Cycurion, Inc.: Form 10-K for the period ended Dec 31, 2024

General

Cycurion, Inc. (collectively with its subsidiaries, the “Company,” “Cycurion,” “we,” “us” or “our”) was originally incorporated as KAE Holdings, Inc., under the laws of the State of Delaware in October 2017, with the purpose of acquiring and holding operating entities in the cybersecurity industry. On July 14, 2020, we changed our corporate name from KAE Holdings, Inc. to Cyber Secure Solutions, Inc., and, on February 24, 2021, to Cycurion, Inc. On February 14, 2025, the date of closing of our de-SPAC transaction, we merged into Western Acquisition Ventures Corp. and changed that company’s name to Cycurion, Inc.

We have one first-tier wholly-owned subsidiary, Cycurion Sub, Inc. (formerly Cycurion, Inc., until February 14, 2025), and three indirectly wholly-owned second-tier subsidiaries: (i) Axxum Technologies LLC (“Axxum”), a Virginia limited liability company formed in December 2006, (ii) Cloudburst Security LLC (“Cloudburst”), a Virginia limited liability company formed in January 2007, and (iii) Cycurion Innovation, Inc., a Delaware corporation formed in September 2021, in connection with our acquisition of assets from Sabres Security Ltd. (“Sabres”), a leading Israeli-based cyber security provider.

Our Business

We provide innovative custom solutions for our clients by adapting our superior knowledge base and government-level experience to create dynamic solutions to best serve our client’s information technology (“IT”) and cybersecurity needs. We assess, secure and advise your organization by leveraging our government proven, cutting edge techniques, custom tools and extensively knowledgeable personnel to revolutionize the client’s cybersecurity posture.

We are committed to surpassing expectations and delivering incomparable value to our clients and partners. We achieve this goal by providing Network Communications and Information Technology Security services and solutions that are custom-tailored to your environment, as well as your level of need. We are built on a foundation of experts in Network Communications and Information Technology who possess unrivaled security expertise and experience. We are committed to hiring the most knowledgeable professionals in order to expand and reinforce our team of experts, leveraging world-class talent to improve and expand upon our already vast understanding of this environment. We pride ourselves on having the capability and resources to successfully implement a management strategy that delivers the solutions you need to stay within budget and on schedule.

We deliver high-quality, cybersecurity solutions to federal government civilian, defense and judicial agencies in addition to commercial clients across a variety of industries. We, through our operating subsidiaries and strategic partnerships, have numerous prime and subcontracts with key government agencies. Our growth engine is driven by organic business solutions and strategic acquisitions of cybersecurity services and technology providers. We leverage our highly skilled workforce to access, secure and advise our clients to improve their cyber security posture. Our ability to identify and implement customized solutions is core to driving continued growth.

Our Services

Consulting and Advisory Services

Our consulting services perform a detailed review of our customers’ IT security to identify and address vulnerabilities. Using advanced tools and research techniques, we enhance our customers’ cybersecurity program to meet regulatory compliance, data confidentiality and privacy standards, and train our customers’ personnel accordingly.

Our advisory services supplement our consulting services with a cost-effective alternative to a full-time chief information officer. Our customers gain access to our pool of experienced chief information officers, who are backed by our resources. They deliver tailored advice and training to keep our customers’ organization ahead in the ever-changing cybersecurity landscape.

Our consulting and advisory services include: (i) security control assessments; (ii) security architecture and engineering; (iii) risk management and compliance audits; (iv) staff augmentation; (v) cybersecurity awareness and training; (vi) cloud security; (vii) virtual CISO support; and (viii) digital modernization.

Managed IT Services

Our managed IT services can optimize an organization’s IT infrastructure, reduce costs and improve operational efficiency, and it offers comprehensive IT management and support for organizations of all sizes.

Managed IT services is a services model in which a managed service provider (“MSP”) remotely manages the day-to-day IT offerings for a client under a service level agreement (“SLA”). This includes remote monitoring and management of servers, disaster recovery, infrastructure as a service (“IaaS”), platform as a service (“PaaS”), and software as a service (“SaaS”). In short, managed IT services provides businesses with IT support and maintenance on an ongoing basis.

IT services are typically provided on a break-fix basis, meaning that the client only calls the provider when there is a problem with its IT infrastructure. Managed IT services, on the other hand, are provided on an ongoing basis under an SLA. This means that the MSP is responsible for the day-to-day maintenance of the client’s IT infrastructure and is always monitoring and managing the system to ensure it is running smoothly.

For example, a company that provides cloud services to businesses would offer managed platform services, remote monitoring and management of servers and security services. The MSP would handle the day-to-day maintenance of the client’s IT infrastructure and offers disaster recovery services in the event of a data breach or other catastrophe.

Our managed IT services include: (i) project and license management; (ii) network infrastructure; (iii) systems engineering and administration; (iv) voice and data infrastructure engineering and management; (iv) application development; (v) IT help desk support; and (vi) staff augmentation.

Managed Security Services

We are a professional and trusted provider of managed security services. Our comprehensive security management solution is designed to help organizations protect their digital assets against various cyber threats. Our managed security services include 24/7 monitoring, threat detection, incident response and remediation. Our Security Operations Center (SOC) as a service offers organizations with a team of security professionals dedicated to monitoring and managing their security infrastructure.

Managed security services (“MSS”) are a crucial component of a robust security program. Managed security service providers (“MSSPs”) specialize in protecting businesses from cyber threats and deliver a range of security services including, but not limited to, intrusion detection, vulnerability assessments and network security services.

MSSPs offer organizations access to a dedicated team of security professionals who use the latest security architectures and technologies to monitor their clients’ networks and systems, identify potential threats and respond promptly to security incidents. This is especially important for small to mid-sized businesses that may not have the in-house resources to maintain a robust security posture on their own.

MSS plays a critical role in safeguarding businesses from cyber threats in today’s digital landscape, making them an essential partner for organizations across industries. MSSPs work with clients ranging from small businesses to large enterprises and are often partnered with internet service providers to provide comprehensive security solutions.

Managed security services can also help organizations meet compliance requirements and reduce the risk of data breaches, which can be costly in terms of lost data, damaged reputation, and regulatory penalties. Additionally, MSSPs can provide SaaS solutions, allowing businesses to access security tools and services on-demand without having to invest in expensive hardware and software.

Our managed security services include: (i) managed detection and response; (ii) external attack surface management; (iii) threat hunting and threat intelligence; (iv) end point detection and response; (v) firewall management; (vi) threat and vulnerability management; (vii) vulnerability and penetration testing; (viii) 24/7/365 security monitoring; and (ix) digital forensic and incident response.

Our Industries

Enterprise Business

Enterprise level organizations face a litany of challenges when curating and implementing a successful IT environment. Challenges generally evolve from multiple points, such as finding experienced and deeply knowledgeable IT staff that is prepared for all security eventualities, to creating a comprehensive, functional, and compliant interface tends to create a high cost, knowledge deficient, and overwhelmed staff that often lacks in providing a positive ROI, and at times a cost-prohibitive scenario.

As digitization of operations becomes a necessity in the current environment, we plan to help our customers hire the right personnel and implement proper protocols in a time- and cost-efficient manner. We will take the responsibility from initial analysis to full spectrum implementation of our services, duly optimizing our customers’ organization and digital environment for the future.

We offer an evolutionary solution for this knowledge gap by providing deeply knowledgeable experts and highly trained analysts directly to our customers’ organization as a service. Our contract analysts provide more than just their individual expertise to solve specific challenges, but also will leverage Cycurion’s entire repository of collective knowledge, techniques and methodologies to our customers’ organization, at a cost below that of hiring an IT department, while providing highly efficient, multi-disciplined and deeply knowledgeable expert solutions to our customers.

Government

Government entities face a number of compliance and certification challenges. With constantly changing legislation, meeting government mandate and expectations in the IT environment is often a challenge. We leverage our historical knowledge and extensive experience on the federal level to continue to fulfill all of IT needs across the government organization.

Bad actors attack government agencies by targeted cyber threats, personnel exploitation and creative manipulation to gain access to critical systems and infrastructure through unperceived vulnerabilities. Public platforms, such as social media, surface, deep and dark web, present substantial risks through knowledge gaps in personnel training, presenting high risk and substantial possibility of security failure. We have been defending and optimizing these environments at the federal level for over a decade and, as a result, have created a robust and predictive methodology to defend and optimize government organizational and security gaps in order to mitigate these threats and vulnerabilities before they are compromised. We provide the knowledge, experience and analytical understanding of this environment to evolve our services to meet current and future needs across the IT spectrum.

Our extensive knowledge and real-world experience with government agencies allow us to understand the operational, security and overall IT needs and challenges that such agencies must overcome to achieve their mandate. We leverage our experience in this space allowing us to provide best-practice solutions throughout the IT environment.

Small and Medium Businesses

We offer IT solutions for small and medium businesses through different management plans by offering IT services and solutions with the same resources, concentrations and knowledge-based analytical methodology that are used for our enterprise and government clients. We provide roadmaps to successful integration, streamlining the businesses’ operation for maximum effectiveness by developing comprehensive IT solutions to navigate the modern cyber environment. We leverage our expertise and experience from our work in the federal environment, custom tailoring these solutions to your business, no matter the size, while focusing on our customers’ business needs and budget.

Healthcare

We understand that healthcare organizations must manage a vast array of rapidly evolving complexities. Our company will lead healthcare organizations through the demands of HIPAA / HITECH security and privacy compliance requirements. We offer healthcare IT services to augment and refine an organization through auditing and assessment of the organization, staff, applications, compliance, risk, vulnerability and infrastructure in order to improve the entity’s ability to better serve the healthcare needs of the organization’s clients.

We understand the key drivers of the healthcare market, and continually create focused, innovative and repeatable solutions. We provide technology services to improve service delivery with a focus on system integration, process reengineering, cloud/web / mobile development, solutions for coordinated community care and case management applications. We have extensive experience providing management consulting from strategic planning, IT assessment, project management, application rationalization, enterprise architecture, organizational change management and training.

Higher Education

We offer cybersecurity services and solutions for universities and high education and protect our customers’ systems, information and students from cyber threats and attacks. Our end-to-end managed cybersecurity solutions include: (i) IT and cybersecurity audit, consulting and advisory services; (ii) Security Operation Center (SOC) Network services; (iii) virtual chief information security officers; and (iv) cyber awareness and threat intelligence training services. We have over 150 years of experience on our management team and have served over 275,000 students.

Cycurion ARx Platform

The Cycurion ARx platform is a turnkey web application protection and managed security solution that combines the essential cybersecurity layers in a comprehensive, customizable platform. This platform offers: (i) Geo Gate Protection; (ii) DDoS Protection; (iii) WAF and API Protection; (iv) Endpoint Protection; and (v) Bot Hunter Protection.

• Geo Gate Protection. This reverse proxy server makes geographic restrictions easy, thus reducing unwanted traffic.
• DDoS Protection. This distributed denial-of-service (“DDOC”) protection mitigates the threat from malicious actors attempting to flood the entry point of an application.
• WAF and API Protection. Web Application Firewall (“WAF”) protection inspects requests in real-time and filters out harmful traffic, while application programing interfaces (“API”) protection is a defense mechanism involving a two-step process of authenticating the data sender and inspecting the data to ensure no malicious data injections have occurred.
• Endpoint Protection. This countermeasure ensures that devices follow compliance and security policies, preventing intrusion from particular vectors.
• Bot Hunter. Our proprietary algorithm provides detection and protection against non-human activity. This can prevent low-level threats like unwanted scraping, and high-level threats like attempted system breaches.

Key Performance Indicators

Our Subsidiaries

Cycurion Sub, Inc.

Our operating subsidiaries are wholly owned by Cycurion Sub., Inc., a Delaware corporation that, until the closing date of the de-SPAC, was known as “Cycurion, Inc.” We continue to conduct our business through the three below-described entities, which are now indirectly wholly-owned second-tier subsidiaries by virtue of the recent closing of the de-SPAC transaction.

Axxum Technologies LLC

Organized in the Commonwealth of Virginia on December 29, 2006, Axxum is a cybersecurity provider with successful assignments within the multiple sub-agencies of the Department of Homeland Security. We acquired Axxum in November 2017. Following our acquisition, we continued Axxum’s core operations of providing contractor services to its existing federal government customer base, while leveraging our existing processes and tools to expand its commercial footprint.

Axxum has the specialized skills and experience to provide a strategy and tactics to help organizations defend against cyber-attacks and implement a secure network infrastructure. Our team has extensive experience implementing cybersecurity solutions against internal and external threats to the health of our clients’ networks. Axxum’s information security focus produces several key benefits:

• Agile Client Focus: Axxum’s projects are overseen directly by its program managers, all of whom have information security backgrounds and are fully authorized to promptly implement client requirements throughout the performance life cycle.
• Streamlined and Process Focused: Axxum’s streamlined infrastructure leverages ISO quality standards integrated with emerging and established technologies, allowing it to engineer innovative solutions without building in excessive overhead.
• Outstanding Personnel: Axxum has a reputation of employing cybersecurity experts.

7

Cloudburst Security LLC

Organized in the Commonwealth of Virginia on January 12, 2007, Cloudburst specializes in providing a full spectrum of high-quality, innovative cybersecurity services to both government and commercial organizations, such as banking and financial; education and schools; energy; critical infrastructure and supervisory control and data acquisition; healthcare; and manufacturing. Cloudburst’s mission is to help our clients — of all sizes and mission types — protect their integral data and information assets, so that they can focus on their core competencies.

We focus on providing tailored solutions that leverage the industry’s best minds and technologies to predict, protect, detect, respond, and sustain our clients from the latest evolving cyber threats. We acquired Cloudburst in April 2019.

Cycurion Innovation, Inc.

Our Cycurion Security Platform’s line of products allows our customers to improve their cyber posture with its Multi-Dimensional Protection (“MDP”) SaaS platform. This platform efficiently bundles and easily implements the external protection of a Web Application Firewall (WAF) and the internal protection of Bot Mitigation. Bot Mitigation is the reduction of risk to applications, Application Program Interfaces (APIs), and backend services from malicious bot traffic that fuels common automated attacks, such as Distributed Denial of Service (DDoS) campaigns and vulnerability probing. The costs of single-layer security can be measured in terms of money, time, and risk, as well as the damage wrought by a data breach, which millions of businesses experience each year. Through this interaction of the WAF and Bot Mitigation, the MDP is able to reinforce these layers of security and generate new security layers in real time in response to emerging threats. This process is directed by our Cycurion Security Platform’s proprietary, cloud-based artificial intelligence (“AI”) algorithm. Crucially, the AI underpinning the MDP platform is constantly evolving to counter new threats. Through a crowdsourcing process, the cloud-based MDP learns from every threat to any protected application and uses that newly acquired knowledge to protect all MDP clients better.

Our Subcontractor Relationship

SLG Innovation, Inc.

We are currently a subcontractor for several keystone contracts held by SLG Innovation, Inc. (“SLG”). The SLG team has an average of over 25 years of experience in the development, planning, implementation, and management of information systems. SLG’s leadership team offers years of combined success in answering the needs of government agencies and healthcare organizations across the country.

The SLG team has worked nationally, as it has served over 25 Department of Health and Human Services agencies, all 50 state governments and over 250 local governments. Since SLG’s inception, it has primarily focused on customers in the middle of the country. The team of professionals has successfully delivered Information Technology, Project Management, and Subject Matter Services to key health and human service projects, including, but not limited to, state Medicaid programs in Illinois, Indiana, Nebraska, and Tennessee, the Indiana Division of Aging, Illinois Early Intervention, University of Illinois Division of Specialized Care for Children, the Multiple Myeloma Research Foundation, and many more.

We established a subcontractor — prime contractor relationship with SLG in fall 2019, where we serviced several government agencies and commercial customers, State of New Mexico, Cognizant, KPMG, and University of Illinois in support of SLG.

Our Acquisitions

SLG Acquisition Agreement

On April 25, 2023, Cycurion Sub executed a Term Sheet with SLG (the “SLG Term Sheet”), pursuant to which SLG Innovation Inc., an Illinois corporation formed in January 2010 (“SLG”), agreed to be acquired by Cycurion Sub. The Term Sheet contained all of the material terms and conditions of two proposed interrelated transactions to be memorialized by an acquisition agreement (the “SLG Acquisition Agreement”). To effectuate the two transactions contemplated by the SLG Term Sheet, Cycurion Sub will form two subsidiaries, which, upon formation, will initially be wholly owned by Cycurion Sub. If, when, and as the transactions contemplated by the SLG Term Sheet are consummated, SLG would merge with and into one of the subsidiaries and survive, thereby becoming a wholly-owned subsidiary of Cycurion Sub. Because certain of the agreements to which SLG is the prime contractor require that the majority owner of the prime contractor be a resident of the City of Chicago or of Cook County (depending on the contract), contemporaneously with the consummation of the first of the two transactions, (i) SLG will divest itself of those agreements with the residency requirements, (ii) the second newly formed subsidiary will assume those agreements, (iii) Mr. Ed Burns will become the owner of a 51% interest in that newly formed subsidiary, and (iv) we will enter into a Management Agreement with that subsidiary (see below for a discussion of the SLG Management Agreement), the economic terms and management / control terms of which are intended to be the equivalent of complete ownership of the 49% owned subsidiary. Mr. Ed Burns is currently the 51% owner of SLG and a resident of the City of Chicago. The SLG Term Sheet provides that, if, when, and as the transactions contemplated thereby are consummated, the two current owners of SLG will be issued shares of our common stock. SLG is fully bound by the terms and provisions of the SLG Term Sheet and the related Management Agreement structure, although Cycurion Sub is permitted to terminate the SLG Term Sheet and to abandon the transactions contemplated thereby any time for any reason or for no reason prior to April 11, 2025, with no further obligations on Cycurion Sub’s part. As of the date of this Annual Report, although we reserve the right to modify the terms and provisions of the SLG Acquisition Agreement, we do not currently expect to terminate it and currently expect to close the transactions contemplated during our current fiscal quarter. Substantially all of the agreements to which SLG is a party have a provision that provides the counterparty to such agreement with a right to approve an assignment or change in control of SLG prior to its effectiveness. If an approval is not forthcoming, then the provisions of the SLG Acquisition Agreement permit us to excise that specific agreement. Upon such occurrence, we reserve that right to reduce the consideration that we would otherwise tender to the equity owners of SLG.

As amended by the parties, initially effective as of November 29, 2023, and subsequently effective as of April 29, 2024, August 16, 2024, and December 31, 2024, the SLG Term Sheet expires on the soonest of (i) closing of the transactions contemplated thereby, (ii) April 11, 2025, if the transactions contemplated thereby have not closed by then, (iii) Cycurion Sub’s termination thereof, and (iv) the mutual termination by all of the parties thereto. Notwithstanding anything to the contrary contained therein, Cycurion Sub may terminate its obligations under the SLG Term Sheet and the transactions contemplated hereby for any reason or for no reason without any further obligations and without any liability at any time through and including April 11, 2025. The SLG Term Sheet, as amended, consensually superseded, as noted therein, Cycurion Sub’s previous “unidirectional” agreement with SLG.

As of March 31, 2025, and in connection with the economic outcome contemplated by the SLG Term Sheet, we entered into a Management Services Agreement (the “SLG Management Agreement”) with SLG to ensure SLG’s continuing commercial viability, which, indirectly, assists the commercial viability of Cycurion Sub and us. To validate and enhance the business relationship with SLG, the parties agreed that Cycurion Sub and we shall, even more formally than historically, manage and control all of SLG’s operations from and after such date. Accordingly, Cycurion and we shall provide management, financing, administrative, and other services to SLG (as described in more detail on Schedule A of the SLG Management Agreement) in exchange for the fees and/or other consideration set forth on Schedule B of the SLG Management Agreement. The relationship, as so memorialized, results in the relationship between the parties from and after such date (if not prior thereto) results in SLG being deemed to be a “Variable Interest Entity” of Cycurion (as such relationship is defined by the Financial Accounting Standards Board), which will result in SLG’s financial statements being consolidated with and into our financial statements.

Our entry into the SLG Management Agreement may accomplish substantially all of SLG’s and our business objectives and may potentially minimize certain of the risks referenced in the section entitled “Risk Factors – Risks Related to the SLG Assignment Agreement”. Accordingly, one or more of the parties to the SLG Term Sheet may postpone the execution or delivery of the SLG Acquisition Agreement and the consummation of certain of the transactions specifically contemplated thereby (as also set forth in the SLG Term Sheet), contingent, in part, on the potential agreements of the equity owners of SLG. Nevertheless, we currently believe that the current draft of the SLG Acquisition Agreement may be executed and delivered by the parties thereto in the first half of our current fiscal year.

The foregoing brief summary description of certain terms and provisions of (i) the SLG Term Sheet does not purport to be complete and is qualified in its entirety by reference to the full text of the SLG Term Sheet, a copy of which is attached to this Annual Report as Exhibit 10.12, (ii) the SLG Term Sheet Amendments, a copy of each of which is attached to this Annual Report as Exhibit 10.12a, Exhibit 10.12b, Exhibit 10.12c, and Exhibit 10.12d, and (iii) the SLG Management Agreement does not purport to be complete and is qualified in its entirety by reference to the full text of the SLG Term Sheet, a copy of which is attached to this Annual Report as Exhibit 10.12e. Readers are encouraged to read those Exhibits in full for a more comprehensive understanding of the transaction contemplated by the SLG Term Sheet.

RCR Acquisition Agreement

RCR Technology Corporation (“RCR”) performs certain services for SLG in its role as an SLG subcontractor and, in that context, became a creditor of SLG. In connection with the transactions contemplated by the SLG Term Sheet, on April 25, 2023, Cycurion Sub and RCR also entered into a term sheet (the “RCR Term Sheet”) for a distinct, but related transaction. The RCR Term Sheet contemplates a transaction, pursuant to which RCR will sell to Cycurion all of the accounts receivable of SLG in favor of RCR (but for those accounts that are less than 90 days old as of the date of consummation of the contemplated transaction). The consummation of the transactions contemplated by the RCR Term Sheet is contingent upon the consummation of the transactions contemplated by the SLG Term Sheet. Nevertheless, as a result of our entry into the SLG Management Agreement with SLG, we still currently intend to consummate the transactions contemplated by the RCR Term Sheet in the first half of our current fiscal year. The RCR Term Sheet provides that, if, when, and as the transactions contemplated thereby are consummated, RCR will be issued shares of our common stock.

Further, as amended by the parties, initially effective as of November 29, 2023, and subsequently effective as of April 29, 2024, August 16, 2024, and December 31, 2024, the RCR Term Sheet expires on the soonest of (i) closing of the transactions contemplated thereby, (ii) April 11, 2025, if the transactions contemplated thereby have not closed by then, (iii) Cycurion’s termination thereof, and (iv) the mutual termination by all of the parties thereto. Notwithstanding anything to the contrary contained therein, Cycurion may terminate its obligations under the RCR Term Sheet and the transactions contemplated hereby for any reason or for no reason without any further obligations and without any liability at any time through and including April 11, 2025. As of the date of this Annual Report, we do not currently expect to terminate the transactions contemplated by the RCR Term Sheet, as amended, and currently expect to close the transactions in the first half of our current fiscal year.

The foregoing brief summary description of certain terms and provisions of the RCR Term Sheet does not purport to be complete and is qualified in its entirety by reference to the full text of the RCR Term Sheet, a copy of which is attached to this Annual Report as Exhibit 10.13 and the full text of the RCR Term Sheet Amendments, a copy of each of which are attached to this Annual Report as Exhibit 10.13a, 10.13b and 10.13c. Readers are encouraged to read those Exhibits in full for a more comprehensive understanding of the transaction contemplated by the RCR Term Sheet.

Acquisition of Technology

On August 17, 2021, we entered into an asset purchase agreement to acquire certain technology assets of Sabres, a leading Israeli-based cyber security provider. As part of the asset purchase agreement, we acquired Multi-Dimensional Protection, Web Application Firewall and Bot Mitigation SaaS platforms, and their associated intellectual property. The transaction closed on September 30, 2021, and we have integrated the SaaS platforms into our existing services offerings.

Our Cycurion Security Platform’s (formerly Sabres’) line of products allows our customers to improve their cyber posture with its MDP SaaS platform. This platform efficiently bundles and easily implements the external protection of a Web Application Firewall (WAF) and the internal protection of Bot Mitigation. Bot Mitigation is the reduction of risk to applications, Application Program Interfaces (APIs), and backend services from malicious bot traffic that fuels common automated attacks, such as Distributed Denial of Service (DDoS) campaigns and vulnerability probing. The costs of single-layer security can be measured in terms of money, time, and risk, as well as the damage wrought by a data breach, which millions of businesses experience each year. Through this interaction of the WAF and Bot Mitigation, the MDP is able to reinforce these layers of security and generate new security layers in real time in response to emerging threats. This process is directed by our Cycurion Security Platform’s (formerly Sabres’) proprietary, cloud-based AI algorithm. We do not have AI processing in the production version of the software. That version is in the testing and evaluation phase. We expect to move the production in quarter three of 2024. Through a crowdsourcing process, the cloud-based MDP learns from every threat to any protected application and uses that newly acquired knowledge to protect all MDP clients better.

Our Cycurion Security Platform’s (formerly Sabres’) line of products provides solutions for substantially all web application security needs. These products provide solutions, whether a client is in need of a web application firewall to comply with regulations and ensure it has a first line of defense against the hazards that the internet can present or is in need of enterprise-level products that empower Security Operations Center (SOC) teams and security management. Our Cycurion Security Platform’s constantly survey a client’s data to detect security issues in need of attention, send automatic updates, and provide the client with a complete database of rules and threats.

9

We have integrated the technology assets that we acquired from Sabres (which now constitutes our Cycurion Security Platform) into our Managed Security Services Practice. We believe that the platform will enhance our service offerings and assist with the expansion of our commercial business. The Sabres platform will be managed by our dedicated support team, and will provide real time reporting, response to security incidents, and will manage all data privacy needs from a single SIEM SaaS platform dashboard.

Our Growth Strategy

Our objectives are to expand our market leadership and management and to capture large market opportunities in cloud, AI and IT. We intend to accomplish these objectives by:

• Continuing to acquire to platforms. We believe there is substantial opportunity to increase our platforms and have experienced growth due to expanded product capabilities and investments. We intend to continue to pursue new customers by adding capacity and leveraging our partnerships in the domestic and international markets.
• Expanding platform coverage with our customers. We believe there is opportunity to develop and expand our relationships with existing customers by targeting additional platforms and geographies, pursuing platform expansions and expanding our coverage.
• Investing in new technology platforms. We plan to continue to develop and broaden our exposure and security solutions, including expanding our coverage, by entering into new contracts focused on program management, cybersecurity, disaster recovery and business continuity. For more information, please see “Item 1. Business – Our Acquisitions.”
• Exploring acquisition opportunities. We intend to acquire other businesses, technology, AI platforms and/or development personnel to enhance the functionality of our platforms. For more information, please see “Item 1. Business – Our Acquisitions.”

Competitors

The IT and cybersecurity solutions market is fragmented, competitive and always evolving. We compete with a range of established and emerging cybersecurity software and services vendors, as well as organizations that choose to build their own solutions in-house. With new technologies and market entrants, we expect the competitive environment to remain intense going forward.

Our competitors include:

• vulnerability management and assessment vendors;
• diversified security software and services vendors;
• endpoint security vendors with vulnerability assessment capabilities;
• public cloud vendors and other companies that offer solutions for cloud security; and
• providers of point solutions that compete with some of the features present in our solutions.

The key competitive factors in our markets include:

• ability to prepare for, detect and mitigate cybersecurity threats;
• ability to respond to customer needs quickly;
• ability for products to facilitate customer needs;
• total cost and ease-of-use of our products;
• brand awareness and reputation; and
• ability to attract and retain employees.

We believe that the principal competitive factors affecting the market for cybersecurity solutions include product functionality, depth of platform offerings, flexibility of delivery models, ease of deployment and use, integration capabilities such as open APIs and scalability, uptime and performance. Some of our competitors are more established and have greater name recognition, longer operating histories, more established customer relationships, larger marketing budgets and significantly greater resources than we do.

Customers

We have over 41 customers across a variety of industries, including enterprise businesses, small and medium businesses, government agencies, healthcare and higher education. Our customers include, but are not limited to, AT&T, Smithsonian Museum, FEMA and Peraton. During the years ended December 31, 2024 and 2023, purchases from our ten largest end-customers accounted for approximately 93% and 88% of our total revenue, respectively.

Backlog

We define backlog as contractually committed orders to be invoiced under our existing agreements that are not included in deferred revenue on our consolidated balance sheets. We expect the amount of backlog to change from period to period due to the timing of billings for our solutions and professional services. At December 31, 2024 and 2023, we had committed backlog of $16 million and $15 million, respectively. We expect the majority of the backlog at December 31, 2024 to be invoiced within the following 12 months.

Government Regulation

Our business and operations are subject to extensive federal and state governmental regulation and supervision. The following is a brief summary of certain statutes and rules and regulations that affect or may affect us. This summary is not intended to be an exhaustive description of the statutes or regulations applicable to our business.

In the ordinary course of our business, we process personal information. Accordingly, we are, or may become, subject to numerous data privacy and security obligations, including federal, state, local, and foreign laws, regulations, guidance, and industry standards related to data privacy and security. Such obligations may include, without limitation, the Federal Trade Commission Act, the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020, or, collectively, the CCPA, the Colorado Privacy Act, Virginia’s Consumer Data Protection Act, the Connecticut Privacy Act, the Utah Consumer Privacy Act and similar U.S. state comprehensive privacy laws, the European Union’s General Data Protection Regulation 2016/679, or EU GDPR, the EU GDPR as it forms part of the United Kingdom law by virtue of section 3 of the European Union (Withdrawal) Act of 2018, or UK GDPR, and the ePrivacy Directive.

Human Capital

As of the date of this Annual Report, we have 46 full-time employees and 0 part-time employees. None of our U.S. employees are represented by a labor union or covered by a collective bargaining agreement. Our senior leadership team has extensive experience with business process management, and while we have grown through a number of acquisitions, we have retained an experienced and cohesive leadership team.

Our key human capital objectives are to attract, retain, engage, reward and develop our highly talented existing and future employees, while cultivating an inclusive workforce and culture to achieve exceptional business results. We are committed to fostering a community of talented individuals from all backgrounds and perspectives by implementing the following.

• Compensation and benefits. We continually work to provide a competitive compensation and benefits program as this plays a key role in our ability to attract and retain a highly skilled workforce. In addition to salaries, these programs, which vary by country/region, include long-term equity incentive awards with certain vesting requirements, deferred compensation plans (which are offered to certain members of executive management), a 401(k) plan, healthcare and insurance benefits, health savings and flexible spending accounts, paid time off, paid volunteer time off, employee assistance program and tuition assistance.
• Health, safety and wellness. The well-being of our employees is paramount to the continued success of our business. To this end, we are committed to each of our employees’ health, safety and wellness. We provide our employees with access to various health and wellness benefits designed to enable them and their family members to have affordable access to health, dental and vision insurance.
• Talent development. We invest significant resources to develop the talent needed to remain a market-leading global supplier of broadband infrastructure. We offer numerous training opportunities on both technical and professional development topics.
• Diversity and inclusion. We believe that maintaining a diverse and inclusive workforce is important to the success of our business. We encourage an environment where individuality is embraced regardless of age, gender, identity, race, sexual orientation, physical or mental ability, ethnicity and perspective and where each employee is accepted.

Research and Development

Rapidly changing technologies, evolving industry standards, changing customer requirements, supply constraints and continuing developments in communications service offerings characterize the markets for our products. Our on-going ability to adapt to these changes and to develop new and enhanced products that meet or anticipate market demand is the main factor influencing our competitive position and our ability to grow.

We continue to invest substantial resources in research and development to enhance our platform offerings by developing new features, functionality, and applications. Our engineering expertise combines extensive security product development experience with individuals who possess deep cloud and user interface design backgrounds.

Our team is staffed by cybersecurity, cloud and data science experts who deliver exposure management intelligence, data science insights, alerts and security advisories. Our team has developed research tools to help improve efficiency and effectiveness in processes such as reverse engineering, code debugging, web app security and visibility into cloud-based tools.

Intellectual Property

Not applicable.

Recent Developments

On January 15, 2025, Cycurion issued a $50,000 promissory note to an unaffiliated investor for $50,000 in proceeds.

On January 21, 2025, Cycurion issued a $75,000 promissory note to an unaffiliated investor for $75,000 in proceeds.

On January 25, 2025, Cycurion issued a $50,000 promissory note to an unaffiliated investor for $50,000 in proceeds.

On January 31, 2025, Cycurion issued a $125,000 promissory note to a related party for 125,000 in proceeds.

On January 24, 2025, Western Acquisition Ventures Corp., a Delaware Corporation (“Western”), held the Special Meeting, at which the Western stockholders considered and adopted, among other matters, a proposal to approve a business combination (“Business Combination”) pursuant to the terms of that certain Agreement and Plan of Merger, dated April 26, 2024, as amended on December 31, 2024 and February 13, 2025 (the “Merger Agreement”), by and among Western, WAV Merger Sub, Inc., a Delaware corporation and a wholly-owned subsidiary of Western (“Merger Sub”), and Cycurion Sub, Inc., a Delaware corporation (“Cycurion Sub”).

On February 14, 2025, the Business Combination closed, and, as contemplated by the Merger Agreement, Merger Sub merged with and into Cycurion Sub with Cycurion Sub surviving the merger as a wholly-owned subsidiary of Western. In addition, in connection with the consummation of the Business Combination, Western Acquisition Ventures Corp. was renamed “Cycurion, Inc.”

On February 18, 2025, Cycurion’s common stock began trading on The Nasdaq Global Market and warrants began trading on The Nasdaq Capital Market under the symbols “CYCU” and “CYCUW”, respectively.

On February 19, 2025, Cycurion announced an agreement with iQSTEL, a multinational innovator in telecommunications, FinTech, electric vehicles and AI-driven solutions.

On February 24, 2025, Cycurion announced an expansion of its partnership with a major health association, bringing its MSSP to several thousand member organizations across the country.

On March 3, 2025, Cycurion announced the availability of its ARx Platform targeted for the corporate sector.

On March 5, 2025, Cycurion announced the award of three new multi-year contracts focused on program management, cybersecurity and disaster and business continuity. These engagements are secured with two government clients and one commercial client.

On March 6, 2025, Cycurion announced a nationwide expansion of its strategic partnership with CentralSquare Technologies, LLC to deliver its IT services across the country.

On April 7, 2025, Cycurion entered into an equity purchase agreement with Yield Point NY LLC whereby the Company has the right, but not the obligation, to direct the investor to purchase up to $60,000,000.

On April 8, 2025, Cycurion announced an expanded partnership with Journal Technologies. Together, the companies have been awarded a $22 million multi-year contract to deliver a criminal justice case management system to a state police agency.

On April 9, 2025, Cycurion increased the size of its board of directors through the appointment of Irving Minnaker.

On April 9, 2025, Cycurion received written notice received from the Listing Qualifications Department of Nasdaq stating that, for the prior 30 consecutive business days, the closing bid price of our common stock had been below the minimum of $1.00 per share required for continued listing on The Nasdaq Capital Market under Nasdaq Listing Rule 5550(a)(2). The notification letter stated that we would be afforded 180 calendar days (until October 6, 2025) to regain compliance. In order to regain compliance, the closing bid price of our common stock must be at least $1.00 for a minimum of ten consecutive business days. The notification letter also stated that, in the event that we do not regain compliance within the initial 180-day period, we may be eligible for an additional 180-day period. If we are not eligible for the additional 180-day period, or if it appears to the Nasdaq staff that we will not be able to cure the deficiency, the Nasdaq Listing Qualifications Department will provide notice after the end of the initial 180-day period that our securities will be subject to delisting. Failure to regain compliance within that 180-day period would result in the delisting of our securities from Nasdaq, although we would have the right to appeal such a delisting to a Nasdaq hearings panel. The Nasdaq notification has no effect at this time on the listing of our common stock.

On April 11, 2025, we received two letters from the Nasdaq Listing Qualifications Department, each addressing a separate compliance deficiency of ours under the Nasdaq Listing Rules. The first letter notified us of our deficiency with regard to Nasdaq Listing Rule 5450(b)(2)(A), which requires a company such as ours, whose securities are listed on The Nasdaq Global Market under the “Market Value Standard”, to maintain a minimum Market Value of Listed Securities (an “MVLS”) of $50,000,000. The deficiency was caused by our MVLS having been below the minimum level for the prior 30 consecutive business days. Under Nasdaq Listing Rule 5810(c)(3)(C), we are entitled to a 180-day period, ending on October 8, 2025, to rectify the deficiency. In order to do so, we must achieve and maintain an MVLS of at least $50,000,000 or more for a minimum of 10 consecutive business days. Failure to regain compliance within that 180-day period would result in the delisting of our securities from Nasdaq, although we would have the right to appeal such a delisting to a Nasdaq hearings panel. The Nasdaq notification has no effect at this time on the listing of our common stock.

The second letter notified us of our deficiency with regard to Nasdaq Listing Rule 5450(b)(2)(C), which requires a minimum Market Value of Publicly Held Shares (an “MVPHS”) of $15,000,000 for continued listing on the Nasdaq Global Market under the “Market Value Standard”. This deficiency was caused by our MVPHS having been below the minimum level for the prior 30 consecutive business days. Under Nasdaq Listing Rule 5810(c)(3)(D), we have 180 calendar days, or until October 8, 2025, to regain compliance, which we can achieve if our MVPHS is at least $15,000,000 for a minimum of 10 consecutive business days. Failure to regain compliance within that 180-day period would result in the delisting of our securities from Nasdaq, although we would have the right to appeal such a delisting to a Nasdaq hearings panel. The Nasdaq notification has no effect at this time on the listing of our common stock.

For more information, please see “Note 19. Subsequent Events.”

Corporate Information

Our principal executive office is located at 1640 Boro Place, Fourth Floor, McLean, Virginia 22102, and our telephone number is (703) 854-1652. Our website address is www.cycurion.com (http://www.cycurion.com). Axxum’s website address is www.axxumtech.com (http://www.axxumtech.com). Cloudburst’s website address is www.cloudburstsecurity.com (http://www.cloudburstsecurity.com). The SEC maintains an internet site that contains reports, proxy and information statements and other information regarding issuers that file electronically with the SEC at www.sec.gov (http://www.sec.gov). The information contained on the websites referenced in this Annual Report is not incorporated by reference into this filing.

You should carefully consider the risks described below with respect to an investment in our shares. If any of the following risks actually occur, our business, financial condition, operating results or cash provided by operations could be materially harmed. As a result, the trading price of our common stock could decline, and you might lose all or part of your investment. When evaluating an investment in our common stock, you should also refer to the other information in this Annual Report, including our consolidated financial statements and related notes.

Risks Related to Our Business Generally

Cycurion has a limited operating history upon which you can evaluate our future business and prospects.

Cycurion has a limited operating history. It was incorporated in 2017. Since its incorporation, Cycurion has acquired two operating subsidiaries: Axxum in 2017 and Cloudburst in 2019. It also acquired certain technology assets of Sabres in September 2021. Accordingly, Cycurion and its subsidiaries have varying operating histories and, together as a consolidated company, has a limited operating history, which can make it difficult for investors to evaluate Cycurion’s operations and prospects and may increase the risks associated with an investment. There can be no assurance that Cycurion’s business plan can be realized in the manner contemplated, that it will ever realize any significant operating revenues, or that its operations will ever be profitable and, therefore, its stockholders may lose all or a substantial part of their investment.

Cycurion has incurred net losses and cannot assure you that it will achieve or maintain profitable operations.

Cycurion’s net income was $1,229,601 for the year ended December 31, 2024 and net loss was $(2,097,013) December 31, 2023. Cycurion may continue to incur significant losses in the future for a number of reasons, including unforeseen expenses, difficulties, complications, and delays and other unknown events.

Cycurion intends to increase its brand awareness, expand the customer base, and expect to continue to invest heavily in its businesses in the foreseeable future as management continues to attempt to expand and grow the core businesses. In addition, Cycurion’s net revenues could be impacted by various factors, including the competitive landscape, customer preferences, and the success of our service offerings.

Accordingly, management cannot assure you that Cycurion will achieve sustainable operating profits as it continues to attempt to expand its product and professional service offerings and otherwise implement its growth initiatives. Any failure to achieve and maintain profitability would have a materially adverse effect on Cycurion’s ability to implement its business plan, its results and operations, and its financial condition, and could cause the value of its common stock to decline, resulting in a significant or complete loss of your investment.

Cycurion’s level of indebtedness and debt service obligations could adversely affect its financial condition and make it more difficult for management to fund its operations.

As of December 31, 2024, Cycurion had approximately $20.2 million of indebtedness and other liabilities outstanding.

• It will need to use a substantial portion of available cash flow to pay interest and principal on existing debt, which will reduce the amount of money available to finance its operations and other business activities;
• its debt level increases its vulnerability to general economic downturns and adverse industry conditions;
• its debt level could limit its flexibility in planning for, or reacting to, changes in its business and in its industry in general;
• its leverage could place Cycurion at a competitive disadvantage compared to its competitors that have less debt; and
• its failure to comply with the financial and other restrictive covenants in our debt instruments which, among other things, may require us to maintain specified financial ratios and will limit its ability to incur debt and sell assets, could result in an event of default that, if not cured or waived, could have a material adverse effect on its business or prospects.

Despite the existing level of indebtedness, Cycurion and its subsidiaries may incur additional indebtedness, which could further exacerbate the risks described above.

Cycurion’s recurring losses, net working capital, and accumulated deficit resulting from substantial operating losses have raised substantial doubt regarding its ability to continue as a going concern.

Cycurion had a net working capital deficit of $7.8 million and an accumulated deficit of $3.2 million resulting from net income incurred during the year ended December 31, 2024 and from substantial losses during prior periods. In addition, it had a net cash outflow of $2.0 million from operating activities during the year ended December 31, 2023 and $1.4 million during the year ended December 31, 2024, all of which raise substantial doubt about its ability to continue as a going concern. Although Cycurion was nominally profitable during the 2024 fiscal year, there is no assurance that it will not continue to generate operating losses and consume significant cash resources for the foreseeable future. Without additional financing, these conditions raise substantial doubt about Cycurion’s ability to continue as a going concern, meaning that it may be unable to continue operations for the foreseeable future or realize assets and discharge liabilities in the ordinary course of operations. If Cycurion seeks additional financing to fund its business and potential acquisition activities in the future and there remains doubt about its ability to continue as a going concern, investors or other financing sources may be unwilling to provide additional funding on commercially reasonable terms or at all. If Cycurion is unable to obtain sufficient funding, its business, prospects, financial condition, and results of operations will be materially and adversely affected, and it may be unable to continue as a going concern. If it is unable to continue as a going concern, it may have to liquidate its assets and may receive less than the value at which those assets are carried on its financial statements; accordingly, it is likely that stockholders will lose all or a part of their investment.

We will require substantial additional funding in the future, which may not be available to us on acceptable terms, or at all, and, if not so available, may require us to delay, limit, reduce, or cease our operations.

Our operations have consumed substantial amounts of cash since our inception. As of December 31, 2024, we had an accumulated deficit of $3.2 million. We expect to continue to incur significant expenses and increasing operating losses for the foreseeable future. Our business will require substantial additional capital for implementation of our long-term business plan and development of cybersecurity technology. Our ability to raise additional funds may be adversely impacted by potential worsening global economic conditions and the recent disruptions to, and volatility in, the credit and financial markets in the U.S. As we require additional funds, we may seek to fund our operations through the sale of additional equity securities, debt financing, and/or strategic collaboration agreements. We cannot be sure that additional financing from any of these sources will be available when needed or that, if available, the additional financing will be obtained on favorable terms.

If we raise additional funds by selling shares of our common stock or other equity-linked securities, the ownership interest of our current stockholders will be diluted. We may seek to access the public or private capital markets whenever conditions are favorable, even if we do not have an immediate need for additional capital at that time. If we raise additional funds through collaborations, strategic alliances or marketing, distribution, or licensing arrangements with third parties, we may have to relinquish valuable rights to our technologies, future revenue streams, or assets or to grant licenses on terms that may not be acceptable to us. If we raise additional funds through debt financing, we may have to grant a security interest on our assets to the future lenders, our debt service costs may be substantial, and the lenders may have a preferential position in connection with any future bankruptcy or liquidation involving the Company.

We may issue additional shares of common stock or preferred stock under an employee incentive plan, which would dilute the interest of our stockholders.

We may issue a substantial number of additional shares of common or preferred stock under an employee incentive plan. The issuance of additional shares of common or preferred stock:

• may significantly dilute the equity interest of investors;
• may subordinate the rights of holders of common stock if preferred stock is issued with rights senior to those afforded our common stock;
• could cause a change of control if a substantial number of shares of our common stock are issued, which may affect, among other things, our ability to use our net operating loss carry forwards, if any, and could result in the resignation or removal of our present officers and directors; and
• may adversely affect prevailing market prices for the common stock.

Cycurion’s ability to grow and compete in the future will be adversely affected if adequate capital is not available to it or not available on favorable terms.

Cycurion has limited capital resources. To date, it has financed its operations through a mix of equity investments by unaffiliated third parties and bank debt financing and, except in connection with this Offering, it expects to continue to do so in the foreseeable future. Cycurion’s ability to continue its normal and planned operations, to grow its business, and to compete in the cybersecurity industry will depend on the availability of adequate capital.

Management cannot assure you that Cycurion will be able to obtain additional financing from those or other sources when or in the amounts needed, on acceptable terms, or at all. If it raises capital through the sale of equity, or securities convertible into equity, that would result in dilution to its then-existing stockholders, which could be significant depending on the price at which it may be able to sell its securities. If Cycurion raises additional capital through the incurrence of additional indebtedness, it would likely become subject to further covenants restricting its business activities, and holders of debt instruments would have rights and privileges senior to those of its then-existing stockholders. In addition, servicing the interest and principal repayment obligations under debt facilities could divert funds that would otherwise be available to support development of new programs and marketing to current and potential new clients. If Cycurion is unable to raise capital when needed or on acceptable terms, it could be forced to delay, reduce, or eliminate certain products or professional service offerings or future marketing efforts, or reduce or discontinue its operations. Any of these events could significantly harm Cycurion’s business, financial condition, and prospects and could cause the value of its common stock to decline, resulting in a significant or complete loss of your investment.

If Cycurion does not continue to innovate and offer solutions and professional services that address the dynamic threat landscape, it may not remain competitive and its revenue and operating results could suffer.

Cycurion’s success will depend, in part, on its ability to develop and implement innovative customer solutions and professional services that anticipate and keep pace with rapid and continuing changes in technology, industry standards, and client preferences, as well as continue to attract top talent and expertise in order to develop innovative solution offerings and professional services that are required to keep up with dynamic industry landscapes. Cycurion may not be successful in anticipating or responding to these developments in a timely basis, and its offerings may not be successful in the marketplace. In addition, services, solutions, and technologies developed by its competitors may make its service or solution offerings uncompetitive or obsolete. Any of these circumstances could have a material adverse effect on its ability to obtain and successfully complete important client engagements, which in return would negatively affect revenue and operating results.

Cycurion relies on personnel with extensive information security expertise and the loss of, or its inability to attract and retain, qualified personnel in the highly competitive labor market for such expertise could harm its business.

Cycurion’s future performance depends upon its ability to attract and retain qualified cybersecurity personnel. The information technology consulting and cybersecurity industries have highly competitive labor markets, which depend on technical expertise and experience. In the future, it may be unable to continue to recruit and retain talent. If it is unable to recruit and/or retain talent, it may not be able to expand. Finally, its competitors may offer more competitive compensation packages than it could afford to offer.

Cycurion regularly attempts to benchmark its employee and contractor compensation against compensation paid within our industry and, if possible, make annual adjustments to the compensation it pays in order to remain competitive in the market.

In order to attract and retain the number of employees Cycurion needs to grow our business, it may need to increase its compensation levels in the future. This could adversely affect its operating margins, which, in turn, could negatively affect its financial condition and operating results.

If Cycurion is unable to hire, retain, train, and motivate qualified personnel and senior management, its business could suffer.

Cycurion’s future success largely depends upon the continued contribution, attraction, and retention of its senior management and other qualified personnel. If one or more of Cycurion’s executive officers are unable or unwilling to continue in their present positions, it may not be able to replace them readily, if at all. Additionally, it may incur additional expenses to recruit and retain new executive officers. If any of its executive officers joins a competitor or forms a competing company, it may lose some or all of its customers. Finally, it does not maintain “key person” life insurance on any of its executive officers. Because of these factors, the loss of the services of any of these key persons could adversely affect Cycurion’s business, financial condition, and results of operations, and thereby an investment in its common stock.

Cycurion must continually enhance its training, existing solutions and technology tools and develop or acquire new solutions and tools, or it will lose clients and its competitive position will suffer.

The cybersecurity landscape is constantly changing with increasing scale, frequency, and organization of attacks. Thus, there is a high need for constant improvement and updates in Cycurion’s existing solutions and technologies. Cycurion faces the risks of its services offerings not being adequately competitive, including not being able to: (i) accurately targeting its clients’ and prospective clients’ most-needed solutions (ii) being cost-effective for its clients and prospective clients, and (iii) being easy to use.

If Cycurion does not meet its clients’ and prospective clients’ expectations, or adequately mitigate these risks, it risks losing its competitive position and clients, which, in turn, will decrease its operating profits, revenue, and net income.

Cycurion faces intense competition in the cybersecurity industry, especially from larger, well-established companies.

Cycurion faces significant competition from other cybersecurity companies, especially those companies who are considered the larger and more established entities. Relative to Cycurion, many of these companies have significantly greater financial, technical, marketing, and other resources, longer operating histories, more well-established brand names and business user recognition, larger customer bases, larger and more mature intellectual property portfolios, and more diverse strategic plans and service offerings. Intense competition from these traditional and new cybersecurity companies has led to declining prices and margins for many cybersecurity services, and Cycurion expects this trend to continue as competition intensifies in the future. Any decrease in Cycurion’s pricing or margins, could significantly harm its business, financial condition, and results of operations, resulting in a significant or complete loss of your investment.

Further, decreasing prices for such professional services due to high number of entrants has somewhat diminished the competitive advantage that Cycurion has enjoyed as a result of its service pricing. If its competitors implement a similar business model, then Cycurion’s competitive position in the market might be diluted. Should this happen, its ability to acquire and keep customers would be impaired. Cycurion’s competitors may also introduce new technologies or services that could make Cycurion’s product offerings and professional services less attractive to its customers or potential customers. The inability to maintain or improve its competitive standing within the cybersecurity industry could materially adversely affect its business, prospects, financial condition, and results of operations.

For all of these reasons, Cycurion may not be able to compete successfully against its current or future competitors or may be required to expend significant resources in order to remain competitive. If Cycurion’s competitors are more successful than Cycurion in developing new product and service offerings or in attracting and retaining customers, Cycurion’s business, financial condition, and results of operations could be adversely affected.

If our products or professional services fail to detect vulnerabilities or identify and respond to cybersecurity incidents, or if our products contain undetected errors or defects, our brand and reputation could be harmed, which could have an adverse effect on our business and results of operations.

If our products or professional services fail to detect vulnerabilities in our customers’ cybersecurity infrastructure, or if our products or professional services fail to identify and respond to new and increasingly complex methods of cyber-attacks, our business and reputation may suffer. There is no guarantee that our products or professional services will detect all vulnerabilities, especially in light of the rapidly changing security landscape to which we must respond. Additionally, our products may falsely detect vulnerabilities or threats that do not actually exist.

Our products may also contain undetected errors or defects. Any errors, defects, disruptions in service, or other performance problems with our products may damage our customers’ businesses and could hurt our reputation. If our products or professional services fail to detect vulnerabilities for any reason, we may incur significant costs, the attention of our key personnel could be diverted, our customers may delay or withhold payment to us or elect not to renew or other significant customer relations problems may arise. We may also be subject to liability claims for damages related to errors or defects in our products. A material liability claim or other occurrence that harms our reputation or decreases market acceptance of our products may harm our business and operating results.

Many federal, state, and foreign governments have enacted laws requiring companies to notify individuals of data security breaches involving their personal data. These mandatory disclosures regarding a security breach often lead to widespread negative publicity, and any association of us with such publicity may cause our customers to lose confidence in the effectiveness of our security solutions. An actual or perceived security breach or theft of the sensitive data of one of our customers, regardless of whether the breach is attributable to the failure of our products or professional services, could adversely affect the market’s perception of our offerings and subject us to legal claims.

We have recently acquired multiple businesses. Our growth strategy is driven by successful acquisitions and integration of additional businesses that provide comparable or complementary services. Our ability to grow is limited if we fail to identify and consummate acquisitions.

We have completed the acquisition of certain complementary businesses, and we intend to consider additional potential strategic transactions, which could involve acquisitions of businesses or assets, joint ventures, or investments in businesses or technologies that expand, complement, or otherwise relate to our business. We may also consider, from time to time, opportunities to engage in joint ventures or other business collaborations with third parties. Should our relationships fail to materialize into significant agreements, or should we fail to work efficiently with these companies, we may lose sales and marketing opportunities and our business, results of operations, and financial condition could be adversely affected.

Any business acquisition creates risks such as, among others: (i) the need to integrate and manage the businesses acquired with our own business; (ii) additional demands on our resources, systems, procedures, and controls; (iii) disruption of our ongoing business; and (iv) diversion of management’s attention from other business concerns. Moreover, these transactions could involve: (a) substantial investment of funds or financings by issuance of debt or equity securities; (b) substantial investment with respect to technology transfers and operational integration; and (c) the acquisition or disposition of lines of businesses. Also, such activities could result in one-time charges and expenses and have the potential to either dilute the interests of our existing stockholders or result in the issuance of, or assumption of debt. Such acquisitions, investments, joint ventures, or other business collaborations may involve significant commitments of financial and other resources. Any such activities may not be successful in generating revenue, income, or other returns, and any resources we committed to such activities will not be available to us for other purposes. Moreover, if we are unable to access the capital markets on acceptable terms or at all, we may not be able to consummate acquisitions, or may have to do so on the basis of a less than optimal capital structure. Our inability to take advantage of growth opportunities or address risks associated with acquisitions or investments in businesses may negatively affect our operating results.

Additionally, any impairment of goodwill or other intangible assets acquired in an acquisition or in an investment, or charges to earnings associated with any acquisition or investment activity, may materially reduce our earnings. Future acquisitions or joint ventures may not result in their anticipated benefits and we may not be able to properly integrate acquired technologies or businesses with our existing operations or successfully combine personnel and cultures. Failure to do so could deprive us of the intended benefits of those acquisitions.

We intend to grow our client base significantly through acquisitions of other service providers. If we fail to retain existing clients and attract new clients through acquisitions, we may never achieve profitability.

Through acquisition of other service providers, we will inherit an increasingly larger client base, which creates cross-selling and up-selling opportunities. We need high-quality service and exemplary client management to retain and grow our client base. We also plan to launch sales and marketing efforts, and if our marketing efforts do not materialize, we may lose existing clients or fail to obtain new clients. Our inability to grow sales as we expand in operations may result in continuing losses, and we may not be profitable for an extended period of time. In addition, even if we are able to make future acquisitions, we will incur additional costs to consummate them, which may result in a shortage in our capital resources. We may also incur difficulties in integrating new businesses with our current operations.

Our business strategy may impose limitations in our ability to accurately forecast future revenue and operating results.

Our operating results are dependent on a variety of factors, including purchasing patterns of our clients, competitive pricing, debt servicing, and general economic trends. Our revenue and operating results may fluctuate if our sales targets are not met, new service offerings receive poor client response, or client acquisition costs increase due to competition. In addition to these factors, our acquisition strategy may impose additional risks to the predictability of our operating results. Revenue streams may be volatile due to the uncertainty in identifying attractive acquisition candidates and our ability to consummate new acquisitions. Unexpected expenses may be incurred during due diligence and post-acquisition. Management intends to manage risk carefully with the acquisitions; however, there can be no assurance that we will be able to identity and consummate acquisitions that improve our results of operations.

As a cybersecurity provider, we are a target of cyber-attacks and other cyber risks that could adversely impact our reputation and operating results.

As a cybersecurity provider, we have been and will likely be a target of cyber-attacks designed to impede the performance of our products, penetrate our network security, or that of our customers, misappropriate proprietary information and/or cause interruptions to our services. If our systems are breached as a result of third-party action, employee error or misconduct, attackers could learn critical information about how our products operate to help protect our customers’ infrastructures from cyber risk, thereby making our customers more vulnerable to cyber-attacks. In addition, if actual or perceived breaches of our network security occur, they could adversely affect the market perception of our products, negatively affecting our reputation, and may expose us to the loss of our proprietary information or information belonging to our customers, investigations or litigation and possible liability, including injunctive relief and monetary damages. Such security breaches could also divert the efforts of our key personnel. In addition, such security breaches could impair our ability to operate our business and provide products and services to our customers. If this happens, our reputation could be harmed, our revenue could decline and our business could suffer.

Additionally, we cannot be certain that our insurance coverage will be adequate for data security liabilities actually incurred, will cover any indemnification claims against us relating to any incident, that insurance will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could have a material adverse effect on our business, including our financial condition, operating results, and reputation.

The loss of, or a significant reduction, in purchases by any of our larger clients could adversely affect our business and financial results.

Currently, we are dependent on a few clients for a large portion of our revenue. If we fail to provide professional services to these clients on a timely basis or fail to meet their performance expectations, including the failure to enhance, maintain, upgrade, or improve our products and professional services, we may lose some of our clients that generate a significant amount of our revenue. If this were to happen, we would need to acquire several smaller clients or another large client to replace the lost revenue, as to which acquisitions there can be no assurance.

Any loss of a significant customer could increase our per-client costs, decrease our operating efficiencies, and have a material adverse effect on our business, results of operations, and financial condition. There can be no assurance that we can easily mitigate the potential loss of any of our larger clients, if at all.

The failure of Congress to approve appropriations bills in a timely manner for the Federal government agencies and departments we support, or the failure of the Administration and Congress to reach an agreement on fiscal issues, could delay and reduce spending, cause us to lose revenue and profit, and affect our cash flow.

On an annual basis, Congress is required to approve appropriations bills that govern spending by each of the Federal government agencies and departments we support. When Congress is, or Congress and the Administration are, unable to agree on budget priorities and, thus, unable to pass annual appropriations bills on a timely basis, Congress typically enacts a continuing resolution. Continuing resolutions generally allow Federal government agencies and departments to operate at spending levels based on the previous fiscal year. When agencies and departments operate on the basis of a continuing resolution, funding we expect to receive from clients for work we are already performing and for new initiatives may be delayed or cancelled. Congress and the Administration have from time to time failed to agree on a continuing resolution, resulting in temporary shutdowns of non-essential Federal government functions and our work on such functions. Such shutdowns may result in delayed payments to us and/or the delay of certain programs and projects for which we were engaged. Thus, the failure by Congress and the Administration to enact appropriations bills in a timely manner can result in the loss of revenue and profit when Federal government agencies and departments are required to cancel or change existing or new initiatives or the deferral of revenue and profit to later periods due to shutdowns or delays in implementing existing or new initiatives. There is also the possibility that Congress will fail to raise the U.S. debt ceiling, when necessary. This can also result in Federal government shutdowns. The delayed funding or shutdown of many parts of the Federal government, including agencies, departments, programs, and projects we support, could have a substantial negative affect on our revenue, profits, and cash flow.

Substantially all of our revenue is generated from contracts with Federal governmental entities.

We derived substantially all of our revenue in each of 2024 and 2023 from contracts with Federal government clients. Selling to government entities can be highly competitive, expensive and time consuming, and often requires significant upfront time and expense without any assurance that we will win a sale. Further expenditures by our Federal government clients may be restricted or reduced by Administration or congressional actions, by action of the Office of Management and Budget, by action of individual agencies or departments, or by other actions. Accordingly, we expect that, due to changing government budgeting and spending priorities and related disputes among Congress and the Administration, some of our government clients in the future may delay payments due to us, may eventually fail to pay what they owe us, and/or may delay certain programs and projects. For some government clients, we may face a difficult choice: turn down (or stop) work due to budget uncertainty with the risk of damaging a valuable client relationship or perform work with the risk of not being paid in a timely fashion or perhaps at all. Congressional elections could also affect spending priorities and budgets at all levels of government. In addition, increased deficits and debt at all levels of government, may lead to reduced spending by agencies and departments on projects or programs we support.

Government entities also have heightened sensitivity surrounding the purchase of cybersecurity solutions due to the critical importance of their IT infrastructures, the nature of the information contained within those infrastructures and the fact that they are highly visible targets for cyber-attacks. Accordingly, increasing sales of our products and professional services to government entities may be challenging.

Further, in the course of providing our products and professional services to government entities, our employees and those of our channel partners may be exposed to sensitive government information. Any failure by us or our channel partners to safeguard and maintain the confidentiality of such information could subject us to liability and reputational harm, which could materially and adversely affect our results of operations and financial performance.

Our reliance on U.S. General Services Administration Multiple Award Schedule (“GSA Schedule”) contracts and other Indefinite Delivery/Indefinite Quantity (“IDIQ”) contracts creates the risk of volatility in our revenue and profit levels.

We believe that one of the elements of our success is our position as a prime contractor under GSA Schedule contracts and other IDIQ contracts, and we believe this position is important to our ability to sell our services to Federal government clients. However, these contract vehicles require us to compete for each delivery order and task order, rather than having a more predictable stream of activity during the term of a multi-year contract. In addition, we may spend considerable cost and management time and effort to prepare bids and proposals for contracts, delivery orders, or task orders that we may not win. There can be no assurance that we will continue to obtain revenue from such contracts at current levels, or in any amount, in the future. To the extent that Federal government agencies and departments choose to employ GSA Schedule contracts and other IDIQ contracts encompassing activities for which we are not able to compete or provide services, we could lose business, which would negatively affect our revenue and profitability.

Future acquisitions could disrupt our business and harm our financial condition and operating results.

To remain competitive, we have in the past and may in the future seek to acquire additional businesses, products, or technologies. The environment for acquisitions in our industry is very competitive and acquisition candidate purchase prices will likely exceed what we would prefer to pay. We also may not find suitable acquisition candidates, and acquisitions we complete may be unsuccessful.

Achieving the anticipated benefits of future acquisitions will depend in part upon whether we can integrate acquired operations, products and technology in a timely and cost-effective manner and successfully market and sell these as new product offerings, or as new features within our existing offerings. The acquisition and integration processes are complex, expensive, and time consuming, and may cause an interruption of, or loss of momentum in, product development, sales activities, and operations. If we are unable to effectively execute or integrate acquisitions, our business, financial condition, and operating results could be adversely affected.

In addition, we may only be able to conduct limited due diligence on an acquired company’s operations or may discover that the products or technology acquired were not as capable as we thought based upon the initial or limited due diligence. Following an acquisition, we may be subject to unforeseen liabilities arising from an acquired company’s past or present operations and these liabilities may be greater than the warranty and indemnity limitations that we negotiate. Any unforeseen liability that is greater than these warranty and indemnity limitations could have a negative impact on our financial condition.

Our strategic partnerships expose us to a range of business risks and uncertainties that could have a material adverse impact on our business and financial results.

We and our subsidiaries have entered, and intend to continue to enter, into strategic partnerships with third parties to support our future growth plans. We cannot provide any assurance that we will be able to continue to enter into additional strategic partnerships. Strategic partnerships require significant coordination between the parties involved, particularly if a partner requires that we integrate its products with our products. Further, we have invested and will continue to invest significant time, money, and resources to establish and maintain relationships with our strategic partners, but we have no assurance that any particular relationship will continue for any specific period of time, result in new offerings that we can effectively commercialize, or result in enhancements to our existing offerings.

We are dependent on the continued services and performance of our senior management and other key employees, the loss of any of whom could adversely affect our business, operating results, and financial condition.

Our future performance depends on the continued services and contributions of our senior management, particularly Emmit McHenry, and other key employees to execute on our business plan and to identify and pursue new opportunities and product innovations. From time to time, there may be changes in our senior management team resulting from the termination or departure of our executive officers and key employees. The loss of the services of our senior management, particularly Emmit McHenry, or other key employees for any reason could significantly delay or prevent the achievement of our development and strategic objectives and harm our business, financial condition, and results of operations.

Accusations against us by third parties of infringement or other violations of their intellectual property rights, regardless of the accuracy of these assertions, could result in significant costs and harm our business and operating results.

We cannot ensure that our professional services and solutions, or the third-party solutions that we offer to our clients, do not infringe on the intellectual property rights of third parties and, in the future, we may have infringement claims asserted against us or against our clients. These claims could harm our reputation, require us to incur significant expenses and monetary liability, and prevent us from offering some of our current professional services or solutions. Legal challenges to our intellectual property rights and claims of intellectual property infringement by third parties could require that we enter into royalty or licensing agreements on less-than-favorable terms. Even if we believe any such challenges or claims are without merit, they can be time-consuming and costly to defend, injure our reputation, and divert management’s attention and resources away from our business. We may need to change our business practices if any of these events were to occur, which may limit our ability to compete effectively and could have an adverse effect on our results of operations.

We depend on unaffiliated third-party software in order to provide our solutions and professional services and support our operations.

Significant portions of our services and operations rely on software that is licensed from third-party vendors. The fees associated with these license agreements could increase in future periods, resulting in increased operating expenses. If there are significant changes to the terms and conditions of our license agreements, or if we are unable to renew these license agreements, we may be required to make changes to our vendors or information technology systems. These changes could impact the solutions and services we provide to our clients or the processes we have in place to support our operations, which could have an adverse effect on our business.

Any material weakness in our internal controls could adversely affect our business.

In the future, under Section 404 of the Sarbanes-Oxley Act of 2002 (the “SOX Act”), we will be required to furnish a report by our management on internal control over financial reporting. This report must contain, among other matters, an assessment of the effectiveness of our internal control over financial reporting, including a statement as to whether or not our internal control over financial reporting is effective. This assessment must include disclosure of any material weaknesses in our internal control over financial reporting identified by our management.

We identify material weakness in our internal controls, which could affect our ability to provide reliable financial statements and our business decision-making process, could harm our business and operating results, cause investors to lose confidence in our reported financial information, cause the market price of our securities to decrease and harm our ability to obtain additional financing, especially additional financing on favorable terms, could be adversely affected. In addition, failure to maintain effective internal control over financial reporting could result in investigations or sanctions by regulatory authorities. For a description of our material weaknesses, please see “Item 9A. Controls and Procedures.”

We may not be able to manage our growth effectively or improve our operational, financial, and management information systems, which would impair our results of operations.

In the near term, we intend to expand the scope of our operational activities significantly. If we are successful in executing our business plan, we will experience growth in our business that could place a significant strain on our business operations, finances, management, and other resources. The factors that may place strain on our resources include, but are not limited to, the following:

• The need for continued development of our financial and information management systems;
• The need to manage strategic relationships and agreements with manufacturers, customers, and partners; and
• Difficulties in hiring and retaining skilled management, technical, and other personnel necessary to support and manage our business.

Additionally, our strategy envisions a period of rapid growth that may impose a significant burden on our administrative and operational resources. Our ability to manage growth effectively will require us to expand the capabilities of our administrative and operational resources substantially and to attract, train, manage, and retain qualified management and other personnel. There can be no assurance that we will be successful in recruiting and retaining new employees or retaining existing employees.

We cannot provide assurances that our management will be able to manage this growth effectively. Our failure to manage growth successfully could result in our sales not increasing commensurately with capital investments, if at all, or otherwise materially adversely affecting our business, financial condition, or results of operations.

We may issue additional shares of Cycurion common stock or other equity securities without your approval, which would dilute your ownership interests and may depress the market price of your shares.

We may issue additional shares of Cycurion common stock or other equity securities of equal or senior rank in the future in connection with, among other things, future acquisitions, repayment of outstanding indebtedness or under the Equity Incentive Plan, without stockholder approval, in a number of circumstances.

Our issuance of additional shares of Cycurion common stock or other equity securities of equal or senior rank could have the following effects:

• your proportionate ownership interest in the combined company decrease;
• the relative voting strength of each previously outstanding share of the combined company may be diminished; or
• the market price of our shares of the combined company stock may decline.

If we are unable continually to add new customer offerings, innovate, and increase efficiencies, our ability to attract new customers may be adversely affected.

In the area of innovation, we must be able to add new solutions and professional service offerings and adopt sales incentives and policies that appeal to our customers and prospective customers. This depends, in part, on the creative and marketing skills of our personnel and on our ability to appeal to both customers and manufacturers. We may not be successful in the development, introduction, marketing and sourcing of new products or sales policies that satisfy customer needs, achieve market acceptance, or generate satisfactory financial returns, any of which could adversely affect our business, financial condition, or results of operations.

Risks Related to the SLG Assignment Agreement

We may fail to consummate some, or all of the assumptions contemplated by the SLG Assignment Agreement.

There is no guarantee that our possible assumption of any or all of the to-be-assigned SLG agreements, which, if assumed by us, would result in our becoming the prime contractor thereunder, will be approved by the counterparties. Mitigating factors that may hinder its acquisition include:

• Legal or regulatory challenges related to our possible assumptions of the to-be-assigned SLG agreements, which will result in our becoming the prime contractor thereunder;
• Discovery of material incompatibilities or challenges from our due diligence of the to-be-assigned SLG agreements, which, if assumed by us, would result in our becoming the prime contractor thereunder;
• Misrepresentation by SLG in respect of any of the to-be-assigned SLG agreements, which, if assumed by us, would result in our becoming the prime contractor thereunder; and
• The counterparty to one or more of the to-be-assigned SLG agreements, which, if assumed by us, would result in our becoming the prime contractor thereunder, does not approve the relevant assignment to us.

Due Diligence may not reveal all issues with respect to SLG.

There is no assurance that our due diligence will reveal all relevant information regarding the to-be- assigned SLG agreements, which, if assumed by us, would result in our becoming the prime contractor thereunder. We rely on our working relationship with SLG, the counterparties to the to-be-assigned SLG agreements, which, if assumed by us, would result in our becoming the prime contractor thereunder, as well as the information provided to us by SLG, its management, counsel, and auditors. There is no assurance that we will receive all relevant information or identify any current or historical factor that might otherwise prevent us from consummating any or all of the assumptions of the to-be-assigned SLG agreements, which, if assumed by us, would result in our becoming the prime contractor thereunder, or cause significant financial costs thereafter.

We may incur significant unforeseen costs related to our possible assumption of the to-be-assigned SLG agreements, which, if assumed by us, would result in our becoming the prime contractor thereunder, that are the subject of the SLG Assignment Agreement.

We recognize that there may be significant additional costs related to the assumption of the to-be- assigned SLG agreements, which, if assumed by us, would result in our becoming the prime contractor thereunder, that are the subject of the SLG Assignment Agreement, including costs related to legal and due diligence, integration and consolidation of the to-be-assigned SLG agreements themselves, which, if assumed by us, would result in our becoming the prime contractor thereunder, as distinguished from our operating as a subcontractor for those agreements, and other unexpected or unforeseen costs. Further, consummating the transactions contemplated by the SLG Assignment Agreement may cause us to:

• Issue common stock that will dilute our current stockholders’ ownership;
• Use a substantial portion of our cash resources;

17

• Increase our interest expense, leverage, and debt service requirements if we incur additional debt to in connection with the obligations that we will assume under the to-be-assigned SLG agreements, which, if assumed by us, would result in our becoming the prime contractor thereunder;
• Assume unexpected liabilities for which SLG has not agreed to indemnify us sufficiently or for which SLG does not have the resources to indemnify us; and
• Record goodwill and non-amortizable intangible assets that are subject to impairment testing and potential impairment charges.

There is no assurance that we will be able to integrate becoming the prime contractor under the to-be-assigned SLG agreements into our business model, which could then result in significant disruption to our business.

Our inability to integrate the to-be-assigned SLG agreements, which, if assumed by us, would result in our becoming the prime contractor thereunder, could impede us from realizing all the benefits of the possible assignments. The integration process of the to-be-assigned SLG agreements, which, if assumed by us, would result in our becoming the prime contractor thereunder, may disrupt our current business model of being a significant subcontractor on many projects rather than the prime contractor itself. The role of prime contractor has certain significant benefits regarding bidding for future contracts, but carries with it a significant administrative burden that currently we may not be able to fulfill successfully.

There is no assurance that any or all the counterparties to the to-be-assigned SLG agreements, which, if we are able to assume, would result in our becoming the prime contractor thereunder, will permit such assignment by SLG and assumption by us.

We have no reason to believe that any of the counterparties will not approve the prospective assignments of the SLG agreements; however, because the terms of each of the agreements that SLG has agreed to assign to us has a provision that provides the counterparty to such agreement with a right to approve an assignment prior to its effectiveness (even though we are known to each applicable counterparty as the prime subcontractor), we cannot provide any assurance that any or all of the counterparties will provide approval of the proposed assignments. Nevertheless, without those approvals, we would continue as the prime subcontractor under each of the agreements and, pursuant to the provisions of the SLG Assignment Agreement, SLG and we would reduce the consideration that we would otherwise tender to SLG.

There is no assurance that the to-be-assigned SLG agreements, which, if assumed by us, would result in our becoming the prime contractor thereunder, will perform as expected.

There is no assurance that the to-be-assigned SLG agreements, which, if assumed by us, would result in our becoming the prime contractor thereunder, will continue to operate at current or historic levels. Although we have no reason to believe otherwise, that is the same risk that we face as the prime subcontractor for such agreements; however, as the prime contractor under such agreements, our costs would be higher than they currently are.

Our insurance policies are expensive and protect us only from some business risks, which will leave us exposed to significant uninsured liabilities.

We carry insurance for most categories of risk that our business may encounter; however, we may not have adequate levels of coverage. We currently maintain general liability, property, workers’ compensation, clinical study, products liability and directors’ and officers’ insurance, along with an umbrella policy. We may not be able to maintain existing insurance at current or adequate levels of coverage. Any significant uninsured liability may require us to pay substantial amounts, which would adversely affect our cash position and results of operations.

Risks Related to Securities Markets and Investment in Our Common Stock

Cycurion has no current plans to pay dividends on its shares of common stock.

Cycurion does not anticipate paying any cash dividends in the foreseeable future. If Cycurion incurs indebtedness in the future to fund its future growth, its ability to pay dividends may be further restricted by the terms of such indebtedness.

If we fail to maintain proper and effective internal control over financial reporting in the future, our ability to produce accurate and timely financial statements could be impaired, which could harm our operating results, investors’ views of us, and, as a result, the value of our common stock.

Pursuant to Section 404 of the Sarbanes-Oxley Act, our management will be required to report upon the effectiveness of our internal control over financial reporting beginning with the annual report for our fiscal year ending December 31, 2024. When and if we are a “large accelerated filer” or an “accelerated filer” and are no longer an “emerging growth company” or “smaller reporting company,” each as defined in the Exchange Act, our independent registered public accounting firm will be required to attest to the effectiveness of our internal control over financial reporting. However, for so long as we remain an emerging growth company or smaller reporting company, we intend to take advantage of an exemption available to emerging growth companies and smaller reporting companies from these auditor attestation requirements. The rules governing the standards that must be met for management to assess our internal control over financial reporting are complex and require significant documentation, testing, and possible remediation. To comply with the requirements of being a reporting company under the Exchange Act, we will need to upgrade our systems including information technology; implement additional financial and management controls, reporting systems, and procedures; and hire additional accounting and finance staff. If we or, if required, our auditors are unable to conclude that our internal control over financial reporting is effective, investors may lose confidence in our financial reporting, and the trading price of our common stock may decline.

We are an emerging growth company, and the reduced reporting requirements applicable to emerging growth companies may make our common stock less attractive to investors.

We are an emerging growth company and are eligible to take advantage of certain exemptions from various reporting requirements that are applicable to other public companies that are not emerging growth companies, including, but not limited to, only two years of audited financial statements in addition to any required unaudited interim financial statements with correspondingly reduced “Management’s Discussion and Analysis of Financial Condition and Results of Operations” disclosure, not being required to comply with the auditor attestation requirements of Section 404 of the Sarbanes-Oxley Act of 2002 reduced disclosure obligations regarding executive compensation in this Annual Report and our periodic reports and proxy statements, exemptions from the requirements of holding non-binding advisory votes on executive compensation and seeking stockholder approval of any golden parachute payments not previously approved and not being required to adopt certain accounting standards until those standards would otherwise apply to private companies. We could be an emerging growth company until the last day of the fiscal year following the fifth anniversary of this offering, although circumstances could cause us to lose that status earlier, including if we become a large accelerated filer (in which case we will cease to be an emerging company as of the date we become a large accelerated filer, which, generally, would occur if, at the end of a fiscal year, among other things, the market value of our common stock that is held by non-affiliates exceeds $700 million as of the last business day of our most recently completed second fiscal quarter), if we have total annual gross revenue of $1.235 billion or more during any fiscal year (in which cases we would no longer be an emerging growth company as of March 31 of such fiscal year), or if we issue more than $1.0 billion in non-convertible debt during any three year period before that time (in which case we would cease to be an emerging growth company immediately). Even after we no longer qualify as an emerging growth company, we may still qualify as a “smaller reporting company,” which would allow us to take advantage of many of the same exemptions from disclosure requirements including not being required to comply with the auditor attestation requirements of Section 404 of the Sarbanes-Oxley Act and reduced disclosure obligations regarding executive compensation in this Annual Report and our periodic reports and proxy statements. We cannot predict if investors will find our common stock less attractive because we may rely on these exemptions. If some investors find our common stock less attractive as a result, there may be a less active trading market for our common stock and our stock price may be more volatile.

Cycurion will qualify as an “emerging growth company” within the meaning of the Securities Act, and if it takes advantage of certain exemptions from disclosure requirements available to emerging growth companies, it could make Cycurion’s securities less attractive to investors and may make it more difficult to compare Cycurion’s performance to the performance of other public companies.

Cycurion will qualify as an “emerging growth company” as defined in Section 2(a)(19) of the Securities Act, as modified by the JOBS Act. As such, Cycurion will be eligible for and intends to take advantage of certain exemptions from various reporting requirements applicable to other public companies that are not emerging growth companies for as long as it continues to be an emerging growth company, including (a) the exemption from the auditor attestation requirements with respect to internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act, (b) the exemptions from say-on-pay, say-on-frequency, and say-on-golden parachute voting requirements, and (c) reduced disclosure obligations regarding executive compensation in its periodic reports and proxy statements. Cycurion will remain an emerging growth company until the earliest of (i) the last day of the fiscal year in which the market value of common stock that is held by non-affiliates exceeds $700 million as of June 30 of that fiscal year, (ii) the last day of the fiscal year in which it has total annual gross revenue of $1.235 billion or more during such fiscal year (as indexed for inflation), (iii) the date on which it has issued more than $1 billion in non-convertible debt in the prior three-year period, or (iv) the last day of the fiscal year following the fifth anniversary of the date of the first sale of its predecessor’s IPO. In addition, Section 107 of the JOBS Act also provides that an emerging growth company can take advantage of the exemption from complying with new or revised accounting standards provided in Section 7(a)(2)(B) of the Securities Act as long as Cycurion is an emerging growth company. An emerging growth company can therefore delay the adoption of certain accounting standards until those standards would otherwise apply to private companies. We have elected not to opt out of such extended transition period and, therefore, Cycurion may not be subject to the same new or revised accounting standards as other public companies that are not emerging growth companies. Investors may find our common stock less attractive because Cycurion will rely on these exemptions, which may result in a less active trading market for our common stock and its price may be more volatile.

Our common stock price may be volatile and as a result you could lose all or part of your investment.

In addition to volatility associated with equity securities in general, the value of your investment could decline due to the impact of any of the following factors upon the market price of our shares of common stock:

• disappointing results from our development efforts;
• decline in demand for our shares of common stock;
• downward revisions in securities analysts’ estimates or changes in general market conditions;
• technological innovations by competitors or in competing products;
• investor perception of our industry or our prospects; and
• general economic trends.

Stock markets in general have experienced extreme price and volume fluctuations, and the market prices of securities have been highly volatile. These fluctuations are often unrelated to operating performance and may adversely affect the market price of our shares of common stock.

Potential future sales pursuant to registration rights granted by the Company and under Rule 144 may depress the market price for our shares of common stock.

The Company has granted a number of its stockholders’ registration rights with respect to their shares of common stock. See the section titled “Registration Rights.” Such future sales of our shares of common stock by our existing stockholders, pursuant to and in accordance with the provisions of any registration statement, may have a depressive effect on the market price of our shares of common stock. Further, in general, under Rule 144 under the Securities Act, a person who has satisfied a minimum holding period of between six months and one-year and any other applicable requirements of Rule 144, may thereafter sell such shares publicly. A significant number of our currently issued and outstanding shares of common stock held by existing stockholders, including officers and directors and other principal stockholders are currently eligible for resale pursuant to and in accordance with the provisions of Rule 144. The possible future sale of our shares by our existing stockholders, pursuant to and in accordance with the provisions of Rule 144, may have a depressive effect on the price of our Shares of common stock in the applicable trading marketplace.

We face risks related to compliance with corporate governance laws and financial reporting standards.

The Sarbanes-Oxley Act, as well as related rules and regulations implemented by the SEC and the Public Company Accounting Oversight Board (“PCAOB”), require changes in the corporate governance practices and financial reporting standards for public companies. These laws, rules and regulations, including compliance with Section 404 of the Sarbanes-Oxley Act relating to internal control over financial reporting, referred to as Section 404, materially increased our legal and financial compliance costs and made some activities more time-consuming and more burdensome.

There can be no assurance that our common stock will continue to trade on The Nasdaq Global Market or another national securities exchange.

There can be no assurance that we will be able to continue to meet The Nasdaq Global Market listing standards. If we are unable to maintain compliance with all applicable listing standards, our common stock may no longer be listed on The Nasdaq Global Market or another national securities exchange and the liquidity and market price of our common stock may be adversely affected.

The Company currently is (and from time to time in the recent past, the Company has been) out of compliance with the standards and requirements for continued listing on Nasdaq.

On April 9, 2025, Cycurion received written notice received from the Listing Qualifications Department of Nasdaq stating that, for the prior 30 consecutive business days, the closing bid price of our common stock had been below the minimum of $1.00 per share required for continued listing on The Nasdaq Capital Market under Nasdaq Listing Rule 5550(a)(2). The notification letter stated that we would be afforded 180 calendar days (until October 6, 2025) to regain compliance. In order to regain compliance, the closing bid price of our common stock must be at least $1.00 for a minimum of ten consecutive business days. The notification letter also stated that, in the event that we do not regain compliance within the initial 180-day period, we may be eligible for an additional 180-day period. If we are not eligible for the additional 180-day period, or if it appears to the Nasdaq staff that we will not be able to cure the deficiency, the Nasdaq Listing Qualifications Department will provide notice after the end of the initial 180-day period that our securities will be subject to delisting. Failure to regain compliance within that 180-day period would result in the delisting of our securities from Nasdaq, although we would have the right to appeal such a delisting to a Nasdaq hearings panel. The Nasdaq notification has no effect at this time on the listing of our common stock.

On April 11, 2025, we received two letters from the Nasdaq Listing Qualifications Department, each addressing a separate compliance deficiency of ours under the Nasdaq Listing Rules. The first letter notified us of our deficiency with regard to Nasdaq Listing Rule 5450(b)(2)(A), which requires a company such as ours, whose securities are listed on The Nasdaq Global Market under the “Market Value Standard”, to maintain a minimum Market Value of Listed Securities (an “MVLS”) of $50,000,000. The deficiency was caused by our MVLS having been below the minimum level for the prior 30 consecutive business days. Under Nasdaq Listing Rule 5810(c)(3)(C), we are entitled to a 180-day period, ending on October 8, 2025, to rectify the deficiency. In order to do so, we must achieve and maintain an MVLS of at least $50,000,000 or more for a minimum of 10 consecutive business days. Failure to regain compliance within that 180-day period would result in the delisting of our securities from Nasdaq, although we would have the right to appeal such a delisting to a Nasdaq hearings panel. The Nasdaq notification has no effect at this time on the listing of our common stock.

The second letter notified us of our deficiency with regard to Nasdaq Listing Rule 5450(b)(2)(C), which requires a minimum Market Value of Publicly Held Shares (an “MVPHS”) of $15,000,000 for continued listing on the Nasdaq Global Market under the “Market Value Standard”. This deficiency was caused by our MVPHS having been below the minimum level for the prior 30 consecutive business days. Under Nasdaq Listing Rule 5810(c)(3)(D), we have 180 calendar days, or until October 8, 2025, to regain compliance, which we can achieve if our MVPHS is at least $15,000,000 for a minimum of 10 consecutive business days. Failure to regain compliance within that 180-day period would result in the delisting of our securities from Nasdaq, although we would have the right to appeal such a delisting to a Nasdaq hearings panel. The Nasdaq notification has no effect at this time on the listing of our common stock.

To remedy any deficit in funds or stockholder equity in order to satisfy Nasdaq’s continuing listing standards or other minimum bid price requirements, if any, we may have to raise additional funding through dilutive equity investments or other external sources; but, there is no certainty such external funding will be available or on acceptable terms, or we may have to conduct reverse stock splits to consolidate our shares of common stock. If we fail to meet Nasdaq’s continued listing requirements and Nasdaq delists our common stock from trading on its exchange and we are not able to list our securities on another national securities exchange, we could face significant material adverse consequences, including without limitation a substantial reduction in the liquidity of our common stock, which could further limit our access to capital markets for fundraising.

Nasdaq may delist our securities from trading on its exchange.

Our common stock is listed on The Nasdaq Global Market and our warrants are listed on The Nasdaq Capital Market. Although we met the minimum initial listing standards of Nasdaq for each of our securities, which generally only requires that we meet certain requirements relating to stockholders’ equity, market capitalization, aggregate market value of publicly held shares, and distribution requirements, we cannot assure you that each of our securities will continue to be listed on Nasdaq in the future. The inability to comply with Nasdaq’s continued requirements or standards could result in the delisting of either or both classes of our securities, which could have a material adverse effect on our financial condition and could cause the value of the common stock, or our warrants, to decline.

If our common stock were to be delisted from trading on The Nasdaq Global Market and become quoted on the over-the-counter market and, under certain circumstances, if the trading price of our common stock were below $5.00 per share on the date the common stock is delisted, trading in our common stock would also be subject to the requirements of certain rules promulgated under the Exchange Act. These rules require additional disclosure by broker-dealers in connection with any trades involving a stock defined as a “penny stock” and impose various sales practice requirements on broker-dealers who sell penny stocks to persons other than established customers and accredited investors, generally institutions. These additional requirements may discourage broker-dealers from effecting transactions in securities that are classified as penny stocks, which could severely limit the market price and liquidity of such securities and the ability of purchasers to sell such securities in the secondary market. A penny stock is defined generally as any non-exchange listed equity security that has a market price of less than $5.00 per share, subject to certain exceptions.

The market price of the Company’s shares of common stock is likely to be highly volatile, and you may lose some or all of your investment.

The market price of the Company’s shares of common stock is likely to be highly volatile and may be subject to wide fluctuations in response to a variety of factors, including the following:

• the inability to obtain or maintain the listing of the Company’s shares of common stock on Nasdaq;
• the inability to recognize the anticipated benefits of the recently closed de-SPAC transaction, which may be affected by, among other things, competition, Cycurion’s ability to grow and manage growth profitably, and retain its key employees;
• changes in applicable laws or regulations;
• risks relating to the uncertainty of Cycurion’s projected financial information; and

In addition, the equity markets have experienced extreme price and volume fluctuations that have affected and continue to affect the market prices of equity securities of many companies. These fluctuations have often been unrelated or disproportionate to the operating performance of those companies. Broad market and industry factors, as well as general economic, political, regulatory and market conditions, may negatively affect the market price of the Company’s shares of common stock, regardless of the Company’s actual operating performance.

Volatility in the Company’s share price could subject the Company to securities class action litigation.

In the past, securities class action litigation has often been brought against a company following a decline in the market price of its securities. If the Company faces such litigation, it could result in substantial costs and a diversion of management’s attention and resources, which could harm its business.

A “short squeeze” due to a sudden increase in demand for shares of our common stock that largely exceeds supply and/or focused investor trading in anticipation of a potential short squeeze have led to, may be currently leading to, and could again lead to, extreme price volatility in shares of our common stock.

Investors may purchase shares of our common stock to hedge existing exposure or to speculate on the price of our common stock. Speculation on the price of our common stock may involve long and short exposures. To the extent aggregate short exposure exceeds the number of shares of our common stock available for purchase on the open market, investors with short exposure may have to pay a premium to repurchase shares of our common stock for delivery to lenders of our common stock. Those repurchases may, in turn, dramatically increase the price of shares of our common stock until additional shares of our common stock are available for trading or borrowing. This is often referred to as a “short squeeze.” With the recent substantial increase in volume of our shares being traded and trading price, the proportion of our common stock that may be traded in the future by short sellers may increase the likelihood that our common stock will be the target of a short squeeze. A short squeeze and/or focused investor trading in anticipation of a short squeeze have led to, may be currently leading to, and could again lead to volatile price movements in shares of our common stock that may be unrelated or disproportionate to our financial performance or prospects and, once investors purchase the shares of our common stock necessary to cover their short positions, or if investors no longer believe a short squeeze is viable, the price of our common stock may rapidly decline. Investors that purchase shares of our common stock during a short squeeze may lose a significant portion of their investment. Under the circumstances, we caution you against investing in our common stock, unless you are prepared to incur the risk of losing all or a substantial portion of your investment.

Increases in market interest rates may cause potential investors to seek higher returns and therefore reduce demand for our common stock, which could result in a decline in our stock price.

One of the factors that may influence the price of our common stock is the return on our common stock (i.e., the amount of distributions as a percentage of the price of our common stock) relative to market interest rates. An increase in market interest rates, which are currently at low levels relative to historical rates, may lead prospective purchasers of our common stock to expect a return, which we may be unable or choose not to provide as we have never paid a dividend and have no current intention to pay any dividends. Further, higher interest rates would likely increase our borrowing costs and potentially decrease the cash available. Thus, higher market interest rates could cause the market price of our common stock to decline.

If securities or industry analysts do not publish research or reports about the Company, or publish negative reports, the Company’s share price and trading volume could decline.

The trading market for the Company’s shares of common stock will depend, in part, on the research and reports that securities or industry analysts publish about the Company. The Company does not have any control over these analysts. If the Company’s financial performance fails to meet analyst estimates or one or more of the analysts who cover the Company downgrade its shares of common stock or change their opinion, the Company’s share price would likely decline. If one or more of these analysts cease coverage of the Company or fail to regularly publish reports on the Company, it could lose visibility in the financial markets, which could cause the Company’s share price or trading volume to decline.

Volatility in the price of our common stock may subject us to securities litigation.

As discussed above, the market for our common stock has been characterized recently by significant price volatility when compared to seasoned issuers, and we expect that our share price will continue to be more volatile than a seasoned issuer for the indefinite future. In the past, plaintiffs have often initiated securities class action litigation against a company following periods of volatility in the market price of its securities. We may in the future be the target of similar litigation. Securities litigation could result in substantial costs and liabilities and could divert management’s attention and resources.

Because the Company does not anticipate paying any cash dividends in the foreseeable future, capital appreciation, if any, would be your sole source of gain.

The Company currently anticipates that it will retain future earnings for the development, operation and expansion of its business and does not anticipate declaring or paying any cash dividends for the foreseeable future. As a result, capital appreciation, if any, of the Company’s shares of common stock would be your sole source of gain on an investment in such shares for the foreseeable future.

The Company’s share price may fluctuate.

The Company’s share price can be volatile. Among the factors that may affect the volatility of the Company’s stock price are the following:

• Speculation in the investment community or the press about, or actual changes in, the Company’s competitive position, organizational structure, executive team, operations, financial condition, financial reporting and results, expense discipline, strategic transactions, or progress on achieving expected benefits;
• The announcement of new products, services, acquisitions, or dispositions by the Company or its competitors;
• Increases or decreases in revenue or earnings, changes in earnings estimates by the investment community, and variations between estimated financial results and actual financial results; and
• Sales of a substantial number of shares of the Company’s shares of common stock by large shareholders.

Future offerings of debt, which would be senior to our common stock upon liquidation, and/or preferred equity securities, which may be senior to our common stock for purposes of distributions or upon liquidation, could adversely affect the market price of our common stock.

In the future, we may attempt to increase our capital resources by making additional offerings of debt or preferred equity securities, including convertible or non-convertible senior or subordinated notes, convertible or non-convertible preferred stock, medium-term notes and trust preferred securities. Upon liquidation, holders of our debt securities and shares of preferred stock and lenders with respect to other borrowings will receive distributions of our available assets prior to the holders of our common stock. In addition, any preferred stock we may issue could have a preference on liquidating distributions or a preference on distribution payments that could limit our ability to make a distribution to the holders of our common stock. Since our decision to issue securities in any future offering will depend on market conditions and other factors beyond our control, we cannot predict or estimate the amount, timing or nature of our future offerings. Thus, our stockholders bear the risk of our future offerings reducing the market price of our common stock.

Anti-takeover provisions contained in our charter and bylaws, as well as provisions of Delaware law, could impair a takeover attempt.

Our charter contains provisions that may discourage unsolicited takeover proposals that stockholders may consider to be in their best interests. We are also subject to anti-takeover provisions under Delaware law, which could delay or prevent a change of control. Together, these provisions may make more difficult the removal of management and may discourage transactions that otherwise could involve payment of a premium over prevailing market prices for our securities. These provisions will include:

• no cumulative voting in the election of directors, which limits the ability of minority stockholders to elect director candidates;
• the right of our Board to elect a director to fill a vacancy created by the expansion of our Board or the resignation, death, or removal of a director in certain circumstances, which prevents stockholders from being able to fill vacancies on our Board; and
• a prohibition on stockholder action by written consent, which forces stockholder action to be taken at an annual or special meeting of our stockholders.

Our charter provides that the Court of Chancery of the State of Delaware and the federal district courts of the United States of America will be the exclusive forums for substantially all disputes between us and our stockholders, which could limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us or our directors, officers, or employees.

Our charter provides that, subject to limited exceptions, any (i) derivative action or proceeding brought on our behalf of under Delaware law, (ii) any action asserting a claim of breach of a fiduciary duty owed by any current or former director, officer or other employee of Cycurion’s stockholders, (iii) any action asserting a claim against Cycurion or any of its directors, officers or other employees arising pursuant to any provision of the DGCL, the charter or the bylaws of Cycurion (in each case, as may be amended from time to time), (iv) any action asserting a claim against Cycurion or any of its directors, officers or other employees governed by the internal affairs doctrine of the State of Delaware or (v) any other action asserting an “internal corporate claim,” as defined in Section 115 of the DGCL, in all cases subject to the court’s having personal jurisdiction over all indispensable parties named as defendants shall, to the fullest extent permitted by law, be exclusively brought in the Court of Chancery of the State of Delaware or, if such court does not have subject matter jurisdiction thereof, another state or federal court located within the State of Delaware. The charter also provides that unless a majority of the Board of Cycurion, acting on behalf of Cycurion, consents in writing to the selection of an alternative forum (which consent may be given at any time, including during the pendency of litigation), the federal district courts of the United States of America, to the fullest extent permitted by law, will be the sole and exclusive forum for the resolution of any action asserting a cause of action arising under the Securities Act. Any person or entity purchasing or otherwise acquiring any interest in shares of Cycurion’s capital stock shall be deemed to have notice of and to have consented to the provisions of Cycurion’s certificate of incorporation described above. Section 27 of the Exchange Act creates exclusive federal jurisdiction over all suits brought to enforce any duty or liability created by the Exchange Act or the rules and regulations thereunder. As a result, the exclusive forum provision will not apply to suits brought to enforce any duty or liability created by the Exchange Act or any other claim for which the federal courts have exclusive jurisdiction. Section 22 of the Securities Act creates concurrent jurisdiction for state and federal courts over all suits brought to enforce any duty or liability created by the Securities Act or the rules and regulations thereunder.

This choice of forum provision may limit a stockholder’s ability to bring a claim in a judicial forum that it finds favorable for disputes with Cycurion or its directors, officers, or other employees, which, along with potential increased costs of litigating the courts provided by the choice of forum provision, may discourage such lawsuits against Cycurion and its directors, officers, and employees. Alternatively, if a court were to find these provisions of Cycurion’s amended and restated certificate of incorporation inapplicable to, or unenforceable in respect of, one or more of the specified types of actions or proceedings, Cycurion may incur additional costs associated with resolving such matters in other jurisdictions, which could adversely affect Cycurion’s business and financial condition.

Cycurion’s business and operations could be negatively affected if it becomes subject to any securities litigation or stockholder activism, which could cause Cycurion to incur significant expense, hinder execution of business and growth strategy and impact its stock price.

In the past, following periods of volatility in the market price of a company’s securities, securities class action litigation has often been brought against that company. Stockholder activism, which could take many forms or arise in a variety of situations, has been increasing recently. Volatility in the stock price of our common stock or other reasons may in the future cause it to become the target of securities litigation or stockholder activism. Securities litigation and stockholder activism, including potential proxy contests, could result in substantial costs and divert management’s and the board of directors’ attention and resources from the Cycurion’s business. Additionally, such securities litigation and stockholder activism could give adversely affect our relationships with service providers and make it more difficult to attract and retain qualified personnel. Also, Cycurion may be required to incur significant legal fees and other expenses related to any securities litigation and activist stockholder matters. Further, its stock price could be subject to significant fluctuation or otherwise be adversely affected by the events, risks and uncertainties of any securities litigation and stockholder activism.

Risks Related to Operating as a Public Company

The Company’s management team has limited skills related to experience managing a public company.

Most members of the Company’s management team have limited experience managing a publicly traded company, interacting with public company investors, and complying with the increasingly complex laws, rules and regulations that govern public companies. As a public company, the Company is subject to significant obligations relating to reporting, procedures and internal controls, and its management team may not successfully or efficiently manage such obligations. These obligations and scrutiny will require significant attention from the Company’s management and could divert their attention away from the day-to-day management of its business, which could adversely affect its business, financial condition, and results of operations.

Cycurion may incur significantly increased costs and devote substantial management time as a result of operating as a public company.

As a public company, Cycurion will incur significant costs related to legal, accounting, listing, hiring of external consultants and advisors, and other expenses. For example, it will be subject to the reporting requirements of the Exchange Act and will be required to comply with the applicable requirements of the Sarbanes-Oxley Act and the Dodd-Frank Wall Street Reform and Consumer Protection Act, as well as rules and regulations subsequently implemented by the SEC and Nasdaq, including the establishment and maintenance of effective disclosure and financial controls, changes in corporate governance practices and required filing of annual, quarterly and current reports with respect to its business and results of operations. Cycurion expects that compliance with these requirements will increase its legal and financial compliance costs and will make some activities more time-consuming and costly. In addition, Cycurion expects that management and other personnel will need to divert attention from operational and other business matters to devote substantial time to these public company requirements. In particular, the Company expects to incur significant expenses and devote substantial management effort toward ensuring compliance with the requirements of Section 404 of the Sarbanes-Oxley Act, which will increase when Cycurion is no longer an emerging growth company. EUDA may also need to hire additional accounting and financial staff with appropriate public company experience and technical accounting knowledge and establish an internal audit function.

Cycurion also expects that operating as a public company will make it more expensive to obtain director and officer liability insurance and the Company may be required to accept reduced coverage or incur substantially higher costs to obtain coverage. This could also make it more difficult for Cycurion to attract and retain qualified people to serve on its board of directors, its board committees or as executive officers.

As Cycurion continues to expand via opportunities for acquisitions, investments or strategic alliances as a public company, we expect that management and other personnel will need to divert attention from operational and other business matters to ensure the success of these opportunities.

Certain recent public offerings of companies with public floats comparable to the public float of Cycurion have experienced extreme volatility that was seemingly unrelated to the underlying performance of the respective company. The Company may experience similar volatility, which may make it difficult for prospective investors to assess the value of its shares of common stock.

The Company’s shares of common stock may be subject to extreme volatility that is seemingly unrelated to the underlying performance of its business. Recently, companies with comparable public floats and public offering sizes have experienced instances of extreme stock price run-ups followed by rapid price declines, and such stock price volatility was seemingly unrelated to the respective company’s underlying performance. Although the specific cause of such volatility is unclear, the Company’s public float may amplify the impact of the actions taken by a few shareholders on the price of its shares of common stock, which may cause its share price to deviate, potentially significantly, from a price that better reflects the underlying performance of its business. Should the Company’s shares of common stock experience run-ups and declines that are seemingly unrelated to the Company’s actual or expected operating performance and financial condition or prospects, prospective investors may have difficulty assessing the rapidly changing value of the Company’s shares of common stock. In addition, investors in the Company’s shares of common stock may experience losses, which may be material, if the price of the Company’s shares of common stock declines after this offering or if such investors purchase shares of common stock prior to any price decline.

Risk Management and Strategy

We have established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats. We have designed and implemented an Access Control Policy. The policy and supporting procedures encompass all information systems that are owned, operated, maintained, and controlled by the Company and all other information systems, both internally and externally, that interact with these systems. Our cybersecurity program and policies is a collaborative effort, requiring commitment from all personnel, including management, internal employees and users of information systems, along with vendors, contractors, and other relevant third parties.

Our Chief Information Security Officer (“CISO”) and Information System Security Officer (“ISSO”) are responsible for providing overall direction, guidance, leadership, and support for the entire information systems environment, while also assisting other applicable personnel in their day-to-day operations. The CISO and ISSO are to report to other members of senior management on a regular basis regarding all aspects of the organization’s information systems posture. Our internal employees and users are responsible for adhering to the organization’s information security policies, procedures, practices, and not undertaking any measure to alter such standards on any information systems. Additionally, end users are to report instances of non-compliance to senior authorities, specifically those by other users. End users – while undertaking day-to-day operations – may also notice issues that could impede the safety and security of our information systems and are to also report such instance immediately to senior authorities. Our vendors, contractor and other third-party entities are responsible for adhering to the organization’s information security policies, procedures, practices, and not undertaking any measure to alter such standards on any such system components.

We have also implemented an IT Security Incident Response Policy. Incident response preparation comprises of how to respond to incidents and how to protect against and detect computer-related incidents. The process of providing incident response is identified by four distinct phases: (i) preparation; (ii) detection and analysis; (iii) containment, eradication and recovery; and (iv) post-incident activity. Our CISO and ISSO are responsible for developing, implementing, coordinating, and maintaining IT security policy and procedures. These individuals also fill the role of Computer Incident Response Team (CIRT) Leaders. They are responsible for the operations of the system and its applications, including reporting, responding to security incidents, and ensuring that adequate event logging is enabled. Our ISSO is responsible for the security of the system and for ensuring incident response (IR) policy and plan are documented, followed, that the IR plan is tested annually, updated with lessons learned from training exercises and on-going incident handling activities, and periodically reviewed at least on an annual basis. This person also fills the role of Deputy CIRT Leader. Our CISO is responsible for information security within the organization and is responsible for the review and approval of the incident response policy and plan. General end-users and non-CIRT personnel are responsible for actively securing their systems and notifying the CIRT of any suspected information security incident (e.g., potential virus detection, phishing emails, potential malware infection, etc.).

Governance

Management considers cybersecurity risk as part of its overall risk oversight function and reviews policies and procedures relative to both the systems and facility to ensure all requirements are within the Company’s purview to meet, and that appropriate resources have been dedicated or otherwise made available to accomplish, these requirements. Our management team, including our CISO and ISSO, are responsible for day-to-day implementation, assessment, and management our cybersecurity risk assessment and management processes. The CISO and ISO have primary responsibility for our overall cybersecurity risk management program, including monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents, and works in partnership with our other business leaders. Our CISO and ISO supervise both our internal cybersecurity personnel and any retained external cybersecurity consultants. Our CISO and ISSO have served in various roles in information technology and information security for over 25 years each.

The Board of Directors receives presentations and reports on cybersecurity, which address a range of topics including recent developments, evolving standards, the threat environment, cybersecurity systems testing and vulnerability assessments, and the Company’s practices and policies to manage risks. The CISO and ISSO report to the Board of Directors on cybersecurity matters and materials risks, if any, from cybersecurity threats. The Board of Directors also receive notice of any significant cybersecurity incidents, as well as ongoing updates regarding any such incident until it has been addressed.

As of the date of this Annual Report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Company, its business strategy, results of operations or financial condition. As cybersecurity threats become more sophisticated, it is reasonably likely that we will be required to expend greater resources to continue to modify and enhance our protective measures.

We do not own any properties. Our principal executive office is located at 1640 Boro Place, Fourth Floor, McLean, Virginia 22102. Our executive office is shared with our subsidiaries, and houses our management team, cybersecurity engineers, support staff, and sales and customer service teams.

Due to the nature of our business and the professional services we offer, a majority of our employees work on client sites or remotely. Our offices do not require any state or regulatory permits. We currently believe that our existing facilities are suitable, but we may need additional space in the future to accommodate our anticipated growth. We believe that such space will be available to us when required and on commercially reasonable terms.

On October 30, 2020, the former owners of Cloudburst filed a Complaint in the Circuit Court of Fairfax County, Commonwealth of Virginia, styled, Andrea Suzara Bennett and Adam W. Bennett Plaintiffs v. KAE Holdings, Inc., Case No. 2020 17025. In the Complaint, plaintiffs alleged the following counts: Breach of Contract — Andrea Bennett and Breach of Contract — Adam Bennett. Plaintiffs are seeking compensatory damages in the aggregate amount of approximately $1,000,000 plus interest. On January 15, 2021, we answered the Complaint, denied the allegations, and alleged certain counterclaims: (i) Breach of Contract — all Counterclaim Defendants, (ii) Fraudulent Inducement — All Counterclaim Defendants, and (iii) Breach of Contract — Adam Bennett. We are seeking damages in an amount to be determined at trial, but no less than $2,800,000, recission of the promissory notes that we issued in connection with our purchase of Cloudburst from the plaintiffs, punitive damages of $350,000, and temporary and permanent injunctive relief. On April 20, 2022, we settled the litigation for a payment of $200,000 in exchange for the Counterclaim Defendants to us for cancellation (i) the $900,000 promissory notes and (ii) 186,048 shares of our common stock, which we had issued to them in connection with their sale of Cloudburst to us in April 2019. As of the date of this Annual Report, this case has been settled.

On February 1, 2024, JPI Technologies, LLC filed a complaint in the Circuit Court of Fairfax County, Virginia, styled JPI Technology, LLC, Plaintiff, v. Axxum Technologies, LLC, Defendant, Case No. 2024-01774. Plaintiff alleged the breach of a settlement agreement and sought damages in the amount of $126,000. Subsequent to the date of filing of the Complaint, Defendant (a wholly-owned subsidiary of ours) has made certain payments to Plaintiff in connection with the Settlement Agreement and denies that it owes the amount alleged in the Complaint. In connection with the settlement agreement, Defendant executed and delivered a Judgment Order in the unpaid settlement amount, interest thereon at the annual rate of 6%, and attorneys’ fees and costs. As of the date of this Annual Report, this case has been settled.

On March 21, 2024, Unique Funding Solutions LLC filed a complaint in the Circuit Court of Fairfax County, Virginia, styled Unique Funding Solutions LLC, Plaintiff v. Cycurion, Inc., d/b/a fka Cyber Secure Solution, Axxum Technologies LLC, Cycurion Innovation, Inc., Cloudburst Security LLC, Emmit Jones McHenry, Kurt, McHenry, and Avin McCoy, Case No. CL2024-0004073. Plaintiff alleged that the entity defendants entered into a future receipts/receivables agreement with Plaintiff, pursuant to which the entity Defendants became obligated to pay to Plaintiffs approximately $490,000. Plaintiff also alleged that the individual Defendants personally guaranteed the obligations of the entity Defendants. Plaintiff further alleged that all Defendants defaulted in the performance of their respective agreements, which became the subject of a settlement agreement in the amount of approximately $430,000, with a weekly payment schedule. Defendants deny the allegations set forth in the complaint and the matter is now in the discovery phase of litigation. As of the date of this Annual Report, this case has been settled.

On July 29, 2024, Object3, LLC initiated an arbitration proceeding with the American Arbitration Association, styled Object3, LLC, Claimant, v. Cloudburst Security, LLC, Respondent, Case No. 01-24-0006-9906. The Claimant made claims for unpaid consulting services and associated costs, fees, and interest for the prior 12-month period in the aggregate amount of approximately $228,000. Defendant (a wholly-owned subsidiary of ours) denies that it owes such amount to Claimant. The arbitration is in the early stages and, as of the date of this Annual Report, we are in negotiations to settle this case.

We know of no other material pending legal proceedings to which we or any of our subsidiaries is a party or to which any of our assets or properties, or the assets or properties of any of our subsidiaries, are subject and, to the best of our knowledge, no adverse legal activity is anticipated or threatened. In addition, we do not know of any such proceedings contemplated by any governmental authorities.

We know of no material proceedings in which any of our directors, officers, or affiliates, or any registered or beneficial stockholder is a party adverse to us or any of our subsidiaries or has a material interest adverse to us or any of our subsidiaries.

Throughout this section, unless otherwise noted, “we,” “our,” “us,” “Cycurion” and the “Company” refer to Cycurion, Inc.

You should read the following discussion of our financial condition and results of operations in conjunction with our financial statements and the notes included elsewhere in this annual report. The following discussion contains forward-looking statements that involve certain risks and uncertainties. Our actual results could differ materially from those discussed in these statements. Factors that could cause or contribute to these differences include those discussed below and elsewhere in this annual report, particularly under the “Risk Factors” and “Disclosure Regarding Forward-Looking Statements” sections.

Management’s plans and basis of presentation:

We were incorporated in Delaware in 2017 as KAE Holdings, Inc, with the purpose of acquiring operating entities in the cybersecurity industry.

Effective July 14, 2020, we changed our corporate name from KAE Holdings, Inc. to Cyber Secure Solutions, Inc., and, on April 24, 2021, to Cycurion, Inc. On February 14, 2025, the date of closing of our de-SPAC transaction, we merged into Western Acquisition Ventures Corp. and changed that company’s name to Cycurion, Inc.

Our Business

We deliver high-quality, cybersecurity solutions to federal government civilian, defense, and judiciary agencies in addition to commercial clients across a variety of industries. We, through our operating subsidiaries and strategic partnerships, have numerous prime and subcontracts with key government agencies. Our growth engine is driven by organic business solutions and strategic acquisitions of cyber/ infrastructure service providers.

For a description of our Business, please see “Item 1. Business.”

Our Subsidiaries

Cycurion Sub, Inc.

Our operating subsidiaries are wholly owned by Cycurion Sub., Inc., a Delaware corporation that, until the closing date of the de-SPAC, was known as “Cycurion, Inc.” We continue to conduct our business through the three below-described entities, which are now indirectly wholly-owned second-tier subsidiaries by virtue of the recent closing of the de-SPAC transaction.

Axxum Technologies LLC

Organized in the Commonwealth of Virginia on December 29, 2006, Axxum is a cybersecurity provider with successful assignments within the multiple sub-agencies of the Department of Homeland Security. We acquired Axxum in November 2017. Following the acquisition, we continued Axxum’s core operations of providing contractor services to its existing federal government customer base while leveraging our existing processes and tools to expand its commercial footprint.

Axxum’s information security focus produces several key benefits:

• Agile Client Focus: Axxum’s projects are overseen directly by its program managers, all of whom have information security backgrounds and are fully authorized to promptly implement client requirements throughout the performance life cycle.
• Streamlined and Process Focused: Axxum’s streamlined infrastructure leverages ISO quality standards integrated with emerging and established technologies, allowing it to engineer innovative solutions without building in excessive overhead.
• Outstanding Personnel: Axxum has a reputation of employing cybersecurity experts.

Cloudburst Security LLC

Cloudburst is a cybersecurity provider with successful assignments within highly sensitive government agencies and other commercial organizations. We acquired Cloudburst in April 2019. Following the acquisition, we continued Cloudburst’s core operations of providing mission-critical and highly sensitive government agencies and other commercial organizations with high-quality, innovative cybersecurity services. Cloudburst focuses on providing tailored solutions that leverage the industry’s best minds and technologies to predict, protect, detect, respond, and sustain our clients from the latest evolving cyber threats.

Cycurion Innovation, Inc.

Cycurion Innovation, Inc. was formed in connection with our acquisition of assets from Sabres, a leading Israeli-based cyber security provider. It operates our Cycurion Security Platform’s line of products allows our customers to improve their cyber posture with its MDP SaaS platform. This platform efficiently bundles and easily implements the external protection of a Web Application Firewall (WAF) and the internal protection of Bot Mitigation. Bot Mitigation is the reduction of risk to applications, Application Program Interfaces (APIs), and backend services from malicious bot traffic that fuels common automated attacks, such as Distributed Denial of Service (DDoS) campaigns and vulnerability probing. The costs of single-layer security can be measured in terms of money, time, and risk, as well as the damage wrought by a data breach, which millions of businesses experience each year. Through this interaction of the WAF and Bot Mitigation, the MDP is able to reinforce these layers of security and generate new security layers in real time in response to emerging threats. This process is directed by our Cycurion Security Platform’s proprietary, cloud-based artificial intelligence (“AI”) algorithm. Crucially, the AI underpinning the MDP platform is constantly evolving to counter new threats. Through a crowdsourcing process, the cloud-based MDP learns from every threat to any protected application and uses that newly acquired knowledge to protect all MDP clients better.

Subcontractor — Prime contractor relationship

SLG Innovation, Inc.

We are currently a subcontractor for several keystone contracts held by SLG. The SLG team has an average of over 25 years of experience in the development, planning, implementation, and management of information systems. SLG’s leadership team offers years of combined success in answering the needs of government agencies and healthcare organizations across the country.

The SLG team has worked nationally, as it has served over 25 Department of Health and Human Services agencies, all 50 state governments, and over 250 local governments. Since SLG’s inception, it has primarily focused on customers in the middle of the country. The team of professionals has successfully delivered Information Technology, Project Management, and Subject Matter Services to key health and human service projects, including, but not limited to, state Medicaid programs in Illinois, Indiana, Nebraska, and Tennessee, the Indiana Division of Aging, Illinois Early Intervention, the University of Illinois Division of Specialized Care for Children, the Multiple Myeloma Research Foundation, and many more.

We established a subcontractor — prime contractor relationship with SLG in the fall of 2019, where we serviced several government agencies and commercial customers, State of New Mexico, Cognizant, KPMG, and the University of Illinois in support of SLG. Axxum Technologies and SLG Innovation that relationship in 2020. A subcontractor offers its specialized services to a prime contractor. Unlike prime contractors, who focus on the managerial side of the government contract, subcontractors tend to dedicate their efforts to lending subject matter expertise and delivery of service to the project. Technically strong subcontractors, along with a strong subcontractor plan are essential to boost the success of a project.

As a result of the strong technical skills and experience of the cyber teams at Cycurion and its subsidiaries, SLG Innovation entered into a Master Services Agreement (MSA) with Axxum Technologies to provide services to SLG customers. The MSA is task order driven and the number of task orders is modified periodically depending on actual customer requirements for IT and Cybersecurity services. Over the last three years, Axxum Technologies has assisted SLG Innovation in growing its revenue and customer base. As a result, SLG Innovation now represents a majority of Cycurion revenues.

SLG Acquisition Agreement

Our revenues from SLG in our 2024 and 2023 fiscal years were $14,703,887 and $13,837,042, respectively. The types of agreements to which SLG is a party are discussed under the heading “Our Business — Key Clients and Historical Performance.” From our perspective, a major benefit to us of the potential transaction contemplated by the SLG Term Sheet, as described below, would be that we could “piggyback” on SLG’s historical relationships with the various contracting governmental agencies in our bidding on future potential agreements. It is axiomatic in the governmental contracting arena in which we are involved that past performance on customer assignments as the prime contractor is one of the more important qualifications in competing for new opportunities within the federal government. We believe that our acquisition of SLG, if that transaction is closed by us, would yield such “past performance” qualifications.

On April 25, 2023, Cycurion Sub executed a Term Sheet with SLG (the “SLG Term Sheet”), pursuant to which SLG agreed to be acquired by Cycurion Sub. The Term Sheet contained all of the material terms and conditions of two proposed interrelated transactions to be memorialized by the SLG Acquisition Agreeement. To effectuate the two transactions contemplated by the SLG Term Sheet, Cycurion Sub will form two subsidiaries, which, upon formation, will initially be wholly owned by Cycurion Sub. If, when, and as the transactions contemplated by the SLG Term Sheet are consummated, SLG would merge with and into one of the subsidiaries and survive, thereby becoming a wholly-owned subsidiary of Cycurion Sub. Because certain of the agreements to which SLG is the prime contractor require that the majority owner of the prime contractor be a resident of the City of Chicago or of Cook County (depending on the contract), contemporaneously with the consummation of the first of the two transactions, (i) SLG will divest itself of those agreements with the residency requirements, (ii) the second newly formed subsidiary will assume those agreements, (iii) Mr. Ed Burns will become the owner of a 51% interest in that newly formed subsidiary, and (iv) we will enter into a Management Agreement with that subsidiary, the economic terms and management/ control terms of which are intended to be the equivalent of complete ownership of that the 49% owned subsidiary. Mr. Ed Burns is currently the 51% owner of SLG and a resident of the City of Chicago. The SLG Term Sheet provides that, if, when, and as the transactions contemplated thereby are consummated, the two current owners of SLG will be issued an aggregate of 996,355 shares of Cycurion common stock.

SLG is fully bound by the terms and provisions of the SLG Term Sheet and the related Management Agreement structure, although Cycurion Sub is permitted to terminate the SLG Term Sheet and to abandon the transactions contemplated thereby any time for any reason or for no reason prior to April 11, 2025, with no further obligations on Cycurion Sub’s part. As of the date of this Annual Report, although we reserve the right to modify the terms and provisions of the SLG Acquisition Agreement, we do not currently expect to terminate it and currently expect to close the transactions contemplated during our current fiscal quarter. Substantially all of the agreements to which SLG is a party have a provision that provides the counterparty to such agreement with a right to approve an assignment or change in control of SLG prior to its effectiveness. If an approval is not forthcoming, then the provisions of the SLG Acquisition Agreement permit us to excise that specific agreement. Upon such occurrence, we reserve that right to reduce the consideration that we would otherwise tender to the equity owners of SLG.

As amended by the parties, initially effective as of November 29, 2023 and subsequently effective as of April 29, 2024, August 16, 2024 and December 31, 2024, the SLG Term Sheet expires on the soonest of (i) closing of the transactions contemplated thereby, (ii) April 11, 2025, if the transactions contemplated thereby have not closed by then, (iii) Cycurion Sub’s termination thereof, and (iv) the mutual termination by all of the parties thereto. Notwithstanding anything to the contrary contained therein, Cycurion Sub may terminate its obligations under the SLG Term Sheet and the transactions contemplated hereby for any reason or for no reason without any further obligations and without any liability at any time through and including April 11, 2025. The SLG Term Sheet, as amended, consensually superseded, as noted therein, Cycurion Sub’s previous “unidirectional” agreements with SLG.

The foregoing brief summary description of certain terms and provisions of (i) the SLG Term Sheet does not purport to be complete and is qualified in its entirety by reference to the full text of the SLG Term Sheet, a copy of which is attached to this Annual Report as Exhibit 10.12, (ii) the SLG Term Sheet Amendments, a copy of each of which is attached to this Annual Report as Exhibit 10.12a, Exhibit 10.12b, Exhibit 10.12c, and Exhibit 10.12d, and (iii) the SLG Management Agreement does not purport to be complete and is qualified in its entirety by reference to the full text of the SLG Term Sheet, a copy of which is attached to this Annual Report as Exhibit 10.12e. Readers are encouraged to read those Exhibits in full for a more comprehensive understanding of the transaction contemplated by the SLG Term Sheet.

RCR Acquisition Agreement

RCR Technology Corporation (“RCR”) performs certain services for SLG in its role as an SLG subcontractor and, in that context, became a creditor of SLG. In connection with the transactions contemplated by the SLG Term Sheet, on April 25, 2023, Cycurion and RCR also entered into a term sheet (the “RCR Term Sheet”) for a distinct, but related transaction. The RCR Term Sheet contemplates a transaction, pursuant to which RCR will sell to Cycurion all of the accounts receivable of SLG in favor of RCR (but for those accounts that are less than 90 days old as of the date of consummation of the contemplated transaction). The consummation of the transactions contemplated by the RCR Term Sheet is contingent upon the consummation of the transactions contemplated by the SLG Term Sheet. Nevertheless, as a result of our entry into the SLG Management Agreement with SLG, we still currently intend to consummate the transactions contemplated by the RCR Term Sheet in the first half of our current fiscal year. The RCR Term Sheet provides that, if, when, and as the transactions contemplated thereby are consummated, RCR will be issued shares of our common stock.

Further, as amended by the parties, initially effective as of November 29, 2023, and subsequently effective as of April 29, 2024, August 16, 2024 and December 31, 2024, the RCR Term Sheet expires on the soonest of (i) closing of the transactions contemplated thereby, (ii) April 11, 2025, if the transactions contemplated thereby have not closed by then, (iii) Cycurion’s termination thereof, and (iv) the mutual termination by all of the parties thereto. Notwithstanding anything to the contrary contained therein, Cycurion may terminate its obligations under the RCR Term Sheet and the transactions contemplated hereby for any reason or for no reason without any further obligations and without any liability at any time through and including April 11, 2025. As of the date of this Annual Report, we do not currently expect to terminate the transactions contemplated by the RCR Term Sheet, as amended, and currently expect to close the transactions in the first half of our current fiscal year.

The foregoing brief summary description of certain terms and provisions of the RCR Term Sheet does not purport to be complete and is qualified in its entirety by reference to the full text of the RCR Term Sheet, a copy of which is attached to this Annual Report as Exhibit 10.13 and the full text of the RCR Term Sheet Amendments, a copy of each of which are attached to this Annual Report as Exhibit 10.13a, 10.13b and 10.13c. Readers are encouraged to read those Exhibits in full for a more comprehensive understanding of the transaction contemplated by the RCR Term Sheet.

Acquisition of Technology

Sabres SaaS Asset Purchase

On August 17, 2021, we entered into an asset purchase agreement to acquire certain technology assets of Sabres, a leading Israeli-based cyber security provider. As part of the asset purchase agreement, we acquired Multi-Dimensional Protection, Web Application Firewall and Bot Mitigation SaaS platforms, and their associated intellectual property. The transaction closed on September 30, 2021, and we have integrated the SaaS platforms into our existing services offerings.

Our Cycurion Security Platform’s (formerly Sabres’) line of products allows our customers to improve their cyber posture with its MDP SaaS platform. This platform efficiently bundles and easily implements the external protection of a Web Application Firewall (WAF) and the internal protection of Bot Mitigation. Bot Mitigation is the reduction of risk to applications, Application Program Interfaces (APIs), and backend services from malicious bot traffic that fuels common automated attacks, such as Distributed Denial of Service (DDoS) campaigns and vulnerability probing. The costs of single-layer security can be measured in terms of money, time, and risk, as well as the damage wrought by a data breach, which millions of businesses experience each year. Through this interaction of the WAF and Bot Mitigation, the MDP is able to reinforce these layers of security and generate new security layers in real time in response to emerging threats. This process is directed by our Cycurion Security Platform’s proprietary, cloud-based AI algorithm. Crucially, the AI underpinning the MDP platform is constantly evolving to counter new threats. Through a crowdsourcing process, the cloud-based MDP learns from every threat to any protected application and uses that newly acquired knowledge to protect all MDP clients better.

Our Cycurion Security Platform’s (formerly Sabres’) line of products provides solutions for substantially all web application security needs. These products provide solutions, whether a client is in need of a web application firewall to comply with regulations and ensure it has a first line of defense against the hazards that the internet can present or is in need of enterprise-level products that empower Security Operations Center (SOC) teams and security management. Our Cycurion Security Platform’s constantly survey a client’s data to detect security issues in need of attention, send automatic updates, and provide the client with a complete database of rules and threats.

We have integrated the technology assets that we acquired from Sabres (which now constitutes our Cycurion Security Platform) into our Managed Security Services Practice. We believe that the platform will enhance our service offerings and assist with the expansion of our commercial business. The Sabres platform will be managed by our dedicated support team, and will provide real time reporting, response to security incidents, and will manage all data privacy needs from a single SIEM SaaS platform dashboard.

Results of Operations for the years ended December 31, 2024 and 2023

Revenue

Revenues decreased $1,578,723 (8.16%) to $17,771,485 for the year ended December 31, 2024, as compared to $19,350,208 for the year ended December 31, 2023.

This decrease in the revenues for the year ended December 31, 2024 is attributed to the conclusion of key contracts with the federal government and state and local agencies, partially offset by new business segments and contracts.

Cost of Revenue

The cost of revenue for the year ended December 31, 2024, was approximately $14,136,742, nearly all of which is related to costs incurred while delivering services to our customers and expansion of our employee base to address our business growth. Conversely, the cost of revenue for the year ended December 31, 2023, was approximately $16,707,148, nearly all of which is related to costs incurred while servicing our contracts, including contractual and servicing obligations with our employees and contractors. This $2,570,406 (15.39%) decrease in the cost of revenues is directly attributable to lower contractor-related expenses.

Research and Development

We did not have any Research and Development expenses for the years ended December 31, 2024 and December 31, 2023.

Selling, General and Administrative

Selling, general and administrative (“SG&A”) expenses decreased by $1,098,019 (47.40%) to $1,218,630 for the year ended December 31, 2024, compared to $2,316,649 for the year ended December 31, 2023, respectively. This improvement was primarily due to reduced legal, administrative, and consulting fees in the 2024 fiscal year.

Interest and Other Expense

Interest and other expense was approximately $(1,186,512) and $(2,419,637) for the years ended December 31, 2024 and 2023, respectively. These expenses for the year ended December 31, 2024 include $1,209,502 in interest-related expenses and losses, related to the payment of our bank instrument, and other loan obligations. This $1,233,125 (50.96%) decrease of interest and other expenses is primarily due to reduced or renegotiated interest expenses in the 2024 fiscal year.

Cash Flows

30

Operating Activities

For the year ended December 31, 2024, net cash used by operating activities was $1,371,281, which included $1,229,601 in net profits, $3,238,749 increase in accounts receivable, $253,902 decrease in deferred revenue, and $908,854 increase in accounts and other payables. We also incurred a marginal $6,566 non-cash adjustment to the amortization of debt discount.

For the year ended December 31, 2023, net cash used in operating activities was $1,987,771, which included $2,097,013 in net losses, $4,636,805 increase in accounts receivable, $242,099 increase in deferred revenue, and $3,105,223 increase in accounts and other payables. We also incurred a $1,094,131 non-cash adjustment to the amortization of debt discount.

Investing Activities

For the year ended December 31, 2024, net cash used in investing activities was approximately $885,066. This was primarily used in the purchase of equipment, and servicing notes issued by WAVS.

For the year ended December 31, 2023, net cash used in investing activities was approximately $706,707. This was used in the purchase of equipment.

Financing Activities

For the year ended December 31, 2024, net cash provided by financing activities was $1,689,268. The net cash provided includes $1,000,000 in proceeds from a private placement, $405,000 in proceeds from notes payables and $252,314 in proceeds from our line of credit.

For the year ended December 31, 2023, net cash provided by financing activities was $3,206,162. The net cash provided includes $2,000,000 in proceeds from a private placement and $1,084,000 in proceeds from notes payables, offset by $193,305 used in the repayment of bank borrowings.

From the date of the closing of our de-SPAC transaction (February 14, 2025) to April 17, 2025, otherwise unaffiliated persons converted 2,999.3 shares of the Company’s Series B Preferred Stock into 5,998,653 shares of the Company’s common stock and 6,666,667 shares of the Company’s Series D Preferred Stock into 6,666,667 shares of the Company’s common stock.

From the date of the closing of our de-SPAC transaction (February 14, 2025) to April 17, 2025, otherwise unaffiliated persons exercised 694,530 Series A warrants for the purchase of 694,530 shares of the Company’s common stock; 2,400,000 Series B warrants for the purchase of 4,800,000 shares of the Company’s common stock; 4,382,033 Series D warrants for the purchase of 8,764,066 shares of the Company’s common stock; and 270,137 common stock warrants for the purchase of 270,137 shares of the Company’s common stock for gross proceeds of approximately $3.5 million.

Liquidity and Capital Resources

Going Concern

We have incurred operating losses since inception through the end of our 2023 fiscal year, having had negative cash flow from operations. As of December 31, 2024, we had an accumulated deficit of approximately $3,203,361, an improvement compared to our accumulated deficit of approximately $4,432,962 at December 31, 2023. The decline was the result of net profits of $1,229,601 incurred during our fiscal year 2024. Furthermore, we expect possible, significant operating losses for the next few years. We also utilized cash in operations of approximately $1,371,281 in the twelve months ended December 31, 2024. As of December 31, 2024, we had unrestricted cash of approximately $40.7 thousand, a decrease of $567 thousand from approximately $607 thousand at December 31, 2023. As of December 31, 2024, our total assets increased to approximately $25.7 million from approximately $20.8 million at December 31, 2023, primarily due to a $3.2 million increase in our accounts receivable and $1.8 million increase in investments held in trust. Based on our current capital resources as of December 31, 2024, including our unrestricted cash and accounts receivable (net) of $10.3 million, we expect to be able to continue our operations for a minimum of 12 months as of the date of these financial statements. We have added the following table that provides aging analysis of our accounts receivable. We provided an analysis of the accounts receivable for the years ending 2023 and 2024. As the company has broadened its business customer base, the nature of the payment and cash receipt cycle has change. Many of the corporate customers have longer payment terms. We expect that this trend to continue as we acquire additional commercial customers.

Accounts Receivable Aging Analysis without SLG ($)

Nevertheless, our continuation as a going concern is dependent on our ability to obtain additional financing until we can generate sufficient, consistent cash flow from operations to meet the expected growth in our obligations. We intend to continue to seek additional debt or equity financing to continue our operations.

Our consolidated financial statements have been prepared on a going concern basis, which implies we may not continue to meet our obligations and continue our operations for the next fiscal year. The continuation of our Company as a going concern is dependent upon our ability to obtain necessary debt or equity financing to continue operations until we begin generating positive cash flow.

There is no assurance that we will ever be consistently profitable or, notwithstanding our recent financing activities, that debt or equity financing will be available to us in the amounts, on terms, and at times deemed acceptable to us, if at all. The issuance of additional equity securities by us would result in a significant dilution in the equity interests of our current stockholders. Obtaining commercial loans, assuming those loans would be available, would increase our liabilities and future cash commitments. If we are unable to obtain financing in the amounts and on terms deemed acceptable to us, we may be unable to continue our business, as planned, and as a result may be required to scale back or cease operations for our business, the result of which would be that our stockholders would lose some or all of their investment. The consolidated financial statements do not include any adjustments to reflect the possible future effects on the recoverability and classification of assets or the amounts and classifications of liabilities that may result should we be unable to continue as a going concern.

Off-balance sheet arrangements

We did not have any off-balance sheet arrangements during the periods presented, and we do not currently have any off-balance sheet arrangements, as defined in the SEC rules and regulations.

Revenue Recognition

We adopted the new revenue standard, ASC 606, on January 1, 2018, using the full retrospective approach. The adoption did not have an effect on 2024 or 2023 revenue recognition or a cumulative effect on opening equity, as the timing and measurement of revenue recognition is materially the same as under ASC 605. The core principle of the new revenue standard is that a company should recognize revenue to depict the transfer of promised goods or services to customers in an amount that reflects the consideration to which the company expects to be entitled in exchange for those goods or services. The following five steps are applied to achieve that core principle:

• Step 1: Identify the contract with the customer
• Step 2: Identify the performance obligations in the contract
• Step 3: Determine the transaction price
• Step 4: Allocate the transaction price to the performance obligations in the contract
• Step 5: Recognize revenue when the company satisfies a performance obligation

For contracts where the period between when we transfer a promised good or service to the customer and when the customer pays is one year or less, we have elected the practical expedient to not adjust the promised amount of consideration for the effects of a significant financing component.

Stock-based compensation

We measure and recognize compensation expense for all options based on the estimated fair value of the award on the grant date. We use the Black-Scholes option-pricing model to estimate the fair value of option awards. The fair value is recognized as expense on a straight-line basis over the requisite service period. We account for forfeitures as they occur. We recognize expense for awards where vesting is subject to a market or performance condition based on the derived service period. Expense for awards with performance conditions would be estimated and adjusted on a quarterly basis based upon our assessment of the probability that the performance condition will be met.

The determination of the grant date fair value of options using an option pricing model is affected principally by our estimated fair value of shares of our Common Stock and requires management to make a number of other assumptions, including the expected life of the option, the volatility of the underlying shares, the risk-free interest rate and expected dividends. The assumptions used in our Black-Scholes option-pricing model represent management’s best estimates at the time of measurement. These estimates are complex, involve a number of variables, uncertainties and assumptions and the application of management’s judgment, as they are inherently subjective. If any assumptions change, our stock-based compensation expense could be materially different in the future.

These assumptions are estimated as follows:

• Fair Value of Common Stock. As our Common Stock has not historically been publicly traded, we estimated the fair value of our Common Stock. See “Fair Value of Common Stock” and “Common Stock Valuation Methodology” sections.
• Expected Term. The expected term represents the period that our options are expected to be outstanding. We calculated the expected term using the simplified method for options based on the average of each option’s vesting term and the contractual period during which the option can be exercised, which is typically 10 years following the date of grant.

32

• Expected Volatility. The expected volatility was based on the historical share volatility of several of our comparable publicly traded companies over a period of time equal to the expected term of the options, as we do not have any trading history to use the volatility of our Common Stock.
• Risk-Free Interest Rate. The risk-free interest rate was based on the yields of U.S. Treasury securities with maturities appropriate for the term of the award.
• Expected Dividend Yield. We have not paid dividends on our Common Stock nor do we expect to pay dividends in the foreseeable future.

Fair Value of Common Stock

Historically, for all periods prior to this offering, the fair values of the shares of Common Stock underlying our options were estimated on each grant date by our board of directors. In order to determine the fair value, our board of directors considered, among other things, contemporaneous valuations of our Common Stock and Preferred Stock prepared by unrelated third-party valuation firms in accordance with the guidance provided by the American Institute of Certified Public Accountants 2013 Practice Aid, Valuation of Privately-Held-Company Equity Securities Issued as Compensation, or the Practice Aid. Given the absence of a public trading market of our capital stock, our board of directors exercised reasonable judgment and considered a number of objective and subjective factors to determine the best estimate of the fair value of our Common Stock, including:

• Contemporaneous third-party valuations of our Common Stock;
• The prices, rights, preferences, and privileges of our Preferred Stock relative to our Common Stock;
• Our business, financial condition, and results of operations, including related industry trends affecting our operations;
• The likelihood of achieving a liquidity event, such as an initial public offering or sale of our company, given prevailing market conditions;
• The lack of marketability of our Common Stock;
• The market performance of comparable publicly traded companies; and
• U.S. and global economic and capital market conditions and outlook.

Critical accounting policies and significant judgments and estimates

Our financial statements are prepared in accordance with GAAP. The preparation of our financial statements requires us to make estimates, assumptions and judgments that affect the reported amounts of assets, liabilities, costs, and expenses. We base our estimates and assumptions on historical experience and other factors that we believe to be reasonable under the circumstances. We evaluate our estimates and assumptions on an ongoing basis. Our actual results may differ from these estimates. Our most critical accounting policies are summarized below. See Note 2 to our consolidated financial statements for the years ended December 31, 2024 and 2023 for a description of our other significant accounting policies.

We review goodwill and indefinite-lived intangible assets for impairment annually during the fourth quarter of each fiscal year or more frequently if impairment indicators arise. The review of impairment consists of using a qualitative approach to determine whether it is more than likely that the fair value of the assets is less than their respective carrying values or a one-step qualitative impairment test.

In performing the qualitative assessment, we consider many factors in evaluating whether the carrying value of goodwill may not be recoverable, including an analysis of the firm’s contract backlog and sales pipeline. While the contract backlog is confirmed contractual wins, the sales pipeline is evaluated by management to determine the uncertainty of the pipeline. Each potential contractual win is assigned a probability of win score to address the potential uncertainty. Thus, it provides a conservative estimate of any future contractual wins. If, based on the qualitative assessment results, it is concluded that the fair value of a reporting unit may not exceed its carrying value, additional quantitative impairment testing is performed.

The quantitative test requires that the carrying value of each reporting unit be compared with its estimated fair value. If the carrying value of a reporting unit is greater than its fair value, a goodwill impairment charge will be recorded for the difference (up to the carrying value of goodwill).

We use a discounted cash flow approach to determine the fair value of a reporting unit. The determination of discounted cash flows of the reporting units and assets and liabilities within the reporting units requires significant estimates and assumptions. These estimates and assumptions primarily include, but are not limited to, the discount rate being the weighted average cost of capital (WACC) for the firm, terminal growth rates, earnings before depreciation and amortization, and capital expenditures forecasts.

Due to the inherent uncertainty involved in making these estimates, actual results could differ from those estimates. We evaluate the merits of each significant assumption, both individually and in the aggregate, used to determine the fair value of the reporting units, as well as the fair values of the corresponding assets and liabilities within the reporting units.

Given that we operated at a net profit in 2024, we performed quantitative impairment testing as second step to validate our qualitative testing. Based on our quantitative impairment testing, the fair value of goodwill substantially exceeds the carrying value.

Goodwill

Recent accounting pronouncements

See Note 2 to our consolidated financial statements for the years ended December 31, 2024 and 2023 for a description of recent accounting pronouncements applicable to our financial statements.

We are a smaller reporting company as defined by Rule 12b-2 of the Exchange Act and are not required to provide information require under this item.

Evaluation of Disclosure control and Procedures.

We carried out an evaluation, under the supervision, and with the participation of our management, including our principal executive officer and principal financial officer, of the effectiveness of our disclosure controls and procedures (as defined in Exchange Act Rules 13a-15(e) and 15d-15(e)). Based upon that evaluation, our principal executive officer and principal financial officer concluded that, as of December 31, 2024, the period covered in this report, our disclosure controls and procedures were not effective to ensure that information required to be disclosed in reports filed under the Securities Exchange Act of 1934 is recorded, processed, summarized and reported within the required time periods and is accumulated and communicated to our management, including our principal executive officer and principal financial officer, as appropriate to allow timely decisions regarding required disclosure due to material weaknesses in internal control over financial reporting further described below.

Despite the identified material weaknesses, management concluded that the consolidated financial statements included in this Annual Report present fairly, in all material respects, the financial position, results of operations and cash flows for the periods disclosed in conformity with GAAP. WWC, P.C., the Company’s independent registered public accounting firm, has issued an unqualified opinion on our consolidated financial statements as of and for the year ended December 31, 2024. They were not engaged to perform, and did not perform, an audit of internal control over financial reporting. This material weakness has no impact on our consolidated financial statements in prior years.

Management’s Report on Internal Control Over Financial Reporting.

Our management is responsible for establishing and maintaining adequate internal control over financial reporting (as defined in Exchange Act Rules 13a-15(f) and 15d-15(f)). Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

The Company’s management, including the Company’s Chief Executive Officer and Chief Financial Officer, do not expect that the Company’s disclosure controls and procedures or the Company’s internal control over financial reporting will prevent or detect all errors and all fraud. A control system, regardless of how well conceived and operated, can provide only reasonable, not absolute, assurance that the objectives of the control system will be met. These inherent limitations include the following: judgements in decision-making can be faulty, and control and process breakdowns can occur because of simple errors or mistakes, controls can be circumvented by individuals, acting alone or in collusion with each other, or by management override. The design of any system of controls is based in part on certain assumptions about the likelihood of future events, and there can be no assurance that any design will succeed in achieving its stated goals under all potential future conditions. Over time, controls may become inadequate because of changes in conditions or deterioration in the degree of compliance with policies or procedures. Because of the inherent limitations in all control systems, no evaluation of controls can provide absolute assurance that all control issues and instances of fraud, if any, have been detected.

Material Weakness in Internal Control over Financial Reporting

Our management assessed the design and effectiveness of our internal control over financial reporting as of December 31, 2024. In making this assessment, we used the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO”) of 2013 regarding Internal Control – Integrated Framework. Based on that evaluation, management has concluded that the Company did not maintain effective internal control over financial reporting as of December 31, 2024 due to the material weakness described below.

• The Company does not have sufficient written documentation of our internal control policies and procedures. Written documentation of key internal controls over financial reporting is a requirement of Section 404 of the Sarbanes-Oxley Act; and
• Management does not have sufficient resources to maintain adequate segregation of duties and maintain its internal control environment.

In response to the above identified weaknesses in our internal control over financial reporting, we plan to improve the documentation of our internal control policies and procedures and develop an internal testing plan to document our evaluation of effectiveness of the internal controls. We expect to conclude these remediation initiatives during the fiscal year ended December 31, 2025. We continue to evaluate testing of our internal control policies and procedures, including assessing internal and external resources that may be available to complete these tasks, but do not know when these tasks will be completed.

Management’s Plan to Remediate the Material Weakness

A material weakness (within the meaning of PCAOB Auditing Standard No. 5) is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis. A significant deficiency is a deficiency, or a combination of deficiencies, in internal control over financial reporting that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the company’s financial reporting.

This Annual Report does not include an attestation report of our registered public accounting firm regarding internal control over financial reporting. Management’s report was not subject to attestation by our registered public accounting firm pursuant to temporary rules of the Securities and Exchange Commission that permit us to provide only management’s report in this Annual Report.

The financial statements for the year ended December 31, 2024 have been audited by the independent public accounting firm WWC, P.C. (“WWC”).

Changes in Internal Control Over Financial Reporting.

There were no changes in the Company’s internal control over financial reporting during the fiscal year ended December 31, 2024 that have materially affected, or are reasonably likely to materially affect, the Company’s internal control over financial reporting.