CISO Global, Inc. 10-K

ITEM 7. MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS The following Management’s Discussion and Analysis of Financial Condition and Results of Operations should be read in conjunction with our financial statements and the related notes contained elsewhere in this Annual Report and is intended to provide information necessary to understand our audited consolidated financial statements for the year ended December 31, 2021 compared to the year ended December 31, 2020 and highlight certain other information which, will enhance a reader’s understanding of our financial condition, changes in financial condition, and results of operations. In particular, the discussion is intended to provide an analysis of significant trends and material changes in our financial position and the operating results of our business during the year ended December 31, 2021, as compared to the year ended December 31, 2020. These historical financial statements may not be indicative of our future performance. This Management’s Discussion and Analysis of Financial Condition and Results of Operations contains numerous forward-looking statements, all of which are based on our current expectations and could be affected by the uncertainties and risks described throughout this filing, particularly in “Item 1A. Risk Factors.” - 23 - Our Business We are a cybersecurity and compliance company comprised of highly trained and seasoned security professionals who work with clients to enhance or create a better cyber posture in their organization. Cybersecurity, also known as computer security or information technology security, is the protection of computer systems and networks from information disclosure, theft of or damage to their hardware, software, or electronic data, as well as from the disruption or misdirection of the services they provide. The cybersecurity industry has a supply and demand issue wherein there is more demand for cybersecurity services than there are expert and seasoned compliance and cybersecurity professionals available in the market. We seek to identify, attract, and retain highly skilled cyber and compliance teams and bring them together to provide holistic cyber services. We accomplish this through acquisitions, direct hiring, and incentivizing employees with stock options to help retain them. On an ongoing basis, we seek to identify cyber talent that is culturally aligned and that offers operating leverage through both existing customer revenue and relationships. We have invested in enterprise solutions and executive talent to integrate our different organizations into an ecosystem that works together to provide complete and holistic cybersecurity through cross pollination of solutions. The ecosystem is intended to provide additional revenue opportunities and drive overall recurring revenue. We provide a full range of cybersecurity consulting and related services, encompassing all three pillars of compliance, cybersecurity, and culture. Our services include secured managed services, compliance services, security operations center (“SOC”) services, virtual Chief Information Security Officer (“vCISO”) services, incident response, certified forensics, technical assessments, and cybersecurity training. We believe that culture is the foundation of every successful cybersecurity and compliance program. To deliver that outcome, we developed our unique offering of MCCP+ (“Managed Compliance & Cybersecurity Provider + Culture”), which is the only holistic solution that provides all three of these pillars under one roof from a dedicated team of subject matter experts. In contrast to the majority of cybersecurity firms that are focused on a specific technology or service, we seek to differentiate ourselves by remaining technology agnostic, focusing on accumulating highly sought-after topic experts. We continually seek to identify and acquire cybersecurity talent to expand our service scope and geographical coverage to provide the best possible service for our clients. We believe that bringing together a world-class team of technological experts with multi-faceted expertise in the critical aspects of cybersecurity is key to providing technology agnostic solutions to our clients in a business environment that has suffered from a chronic lack of highly skilled professionals, thereby setting us apart from competitors and in-house security teams. Our goal is to create a culture of security and to help quantify, define, and capture a return on investment from information technology and cybersecurity spending. Our brand rallies around the battle cry: “Cybersecurity is a Culture, not a Product.” 2021 Highlights Our operating results for the year ended December 31, 2021 included the following: ● Total revenue increased by $7.9 million to $15.1 million for the year ended December 31, 2021, as compared to the year ended December 31, 2020. ● Total gross profit decreased by $1.1 million to $1.8 million for the year ended December 31, 2021, as compared to the year ended December 31, 2020. ● We acquired VelocIT, Atlantic, RED74, and Arkavia, all of which are now wholly owned subsidiaries of our company. - 24 - Results of Operations Comparison of the Year Ended December 31, 2021 to the Year Ended December 31, 2020 Our financial results for the year ended December 31, 2021 are summarized as follows in comparison to the year ended December 31, 2020: For the Year Ended December 31, 2021 December 31, 2020 Variance Revenue: Security managed services $ 11,797,719 $ 5,359,101 $ 6,438,618 Professional services 3,344,840 1,881,727 1,463,113 Total revenue 15,142,559 7,240,828 7,901,731 Cost of revenue: Security managed services 3,089,599 991,275 2,098,324 Professional services 515,171 87,271 427,900 Cost of payroll 9,729,526 3,287,020 6,442,506 Total cost of revenue 13,334,296 4,365,566 8,968,730 Total gross profit 1,808,263 2,875,262 (1,066,999 ) Operating expenses: Professional fees 1,189,319 926,526 262,793 Advertising and marketing 435,016 150,236 284,780 Selling, general and administrative 9,809,200 3,309,086 6,500,114 Stock-based compensation 8,076,688 1,896,276 6,180,412 Impairment of goodwill 22,078,064 - 22,078,064 Total operating expenses 41,588,287 6,282,124 35,306,163 Loss from operations (39,780,024 ) (3,406,862 ) (36,373,162 ) Other income (expense): Other income expense) (39,063 ) 10,751 (49,814 ) Interest expense, net (307,363 ) (17,151 ) (290,212 ) PPP loan forgiveness 980,800 - 980,800 Total other income (expense) 634,374 (6,400 ) 640,774 Net loss $ (39,145,650 ) $ (3,413,262 ) $ (35,732,388 ) Revenue Security managed services revenue increased by $6,438,618, or 120%, for the year ended December 31, 2021, as compared to the year ended December 31, 2020, primarily due to the acquisitions of Alpine, VelocIT, Atlantic, RED74, and Arkavia, which were consummated on December 16, 2020, August 12, 2021, November 9, 2021, October 1, 2021, and December 1, 2021, respectively. An aggregate of $4,238,631 in revenue was the result of these acquisitions for the year ended December 31, 2021. The additional increase in revenue was the result of additional customers and usage increases within existing customers. Professional services revenue increased by $1,463,113, or 78%, for the year ended December 31, 2021, as compared to the year ended December 31, 2020, primarily due to the acquisitions of Alpine, VelocIT, Atlantic, RED74, and Arkavia , which were consummated on December 16, 2020, August 12, 2021, November 9, 2021, October 1, 2021, and December 1, 2021, respectively. Expenses Cost of Revenue Security managed services cost of revenue increased by $2,098,324, or 212%, for the year ended December 31, 2021, as compared to the year ended December 31, 2020, primarily due to the acquisitions of VelocIT, Atlantic, RED74, and Arkavia, which were consummated on August 12, 2021, November 9, 2021, October 1, 2021, and December 1, 2021, respectively. As a result of these acquisitions, we incurred cost of revenue of $1,750,169 for the year ended December 31, 2021. In addition, we anticipated a lower margin during the year ended December 31, 2021, due to VelocIT’s hardware revenue stream having a low margin, as well as Technologyville’s planned territory expansion which created upfront costs. - 25 - Professional services cost of revenue increased by $427,900, or 490%, for the year ended December 31, 2021, as compared to the year ended December 31, 2020, primarily due to the acquisitions of Alpine, VelocIT, and Arkavia, which were consummated on December 16, 2020, August 12, 2021, and December 1, 2021, respectively. As a result of these acquisitions, we incurred cost of revenue of $106,211 for the year ended December 31, 2021. The additional increase in revenue was a result of additional customers and usage increases within existing customers. In addition, we anticipated lower margins during the year ended December 31, 2021 due to increased training costs as a result of the increase in new employees. Cost of payroll increased by $6,442,506, or 196%, for the year ended December 31, 2021, as compared to the year ended December 31, 2020, primarily due to the acquisitions of Technologyville, Clear Skies, VelocIT, Atlantic, RED74, and Arkavia, which were consummated on May 25, 2020, August 1, 2020, August 12, 2021, November 9, 2021, and October 1, 2021, respectively. In addition, $2,132,554 of compensation expense related to options was recorded during the year ended December 31, 2021. As a result of these acquisitions, we incurred cost of revenue of $3,574,942 for the year ended December 31, 2021. Operating Expenses Professional fees increased by $262,793, or 28%, for the year ended December 31, 2021, as compared to the year ended December 31, 2020, as a result of increased expenses resulting from preparation for our uplist to Nasdaq and our public offering. Advertising and marketing expenses increased by $284,780, or 190%, for the year ended December 31, 2021, as compared to December 31, 2020, as a result of additional spend on public relations. Selling, general, and administrative expenses increased $6,500,114, or 196%, for the year ended December 31, 2021, as compared to the year ended December 31, 2020, as a result of an increase in payroll due to our ability to recognize a full year of Clear Skies’ and Alpine’s payroll, as well as a portion of VelocIT’s, Atlantic’s, RED74’s, and Arkavia’s payroll. Stock-based compensation expenses increased by $6,180,412, or 438%, for the year ended December 31, 2021, as compared to the year ended December 31, 2020, primarily as a result of an increase in stock options awarded during the year ended December 31, 2021. Impairment of goodwill increased by $22,078,064, or 100%, for the year ended December 31, 2021, as compared to the year ended December 31, 2021, as a result of our analysis of our carrying amount of goodwill being impaired. Other Income (Expense) Interest expense increased by $290,212, or 1,692%, during the year ended December 31, 2021, as compared to the year ended December 31, 2020, as a result of the recording of a full year of interest related to our $3,000,000 related party convertible note. Working Capital Our working capital as of December 31, 2021, as compared to our working capital as of December 31, 2020, is summarized as follows: As of December 31, 2021 December 31, 2020 Current assets $ 9,254,776 $ 6,346,008 Current liabilities 5,141,561 3,863,594 Working capital surplus $ 4,113,215 $ 2,482,414 The increase in current assets is primarily due to a decrease in cash and cash equivalents of $2,471,995, offset by an increase in accounts receivable, inventory and prepaid expenses and other current assets of $3,833,968, $727,974, and $818,821, respectively. The increase in current liabilities is primarily due to the increase in accounts payable and accrued expense, and the settlement liability of $1,899,262 and $470,000, respectively. - 26 - Cash Flows Our cash flows for the year ended December 31, 2021, as compared to our cash flows for the year ended December 31, 2020, can be summarized as follows: Year Ended December 31, 2021 2020 Net cash used in operating activities $ (7,385,129 ) $ (1,702,079 ) Net cash provided by investing activities 2,050,057 285,297 Net cash provided by financing activities 2,863,077 4,737,167 Increase (decrease) in cash $ (2,471,995 ) $ 3,320,385 Operating Activities Net cash used in operating activities was $7,385,129 for the year ended December 31, 2021 and was primarily due to cash used to fund a net loss of $39,145,650, adjusted for non-cash expenses in the aggregate of $33,853,661 and additional cash outlaid by changes in the levels of operating assets and liabilities in the aggregate of $2,093,140, primarily as a result of an increase in accounts receivable and other current assets. Net cash used in operating activities was $1,702,079 for the year ended December 31, 2020 and was primarily due to cash used to fund a net loss of $3,413,262, adjusted for non-cash expenses in the aggregate of $2,064,389, partially offset by cash generated by changes in the levels of operating assets and liabilities in the aggregate of $353,206, primarily as a result of an increase in accounts payable. Investing Activities Net cash provided by investing activities of $2,050,057 for the year ended December 31, 2021, was primarily due to the cash acquired in the acquisitions of VelocIT, Atlantic, RED74, and Arkavia. Net cash provided by investing activities of $285,297 for the year ended December 31, 2020, was due to cash acquired in the Techville and Clear Skies Acquisitions. Financing Activities Net cash provided by financing activities for the year ended December 31, 2021 was $2,863,077, which was primarily due to cash received from the sale of our common stock, and proceeds from loans and notes payable of $3,250,000 and $1,863,474, respectively, and offset by the payment of loans of $2,300,397. Net cash provided by financing activities for the year ended December 31, 2020 was $4,737,167 and was due to cash received from the sale of our common stock of $1,131,009 and proceeds from a convertible note of $3,000,000. The Company has considered its material cash requirements from known contractual obligations, such as lease obligations, purchase obligations, and other liabilities reflected on the company’s balance sheet as of December 31, 2021 and has determined that none exist other than the Company’s commitment to pay $150,000 to the Atlantic Shareholders as part of the Company’s listing to a national exchange, $5,497,500 of future minimum payments of non-convertible outstanding debt and $284,512 in outstanding lease obligations. Liquidity The accompanying consolidated financial statements have been prepared on the basis that we will continue as a going concern, which contemplates realization of assets and satisfying liabilities in the normal course of business. At December 31, 2021, we had an accumulated deficit of $44,012,422 and working capital surplus of $4,113,215. For the year ended December 31, 2021, we had a loss from operations of $39,780,024 and negative cash flows from operations of $7,385,129. Although our company is showing positive revenue and gross profit trends, we expect to incur further losses through the end of 2022. - 27 - To date, we have funded operations primarily through the sale of equity in private placements and revenue generated by our services. During the year ended December 31, 2021, we received $3,250,000 from private placements of our common stock. We believe that our existing cash and cash equivalents and cash generated by operating activities will be sufficient to meet our operating and capital requirements for at least the next 12 months as well as our longer-term expected future cash requirements and obligations. Our future capital requirements, both near-term and long-term, will depend on many factors, in addition to our recurring operating expenses, include our growth rate, the continued expansion of sales and marketing activities, the introduction of new and enhanced products and service offerings, and the costs of any future acquisitions in complementary businesses and technologies. To the extent existing cash and cash equivalents are not sufficient to fund future activities, we may seek to raise additional funds through equity, equity-linked or debt financings. Any additional equity financing may be dilutive to our existing stockholders. We may enter into agreements or letters of intent with respect to potential investments in, or acquisitions of, complementary businesses, services or technologies, which could also require us to seek additional equity financing, incur indebtedness or use cash resources. In the event that additional financing is required from outside sources, we may not be able to raise it on terms acceptable to us or at all. If we are unable to raise additional capital when desired, or if we cannot expand our operations or otherwise capitalize on our business opportunities because we lack sufficient capital, our business, operating results and financial condition would be adversely affected. Effects of Inflation We do not believe that inflation has had a material impact on our business, revenue, or operating results during the periods presented. Recently Issued Accounting Pronouncements See Note 2 to our consolidated financial statements for the years ended December 31, 2021 and 2020 included elsewhere in this Annual Report. Critical Accounting Policies and Estimates Use of Estimates The preparation of financial statements in conformity with U.S. GAAP requires management to make estimates and assumptions that affect the reported amounts of assets and liabilities and disclosure of contingent liabilities at dates of the financial statements and the reported amounts of revenue and expenses during the periods. Our significant estimates and assumptions include the recoverability and useful lives of long-lived assets, stock-based compensation, and the valuation allowance related to our deferred tax assets. Certain of our estimates, including the carrying amount of intangible assets and goodwill, could be affected by external conditions, including those unique to us and general economic conditions. It is reasonably possible that these external factors could have an effect on our estimates and could cause actual results to differ from those estimates. - 28 - Fair Value Measurement The fair value measurement guidance clarifies that fair value is an exit price, representing the amount that would be received to sell an asset or paid to transfer a liability in an orderly transaction between market participants. As such, fair value is a market-based measurement that should be determined based on assumptions that market participants would use in the valuation of an asset or liability. It establishes a fair value hierarchy that prioritizes the inputs to valuation techniques used to measure fair value. The hierarchy gives the highest priority to unadjusted quoted prices in active markets for identical assets or liabilities (Level 1 measurements) and the lowest priority to unobservable inputs (Level 3 measurements). The three levels of the fair value hierarchy under the fair value measurement guidance are described below: Level 1 - Unadjusted quoted prices in active markets that are accessible at the measurement date for identical assets or liabilities; Level 2 - Quoted prices in markets that are not active, or inputs that are observable, either directly or indirectly, for substantially the full term of the asset or liability; or Level 3 - Prices or valuation techniques that require inputs that are both significant to the fair value measurement and unobservable (supported by little or no market activity). Business Combination We allocate the purchase price of an acquired business to the tangible and intangible assets acquired and liabilities assumed based upon their estimated fair values on the acquisition date. Any excess of the purchase price over the fair value of the net assets acquired is recorded as goodwill. The purchase price allocation process requires management to make significant estimates and assumptions, especially at the acquisition date with respect to intangible assets. Direct transaction costs associated with the business combination are expensed as incurred. The allocation of the consideration transferred in certain cases may be subject to revision based on the final determination of fair values during the measurement period, which may be up to one year from the acquisition date. We include the results of operations of the business that it has acquired in its consolidated results prospectively from the date of acquisition. If the business combination is achieved in stages, the acquisition date carrying value of the acquirer’s previously held equity interest in the acquiree is re-measured to fair value at the acquisition date; any gains or losses arising from such re-measurement are recognized in profit or loss. Intangible Assets Intangible assets are comprised of trademarks, customer bases, non-compete agreements and intellectual property with original estimated useful lives with a range of 2 to 15 years. Once placed into service, we amortize the cost of the intangible assets over their estimated useful lives on a straight-line basis. Goodwill Goodwill represents the excess of the purchase price of the acquired business over the estimated fair value of the identifiable net assets acquired. Goodwill is not amortized but is tested for impairment at least annually at year end, at the reporting unit level or more frequently if events or changes in circumstances indicate that the asset might be impaired. Goodwill is tested for impairment at the reporting level by first performing a qualitative assessment to determine whether it is more likely than not that the fair value of the reporting unit is less than its carrying value. If the reporting unit does not pass the qualitative assessment, then the reporting unit’s carrying value is compared to its fair value. The fair values of the reporting units are estimated using market and discounted cash flow approaches. Goodwill is considered impaired if the carrying value of the reporting unit exceeds its fair value. The discounted cash flow approach uses expected future operating results. Failure to achieve these expected results may cause a future impairment of goodwill at the reporting unit. Due to the Company determining that the reporting unit’s carrying value was over the estimate of the fair value recorded, we recognized a loss on impairment of goodwill of $22,078,064 at December 31, 2021. Impairment of Long-lived Assets We will periodically evaluate the carrying value of long-lived assets to be held and used when events and circumstances warrant such a review and at least annually. The carrying value of a long-lived asset is considered impaired when the anticipated undiscounted cash flow from such asset is separately identifiable and is less than its carrying value. In that event, a loss is recognized based on the amount by which the carrying value exceeds the fair value of the long-lived asset. Fair value is determined primarily using the anticipated cash flows discounted at a rate commensurate with the risk involved. Losses on long-lived assets to be disposed of are determined in a similar manner, except that fair values are reduced for the cost to dispose. - 29 - Stock-Based Compensation We measure the cost of services received in exchange for an award of equity instruments based on the fair value of the award. For employees and directors, the fair value of the award is measured on the grant date and for non-employees, the fair value of the award is generally re-measured on vesting dates and interim financial reporting dates until the service period is complete. Awards granted to directors are treated on the same basis as awards granted to employees. Revenue Recognition Our agreements with clients are primarily service contracts that range in duration from a few months to one year. We recognize revenue when control of these services is transferred to the client for an amount, referred to as the transaction price, which reflects the consideration to which we are expected to be entitled in exchange for those goods or services. A contract with a client exists only when: ● the parties to the contract have approved it and are committed to perform their respective obligations; ● we can identify each party’s rights regarding the distinct services to be transferred (“performance obligations”); ● we can determine the transaction price for the services to be transferred; and ● the contract has commercial substance, and it is probable that we will collect the consideration to which it will be entitled in exchange for the goods or services that will be transferred to the client. We do not adjust the promised amount of consideration for the effects of a significant financing component since we expect, at contract inception, that the period between the time of transfer of the promised goods or services to the client and the time the client pays for these goods or services to be generally one year or less. Our credit terms to clients generally average thirty days, although in some cases payments are required in 15 days. We do not disclose the value of unsatisfied performance obligations for contracts with original expected duration of one year or less. Disaggregation of Revenue Revenue consisted of the following by service offering for year ended December 31, 2021: Security Managed Services Professional Services Total Primary Sector Markets Public $ 3,389,899 $ 44,579 $ 3,434,478 Private 8,052,315 3,226,641 11,278,956 Not-for-profit 355,505 73,620 429,125 $ 11,797,719 $ 3,344,840 $ 15,142,559 Major Service Lines Compliance $ 4,234,839 $ - $ 4,234,839 Secured managed services 6,990,606 - 6,990,606 SOC managed services 375,644 - 375,644 vCISO 196,630 - 196,630 Technical assessments - 2,641,171 2,641,171 Incident response and forensics - 523,080 523,080 Training - 149,529 149,529 Other cybersecurity services - 31,060 31,060 $ 11,797,719 $ 3,344,840 $ 15,142,559 - 30 - Revenue consisted of the following by service offering for the year ended December 31, 2020: Security Managed Services Professional Services Total Primary Sector Markets Public $ 3,390,166 $ 5,068 $ 3,395,234 Private 1,823,530 1,867,659 3,691,189 Not-for-profit 145,405 9,000 154,405 $ 5,359,101 $ 1,881,727 $ 7,240,828 Major Service Lines Compliance $ 3,446,157 $ - $ 3,446,157 Secured managed services 1,340,468 - 1,340,468 SOC managed services 496,050 - 496,050 vCISO 76,426 - 76,426 Technical assessments - 801,055 801,055 Incident response and forensics - 750,069 750,069 Training - 97,706 97,706 Other cybersecurity services - 232,897 232,897 $ 5,359,101 $ 1,881,727 $ 7,240,828 Practical Expedients As part of Accounting Standards Code (“ASC”) 606, we have adopted practical expedients, including the following: (i) we have determined that we need not adjust the promised amount of consideration for the effects of a significant financing component since we expect, at contract inception, that the period between when we transfer a promised service to the customer and when the customer pays for that service will be one year or less and (ii) we recognize any incremental costs of obtaining a contract as an expense when incurred if the amortization period of the asset that the entity otherwise would have recognized is one year or less. Reimbursed Expenses We include reimbursed expenses in revenue and costs of revenue as we are primarily responsible for fulfilling the promise to provide the specified service, including the integration of the related services into a combined output to the client, which are inseparable from the integrated service. These costs include such items as consumables, transportation and travel expenses, over which we have discretion in establishing prices. Costs of Revenue Costs of revenue include (i) compensation and benefits for billable employees and consultants directly involved with delivering services offerings and engagements; (ii) consumables used for the services; and (iii) other expenses directly related to service contracts such as professional services, meals and travel expenses. Volatility in Stock-Based Compensation The volatility is based on historical volatilities of companies in comparable stages as well as the historical volatility of companies in the industry and, by statistical analysis of the daily share-pricing model. The volatility of stock-based compensation at any point in time is based on historical volatility of similar companies in the industry for the last two to five years. Off-Balance Sheet Arrangements We have no off-balance sheet arrangements that have or are reasonably likely to have a material current or future effect on our financial condition, changes in financial condition, revenue or expenses, results of operations, liquidity, capital expenditures, or capital resources. - 31 - ITEM 7A. QUANTITATIVE AND QUALITATIVE DISCLOSURES ABOUT MARKET RISK Because we are a smaller reporting company, we are not required to provide the information called for by this Item. ITEM 8. FINANCIAL STATEMENTS AND SUPPLEMENTARY DATA The information called for by Item 8 is included beginning on page F-1 contained in this Annual Report on Form 10-K. ITEM 9. CHANGES IN AND DISAGREEMENTS WITH ACCOUNTANTS ON ACCOUNTING AND FINANCIAL DISCLOSURE None.