification has no immediate effect on the listing of our common stock on the Nasdaq Capital Market. We intend to actively monitor the bid price of our common stock and our minimum market value of listed securities and will consider options available to us to achieve compliance with the Nasdaq listing rules. There can be no assurance that we will be able to regain compliance with the minimum bid price requirement or will otherwise be in compliance with the other listing standards for the Nasdaq Capital Market.

Recently Issued Accounting Pronouncements

See Note 3 to our consolidated financial statements for the years ended December 31, 2025 and 2024 included elsewhere in this Annual Report.

Critical Accounting Estimates

Fair Value Measurements

The fair value measurement guidance clarifies that fair value is an exit price, representing the amount that would be received to sell an asset or paid to transfer a liability in an orderly transaction between market participants. As such, fair value is a market-based measurement that should be determined based on assumptions that market participants would use in the valuation of an asset or liability. It establishes a fair value hierarchy that prioritizes the inputs to valuation techniques used to measure fair value. The hierarchy gives the highest priority to unadjusted quoted prices in active markets for identical assets or liabilities (Level 1 measurements) and the lowest priority to unobservable inputs (Level 3 measurements). The three levels of the fair value hierarchy under the fair value measurement guidance are described below:

Level 1 - Unadjusted quoted prices in active markets that are accessible at the measurement date for identical assets or liabilities;

Level 2 - Quoted prices in markets that are not active, or inputs that are observable, either directly or indirectly, for substantially the full term of the asset or liability; or

Level 3 - Prices or valuation techniques that require inputs that are both significant to the fair value measurement and unobservable (supported by little or no market activity).

The automatic discounted share-settlement feature of our convertible notes issued in December 2024 was an embedded derivative requiring bifurcation accounting as (1) the feature was not clearly and closely related to the debt host and (2) the feature met the definition of a derivative under ASC 815, Derivatives and Hedging.

The bifurcated embedded features were initially recorded on the balance sheet at their fair value on the date of issuance. After the initial recognition, the fair value of the embedded derivative liability changed over time due to changes in the share price of our common stock. The change in fair value has been included in our statement of operations. The embedded derivative liability and related convertible notes payable were extinguished during the year ended December 31, 2025.

Business Combinations

We allocate the purchase price of an acquired business to the tangible and intangible assets acquired and liabilities assumed based upon their estimated fair values on the acquisition date. Any excess of the purchase price over the fair value of the net assets acquired is recorded as goodwill. The purchase price allocation process requires management to make significant estimates and assumptions, especially at the acquisition date with respect to intangible assets. Direct transaction costs associated with the business combination are expensed as incurred. The allocation of the consideration transferred in certain cases may be subject to revision based on the final determination of fair values during the measurement period, which may be up to one year from the acquisition date. We include the results of operations of the business that it has acquired in its consolidated results prospectively from the date of acquisition.

If the business combination is achieved in stages, the acquisition date carrying value of the acquirer’s previously held equity interest in the acquiree is re-measured to fair value at the acquisition date; any gains or losses arising from such re-measurement are recognized in profit or loss.

Goodwill

Goodwill is assessed for impairment annually, or more frequently, if events occur that would indicate a potential reduction in the fair value of a reporting unit below its carrying value. We perform our annual impairment review of goodwill at the reporting unit level. If we determine the fair value of the reporting unit’s goodwill is less than their carrying value as a result of an annual or interim test, an impairment loss is recognized and reflected in operating income or loss in the consolidated statements of operations during the period incurred. We perform our impairment assessment based on a quantitative analysis performed for our reporting unit.

We performed our annual impairment assessment of goodwill as of December 31, 2025 and concluded that no impairment of goodwill was indicated. As of December 31, 2025, we believe such assets are recoverable, however, there can be no assurance that these assets will not be impaired in future periods. Any future impairment charges could adversely impact our results of operations.

Impairment of Long-lived Assets

We review finite-lived intangible assets for impairment whenever an event occurs or circumstances change that indicate that the carrying amount of an asset group may not be fully recoverable. Recoverability is determined based on an estimate of undiscounted future cash flows resulting from the use of an asset group and its eventual disposition. Should an asset group not be recoverable, an impairment loss is measured by comparing the fair value of the asset group to its carrying value. If we determine the fair value of an asset group is less than the carrying value, an impairment loss is recognized in operating income or loss in the consolidated statements of operations during the period incurred.

Stock-based Compensation

We measure and recognize compensation expense for equity-based awards based on the grant date fair values of the awards. For options with service or performance-based vesting conditions, the grant date fair value is estimated using the Black-Scholes option-pricing model, which requires management to make assumptions and apply judgment in determining the grant date fair value.

The most significant assumptions and judgments include estimating the expected option term, the expected stock price volatility and the risk-free interest rates. The assumptions used in our option pricing model represent management’s best estimates. If factors change and different assumptions are used, our equity-based compensation expense could be materially different in the future. We record forfeitures when they occur

We will continue to use judgment in evaluating the assumptions related to our equity-based awards on a prospective basis. As we continue to accumulate additional data related to our awards, we may refine our estimates, which could materially impact our future equity-based compensation expense.

Revenue Recognition

Our agreements with clients are primarily service contracts that range in duration from a few months to three years. We recognize revenue when control of these services is transferred to the client for an amount, referred to as the transaction price, which reflects the consideration to which we are expected to be entitled in exchange for those goods or services.

A contract with a client exists only when:

• the parties to the contract have approved it and are committed to perform their respective obligations;
• we can identify each party’s rights regarding the distinct services to be transferred (“performance obligations”);
• we can determine the transaction price for the services to be transferred; and
• the contract has commercial substance, and it is probable that we will collect the consideration to which it will be entitled in exchange for the goods or services that will be transferred to the client.

We do not adjust the promised amount of consideration for the effects of a significant financing component since we expect, at contract inception, that the period between the time of transfer of the promised goods or services to the client and the time the client pays for these goods or services to be generally one year or less. Our credit terms to clients generally average thirty days, although in some cases payments are required in 15 days.

See Note 3 to our consolidated financial statements for the years ended December 31, 2025 and 2024 included elsewhere in this Annual Report for additional information regarding revenue recognition and deferred revenue.

Off-Balance Sheet Arrangements

We have no off-balance sheet arrangements that have or are reasonably likely to have a material current or future effect on our financial condition, changes in financial condition, revenue or expenses, results of operations, liquidity, capital expenditures, or capital resources.

Evaluation of Disclosure Controls and Procedures

We maintain disclosure controls and procedures (as that term is defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act) that are designed to ensure that information required to be disclosed in our reports under the Exchange Act is recorded, processed, summarized, and reported within the time periods specified in the SEC’s rules and forms, and that such information is accumulated and communicated to our management, including Chief Executive Officer and Chief Financial Officer, as appropriate, to allow timely decisions regarding required disclosures. In designing disclosure controls and procedures, our management necessarily was required to apply its judgment in evaluating the cost-benefit relationship of possible disclosure controls and procedures. The design of any disclosure controls and procedures also is based in part upon certain assumptions about the likelihood of future events, and there can be no assurance that any design will succeed in achieving its stated goals under all potential future conditions. Any controls and procedures, no matter how well designed and operated, can provide only reasonable, not absolute, assurance of achieving the desired control objectives.

Our management, with the participation of our Chief Executive Officer and Chief Financial Officer, has evaluated the effectiveness of the design and operation of our disclosure controls and procedures as of the end of the period covered by this report. Based on this evaluation, our CEO and CFO concluded that, as of December 31, 2025, our disclosure controls and procedures are designed at a reasonable assurance level and are effective to provide reasonable assurance that information we are required to disclose in reports we file or submit under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms, and that such information is accumulated and communicated to our management, including our CEO and CFO, as appropriate, to allow timely decisions regarding required disclosure.

Limitations on Effectiveness of Controls and Procedures

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. In addition, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions or that the degree of compliance with the policies or procedures may deteriorate.

Changes in Internal Control Over Financial Reporting

There were no changes in our internal control over financial reporting during the year ended December 31, 2025 that materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

Management’s Report on Internal Control over Financial Reporting

Our management is responsible for establishing and maintaining adequate internal control over financial reporting based on the framework established in Internal Control—Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission. Our internal control over financial reporting is a process designed under the supervision of its principal executive and principal financial officers and effected by our Board of Directors, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of its consolidated financial statements for external reporting purposes in accordance with United States generally accepted accounting principles. Based on our assessment under this framework, our management concluded that our internal control over financial reporting was effective as of December 31, 2025.

Our independent registered public accounting firm will not be required to report on the effectiveness of our internal control over financial reporting pursuant to Section 404 until we are no longer an “emerging growth company” nor a non-accelerated filer.