CISO Global, Inc. 10-Q

ITEM 2. MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS Note Regarding Forward-Looking Statements This Quarterly Report on Form 10-Q includes a number of forward-looking statements that reflect management’s current views with respect to future events and financial performance. Forward-looking statements are projections in respect of future events or our future financial performance. In some cases, you can identify forward-looking statements by terminology such as “may,” “should,” “expects,” “plans,” “anticipates,” “believes,” “estimates,” “predicts,” “potential” or “continue” or the negative of these terms or other comparable terminology. These statements include statements regarding the intent, belief or current expectations of us and members of our management team, as well as the assumptions on which such statements are based. Prospective investors are cautioned that any such forward-looking statements are not guarantees of future performance and involve risk and uncertainties, and that actual results may differ materially from those contemplated by such forward-looking statements. These statements are only predictions and involve known and unknown risks, uncertainties and other factors, including the risks set forth in the section entitled “Risk Factors” in our Annual Report on Form 10-K for the fiscal year ended December 31, 2020, as filed with the U.S. Securities and Exchange Commission (the “SEC”) on March 31, 2021, any of which may cause our company’s or our industry’s actual results, levels of activity, performance or achievements to be materially different from any future results, levels of activity, performance or achievements expressed or implied in our forward-looking statements. These risks and factors include, by way of example and without limitation: ● our ability to achieve and sustain profitability of the existing lines of business through expansion; ● our ability to raise sufficient capital to acquire world-class engineer-owned cybersecurity companies; ● our ability to attract and retain world-class cybersecurity talent; ● our ability to identify potential acquisition targets within predetermined parameters; ● our ability to successfully execute acquisitions, integrate the acquired businesses and create synergies as a nationwide cybersecurity consolidator; ● our ability to attract and retain key technology or management personnel and to expand our management team; ● the accuracy of estimates regarding expenses, future revenue, capital requirements, profitability, and needs for additional financing; ● business interruptions resulting from geo-political actions, including war, and terrorism or disease outbreaks (such as the outbreak of COVID-19 or any of its variants); ● our ability to attract and retain clients; and ● our ability to navigate through the increasingly complex cybersecurity regulatory environment. Although we believe that the expectations reflected in the forward-looking statements are reasonable, we cannot guarantee future results, levels of activity, or performance. Except as required by applicable law, including the securities laws of the United States, we do not intend to update any of the forward-looking statements to conform these statements to actual results. Readers are urged to carefully review and consider the various disclosures made by us in this report and in our other reports filed with the SEC. We undertake no obligation to update or revise forward-looking statements to reflect changed assumptions, the occurrence of unanticipated events, or changes in the future operating results over time, except as required by law. We believe that our assumptions are based upon reasonable data derived from and known about our business and operations. No assurances are made that actual results of operations or the results of our future activities will not differ materially from our assumptions. As used in this Quarterly Report on Form 10-Q and unless otherwise indicated, the terms “Company,” “we,” “us,” and “our” refer to Cerberus Cyber Sentinel Corporation, a Delaware corporation, and its wholly owned subsidiaries including GenResults, LLC, an Arizona limited liability company (“GenResults”), TalaTek, LLC, a Virginia limited liability company (“TalaTek”), Technologyville, Inc., an Illinois corporation (“Techville”), Clear Skies Security, LLC, a Georgia limited liability company (“Clear Skies”), Alpine Security, LLC, an Illinois limited liability company (“Alpine”) and Catapult Acquisition Corporation (“VelocIT), a New Jersey corporation. Unless otherwise specified, all dollar amounts are expressed in United States dollars. 23 Corporate History Cerberus Cyber Sentinel Corporation (“Cerberus Sentinel”) was formed on March 5, 2019 as a Delaware corporation. Our principal offices are located at 6900 E. Camelback Road, Suite 240, Scottsdale, AZ 85251. Effective May 25, 2020, we entered into a Stock Purchase Agreement with Techville and its sole shareholder, pursuant to which Techville became a wholly owned subsidiary of the Company (the “Techville Acquisition”). Under the terms of the Techville Acquisition, all issued and outstanding common stock of Techville was exchanged for an aggregate of 3,392,271 shares of our common stock. Effective August 1, 2020, we entered into a Stock Purchase Agreement with Clear Skies and its equity holders, pursuant to which Clear Skies became a wholly owned subsidiary of the Company (the “Clear Skies Acquisition”). Under the terms of the Clear Skies Acquisition, all issued and outstanding equity securities in Clear Skies were exchanged for an aggregate of 2,330,000 shares of our common stock. On December 16, 2020, we entered into an Agreement and Plan of Merger pursuant to which Alpine became a wholly owned subsidiary of the Company. All units representing membership interests of Alpine issued and outstanding were converted into 900,000 shares of our common stock. On July 26, 2021, and effective August 12, 2021, we entered into an Amended and Restated Agreement and Plan of Merger pursuant to which VelocIT became a wholly-owned subsidiary of the Company. All issued and outstanding shares of common stock of VelocIT were converted into the right to receive an aggregate of up to 2,566,778 shares of common stock of the Company, subject to a holdback of 256,678 shares of Company stock. Our Business The cyber security industry has a supply and demand issue; there is more demand for cyber security services than expert and seasoned compliance and cybersecurity professionals available in the market. We are a cybersecurity and compliance company comprised of highly trained and seasoned security professionals who work with clients to enhance or create a better cyber posture in their organization. We seek to identify, attract, and retain highly skilled cyber and compliance teams and bring them together to provide holistic cyber services. This is accomplished through acquisitions, direct hiring and incentivizing employees with stock options to help retain them. On an ongoing basis, we seek to identify cyber talent that is culturally aligned and that offers operating leverage through both existing customer revenue and relationships. We have invested in enterprise solutions and executive talent to integrate our different organizations into an ecosystem that works together to provide complete and holistic cybersecurity through cross pollination of solutions. The ecosystem is intended to provide additional revenue opportunities and drive overall recurring revenue. We emphasize to clients the critical nature of having their work force create a continuously aware security culture. Once engaged, we strive to become the trusted advisors for customers’ cybersecurity and compliance needs by providing tailored security solutions based upon their organizational needs. We do not focus on the selling of cybersecurity products; we are product agnostic so that we can provide solutions that fit customers’ security needs, financial realities, and future strategy. Our approach is to evaluate clients’ organizations holistically, identify compliance requirements, and help secure the infrastructure while helping to create a culture of security. We provide a full range of cybersecurity services, encompassing all pillars of cybersecurity, compliance, and culture, including Secured Managed Services, Compliance Services, SOC Services, Virtual CISO (vCISO) Services, Incident Response, Certified Forensics, Technical Assessments, and Cybersecurity Training. We believe that culture is the foundation of every successful cybersecurity and compliance program. To deliver that outcome, we developed our unique offering of MCCP+, which is the only holistic solution that provides all three of these pillars under one roof from a dedicated team of subject matter experts. In contrast to the majority of cybersecurity firms that are focused on a specific technology or service, we seek to differentiate ourselves by remaining technology agnostic, focusing on accumulating highly-sought after topic experts. We continually identify and acquire cyber security talent to expand our service scope and geographical coverage to provide the best possible service for our clients. We believe that bringing together a world-class team of technological experts with multi-faceted expertise in the critical aspects of cybersecurity is key to providing technology agnostic solutions to our clients in a business environment that has suffered from a chronic lack of highly-skilled professionals, thereby setting us apart from competitors and in-house security teams. Our goal is to create a culture of security and to help quantify, define and capture a return on investment (ROI) from information technology and cybersecurity spending. Our brand rallies around the battle cry: “Cybersecurity is a Culture, not a Product.” 24 Offering this set of cybersecurity services allows us to capture more revenue with greater efficiency, facilitating greater profitability and stronger customer retention. The benefit to our customers is that they receive an efficient engagement from a single provider that covers a wide range of their needs. This means their challenges are addressed more thoroughly and problems are resolved more rapidly when compared to working with multiple vendors. This leads to the best possible outcome which enables them to commit to us for the long term. We believe that our business model is differentiated from other companies in the industry in that our employees are not consultants; they’re dedicated partners available on a recurring monthly contract. Due to the numerous challenges in hiring experienced cybersecurity and compliance professionals, we believe that assimilating our team of industry and subject matter experts into our clients’ teams is the ideal solution. We are technology agnostic. Whereas, most cybersecurity firms are locked into working with a single technology, we seek to differentiate ourselves by remaining technology agnostic. This approach enables us to work with any business, no matter what systems or tools they use. For our customers the benefit is equally valuable; they’re able to choose the best tools and technology for their business needs without affecting their relationship with us. We believe that building a world-class technology team with industry-specific and subject-matter expertise is the key to providing cutting-edge solutions to our clients. We aim to continue to identify and acquire cybersecurity talent to expand our scope of services and geographical footprint to fortify our capability to deliver excellence to our customers. Furthermore, our commitment is that we will stay a step ahead of threat actors and regulatory obligations to keep our customers safe and compliant. Our Service Offering We currently offer two major types of services to clients including Security Managed Services and Professional Services. 25 Security Managed Services Our Security Managed Services deliver an end-to-end solution to cybersecurity and compliance needs. We begin with a gap analysis of our customers’ existing cybersecurity and compliance practices. Next, we perform penetration testing, vulnerability scanning, and a best practices assessment. This culminates with a deliverable report outlining failures and risks and includes a remediation roadmap organized based on highest-value opportunities and critical necessities. This prioritized approach utilizes the maxi-min strategy to optimize our customers’ budget; something that comes from decades of experiential wisdom. Using this roadmap, our team performs remediation and change implementation throughout a customer’s business. This is followed by our culture program that delivers cybersecurity and compliance awareness training, risk reporting, and periodic knowledge verification. We cover every area of our customers’ businesses and engage with every member of their team. This is our end-to-end holistic approach that we believe leaves no stone unturned to ensure our customers are truly safe, secure, and compliant. We offer multiple services in the Security Managed Services portfolio including the following: ● Compliance: Our compliance practice ensures the customers are implementing the right controls, properly prioritizing risks, and investing in the appropriate remediation, so our customers can achieve compliance, adhere to industry standards and guidelines, and manage continuous monitoring over time. We provide the combination of integrated processes and systems, experienced staff, and innovative technology to help our customers meet those goals. Our seasoned experts possess the stringent industry certifications and accreditations that prove they understand security compliance regulations, frameworks, and controls. Our deep knowledge of these rigorous and unique requirements means we can offer a thorough, timely assessment that will identify residual risk within the customer’s information system. We then propose mitigation strategies to manage the customer’s risk effectively. As an authorized FedRAMP vendor ourselves, we bring an insider’s perspective to the process in the following standards: ○ FedRAMP - The Federal Risk and Authorization Management Program (FedRAMP) provides standardization to cloud security for Cloud Service Providers (CSP). FedRAMP recognition is required to sell cloud services to the US Federal and many state and local governments https://www.fedramp.gov/ ○ FISMA 2014 - codifies the Department of Homeland Security’s role in administering the implementation of information security policies for federal Executive Branch civilian agencies, overseeing agencies’ compliance with those policies, and assisting OMB in developing those policies. https://www.cisa.gov/federal-information-security-modernization-act ○ ISO 17021, ISO 27001 is an International Standard that provides Certification Bodies (CB) with a set of requirements that will enable them to ensure that their management system certification process is carried out in a competent, consistent and impartial manner. https://www.iso.org/ ○ HIPAA - Technology for Economic and Clinical Health Act of 2009 (“HITECH”) – These are laws regulated by the Department of Health and Human Services (“HHS”) to secure the privacy and confidentiality of protected health information (“PHI”) ( https://www.hhs.gov/hipaa/index.html ) ○ PCI - This is a standard administered by the Payment Card Industry Security Standards Council ( https://www.pcisecuritystandards.org/pci_security/ ) ○ Cyber Security Framework (CSF) Consist of five core functions: Identify, Protect, Detect, Respond, and Recover. NIST defines the framework core on its official website as a set of cybersecurity activities, desired outcomes, and applicable informative references common across critical infrastructure sectors. https://www.nist.gov/cyberframework ○ NIST - The National Institute of Standards and Technology (“NIST”) – This is formally known as a National Bureau of Standards, which is a federal agency that promotes and maintains measurement standards while encouraging and assisting industry and science to develop and use these standards. https://www.nist.gov/ ○ 800-171/CMMC - CMMC is intended to serve as a verification mechanism to ensure that DIB companies implement appropriate cybersecurity practices and processes to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) within their unclassified networks. https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final 26 ○ GDPR - The General Data Protection Regulation is one of the most wide-ranging pieces of legislation passed by the EU in recent memory. It was introduced to standardize data protection law across the single market and give people in a growing digital economy greater control over how their personal information is used. https://gdpr.eu/compliance/ ○ Service Organization 2 (“SOC 2”) – This is an auditing procedure that focuses on a business’ non-financial reporting controls related to security, availability, processing, integrity, confidentiality, and privacy of a system; https://www.aicpa.org/ ○ HITRUST CSF – This is a comprehensive security framework (“CSF”) developed by the Health Information Trust Alliance (“HITRUST”) in collaboration with healthcare, technology and information security leaders, to create access, store and exchange sensitive and/or regulated data; https://hitrustalliance.net/ ● Secured Managed Services: Cybersecurity companies who may excel at pointing out vulnerabilities or configuration issues, we have experts with the capability to resolve fix them. Our team has extensive experience in remediating security issues in a holistic fashion, to quickly effect change at organization scale. We know our customers’ teams are busy enough as is, so we offload the burden of addressing the dozens or hundreds of remediation items that may come from a security review, penetration test, or incident response project. Our remediation services resolve vulnerabilities that may expose risk to, or have caused, unwanted conditions or outcomes. Examples of issues that Cerberus Sentinel remediate include writing new or more effective policies, rearchitecting computer networks to minimize attack surface, implementing high security password requirements and multi-factor authentication, applying missing security patches that expose an organization to security attack, or correcting misconfigurations that can lead to unauthorized access such as a user being granted overly broad permissions. Our remediation services provide customers with a mature methodology for the heavy lifting needed to ensure that implementing solutions to minimize security risk are done safely, efficiently, and correctly the first time. ● SOC Managed Services: We offer SOC-as-a-service, which is a subscription-based service that manages and monitors client’s’ logs, devices, clouds, network, and assets for possible cyber threats. This lets our service provide the clients with the knowledge and skills necessary to combat cybersecurity threats. ● vCISO Service: Corporations are in need of cybersecurity services but many do not have the capital resources or knowledge base to hire a Chief Information Security Officer (“CISO”). We offer this service to companies on an ongoing managed service basis as a resource to augment their management team. vCISO includes road mapping the future state for the client and providing our knowledgeable expertise to help them achieve their security needs. Professional Services Our advisory services include a wide array of tailored solutions for organizations of all sizes. Our in-depth and uniquely acquired industry expertise allows us to act as a trusted advisor of our clients to help them lower their risk profile, minimize cost impact to organizations and meet regulatory compliance demands. We specialize in: ● Incident Response and Forensics: This is where we focus on identification, investigation, and remediation of cyberattacks. ● Technical Assessments: We specialize in advanced cyber security assessments that highlight the skills and experience of our team’s top-tier talent. Our customers benefit from our routine identification of issues based on our emphasis on real-world manual testing techniques and custom exploit development to uncover new avenues of attack. We believe that our approach to penetration testing services strikes the perfect equilibrium between cost, time and results. Our team of highly skilled testers utilize the same tools and techniques a malicious cybercriminal would use to try to gain unauthorized access to highly-guarded corporate systems and data to evaluate technical controls and quantify business risks in a meaningful way. This level of analysis provides business leaders the knowledge required to not only understand the impact a successful attack might have on their business operations, but also can validate the effectiveness of existing security controls and justify additional security related investment. Training: This targets the root cause for 75% of cyber breach events by starting with a culture of security-first forward thinking. Our security awareness training can prevent a catastrophic cyberattack before it even occurs by equipping users with the tools and techniques required to spot a potential cyberattack in the early stages. 27 ● Other Cybersecurity Services: ○ Cybersecurity Road Mapping: Bringing the culture of cybersecurity to client’s leadership team and penetrating throughout the organization is a critical first step of building any successful cybersecurity system. Through our consulting service, we dive into both the cultural and technical aspects of cybersecurity within the organization, providing meaningful recommendations to improve cybersecurity posture immediately. We help our clients build effective policies and best practices, design or enhance a cybersecurity system and train the executive management team to foster a top-down culture of cybersecurity in order to facilitate diligent implementation of cybersecurity awareness. ○ Gap and Risk Assessment: Threat actors probe and exploit the weakest points in an organization, it doesn’t matter if a business has done 100 things right when one mistake can be catastrophic. Cerberus Sentinel combines decades of security expertise and in-depth knowledge of how cyberattackers operate to deliver a thorough security risk gap analysis that identifies real world threats and issues guidance for protection. We first familiarize ourselves with the customer’s environment, business model, operations, and business drivers to best determine a customer’s cybersecurity posture in an ever evolving threat landscape. We then use our advanced threat intelligence, data breach experience, and analytics to accurately assess the customers unique cybersecurity risk based on their “as is” state. We then operate with a holistic mindset, considering every link in the cybersecurity chain from people, processes, and technology, to determine their ideal “to be” state, aligned with their business goals, compliance requirements, and risk tolerance. Finally, we collaboratively devise and develop a strategic cybersecurity plan that takes into account critical priorities to effectively reduce cybersecurity risk by closing the gap between their “as is” and “to be” states. This comprehensive awareness of internal systems and policies provides our customers with a clear understanding of their overall risk as well as the strategies and tools they need to protect their most valuable assets: their data and brand reputation. Significant Development During the Quarter Acquisition of VelocIT On June 30, 2021, we entered into an Agreement and Plan of Merger (the “Merger Agreement”) by and among the Company, Catapult Acquisition Merger Sub, LLC (“Merger Sub”), Catapult Acquisition Corporation (“Catapult”), the shareholders of Catapult Acquisition Corporation (the “Catapult Shareholders”) and Darek Hahn, in his capacity as the shareholder representative (the “Shareholder Representative”). Pursuant to the Merger Agreement, Catapult agreed to merge with and into Merger Sub (the “Merger”), with Merger Sub surviving the Merger as a wholly-owned subsidiary of the Company. The Merger was to become effective as soon as practicable following completion of certain conditions to closing in the Merger Agreement (the “Effective Time”). On July 26, 2021, the Company, Merger Sub, Catapult, the Catapult Shareholders and the Shareholder Representative entered into an Amended and Restated Agreement and Plan of Merger (the “Amended and Restated Merger Agreement”) to provide, among other things, that Merger Sub would merge with and into Catapult, with Catapult surviving the Merger as a wholly-owned subsidiary of the Company. All issued and outstanding shares of common stock of Catapult immediately prior to the Effective Time were converted into the right to receive an aggregate of up to 2,566,778 shares of common stock, par value $0.00001, of the Company, subject to a holdback of 256,678 shares of Cerberus Stock. The Effective Time was August 12, 2021. Catapult, which operates under the brand name of VelocIT, offers enterprise solutions through a suite of products and services to small and medium sized businesses. Such suite of products and services include IT leadership, vector alerts, active directory management, server management, email management, antivirus services, LAN services, wireless management, firewall management, virtualization management, WAN services, SAN services, endpoint back-up, endpoint encryption and business continuity support. VelocIT is based in Cranbury, New Jersey. 28 Results of Operations Comparison of the Three Months Ended September 30, 2021 to the Three Months Ended September 30, 2020 Our financial results for the three months ended September 30, 2021 are summarized as follows in comparison to the three months ended September 30, 2020: Three Months Ended September 30, 2021 2020 Variance Revenue: Security Managed Services $ 3,099,753 $ 1,683,733 $ 1,416,020 Professional Services 645,255 325,865 319,390 Total revenue 3,745,008 2,009,598 1,735,410 Cost of revenue: Security Managed Services 650,955 423,784 227,171 Professional Services 234,326 18,962 215,364 Cost of payroll 2,093,072 868,810 1,224,262 Total cost of revenue 2,978,353 1,311,556 1,666,797 Total gross profit 766,655 698,042 68,613 Operating expenses: Professional fees 293,408 284,511 8,897 Advertising and marketing 254,026 30,488 223,538 Selling, general and administrative 2,085,720 1,020,765 1,064,955 Stock based compensation 1,251,635 392,661 858,974 Loss on write-off of account receivable 40,264 - 40,264 Total operating expenses 3,925,053 1,728,425 2,196,628 Loss from operations (3,158,398 ) (1,030,383 ) (2,128,015 ) Other income (expense): Other income 169 751 (582 ) Interest expense, net (75,470 ) (5,567 ) (69,903 ) PPP loan forgiveness 980,800 - 980,800 Total other income (expense) 905,499 (4,816) 899,935 Net loss $ (2,252,899 ) $ (1,035,199 ) $ (1,217,700 ) Revenues Security managed services revenues increased by $1,416,020, or 84%, for the three months ended September 30, 2021, as compared to the three months ended September 30, 2020, due to to revenues of $985,146 for VelocIT for the 3 months ended September 30, 2021. We did not recognize any revenue attributable to VelocIT during the 3 months ended September 30, 2020 because the acquisition consummated on August 12 , 2021. The additional increase in revenues were a result of additional customers and usage increases within existing customers. Professional services revenues increased by $319,390, or 98%, for the three months ended September 30, 2021, as compared to the three months ended September 30, 2020, due to revenues for Clear Skies and Alpine of $695,069 for the 3 months ended September 30, 2021. The acquisitions of Clear Skies and Alpine were consummated on August 1, 2020 and December 16, 2020, respectively. Revenues for Clear Skies was approximately $141,000 for the 3 months ended September 30, 2020. Expenses Cost of Revenues Security managed services cost of revenues increased by $227,171, or 54%, for the three months ended September 30, 2021, as compared to the three months ended September 30, 2020, and was primarily the result of as a result of the VelocIT acquisition on August 12, 2020. 29 Profesional services cost of revenues increased by $215,364, or 1,136%, for the three months ended September 30, 2021, as compared to the three months ended September 30, 2020, due to cost of revenues for Clear Skies and Alpine. The acquisitions of Clear Skies and Alpine were consummated on August 1, 2020 and December 16, 2020, respectively. Cost of payroll cost of revenues increased by $1,224,262, or 141%, for the three months ended September 30, 2021, as compared to the three months ended September 30, 2020, as a result of the cost of headcount for the VelocIT, Clear Skies, and Alpine acquisitions as well as an increase in employees resulting in an increase in salaries in other lines of business due to an increase in demand for our services. Operating Expenses Professional fees remained relatively consistent during the three months ended September 30, 2021 as compared to three months ended September 30, 2020. Advertising and marketing expenses increased by $223,538, or 733%, for the three months ended September 30, 2021, as compared to the three months ended September 30, 2020, as a result of increased public relations and marketing prograams. Selling, general and administrative expenses increased by $1,064,955, or 104%, for the three months ended September 30, 2021, as compared to the three months ended September 30, 2020, primarily as a result of an increase in payroll due to the Company being able to recognize Alpine’s payroll as well as a portion of VelocIT’s payroll, which both were not recognizeable during the three months ended September 30, 2020, due to the acquisition dates of December 1, 2020 and August 12, 2021, respectively. Stock based compensation expenses increased by $858,974, or 219%, for the three months ended September 30, 2021, as compared to the three months ended September 30, 2020, due to an increase in stock options awarded during the three months ended September 30, 2021. Loss on write-off of accounts receivable remained relatively consistent during the three months ended September 30, 2021 as compared to the three months ended September 30, 2020. Comparison of the Nine Months Ended September 30, 2021 to the Nine Months Ended September 30, 2020 Our financial results for the nine months ended September 30, 2021 are summarized as follows in comparison to the nine months ended September 30, 2020: Nine Months Ended September 30, 2021 2020 Variance Revenue: Security Managed Services $ 6,979,146 $ 3,612,489 $ 3,366,657 Professional Services 2,275,437 1,015,816 1,259,621 Total revenue 9,254,583 4,628,305 4,626,278 Cost of revenue: Security Managed Services 1,326,788 726,614 600,174 Professional Services 350,388 82,992 267,396 Cost of payroll 5,052,684 2,135,691 2,916,993 Total cost of revenue 6,729,860 2,945,297 3,784,563 Total gross profit 2,524,723 1,683,008 841,715 Operating expenses: Professional fees 695,023 685,821 9,202 Advertising and marketing 471,721 104,058 367,663 Selling, general and administrative 5,241,095 2,235,041 3,006,054 Stock based compensation 2,981,523 1,062,000 1,919,523 Loss on write-off of account receivable 55,528 15,000 40,528 Total operating expenses 9,444,890 4,101,920 5,342,970 Loss from operations (6,920,167 ) (2,418,912 ) (4,501,255 ) Other income (expense): Other income 2,553 10,751 (8,218 ) Interest expense, net (209,806 ) (12,285 ) (197,521 ) PPP loan forgiveness 980,800 - 980,800 Total other income (expense) 773,547 (1,534 ) 775,081 Net loss $ (6,146,620 ) $ (2,420,446 ) $ (3,726,174 ) 30 Revenues Security managed services revenues increased by $3,366,657, or 93%, for the nine months ended September 30, 2021, as compared to the nine months ended September 30, 2020, due to the acquisitions of VelocIT and Technologyville consummated on August 12, 2021 and May 25, 2020, respectively. Approximately $2,400,000 was a result of these acquisitions. The balance is a result of increase in usage and various new client contracts that were entered into subsequent to September 30, 2020. Professional services revenues increased by $1,259,621, or 124%, for the nine months ended September 30, 2021, as compared to the nine months ended September 30, 2020, due to the acquisitions of Clear Skies and Alpine consummated on August 1, 2020 and December 16, 2020, respectively. Expenses Cost of Revenues Secuity managed services cost of revenues increased by $600,174, or 83%, for the nine months ended September 30, 2021, as compared to the nine months ended September 30, 2020, and was primarily due to the acquisitions of VelocIT and Technologyville consummated on August 12, 2021 and May 25, 2020, respectively. Professional services cost of revenues increased by $267,396, or 322%, for the nine months ended September 30, 2021, as compared to the nine months ended September 30, 2020, due to the acquisitions of Clear Skies and Alpine consummated on August 1, 2020 and December 16, 2020, respectively. Cost of payroll increased by $2,916,993, or 137%, for the nine months ended September 30, 2021, as compared to the nine months ended September 30, 2020, due to as a result of the cost of headcount for the VelocIT, Clear Skies, and Alpine acquisitions as well as an increase in employees resulting in an increase in salaries in other lines of business due to an increase in demand for our services. Operating Expenses Professional fees remained relatively consistent during the nine months ended September 30, 2021 as compared to the nine months ended September 30, 2020. Advertising and marketing expenses increased by $367,663, or 353%, for the nine months ended September 30, 2021, as compared to the nine months ended September 30, 2020, as a result of additional spend on public relations. Selling, general and administrative expenses increased by $3,006,054, or 135%, for the nine months ended September 30, 2021, as compared to the nine months ended September 30, 2020, as a result of primarily as a result of an increase in payroll due to the Company being able to recognize a full nine months of Clear Skies’ and Alpine’s payroll as well as a portion of VelocIT’s payroll, which were not recognizeable during the nine months ended September 30, 2020, due to the acquisition dates of August 1, 2020, December 1, 2020 and August 12, 2021, respectively. Stock based compensation expenses increased by $1,919,523, or 181%, for the nine months ended September 30, 2021, as compred to the nine months ended September 30, 2020, as a result of an increase in stock options awarded during the nine months ended September 30, 2021. Loss on write-off of accounts receivable remained relatively consistent during the nine months ended September 30, 2021 as compared to the nine months ended September 30, 2020. Working Capital Surplus Our working capital surplus as of September 30, 2021, in comparison to our working capital surplus as of December 31, 2020, is summarized as follows: As of September 30, December 31, 2021 2020 Current assets $ 5,484,029 $ 6,346,008 Current liabilities 4,838,200 3,863,594 Working capital surplus $ 645,829 $ 2,482,414 31 The decrease in current assets is primarily due to a decrease in cash and cash equivalents of $2,467,451, offset by an increase in accounts receivable of $1,261,999. The increase in current liabilities is primarily due to the increase in accounts payable and accrued expense, and the current portion of lease liabilities of $684,355 and $157,720, respectively. Cash Flows Our cash flows for the nine months ended September 30, 2021, in comparison to our cash flows for the nine months ended September 30, 2020, can be summarized as follows: Nine months ended September 30, 2021 2020 Net cash used in operating activities $ (4,312,312 ) $ (1,157,976 ) Net cash provided by investing activities 662,176 254,180 Net cash provided by financing activities 1,182,685 1,443,158 Increase (decrease) in cash $ (2,467,451 ) $ 539,362 Operating Activities Net cash used in operating activities was $4,313,312 for the nine months ended September 30, 2021 and was primarily due to cash used to fund a net loss of $7,124,149, adjusted for non-cash expenses in the aggregate of $2,631,683 and additional cash outlaid by changes in the levels of operating assets and liabilities, primarily as a result of an increase in accounts receivable and other current assets. Net cash used in operating activities was $1,157,976 for the nine months ended September 30, 2020 and was primarily due to cash used to fund a net loss of $2,420,446, adjusted for non-cash expenses in the aggregate of $1,170,094, partially offset by cash generated by changes in the levels of operating assets and liabilities, primarily as a result of an increase in accounts payable. Investing Activities Net cash provided by investing activities of $662,176 for the nine months ended September 30, 2021, was due to cash acquired in the VelocIT acquisition. Net cash provided by investing activities of $254,180 for the nine months ended September 30, 2020, was due to cash acquired in the Techville and Clear Skies Acquisitions. Financing Activities Net cash provided by financing activities for the nine months ended September 30, 2021 was $1,182,685, which was primarily due to cash received from the sale of the Company’s common stock of $3,250,000 and offset by the payment of loans of approximately $2,000,000. Net cash provided by financing activities for the nine months ended September 30, 2020 was $1,443,158 and was due to cash received from the sale of the Company’s common stock of $790,000 and proceeds from PPP loans of $709,600. Liquidity The accompanying unaudited condensed consolidated financial statements have been prepared on the basis that the Company will continue as a going concern, which contemplates realization of assets and satisfying liabilities in the normal course of business. At September 30, 2021, the Company had an accumulated deficit of approximately $11,013,000 and working capital surplus of approximately $646,000. For the nine months ended September 30, 2021, the Company had a loss from operations of approximately $6,920,000 and negative cash flows from operations of approximately $4,312,000. Although the Company is showing positive revenues and gross profit trends, the Company expects to incur further losses through the end of 2021. 32 To date the Company has been funding operations primarily through the sale of equity in private placements and revenues generated by the Company’s services. During the nine months ended June 30, 2021, the Company received $3,250,000 from private placements of the Company’s common stock. Based on its current cash resources and commitments, the Company believes it will be able to maintain its current planned development and corresponding level of expenditure for at least twelve months from the date of the issuance of these unaudited condensed consolidated financial statements, although no assurance can be given that it will not need additional funds prior to such time. Effects of Inflation We do not believe that inflation has had a material impact on our business, revenues or operating results during the periods presented. Significant Accounting Policies and Estimates Our significant accounting policies are more fully described in the notes to our condensed consolidated financial statements included herein for the quarter and six months ended June 30, 2021 and in the notes to our consolidated financial statements included in our Annual Report on Form 10-K for the year ended December 31, 2020, as filed with the SEC on March 31, 2021. Fair Value Measurement The fair value measurement guidance clarifies that fair value is an exit price, representing the amount that would be received to sell an asset or paid to transfer a liability in an orderly transaction between market participants. As such, fair value is a market-based measurement that should be determined based on assumptions that market participants would use in the valuation of an asset or liability. It establishes a fair value hierarchy that prioritizes the inputs to valuation techniques used to measure fair value. The hierarchy gives the highest priority to unadjusted quoted prices in active markets for identical assets or liabilities (Level 1 measurements) and the lowest priority to unobservable inputs (Level 3 measurements). The three levels of the fair value hierarchy under the fair value measurement guidance are described below: Level 1 - Unadjusted quoted prices in active markets that are accessible at the measurement date for identical assets or liabilities; Level 2 - Quoted prices in markets that are not active, or inputs that are observable, either directly or indirectly, for substantially the full term of the asset or liability; or Level 3 - Prices or valuation techniques that require inputs that are both significant to the fair value measurement and unobservable (supported by little or no market activity). Business Combination The Company allocates the purchase price of an acquired business to the tangible and intangible assets acquired and liabilities assumed based upon their estimated fair values on the acquisition date. Any excess of the purchase price over the fair value of the net assets acquired is recorded as goodwill. The purchase price allocation process requires management to make significant estimates and assumptions, especially at the acquisition date with respect to intangible assets. Direct transaction costs associated with the business combination are expensed as incurred. The allocation of the consideration transferred in certain cases may be subject to revision based on the final determination of fair values during the measurement period, which may be up to one year from the acquisition date. The Company includes the results of operations of the business that it has acquired in its consolidated results prospectively from the date of acquisition. 33 If the business combination is achieved in stages, the acquisition date carrying value of the acquirer’s previously held equity interest in the acquiree is re-measured to fair value at the acquisition date; any gains or losses arising from such re-measurement are recognized in profit or loss. Goodwill Goodwill represents the excess of the purchase price of the acquired business over the estimated fair value of the identifiable net assets acquired. Goodwill is not amortized but is tested for impairment at least annually at year end, at the reporting unit level or more frequently if events or changes in circumstances indicate that the asset might be impaired. Goodwill is tested for impairment at the reporting level by first performing a qualitative assessment to determine whether it is more likely than not that the fair value of the reporting unit is less than its carrying value. If the reporting unit does not pass the qualitative assessment, then the reporting unit’s carrying value is compared to its fair value. The fair values of the reporting units are estimated using market and discounted cash flow approaches. Goodwill is considered impaired if the carrying value of the reporting unit exceeds its fair value. The discounted cash flow approach uses expected future operating results. Failure to achieve these expected results may cause a future impairment of goodwill at the reporting unit. Impairment of Long-lived Assets We will periodically evaluate the carrying value of long-lived assets to be held and used when events and circumstances warrant such a review and at least annually. The carrying value of a long-lived asset is considered impaired when the anticipated undiscounted cash flow from such asset is separately identifiable and is less than its carrying value. In that event, a loss is recognized based on the amount by which the carrying value exceeds the fair value of the long-lived asset. Fair value is determined primarily using the anticipated cash flows discounted at a rate commensurate with the risk involved. Losses on long-lived assets to be disposed of are determined in a similar manner, except that fair values are reduced for the cost to dispose. Revenue Recognition The Company’s agreements with its clients are primarily service contracts that range in duration from a few months to one year. The Company recognizes revenue when control of these services is transferred to the client for an amount, referred to as the transaction price, which reflects the consideration to which the Company is expected to be entitled in exchange for those goods or services. A contract with a client exists only when: ● the parties to the contract have approved it and are committed to perform their respective obligations; ● the Company can identify each party’s rights regarding the distinct services to be transferred (“performance obligations”); ● the Company can determine the transaction price for the services to be transferred; and ● the contract has commercial substance, and it is probable that the Company will collect the consideration to which it will be entitled in exchange for the goods or services that will be transferred to the client. For the majority of its contracts, the Company receives non-refundable upfront payments. The Company does not adjust the promised amount of consideration for the effects of a significant financing component since the Company expects, at contract inception, that the period between the time of transfer of the promised goods or services to the client and the time the client pays for these goods or services to be generally one year or less. The Company’s credit terms to clients generally average thirty days, although in some cases payments are required in 15 days. The Company does not disclose the value of unsatisfied performance obligations for contracts with original expected duration of one year or less. 34 Disaggregation of Revenue Revenue consists of the following by service offering for the nine months ended September 30, 2021: Security Managed Services Professional Services Total Primary Sector Markets Public $ 3,179,047 $ 44,579 $ 3,223,626 Private 3,607,146 2,178,545 5,785,691 Not-for-Profit 192,953 52,313 245,266 $ 6,979,146 $ 2,275,437 $ 9,254,583 Major Service Lines Compliance $ 3,336,795 $ - $ 3,336,795 Secured Managed Services 3,134,269 - 3,134,269 SOC Managed Services 352,535 - 352,535 vCISO 155,547 - 155,547 Technical Assessments - 1,844,496 1,844,496 Forensics & I/R - 265,567 265,567 Training - 149,529 149,529 Other CyberSecurity Services - 15,845 15,845 $ 6,979,146 $ 2,275,437 $ 9,254,583 Revenue consists of the following by service offering for the nine months ended September 30, 2020: Security Managed Services Professional Services Total Primary Sector Markets Public $ 2,498,371 $ 5,068 $ 2,503,439 Private 1,024,744 1,001,748 2,026,492 Not-for-Profit 89,374 9,000 98,374 $ 3,612,489 $ 1,015,816 $ 4,628,305 Major Service Lines Compliance $ 2,519,958 $ - $ 2,519,958 Secured Managed Services 752,371 - 752,371 SOC Managed Services 301,760 - 301,760 vCISO 38,400 - 38,400 Technical Assessments - 190,825 190,825 Forensics & I/R - 554,069 554,069 Training - 58,625 58,625 Other CyberSecurity Services - 212,297 212,297 $ 3,612,489 $ 1,015,816 $ 4,628,305 Practical Expedients As part of ASC 606, the Company has adopted several practical expedients including the following: (i) the Company has determined that it need not adjust the promised amount of consideration for the effects of a significant financing component since the Company expects, at contract inception, that the period between when the Company transfers a promised service to the customer and when the customer pays for that service will be one year or less and (ii) the Company recognizes any incremental costs of obtaining a contract as an expense when incurred if the amortization period of the asset that the entity otherwise would have recognized is one year or less. Reimbursed Expenses The Company includes reimbursed expenses in revenues and costs of revenue as the Company is primarily responsible for fulfilling the promise to provide the specified service, including the integration of the related services into a combined output to the client, which are inseparable from the integrated service. These costs include such items as consumables, transportation and travel expenses, over which the Company has discretion in establishing prices. 35 Costs of Revenue Costs of revenue include (i) compensation and benefits for billable employees and consultants directly involved with delivering services offerings and engagements; (ii) consumables used for the services; and (iii) other expenses directly related to service contracts such as professional services, meals and travel expenses. Volatility in Stock-Based Compensation The volatility is based on historical volatilities of companies in comparable stages as well as the historical volatility of companies in the industry and, by statistical analysis of the daily share-pricing model. The volatility of stock-based compensation at any point in time is based on historical volatility of similar companies in the industry for the last two to five years. New and Recently Adopted Accounting Pronouncements Any new and recently adopted accounting pronouncements are more fully described in Note 2 to our unaudited condensed consolidated financial statements herein for the quarter ended September 30, 2021. Off-Balance Sheet Arrangements We have no off-balance sheet arrangements that have or are reasonably likely to have a current or future effect on our financial condition, changes in financial condition, revenues or expenses, results of operations, liquidity, capital expenditures or capital resources that is material to stockholders. Item 3. Quantitative and Qualitative Disclosures about Market Risk Not Applicable. As a smaller reporting company, we are not required to provide the information required by this Item.