AWARE INC /MA/ 10-K

ITEM 1. BUSINESS Company Overview Aware, Inc. (“Aware”, “we”, “us”, “our”, or the “Company”) is a leading, biometric identification company that validates and secures identities using proven and trusted biometrics. Aware’s software offerings address the growing challenges that government and commercial enterprises face in knowing, authenticating and securing individuals through frictionless and highly secure user experiences. Aware’s algorithms are based on diverse data sets from around the world and can be tailored to the unique security requirements of each customer. Our portfolio enables government agencies and commercial entities to enroll, identify, authenticate and enable using biometrics, which comprise physiological characteristics, such as fingerprints, faces, irises and voices. • Enroll: Register biometric identities into an organization’s secure database • Identify: Utilize an organization’s secure database to accurately identify individuals using biometric data • Authenticate: Provide frictionless, multi-factor, password-less access to secured accounts and databases with biometric verification • Enable: Manage the lifecycle of secure identities through optimized biometric interchanges Our comprehensive portfolio of biometric solutions is based on innovative, robust products designed explicitly for ease of integration, including customer-managed and integration ready biometric frameworks, platforms, software development kits (“SDKs”) and services. Principal government applications of biometrics systems include border control, visa applicant screening, law enforcement, national defense, intelligence, secure credentialing, access control, and background checks. Principal commercial applications include mobile enrollment, user authentication, identity proofing, and secure transaction enablement. Our products span multiple biometric modalities, including fingerprint, face, iris and voice, and provide interoperable, standards-compliant, field-proven biometric functionality. Our products are used to capture, verify, format, compress and decompress biometric images as well as aggregate, analyze, process, match and transport those images and templates within biometric systems. For large deployments, we may provide project management and software engineering services. We sell our biometrics software products and services globally through a multifaceted distribution strategy using systems integrators, original equipment manufacturers (“OEMs”), value added resellers (“VARs”), partners, and directly to select end user customers. Aware was incorporated in Massachusetts in 1986. We are headquartered at 76 Blanchard Road in Burlington, Massachusetts, and our telephone number at this address is (781) 687-0300. Our website address is www.aware.com. The information on our website is not part of this Form 10-K, unless expressly noted. Our stock is traded on the Nasdaq Global Market under the symbol AWRE. Principal Products & Services We sell a broad range of biometrics software products and solutions that perform functions to address our customers’ desired use cases where they are addressing improved security, data protection, compliance and improved ROI and efficiencies including: 1. Enrollment of their workforce for benefits and background checks 2. Enrollment of their customers for a better experience or improved customer service and security 3. Law enforcement processing and forensic analysis 4. Trusted remote enrollment where travel or direct contact is not viable 5. Trusted transactions and authentication that enable physical and logical access control Our biometrics software solutions are built upon robust componentized products that are customer configurable to give them control so they can uniquely address their specific customers’ expectations. These solutions and services facilitate customers with an opportunity for a faster go-to-market process to help reduce their development times and exposure to software support and maintenance risks. Our solutions and services are described below. 3 Integrated Framework and Platform Solutions and Services Knomi® Mobile Framework The Knomi mobile biometric authentication framework is built on our hardened biometric SDK components, which are optimized to operate on mobile devices, and a server that together enable strong, multi-factor, password-free authentication from a mobile device using biometrics. Knomi offers multiple biometric modality options, including facial recognition, and voice authentication as means to enroll, onboard or authenticate. Knomi software components can be used in different combinations and configurations to enable either a server-centric architecture, a web-based or a device-centric implementation. Knomi has primarily been sold as a fixed term license that is priced on a subscription-based model and is also available as a perpetual license. Going forward we plan to transition the Knomi offering to within the AwareID offering. AwareABIS™ AwareABIS is an automated biometric identification system (“ABIS”) used for large-scale biometric identification and deduplication using fingerprint, face, and iris recognition. AwareABIS is a highly scalable platform that performs one-to-many ("1:N") search or one-to-one ("1:1") match against large stores of biometrics and other identity data. Utilizing distributed computing, AwareABIS also enables complex filtering, and linking operations critical to data preparation and quality assurance functions, such as identity resolution and data deduplication of massive biometric databases (tens of millions of records). The platform is built upon several mature, high-performance, field-proven applications and algorithms from Aware. AwareABIS has primarily been sold as a fixed term license that is priced based on the size of the biometric system or on a subscription-based model. AFIX Suite of Products Aware’s AFIX suite of products is used for small-scale law enforcement focused biometric identification. AFIX Tracker™ supports fingerprint, palmprint and latent print identification, designed to serve between 15,000 and 2 million identities. AFIX Tracker has several function-specific variants: Entry Only (LE), Latent Workstation (LW), Remote Workstation (RW), Facial Recognition (FR), and View & Print (VP). In addition to AFIX Tracker we also sell and offer AFIX Face, AFIX Verifier, AFIX Identifier, AFIX Comparator, AFIX Engine, and ANTE (AFIX NIST Transaction Engine). AFIX Tracker is ideal for crime scene investigation applications in low to moderate sized community populations. The product provides minutiae-based search capability and can be configured as either a standalone system, or for use with centralized, server-based data stores. AFIX Tracker has primarily been sold as a perpetual license and is also available as a fixed term license that is priced on a subscription-based model or the size of the biometric system. BioSP™ - Biometric Services Platform BioSP is a biometric integration platform-as-a-service ("iPaaS") used to enable biometric data processing and management functionality in a web services architecture. It provides workflow, data management and formatting, and other important utilities for large-scale fingerprint recognition, face recognition, and iris recognition systems. BioSP is well suited for applications that require the collection of biometrics throughout a distributed network, and subsequent aggregation, analysis, processing, distribution, matching, and sharing of data with other system components. BioSP is modular, programmable, scalable, and secure, capable of managing all aspects of transaction workflow, including messaging, submissions, responses, and logging. BioSP has primarily been sold as a perpetual license and is also available as a fixed term license that is priced on users, transactions, or enterprise wide. WebEnroll WebEnroll is a browser-based biometric enrollment and data management solution available as an enhanced version of BioSP™ that utilizes BioComponents™ for capture of biographic data, fingerprints and facial images in a browser. Each BioComponent performs advanced biometric image autocapture as well as capture device hardware abstraction. Once images are captured, they are submitted to BioSP, where configurable workflows and modular software applications are used for processing, routing, and storage of each transaction. WebEnroll has primarily been sold as a perpetual license and is also available as a fixed term license that is priced on users, transactions, or enterprise wide. 4 AwareID™ AwareID ™ is a Software-as-a-Service (SaaS) offering that provides advanced identity verification and continuous authentication capabilities. Its modular design ensures flexibility and extensibility across various industries. AwareID continues to leverage Knomi to provide biometric face and voice matching (1:1 and 1:N), liveness-verification (presentation attack detection), and document validation. The platform uses proprietary Adaptive Authentication technology in cloud-based bundles which can be pre-configured and/or configured by the customer to provide comprehensive authentication functionality with situational awareness for onboarding, access control/management, and authentication of transactions. These services can be used discretely to enhance investments already in place or combined to provide higher functionality. The AwareID solution is built on open architecture and interfaces to maximize interoperability and connection to other biometric and/or digital identity applications and platforms. AwareID is typically provided as a SaaS offering with usage-based or transaction-based pricing, however it is also available on-premises when leveraging Knomi SDKs. Software products We sell a broad range of software components, or “building blocks”, such as SDKs, APIs, and applications that customers use to streamline or develop their systems into more effective solutions. These building blocks enable important functions including: 1. Matching of biometric samples against biometric databases. 2. Enrollment, analysis, and processing of biometric images and identity data on workstations. 3. Image compression BioComponents™ bundles our offerings as applications with a user interface. We also license our software unbundled as building blocks and have primarily sold these offerings as a perpetual license. Historically, we sold our software products under perpetual or fixed-term licenses. With the introduction of AwareID, we have incorporated SaaS offerings into our product line-up. While we did not recognize material revenues from our SaaS offerings during 2024 and 2023, we continue to invest in and we expect SaaS to become a significant product offering moving forward. Building Blocks: SDKs, APIs, Applications, and Subsystems Biometric Search & Matching SDKs Our SDKs consist of: i) multiple software libraries; ii) sample applications that show customers how to use the libraries; and iii) documentation. Customers use our SDKs to design and develop biometrics applications. Nexa™ is our line of biometric search and match SDKs, including Nexa|Fingerprint™, Nexa|Face™, Nexa|Iris™ and Nexa|Voice™. These products provide high-performance biometric algorithms for fingerprint, facial, iris and voice identification or authentication. The algorithms in these products convert images into biometric templates, which can then be compared to templates stored in databases to find matches. In addition to the Nexa line, we also offer AwareXM™, an interoperable fingerprint matching SDK that provides MINEX-certified, INCITS 378-compliant fingerprint minutiae extraction, template generation, and fingerprint authentication. Biometric Enrollment SDKs and APIs Our suite of enrollment SDKs and APIs performs functions that are critical to biometric enrollment, including (i) image capture and hardware abstraction, (ii) image quality assurance, (iii) image compression, (iv) mobile enrollment, matching and liveness verification, and (v) fingerprint card processing. Imaging products In addition to our biometrics software products, we also sell products used in applications involving medical and advanced imaging. Our principal imaging product is Aware JPEG 2000, which is based on the JPEG2000 standard. The JPEG2000 standard is an image compression standard and coding system that was created by the Joint 5 Photographic Experts Group committee in 2000. Our JPEG2000 product is used to compress, store, and display images. Those images are typically medical images. Software maintenance We also provide and sell software maintenance to many of our customers who purchase our software products and solutions. Software maintenance has historically been made available by contracts that typically have a one-year term during which customers have the right to receive technical support and software updates for a fixed fee, if and when they become available. Software maintenance is also available as part of a subscription-based solution offering under which customers receive standard software maintenance plus access to upgrades and product enhancements. Services We provide a variety of program management and software engineering services, including: i) project planning and management; ii) system and architecture design; iii) software design, development, customization, configuration, and testing; and iv) software integration and installation. Services are sold in conjunction with our products and solutions and are provided for a fixed fee. Service engagement deliverables may include: i) complete customer software solutions; ii) one or more subsystems comprised of software products that are integrated within a larger system; iii) custom-configured versions of existing software products; or iv) custom-designed software products. In some cases, the software resulting from service engagements may form the basis for new or improved Aware software solutions and/or products. Our customers for services include: i) government agencies; ii) large multinational systems integrators; iii) smaller systems integrators with a particular market, technology or geographic focus; and iv) commercial partners or providers of products, solutions, and services for themselves or to their end customers. We provide services directly to end-users or indirectly to end-users through systems integrators or commercial entities or partners. When we provide services to systems integrators, they are often engaged with the end-user as a prime contractor and are responsible for delivery of a complete solution, in which case we typically serve as a subcontractor assigned a subset of the total scope of work. The scope of our services projects varies. A small project might involve configuration and testing of a single software product, taking a small team one month or less. A large project might involve delivery of a more complex solution comprised of multiple products and subsystems, requiring a larger team to conduct program and project management, system design, software customization and integration, and taking up to one year or more. Some projects are followed by subsequent follow-on projects that serve to change or extend the features and functionality of the initial system. Distribution Methods We sell our solutions and services predominantly through three principal channels of distribution: i) Partner sales – This category includes resellers that market and sell Aware-branded solutions to end users. Additionally, this category includes system integrators, consulting partners, independent software vendors (ISVs), distributors, and managed service providers (MSPs) that market, sell, deploy, and support our solutions. It also includes referral partners who identify opportunities but do not resell or directly deliver solutions. ii) Direct channel – We sell directly to federal, state, and local government agencies, as well as large enterprise customers in both the public and commercial sectors. iii) OEM partnerships – System integrators, ISVs, MSPs, and hardware vendors that integrate our biometric components and SDKs into their platforms or applications, which are then sold independently. Major Customers All of our revenue in 2024 and 2023 was derived from unaffiliated customers. No customer represented 10% or more of total revenue in 2024, and one customer represented 18% of total revenue in 2023. As of December 31, 2024, two customers combined represented 34% of our net accounts receivable and unbilled receivables, and as of December 31, 2023, one customer represented 16%, of our net accounts receivable and unbilled receivables. 6 Competitive Business Conditions A significant number of established companies have developed or are developing and marketing software and hardware for biometrics products and applications that currently compete with or will compete directly with our offerings. We believe that additional competitors will enter the biometrics market and become significant long-term competitors, and that, as a result, competition will increase. Companies competing with us may introduce solutions that are competitively priced, have increased performance or functionality or incorporate technological advances we have not yet developed or implemented. Our current principal competitors include: • Diversified technology providers that offer integrated biometrics solutions to governments, law enforcement agencies and other commercial organizations. This group of competitors includes companies such as Idemia, Thales, and NEC. • Component providers that offer biometrics software and hardware components for fingerprint, facial, iris and voice biometric identification. This group of competitors includes companies such as FaceTec, iProov, and Innovatrics. We expect competition to intensify in the near term in the biometrics market. Many current and potential competitors have substantially greater financial, marketing, and research resources than we have. Moreover, low-cost foreign competitors have demonstrated a willingness to sell their products at significantly reduced prices. To compete effectively in this environment, we must continually develop and market new and enhanced solutions and technologies at competitive prices, and must have the resources available to invest in significant research and development activities. Our failure to compete successfully could cause our revenues and market share to decline. Intellectual Property We rely on a combination of nondisclosure agreements and other contractual provisions, as well as patent, trademark, trade secret and copyright law to protect our proprietary rights. We have an active program to protect our proprietary technology through the filing of patents. As of December 31, 2024, we had 68 U.S. patents, 4 foreign patents and 7 pending patent applications. Our patents and patent applications pertain primarily to biometrics and imaging compression. We have let certain patents expire that are not aligned with our business and are not relevant to our current or future activities. Our patents have expiration dates ranging from 2026 to 2042. Although we have patented certain aspects of our technology, we rely primarily on trade secrets to protect our intellectual property. We attempt to protect our trade secrets and other proprietary information through agreements with our customers, suppliers, employees and consultants, and through security measures. Each of our employees is required to sign a non-disclosure agreement. Although we intend to protect our rights vigorously, we cannot guarantee that these measures will be successful. In addition, effective intellectual property protection may be unavailable or limited in certain foreign countries. Third parties may assert exclusive patent, copyright and other intellectual property rights to technologies that are important to us. We may receive claims from third parties suggesting that we may be obligated to license such intellectual property rights. If we were found to have infringed any third party’s patents, we could be subject to substantial damages or an injunction preventing us from conducting our business. Employees As of December 31, 2024, we employed 64 people, all based in the U.S., including 33 in engineering and research, 20 in sales and marketing, and 11 in finance and administration. Of these employees, 47 were based in Massachusetts and 17 were based outside of Massachusetts. None of our employees are represented by a labor union. We consider our employee relations to be good. We believe that our future success will depend in large part on the service of our technical, sales, marketing and senior management personnel and upon our ability to retain highly qualified technical, sales and marketing and managerial personnel. We cannot guarantee that we will be able to retain our key managers and employees or that we will be able to attract and retain additional highly qualified personnel in the future. 7 Available Information Our Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, proxy statements, and amendments to reports filed pursuant to Sections 13(a) and 15(d) of the Securities Exchange Act of 1934, as amended, are made available free of charge on or through our website at www.aware.com as soon as reasonably practicable after such reports are filed with, or furnished to, the Securities and Exchange Commission (“the SEC”). The SEC also maintains a website, www.sec.gov, that contains reports and other information regarding issuers that file electronically with the SEC. Copies of our (i) Corporate Governance Principles, (ii) charters for the Audit Committee, Compensation Committee, and Nominating Committee, and (iii) Code of Ethics are available in the Investor Relations section of our website at www.aware.com. ITEM 1A. Ri sk Factors Our operating results may fluctuate significantly from period-to-period and are difficult to predict. Individual orders can represent a meaningful percentage of our revenues and operating results in any single period and the timing of the receipt of those orders is difficult to predict. The failure to close an order or the deferral or cancellation of an order can result in revenue and net income shortfalls for that quarter. We base our current and future expense levels on our internal operating plans and sales forecasts, and our operating costs are to a large extent fixed. As a result, we may not be able to sufficiently reduce our costs in any quarter to adequately compensate for an unexpected near-term shortfall in revenues, and even a small shortfall could disproportionately and adversely affect our financial results for that quarter. Our financial results may be negatively affected by a number of factors as well, including the following: • any lack or reduction of government funding and the political, budgetary and purchasing constraints of government customers who purchase products and services directly or indirectly from us; • the terms of customer contracts that affect the timing of revenue recognition; • the size and timing of our receipt of customer orders; • significant fluctuations in demand for our products and services; • any loss of a key customer or one of its key customers; • new competitors entering our markets, or the introduction of enhanced solutions from new or existing competitors; • competitive pressures on selling prices; • any cancellations, or delays of orders or contract amendments by government customers; • higher than expected costs, asset write-offs, and other one-time financial charges; and • general economic trends and other factors. • write-offs of investments in private companies; As a result of these factors, we believe that period-to-period comparisons of our revenue levels and operating results are not necessarily meaningful. You should not rely on our quarterly or annual revenue and operating results to predict our future performance. We derive a significant portion of our revenue directly or indirectly from government customers, and our business may be adversely affected by changes in the contracting or fiscal policies of those governmental entities. We derive a significant portion of our revenue directly or indirectly from federal, international, state and local governments. We believe that the success and growth of our business will continue to depend on government customers purchasing our products and services either directly from us or indirectly through our channel partners. 8 Changes in government contracting policies or government budgetary constraints may adversely affect our financial performance. Among the factors that could adversely affect our business are: • the impact of actions, such as those recently announced by the U.S. Department of Government Efficiency, intended to reduce the size of the federal government and federal spending, • other changes in fiscal policies or decreases in available government funding, • changes in government funding priorities; • changes in government programs or applicable requirements; • the adoption of new laws or regulations or changes to existing laws or regulations relating to the provision of biometrics services or the use of biometric data; • changes in political or social attitudes with respect to security and defense issues; • changes in audit policies and procedures of government entities; • potential delays or changes in the government appropriations process; and • delays in the payment of our invoices by government payment offices. These and other factors could cause government customers or our channel partners to reduce purchases of products and services from us, which would have a material adverse effect on our business, financial condition and operating results. We derive a significant portion of our revenue from third party channel partners. Our future results depend upon the continued successful distribution of our products through a channel of systems integrators and OEM partners. Systems integrators, including VARs, use our software products as a component of the biometrics systems they deliver to their customers. OEMs embed our software products in their technology devices or software products. These channel partners typically sell their products and services to government customers. Our failure to effectively manage our relationships with these third parties could impair the success of our sales, marketing and support activities. Moreover, the activities of these third parties are not within our direct control. The occurrence of any of the following events could have a material adverse effect on our business, financial condition and operating results: • a reduction in sales efforts by our partners; • the failure of our partners to win awards in which our products are used; • a reduction in technical capabilities or financial viability of our partners; • a misalignment of interest between us and any of our partners; • the termination of our relationship with a major systems integrator or OEM; or • any adverse effect on a partner’s business related to competition, pricing or other factors. A significant commercial market for biometrics technology may not develop, and, even if it does, there can be no assurance our biometrics technology will be successful. A component of our strategy to grow our revenue includes expansion into commercial markets. To date, biometrics technology has received only limited acceptance and slow adoption in these markets. Although the recent appearance of biometric readers on popular consumer products, such as smartphones, has increased interest in biometrics as a means of authenticating and/or identifying individuals, commercial markets for biometrics technology are still developing and evolving. Biometrics-based solutions compete with more traditional security methods including keys, cards, personal identification numbers, passwords and security personnel. Acceptance of biometrics as an alternative to such traditional methods depends upon a number of factors including: i) the performance and reliability of biometric 9 solutions; ii) costs involved in adopting and integrating biometric solutions; iii) public concerns regarding privacy; and iv) potential privacy legislation. For these reasons, we are uncertain whether there will be significant demand for biometrics technology from commercial markets. Moreover, even if there is significant demand, there can be no assurance that our biometrics products will achieve market acceptance. If the biometrics market does not experience significant growth or if our products do not achieve broad acceptance both domestically and internationally, we may not be able to grow our business. Our revenues are derived primarily from sales of biometrics products and services. Our expectations regarding the future growth rate or the size of the biometrics market may not be accurate. The expansion of the biometrics market and the market for our biometrics products and services depends on a number of factors, such as: • the cost, performance and reliability of our products and services and the products and services offered by our competitors; • the continued growth in demand for biometrics solutions within the government and law enforcement markets, as well as the development and growth of demand for biometric solutions in markets outside of government and law enforcement; • customers’ perceptions regarding the benefits of biometrics solutions; • public perceptions regarding the intrusiveness of these solutions and the manner in which organizations use the biometric information collected; • public perceptions regarding the confidentiality of private information; • proposed or enacted legislation related to privacy of biometric information; • customers’ satisfaction with biometrics solutions; and • marketing efforts and publicity regarding biometrics solutions. Even if biometrics solutions gain wide market acceptance, our solutions may not adequately address market requirements and may not continue to gain market acceptance. If biometrics solutions generally or our solutions specifically do not gain wide market acceptance, we may not be able to achieve our anticipated level of growth and our revenues, and our results of operations would be adversely affected. We face intense competition from other biometrics solutions providers. A significant number of established companies have developed or are developing and marketing software and hardware for biometrics products and applications that currently compete with or will compete directly with our offerings. We believe that additional competitors will enter the biometrics market and become significant long-term competitors, and that, as a result, competition will increase. Companies competing with us may introduce solutions that are competitively priced, have increased performance or functionality or incorporate technological advances we have not yet developed or implemented. Our current principal competitors include: • Diversified technology providers that offer integrated biometrics solutions to governments, law enforcement agencies and other organizations. This group of competitors includes companies such as Idemia, Thales, and NEC. • Component providers that offer biometrics software and hardware components for fingerprint, facial, iris and voice biometric identification. This group of competitors includes companies such as FaceTec, iProov, and Innovatrics. We expect competition to intensify in the near term in the biometrics market. Many current and potential competitors have substantially greater financial, marketing, and research resources than we have. Moreover, low-cost foreign competitors from developing economies and other countries have demonstrated a willingness to sell their products at significantly reduced prices. To compete effectively in this environment, we must continually develop and market new and enhanced solutions and technologies at competitive prices and must have the resources available to invest in significant research and development activities. Our failure to compete successfully could cause our revenues and market share to decline. 10 The biometrics industry is characterized by rapid technological change and evolving industry standards, which could render our existing products obsolete. Our future success will depend upon our ability to develop and introduce a variety of new capabilities and enhancements to our existing products in order to address the changing and sophisticated needs of the marketplace. Frequently, technical development programs in the biometrics industry require assessments to be made of the future direction of technology, which is inherently difficult to predict. Delays in introducing new products and enhancements, the failure to choose correctly among technical alternatives or the failure to offer innovative products or enhancements at competitive prices may cause customers to forego purchases of our products and purchase our competitors’ products. We may not have adequate resources available to us or may not adequately keep pace with appropriate requirements in order to effectively compete in the marketplace. Our software products may have errors, defects or bugs, which could result in delayed or lost revenue, expensive correction, liability to our customers, and claims against us. Despite testing, complex software products such as ours may contain errors, defects, or bugs, which may only be discovered after they have been installed and used by our customers. Defects in the products that we develop and sell to our customers could require expensive corrections and result in delayed or lost revenue, adverse customer reaction and negative publicity about us or our products and services. Customers who are not satisfied with any of our products may also bring claims against us for damages, which, even if unsuccessful, would likely be time-consuming to defend, and could result in costly litigation and payment of damages. Such claims could harm our reputation, financial results and competitive position. Our business may be adversely affected by our use of open-source software. The software industry is making increasing use of open-source software in the development of products. We also license and integrate certain open-source software components from third parties into our software. Open-source software license agreements may require that the software code in these components or the software into which they are integrated be freely accessible under open-source terms. Many features we may wish to add to our products in the future may be available as open-source software and our development team may wish to make use of this software to reduce development costs and speed up the development process. While we carefully monitor the use of all open-source software and try to ensure that no open-source software is used in such a way as to require us to disclose the source code to the related product, such use could inadvertently occur. If we were required to make our software freely available, our business could be seriously harmed. We rely on third-party software to develop and provide our solutions and significant defects in third-party software could harm our business. We rely on software licensed from third parties to develop and offer some of our solutions. In addition, we may need to obtain future licenses from third parties to use software or other intellectual property associated with our solutions. We cannot assure you that these licenses will be available to us on acceptable terms, without significant price increases or at all. Any loss of the right to use any such software or other intellectual property required for the development and maintenance of our solutions could result in delays in the provision of our solutions until equivalent technology is either developed by us or, if available from others, is identified, obtained, and integrated, which could harm our business. Any errors or defects in third-party software could result in errors or a failure of our solutions, which could harm our business. We rely on third-party relationships. We have a number of relationships with third parties that are significant to our sales, marketing, support, and product development efforts, including hosting facilities for our cloud-based services. We rely on software and hardware vendors, large system integrators, and technology consulting firms to supply marketing and sales opportunities for our direct sales force and to strengthen our offerings using industry-standard tools and utilities. We also have relationships with third parties that distribute our products. There can be no assurance that these companies, many of which have far greater financial and marketing resources than us, will not develop or market offerings that compete with ours in the future or will not otherwise end or limit their relationships with us. Further, the use of third-party hosting facilities requires us to rely on the functionality and availability of the third parties’ services, as well as their data security, which despite our due diligence, may be or become inadequate. 11 Part of our future business is dependent on market demand for, and acceptance of, the cloud-based model for the use of software. We expect to derive a growing percentage of our revenue from the sale of cloud-based services. As a result, widespread acceptance and use of the cloud-based business model is critical to our future growth and success. While cloud-based solutions are widely adopted across many software sub-sectors, certain industries, such as security and government, have been slower to transition due to concerns over data control, privacy, and regulatory compliance. Under the perpetual or fixed-term license model for software procurement, users typically run applications on their own infrastructure, maintaining direct control over their IT environment. Government agencies and security-conscious enterprises may be particularly resistant to shifting mission-critical applications and sensitive data to cloud-based environments due to stringent security requirements, compliance mandates, and perceived risks associated with third-party hosting. If the adoption of cloud-based solutions in these sectors grows more slowly than anticipated or fails to gain traction, demand for our services could be negatively affected, which may, in turn, impact our future growth. Our operational systems, networks and products are subject to continually evolving cybersecurity or other technological risks, which could result in the disclosure of our or our customers' confidential information, damage to our reputation, additional costs, regulatory penalties and financial losses. Our products, services and systems may be used in critical company, customer or third-party operations, or involve the storage, processing and transmission of sensitive data, including valuable intellectual property, other proprietary or confidential data, regulated data, and personal information of employees, customers and others. Successful breaches, employee malfeasance, or human or technological error could result in, for example, unauthorized access to, disclosure, modification, misuse, loss, or destruction of company, customer, or other third party data or systems; theft of sensitive, regulated, or confidential data including personal information and intellectual property; the loss of access to critical data or systems through ransomware, destructive attacks or other means; and business delays, service or system disruptions or denials of service. If we or third parties with which we do business were to fall victim to successful cyber-attacks or experience other cybersecurity incidents, including the loss of individually identifiable customer or other sensitive data, we may incur substantial costs and suffer other negative consequences, which may include remediation costs, such as liability for stolen assets or information, repairs of system damage, and incentives to customers or business partners in an effort to maintain relationships after an attack as well as litigation and legal risks, including regulatory actions by state and federal regulators. Our intellectual property is subject to limited protection. Because we are a technology provider, our ability to protect our intellectual property and to operate without infringing the intellectual property rights of others is critical to our success. We regard our technology as proprietary. We rely on a combination of U.S. and worldwide patent, trade secret, copyright, and trademark law as well as confidentiality agreements to protect our proprietary technology. We cannot assure you that we will be able to enforce the patents we own against third parties. Some foreign countries do not currently provide effective legal protection for intellectual property and our ability to prevent the unauthorized use of our products in those countries is therefore limited. Despite our efforts, these measures can only provide limited protection. Unauthorized third parties may try to copy or reverse engineer portions of our products or otherwise obtain and use our intellectual property. If we fail to protect our intellectual property rights adequately, our competitors may gain access to our technology, and our business would thus be harmed. In the future, we may be involved in legal action to enforce our intellectual property rights relating to our patents, copyrights or trade secrets. Any such litigation could be costly and time-consuming for us, even if we were to prevail. Moreover, even if we are successful in protecting our proprietary information, our competitors may independently develop technologies substantially equivalent or superior to our technology. Accordingly, despite our efforts, we may be unable to prevent third parties from infringing upon or misappropriating our intellectual property or otherwise gaining access to our technology. The misappropriation of our technology or the development of competitive technology could seriously harm our business. We may be sued by third parties for alleged infringement of their proprietary rights . We may be subject to claims that our technology and products infringe the intellectual property rights of others. A large and increasing number of participants in the technology industry, including companies known as non-practicing entities, have applied for or obtained patents. Some of these patent holders have demonstrated a readiness to commence 12 litigation based on allegations of patent infringement. Third parties have asserted against us in the past and may assert against us in the future patent, copyright and other intellectual property rights to technologies that are important to our business. Intellectual property rights can be uncertain and involve complex legal and factual questions. Moreover, intellectual property claims, with or without merit, can be time-consuming and expensive to litigate or settle, and could divert management attention away from the execution of our business plan. If we were found to have infringed the proprietary rights of others, we could be subject to substantial damages or an injunction preventing us from conducting our business. If we are unable to attract and retain key personnel, our business could be harmed. If any of our key employees were to leave, we could face substantial difficulty in hiring qualified successors and could experience a loss in productivity while any successor obtains the necessary training and experience. Our employment relationships are at-will and we have had key employees leave in the past. We cannot assure you that one or more key employees will not leave in the future. We intend to continue to hire additional highly qualified personnel, including software engineers and sales personnel, but may not be able to attract, assimilate or retain qualified personnel in the future. Any failure to attract, integrate, motivate and retain these employees could harm our business. Our business may be affected by government laws and regulations. Extensive regulation under federal, state, and foreign law has adversely affected us and could further adversely affect us in ways that are difficult for us to predict. More specifically, we are subject to regulatory environment changes regarding privacy and data protection that could have a material impact on our results of operations. These regulatory changes may potentially involve new regulatory issues/requirements such as the EU General Data Protection Regulation (“GDPR”), the California Privacy Rights Act (“CPRA”) and other comprehensive state privacy laws, the Illinois Biometric Privacy Act, Texas Statute on the Capture or Use of Biometric Identifier, State of Washington H.B. 1493, Brazil’s General Data Protection Law (“LGPD”) and any other state, federal or foreign regulations governing the collection, use and storage of biometric data. The potential costs of compliance with or imposed by new/existing regulations and policies that are applicable to us, or fines and penalties to which we may become subject if we fail to comply with those regulations and polices, may affect the use of our products and services and could have a material adverse impact on our results of operations. In addition, our business may also be adversely affected by: i) the imposition of tariffs, duties and other import restrictions on goods and services we purchase from non-domestic suppliers; ii) the imposition of tariffs, duties or other restrictions on the goods and services we provide outside of the United States; iii) the imposition of economic sanctions on existing or potential customers or suppliers, or iv) by the imposition of export restrictions on products we sell internationally. Changes in current or future laws or regulations, in the United States or elsewhere, could seriously harm our business. Adverse economic conditions could harm our business. Unfavorable changes in economic conditions, including recessions, inflation, turmoil in financial markets, changes caused by global crisis such as a pandemic, the ongoing conflict between Russia and Ukraine and resulting economic sanctions, conflicts in the Middle East, or other changes in economic conditions, could harm our business, results of operations, and financial conditions as a result of: • reduced demand for our products; • increased risk of order cancellations or delays; • increased pressure on the prices for our products; • greater difficulty in collecting accounts receivable; • risks to our liquidity, including the possibility that we might not have access to our cash when needed; and • rising interest rates, recessionary cycles, and inflationary pressures, that could make our products more expensive or could increase our costs. 13 • health epidemics, impacting the markets and communities in which we, our partners and clients operate. We are unable to predict whether or when any such adverse economic conditions could occur in the U.S. or other countries; and if they do occur, we cannot predict the timing, duration, or severity. We may not realize the anticipated benefits of our acquisitions or investments. We may make acquisitions of or investments in companies that offer complementary products, services, and technologies, such as our acquisition of FortressID in December of 2021 and our investment in Omlis Limited. The ultimate success of our acquisitions depends, in part, on our ability to realize the anticipated synergies, cost savings and growth opportunities from integrating acquired businesses or assets into our existing businesses. However, the acquisition and successful integration of independent businesses or assets is a complex, costly and time-consuming process, and the benefits we realize may not exceed the costs of the acquisition. The risk and difficulties associated with acquiring and integrating companies and other assets include, among others, difficulties assimilating the operations and personnel of acquired companies, challenges in realizing the value of the acquired assets relative to the price paid, distraction of management from our ongoing businesses and potential product disruptions associated with the sale of the acquired company’s products. These factors could have a material adverse effect on our business, financial condition, operating results and cash flows. Additionally, our acquisitions have provided, in the case of Fortress ID, and may in the future provide for future contingent acquisition payments, based on the achievement of performance targets or milestones. These arrangements can impact or restrict integration of acquired businesses and can result in disputes, including litigation. In addition, there is uncertainty regarding the realizability of investments in private companies, such as our investment in Omlis Limited that was written down to $0 in 2023. Additionally, regardless of the form of consideration we pay, acquisitions and investments could negatively impact our operations and earnings per share. We may have additional tax liabilities. We are subject to income taxes in the United States and, in certain cases, in foreign jurisdictions. Significant judgments are required in determining our provisions for income taxes. In the course of preparing our tax provisions and returns, we must make calculations where the ultimate tax determination may be uncertain. Our tax returns are subject to examination by the Internal Revenue Service (“IRS”) and state tax authorities. There can be no assurance as to the outcome of these examinations. If the ultimate determination of taxes owed—including income taxes, value-added tax (“VAT”), goods and services tax (“GST”), or other foreign tax obligations—exceeds amounts previously accrued, our operating results, cash flows, and financial condition could be adversely affected. The market price of our common stock has been and may continue to be subject to wide fluctuations, and this may make it difficult for shareholders to resell the common stock when they want or at prices they find attractive. The market price of our common stock, like that of other technology companies, is volatile and is subject to wide fluctuations in response to a variety of factors, including: • variations in operating results; • announcements of technological innovations or new products by us or our competitors, • changes in customer relationships, such as the loss of a key customer; • recruitment or departure of key personnel; • trading volume of our common stock; • price and volume fluctuation in the overall stock market; • corporate actions we may initiate, such as acquisitions, stock sales or repurchases, dividend declarations, or corporate reorganizations. Our stock price may also be affected by broader market trends unrelated to our performance. As a result, purchasers of our common stock may be unable at any given time to sell their shares at or above the price they paid for them. Moreover, companies that have experienced volatility in the market price of their stock often are subject to securities class action litigation. If we were the subject of such litigation, it could result in substantial costs and divert management's attention and resources. 14 If we are unable to maintain effective internal controls over financial reporting, investors could lose confidence in the reliability of our financial statements, which could result in a decline in the price of our common stock. As a public company, we are required to enhance and test our financial, internal and management control systems to meet obligations imposed by the Sarbanes-Oxley Act of 2002. Consistent with the Sarbanes-Oxley Act and the rules and regulations of the SEC, management's assessment of our internal controls over financial reporting is required in connection with our filing of our Annual Report on Form 10-K. If we are unable to identify, implement and conclude that we have effective internal controls over financial reporting, investors could lose confidence in the reliability of our financial statements, which could result in a decrease in the value of our common stock. Our assessment of our internal controls over financial reporting may also uncover weaknesses or other issues with these controls that could also result in adverse investor reaction. We must make judgments in the process of preparing our financial statements. We prepare our financial statements in accordance with generally accepted accounting principles and certain critical accounting policies that are relevant to our business. The application of these principles and policies requires us to make significant judgments and estimates. The most significant estimates included in the financial statements pertain to revenue recognition, allowance for credit losses, valuation of acquired assets and assumed liabilities in business combinations, valuation of contingent acquisition payments, valuation of investment in note receivable, goodwill and long-lived asset impairment and valuation allowance for deferred income tax assets. Actual results could differ from those estimates. In the event that our judgments and estimates differ from actual results, we may have to change them, which could materially affect our financial position and results of operations. Moreover, accounting standards have been subject to rapid change and evolving interpretations by accounting standards setting organizations over the past few years. The implementation of new accounting standards requires us to interpret and apply them appropriately. If our current interpretations or applications are later found to be incorrect, we may have to restate our financial statements and the price of our stock could decline. Our officers, directors and holders of 5% of outstanding shares together beneficially own a significant portion of our common stock and, as a result, can exercise control over stockholder and corporate actions. Our officers and directors and the holders of at least 5% of our outstanding shares currently beneficially own approximately 48% of our outstanding common stock, and 60% on a fully diluted basis assuming the exercise of both vested and unvested options. As such, they have a significant influence over most matters requiring approval by stockholders, including the election of directors and approval of significant corporate transactions. This concentration of ownership may also have the effect of delaying or preventing a change in control, which in turn could have a material adverse effect on the market price of our common stock or prevent stockholders from realizing a premium over the market price for their shares. ITEM 1B. Unresol ved Staff Comments Not applicable. ITEM 1C. CYBERSECUTIY Cybersecurity Risk Management and Strategy To help protect the Company from a major cybersecurity incident that could have a material impact on operations or the Company’s financial results, the Company has implemented policies, programs and controls, including technology investments that focus on cybersecurity incident prevention, identification and mitigation. The steps the Company takes to reduce its vulnerability to cyberattacks and to mitigate impacts from cybersecurity incidents include, but are not limited to: establishing information security policies and standards, implementing information protection processes and technologies, monitoring its information technology systems for cybersecurity threats, assessing cybersecurity risk profiles of key third-parties, implementing cybersecurity training and collaborating with public and private organizations on cyber threat information and best practices. The Company has implemented a Cybersecurity Policy (the “Policy”) that provides a framework for responding to cybersecurity incidents. The Policy includes requirements for incident disclosure and reporting, protocols for incident 15 evaluation, including the use of third-party service providers and partners, and processes for notification and internal escalation of information to the Company’s senior management, incident response team, and Board of Directors (the "Board") and appropriate Board committees. The Policy also addresses requirements for the Company’s external reporting obligations. The Plan is reviewed and updated, as necessary but no less frequently than once a year, under the leadership of the Company’s Chief Security Officer (“CSO”). Although the Company did not experience a material cybersecurity incident during the year ended December 31, 2024, the scope and impact of any future incident cannot be predicted. See “Item 1A. Risk Factors” for more information on the Company’s cybersecurity-related risks. Governance The Board of Directors, primarily through its Audit Committee, oversees the Company’s cybersecurity program. Management regularly reports to the Audit Committee on the current state of the Company’s cybersecurity program, including the current threat landscape, cybersecurity risks, and any significant incidents. The Audit Committee may provide updates to the Board on the substance of these reports and any recommendations for improvements that the Audit Committee deems appropriate. At the management level, the Company has established written policies and procedures to ensure that significant cybersecurity incidents are immediately investigated, addressed through the coordination of various internal departments, and publicly reported, to the extent required by applicable law.