CISO Global, Inc. 10-K

ITEM 1. BUSINESS Unless otherwise indicated or the context requires otherwise, the terms “we,” “us,” “our,” and “our company” refer to CISO Global, Inc., a Delaware corporation, and our wholly owned subsidiaries. Unless otherwise specified, all dollar amounts are expressed in United States dollars. Our Business General We are a cybersecurity and compliance company comprised of highly trained and seasoned security professionals who work with clients to enhance or create a better cyber posture in their organization. Cybersecurity, also known as computer security or information technology security, is the protection of computer systems and networks from information disclosure, theft of or damage to their hardware, software, or electronic data, as well as from the disruption or misdirection of the services they provide. The cybersecurity industry has a supply and demand issue wherein there is more demand for cybersecurity services than there are expert and seasoned compliance and cybersecurity professionals available in the market. We seek to identify, attract, and retain highly skilled cyber and compliance teams and bring them together to provide holistic cyber services. We accomplish this through acquisitions, direct hiring, and incentivizing employees with stock options to help retain them. On an ongoing basis, we seek to identify cyber talent that is culturally aligned and that offers operating leverage through both existing customer revenue and relationships. We have invested in enterprise solutions and executive talent to integrate our different organizations into an ecosystem that works together to provide complete and holistic cybersecurity through cross pollination of solutions. The ecosystem is intended to provide additional revenue opportunities and drive overall recurring revenue. We emphasize to clients the critical nature of having their work force create a continuously aware security culture. Once engaged, we strive to become the trusted advisors for customers’ cybersecurity and compliance needs by providing tailored security solutions based upon their organizational needs. We do not focus on selling cybersecurity products; we are product-agnostic so that we can provide solutions that fit the customer’s security needs, financial realities, and future strategy. Our approach is to evaluate the client’s organization holistically, identify compliance requirements, and secure the infrastructure while helping to create a culture of security. We provide a full range of cybersecurity consulting and related services, encompassing all three pillars of compliance, cybersecurity, and culture. Our services include compliance services, secured managed services, security operations center (“SOC”) services, virtual Chief Information Security Officer (“vCISO”) services, incident response, certified forensics, technical assessments, and cybersecurity training. We believe that culture is the foundation of every successful cybersecurity and compliance program. To deliver that outcome, we developed our unique offering of MCCP+ (“Managed Compliance & Cybersecurity Provider + Culture”), which is the only holistic solution that provides all three of these pillars under one roof from a dedicated team of subject matter experts. In contrast to the majority of cybersecurity firms that are focused on a specific technology or service, we seek to differentiate ourselves by remaining technology agnostic, focusing on accumulating highly sought-after topic experts. We continually seek to identify and acquire cybersecurity talent to expand our service scope and geographical coverage to provide the best possible service for our clients. We believe that bringing together a world-class team of technological experts with multi-faceted expertise in the critical aspects of cybersecurity is key to providing technology agnostic solutions to our clients in a business environment that has suffered from a chronic lack of highly skilled professionals, thereby setting us apart from competitors and in-house security teams. Our goal is to create a culture of security and to help quantify, define, and capture a return on investment from information technology and cybersecurity spending. Offering this set of cybersecurity services allows us to capture more revenue with greater efficiency, facilitating greater profitability and stronger customer retention. The benefit to our customers is that they receive an efficient engagement from a single provider that covers a wide range of their needs. This means their challenges are addressed more thoroughly and problems are resolved more rapidly when compared to working with multiple vendors. This leads to the best possible outcome, which enables our customers to commit to us for the long term. - 4 - We believe that our business model is differentiated from other companies in the industry in that our employees are not consultants; they are dedicated partners available on a recurring monthly contract. Due to the numerous challenges in hiring experienced cybersecurity and compliance professionals, assimilating our team of industry and subject matter experts into our clients’ teams is the ideal solution. We are technology agnostic. Whereas, most cybersecurity firms are locked into working with a single technology, we seek to differentiate ourselves by remaining technology agnostic. This approach enables us to work with any business, no matter what systems or tools they use. For our customers, the benefit is equally valuable as they are able to choose the best tools and technology for their business needs without affecting their relationship with us. We believe that building a world-class technology team with industry-specific and subject-matter expertise is the key to providing cutting-edge solutions to our clients. We will continue to identify and acquire cybersecurity talent to expand our scope of services and geographical footprint to fortify our capability to deliver excellence to our customers. Furthermore, our goal is to stay a step ahead of threat actors and regulatory obligations to keep our customers safe and compliant. The Cybersecurity Challenge As the world has become increasingly connected through the Internet, cyberattacks have prevailed and evolved, in different forms, causing uncontainable threats to the integrity and privacy of enterprise and personal data and resulted in significant economic losses globally. A report published by Cybersecurity Ventures stated that damages from global cybercrime is predicted to hit $10.5 trillion annually by 2025. Cybersecurity Ventures estimated that consumers and organizations will fall victim to a ransomware attack every two seconds at an approximate cost of $265 billion annually in 2031. This is up from $20 billion and every 11 seconds in 2021. As a result, ransomware is one of the fastest growing types of cybercrime. Moreover, an Accenture survey reported that 68% of business leaders feel their cybersecurity risks are increasing. Cybersecurity Ventures has also estimated that worldwide global cybersecurity spending will exceed $1.75 trillion cumulatively from the fiscal years 2021 to 2025, with $459 billion expected to be spent on an annual basis in 2025. The New York Times reported that in 2021 there would be 3.5 million unfilled job openings in the cybersecurity field. Three years later, despite widespread university and government investments into education programs and recruitment efforts, the rates are roughly the same, based upon a report from Cybersecurity Ventures, and that disparity between supply and demand will remain through at least 2025. In response to the increasing economic damage caused by heightened cybersecurity risks, regulatory bodies have pushed the implementation of new cybersecurity legislations, and cyber insurance companies have increased minimum cybersecurity underwriting requirements, as well as premium costs. We believe that we are well positioned in a fast-growing industry to provide businesses with a wide scope of cybersecurity services and with significant opportunities for growth. We support clients from 17 historical acquisitions with expanded service offerings. With 1,100 clients, this represents a tremendous opportunity for cross-selling and upselling. Additionally, we have built and continue to expand an extensive channel and partnership ecosystem, providing training, support, and partner marketing content to establish reliable streams of new revenue with new clients. In addition, our strategy around IP allows us to further penetrate our existing customers, new markets, and opens up additional partnership opportunities. Cybersecurity Service Offerings We offer a comprehensive range of cybersecurity services to protect our clients’ digital assets and ensure compliance with industry standards and regulations. Our services fall into two main categories: Security Managed Services and Professional Services. - 5 - Security Managed Services Our Security Managed Services include the following offerings: ● Compliance Services: We help clients implement appropriate controls, prioritize risks, and ensure adherence to industry standards and regulations, such as Cybersecurity Maturity Model Certification (“CMMC”), Federal Risk and Authorization Management Program (“FedRAMP”), Federal Information Security Modernization Act (“FISMA”), Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), Health Information Trust Alliance (“HITRUST”), Import Export Code (“IEC”), Internal Organization for Standardization (“ISO”), National Institute of Standards and Technology (“NIST”), and more. Our experienced experts possess relevant certifications and provide continuous monitoring and support. ● Cyber Defense Operations: Our U.S.-based SOC provides 24/7 threat monitoring, alerting, validation, and proactive threat hunting. We offer Managed Detection and Response (“MDR”), Extended Detection and Response (“XDR”), Security Information and Event Management (“SIEM”), and Patch and Vulnerability Management services, ensuring a unified solution for cyber resiliency. ● Secured Managed Services: We offer fully managed Security Managed Services (“SMS”), combining secure network architecture, our portfolio of internally developed cybersecurity software, SOC services, compliance support, remediation teams, and advanced firewall management. Our engineers and architects can manage secure cloud migrations, design new systems, and implement solutions to minimize security risks efficiently. Cybersecurity Professional Services Our Professional Services include the following offerings: ● Incident Response and Digital Forensics: Our experienced team specializes in identifying and remediating cyber attacks, using real-world hacking techniques to investigate the entire environment discreetly, assess the scope of the attack, and effectively remediate any damages or persistent threats. ● Security Testing and Training: We provide security testing services, including penetration testing (red team and purple team), attack simulation exercises, and training programs, including CMMC (Certified Cyber Profession (“CCP”) and Cybersecurity Capability Assessment (“CCA”)), Computing Technology Industry Association (“CompTIA”), International Information System Security Certification Consortium (“ISC 2 ”), to increase clients’ cybersecurity readiness and resiliency. - 6 - Growth Strategy We are following a phased growth strategy. In Phase I, we established a foundation of end-to-end cybersecurity experts through acquiring niche companies with unparalleled expertise and talent. Today, our experts span the United States and Latin America and each have their own special expertise, industry specific knowledge, familiarity with regulatory frameworks and focal areas that fall into four key pillars of cybersecurity: risk and compliance, cyber defense operations, security testing and training, and secure IT and architecture. These practice areas, led by a seasoned executive team of industry thought leaders, are enabling us to effectively tackle a rapidly expanding market. In Phase II of our growth strategy, we are supporting clients from 17 historical acquisitions with expanded service offerings. With only a 9% penetration into 1,100 clients for multiple services consumed, this represents a tremendous opportunity for cross-selling and upselling. Additionally, we have built and continue to expand an extensive channel and partnership ecosystem, providing training, support, and partner marketing content to establish reliable streams of new revenue with new clients. Phase II also includes the development and launch of key software-first intellectual property (“IP”) technologies that can effectively address many of the cybersecurity challenges facing enterprises today. Leveraging machine learning (“ML”), artificial intelligence (“AI”), deep learning, and neural net technologies, as well as proprietary DarkNet threat intelligence, we are developing multi-layered cybersecurity technologies to help drive the cyber effectiveness leading to resiliency. Equipped with a comprehensive team, our focus in Phase III will be fueling organic growth with our intellectual property. With a complete portfolio of scalable solutions that are underpinned by an end-to-end team of cybersecurity and compliance experts, we can expand our technology offerings through product led growth strategies. Optimizing user experience and hands-free purchasing through digital interfaces, the company can grow its clients without adding demand to its services team. Such scalability will serve to increase revenue and margins concurrently. We are focused on the development of our own Intellectual Property suite which incorporates AI, Neural Nets and the latest generation of algorithms. Our portfolio includes the following software-first solutions: ARGO Security Management – A security management platform which is able to aggregate, then curate security data in real time from a client’s entire environment, including network asset information, currently deployed cyber tools, SOC, vulnerability management, secure managed IT and penetration testing data. CISO Edge Cloud Security Platform – A cloud-first security solution designed to protect users from untrusted and malicious online threats. CISO Edge uses advanced AI deep learning as well as artificial neural networks to provide advanced threat detection and monitoring. CHECKLIGHT ® Endpoint Security Monitoring – A powerful, proactive security monitoring software that detects potential threats to networks and provides advance alerts so attacks can’t take hold. Relying on the same cybersecurity software engine used by several federal agencies, it identifies unauthorized processes associated with fraudulent phishing attacks, hacking, imposter scams, malware, ransomware, and viruses. DISC Next Gen VPN – A token exchange-protected remote access solution that replaces traditional VPN connections with enhanced security and access verification. Skanda Breach Assessment Tool – A next-generation, analysis tool that applies AI-based automation and ML technologies, which looks beyond vulnerabilities identified by most other technology to deliver continuous security assessments. Our Corporate and Acquisition History We were formed on March 5, 2019 as a Delaware corporation. Our principal offices are located at 6900 East Camelback Road, Suite 900, Scottsdale, Arizona 85251. On October 2, 2019, we filed a registration statement on Form 10-12G with the Securities and Exchange Commission (“SEC”) to effect registration of our common stock, par value $0.00001 per share, under the Exchange Act. The registration statement became effective on December 1, 2019. On February 29, 2024, our board of directors approved a 1-for-15 reverse stock split of our common stock. The record date for the reverse stock split was the close of business on March 7, 2024, with share distribution occurring on March 8, 2024. As a result of the reverse stock split, stockholders received one share of CISO Global, Inc. common stock, par value $0.00001, for each 15 shares they held as of the record date. All share and per share amounts have been retroactively restated for the effects of this reverse stock split. Common stock underlying our outstanding warrants, convertible notes, and options have also been adjusted, and the conversion and exercise prices have also been adjusted. - 7 - We have substantially expanded our business in recent years through a number of acquisitions. The following table sets forth certain information regarding such acquisitions: Acquired Company, Location Type of Acquisition Date Services Provided by Acquired Company GenResults, LLC (“GenResults”) Arizona (1) Stock April 12, 2019 Cybersecurity services. VCAB Six Corporation (“VCAB”) Texas Merger April 12, 2019 N/A (2) TalaTek, LLC (“TalaTek”) Virginia Merger October 1, 2019 Integrated risk management services, including risk assessments, IT audits, cybersecurity services, and managed compliance services. Technologyville, Inc. Illinois Stock May 25, 2020 Managed IT services. Clear Skies Security, LLC Georgia Stock August 1, 2020 Security assessment and penetration testing. Alpine Security, LLC Missouri Merger December 16, 2020 Integrated risk management services. Catapult Acquisition Corporation (“VelocIT”) New Jersey Merger August 12, 2021 Integrated risk management services. Atlantic Technology Systems, Inc., and Atlantic Technology Enterprises, Inc. (collectively, “Atlantic”) New Jersey Stock October 1, 2021 Integrated risk management services. RED74 LLC (“RED74”) New Jersey Merger November 9, 2021 Integrated risk management services. Ocean Point Equities, Inc. (“Arkavia”) Santiago, Chile Stock December 1, 2021 Cybersecurity services. True Digital Security, Inc. (“True Digital”) New York Florida Oklahoma Stock January 19, 2022 Cybersecurity and compliance. Creatrix, Inc. Tennessee Maryland Stock June 1, 2022 Identity management, systems integration and software engineering, biometrics, vetting, credentialing, and case management. CyberViking, LLC Georgia Oregon Stock July 1, 2022 Application security services, incident response, threat hunting, and creation and management of security operation centers. Servicios Informaticos CUATROi, S.P.A., Comercializadora CUATROi S.P.A., CUATROi Peru, S.A.C., and CUATROi S.A.S. Santiago, Chile Bogota, Columbia, and Lima, Peru Stock August 25, 2022 Managed services and cybersecurity. NLT Networks, S.P.A., NLT Technologias, Limitada, NLT Servicios Profesionales, S.P.A., and White and Blue Solutions, LLC Providencia, Chile Florida Stock September 1, 2022 Security solutions and managed services. SB Cyber Technologies, LLC Virginia Stock July 14, 2023 Managed services and compliance. (1) Prior to our acquisition of GenResults, GenResults was wholly owned by an entity affiliated with David G. Jemmett, our Chief Executive Officer and a director of our company. Due to the companies being under common control, we accounted for the acquisition as a reorganization. (2) At the time of the VCAB Merger, VCAB was subject to a bankruptcy proceeding and had minimal assets, no equity owners, and no liabilities, except for approximately 1,500 holders of Class 5 Allowed General Unsecured Claims and a holder of allowed administrative expenses (collectively the “Claim Holders”). Pursuant to the terms of the VCAB Merger, and in accordance with the bankruptcy plan, we issued an aggregate of 133,334 shares of our common stock (the “Plan Shares”) to the Claim Holders as full settlement and satisfaction of their respective claims. As provided in the bankruptcy plan, the Plan Shares were issued pursuant to Section 1145 of the United States Bankruptcy Code. We entered into the VCAB Merger to increase our stockholder base to, among other things, assist us in satisfying the listing standards of a national securities exchange. - 8 - Customers Our recent acquisitions have resulted in expansion of our customer base and increased usage within existing customers. None of our customers individually accounted for more than 10.0% of our consolidated revenue for the years ended December 31, 2023 and 2022, nor are we dependent upon a few major customers. Competition The cybersecurity market is highly fragmented. We primarily compete with established and emerging security product vendors. While the market for traditional endpoint and IT operations solutions has historically been competitive, we believe as we look to enter into adjacent markets and expand our total addressable market, we may face new competitors. We believe we compete favorably with our competitors on the basis of these factors as a result of our intelligence and expertise from the frontlines, as well as the features and performance of our solutions, the ease of integration of our solutions in diverse IT environments, the breadth of our services, the integration of our SaaS solution offerings in our platform, the measurement and reporting capabilities of our validation technologies, and the reputation of our consulting organization. However, many of our competitors have substantially greater financial, technical and other resources, greater name recognition, larger sales and marketing budgets, deeper customer relationships, broader distribution, and larger and more mature intellectual property portfolios. We face direct competition from all small-to-medium-sized cybersecurity service providers nationwide given the broad service scope we currently provide. Many competitors provide cloud-based services, which means our competition is not restricted by regions. It is critical for our executive management team to identify and attract strategic acquisition targets in order to strengthen our competitive advantage as a cybersecurity consolidator, which we believe brings higher service quality, more diverse service scope, and broader geographical coverage at a lower cost. Intellectual Property We believe that our intellectual property rights are valuable and important to our business. We rely on trademarks, patents, copyrights, trade secrets, license agreements, intellectual property assignment agreements, confidentiality procedures, non-disclosure agreements, and employee non-disclosure and invention assignment agreements to establish and protect our proprietary rights. Though we rely in part upon these legal and contractual protections, we believe that factors such as the skills and ingenuity of our employees and the functionality and frequent enhancements to our solutions are larger contributors to our success in the marketplace. We continue to grow our portfolio of intellectual property rights in connection with our products, services, research and development, and other activities to protect our proprietary technology relevant to our business. We intend to pursue additional intellectual property protection to the extent we believe it would be beneficial and cost-effective. If we become more successful, we believe that competitors will be more likely to try to develop products that are similar to ours and that may infringe our proprietary rights. It may also be more likely that competitors or other third parties will claim that our products infringe their proprietary rights. In particular, large and established companies in the cybersecurity industry have extensive patent portfolios and are regularly involved in both offensive and defensive litigation. From time-to-time, third parties, including certain of these large companies and non-practicing entities, may assert patent, copyright, trademark, and other intellectual property rights against us, our channel partners, our cloud platform providers, or our end-customers, whom our standard license and other agreements obligate us to indemnify against such claims. Successful claims of infringement by a third party, if any, could prevent us from distributing certain products or performing certain services, require us to expend time and money to develop non-infringing solutions, or force us to pay substantial damages (including, in the United States, treble damages if we are found to have willfully infringed patents), royalties or other fees. We cannot assure you that we do not currently infringe, or that we will not in the future infringe, upon any third-party patents or other proprietary rights. - 9 - Government Regulation We are not aware of any specific regulations that govern cybersecurity firms or the areas in which we operate. While there are a few federal cybersecurity regulations, they govern industries that we serve and exist to focus on specific industries. Three of the main cybersecurity regulations are HIPAA, the 1999 Gramm-Leach-Bliley Act, and the 2002 Homeland Security Act, which included the Federal Information Security Management Act (“FISMA”). The three regulations mandate that healthcare organizations, financial institutions, and federal agencies, respectively, should protect their systems and information. FISMA, which applies to every government agency, requires the development and implementation of mandatory policies, principles, standards, and guidelines on information security. However, the regulations do not address numerous computer related industries, such as Internet Service Providers and software companies. Furthermore, the regulations do not specify what cybersecurity measures must be implemented and require only a “reasonable” level of security. In addition, the National Cybersecurity Division is another regulatory body that is a division of the Office of Cybersecurity & Communications within the U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency. Human Capital Management We believe that our future success will depend, in part, on our continued ability to attract, hire, and retain qualified personnel. In particular, we depend on the skills, experience, and performance of our senior management and engineering and technical personnel. We compete for qualified personnel with other cyber security companies and industry experts. We provide competitive compensation and benefits programs to help meet the needs of our employees. In addition to salaries, these programs (which vary by country/region and employment classification) include incentive compensation plan, pension, healthcare and insurance benefits, paid time off, family leave, and on-site services, among others. We also use targeted equity-based grants with vesting conditions to facilitate retention of personnel, particularly for our key employees. The success of our business is fundamentally connected to the well-being of our people. Accordingly, we are committed to the health and safety of our employees. In response to the COVID-19 pandemic, we implemented significant changes that we determined were in the best interest of our employees, as well as the communities in which we operate, and which comply with government regulations. This includes having employees work from home, while implementing additional safety measures for employees continuing critical on-site work. Environmental, Social, and Governance Efforts Environmental Commitment We are committed to protecting the environment and attempt to mitigate any negative impact of our operations. We monitor resource use, improve efficiency, and at the same time reduce our emissions and waste. Social Responsibility We are a trusted cybersecurity expert providing safe, efficient, and sustainable services to our existing and new communities. Our success is the direct result of the dedication and strength of our team and promotes equity, diversity, integrity, inclusion, reliability and accountability. We believe that a combination of diverse team members and an inclusive culture contributes to our success. Each member is a valued part of our team bringing a diverse perspective to help grow business and achieve our goals. Our tradition of serving employees, customers, and investors is at the core of our culture. For third-party vendor selection and oversight, we have standard operating procedures that apply to employees and subcontractors who, on our behalf, oversee and conduct technical protocols. - 10 - Employees As of December 31, 2023, we had 402 employees, of which 397 were full-time. In addition, we utilize independent contractors for projects of short duration or where specialized knowledge or experience is needed for a complex project. We are not dependent on any independent contractor, and we believe adequate replacements would be available in the event any such independent contractor becomes unavailable to us. We believe our relations with our employees is good. Available Information Our Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, our proxy and information statements and all amendments to those reports will be available free of charge through our website at www.ciso.inc as soon as practicable after such material is electronically filed with, or furnished to, the SEC. Except as otherwise stated in these documents, the information contained on our website or available by hyperlink from our website is not incorporated by reference into this report or any other documents we file, with or furnish to, the SEC. Implications of Being an Emerging Growth Company We qualify as an “emerging growth company” as the term is used in The Jumpstart Our Business Startups Act of 2012 (the “JOBS Act”), and therefore, we may take advantage of certain exemptions from various public company reporting requirements, including: ● a requirement to only have two years of audited financial statements and only two years of related selected financial data and management’s discussion and analysis; ● exemption from the auditor attestation requirement on the effectiveness of our internal controls over financial reporting; ● reduced disclosure obligations regarding executive compensation; and ● exemptions from the requirements of holding a nonbinding advisory stockholder vote on executive compensation and any golden parachute payments. We may take advantage of these provisions for up to five years or such earlier time that we are no longer an emerging growth company. We would cease to be an emerging growth company if we have more than $1.07 billion in annual revenue, issue more than $1.0 billion of non-convertible debt over a three-year period, or become a large accelerated filer. So long as we remain an emerging growth company, we may choose to take advantage of some, but not all, of the available benefits of the JOBS Act. We have taken advantage of some of the reduced reporting requirements in our filings. Accordingly, the information contained herein may be different than the information you receive from other public companies in which you hold stock. In addition, the JOBS Act provides that an emerging growth company can delay adopting new or revised accounting standards until such time as those standards apply to private companies. We have elected to avail ourselves of this exemption from new or revised accounting standards and, therefore, we will not be subject to the same new or revised accounting standards as other public companies that are not emerging growth companies.