SideChannel, Inc. 10-K

ITEM 1. BUSINESS Recent Reverse Merger On July 1, 2022 (the “Closing Date”) the Company, then known as Cipherloc Corporation, a Delaware corporation, completed its acquisition (“Business Combination”) of all the outstanding equity securities of SideChannel, Inc., a Massachusetts corporation pursuant to an Equity Securities Purchase Agreement dated May 16, 2022 (the “Purchase Agreement”). On September 9, 2022, SideChannel, Inc. the acquired Massachusetts corporation and a subsidiary of the registrant, changed its name to SCS, Inc. (the “Subsidiary” or “SCS”) and Cipherloc Corporation, the Delaware parent company of the subsidiary has changed its name to SideChannel, Inc. The transaction was accounted for as a reverse acquisition in accordance with accounting principles generally accepted in the United States of America (“GAAP”). Under this method of accounting, SCS was deemed to be the accounting acquirer for financial reporting purposes. This determination was primarily based on the facts that, immediately following the Business Combination: (1) the majority of the Board of Directors of the combined company will be composed of directors designated by the Sellers under the terms of the Purchase Agreement; and (2) existing members of SCS management constituted the management of the combined company. Because SDS has been determined to be the accounting acquirer in the Business Combination, but not the legal acquirer, the transaction is deemed a reverse acquisition under the guidance of the Financial Accounting Standards Board (“FASB”) Accounting Standards Codification (“ASC”) Topic 805, Business Combinations. As a result, the historical financial statements of SideChannel are the historical financial statements of the combined company. Following the closing of the Business Combination, SCS, Inc. became a wholly owned subsidiary of the Company. As used herein, the words “the Company” refers to, for periods following the Business Combination, SideChannel, together with its subsidiaries, and for periods prior to the Business Combination, SideChannel Inc., and its direct and indirect subsidiaries, as applicable. On August 2, 2022, the Company changed its ticker symbol from CLOK to SDCH. Business Overview & Strategy The Company is a provider of cybersecurity services and technology to middle market companies. The Company’s website is www.sidechannel.com . Our mission is to make cybersecurity easy and accessible for mid-market and emerging companies, a market that we believe is currently underserved. We believe that our cybersecurity offerings will reduce risks for our customers through identifying and developing cybersecurity, privacy, and risk management solutions. We anticipate that our target customers will continue to need cost-effective security solutions beginning with but not limited to what we refer to as virtual Chief Information Security Officer services (“vCISO” or “vCISO Services”). We also have announced development of a new software product, Enclave, that we believe offers mid-market and emerging companies the means to simplify several crucial cybersecurity infrastructure procedures, including encryption, microsegmentation and access control (“Enclave”). Our strategy focuses on growth from these three areas 1. Securing new vCISO clients 2. Adding new Cybersecurity Software and Services offerings such as Enclave 3. Increasing adoption of Cybersecurity Software and Services offerings at vCISO clients, including Enclave In support of securing new vCISO clients, we expanded the sales and marketing team from one dedicated person to five during the fiscal quarter ended during September 30, 2022. On October 27, 2022, we announced that during the same fiscal quarter we acquired six (6) new clients with potential annual revenue of $1.3 million. vCISO engagements are typically twelve (12) month engagements containing a monthly subscription and an annual renewal option. Hourly rates for vCISO time and material projects range from $350 to $400. Each of our vCISO’s is generally embedded into the C-suite executive teams of two (2) to four (4) of our clients. 4 We have implemented an account management organization responsible for delivering services and software to our clients. Our vCISO’s and the security and privacy engineers that support them are part of our account management organization. As this team delivers vCISO Services for our clients, we often identify projects to implement and maintain programs that reduce cybersecurity risks which expand our scope of work and increase our revenue generating potential. Similarly, as this team delivers a new cybersecurity service or installs cybersecurity software at a client, we often learn about opportunities to improve the protection of our clients’ digital assets through additional service and software engagements. Our vCISO engagements provide our clients with the C-suite cybersecurity leadership needed to effectively mitigate cybersecurity risks and support ongoing operation of critical business functions. This strategic cybersecurity leadership will often result in additional statements of work for SideChannel to deliver the Cybersecurity Software and Services needed to address gaps in our clients’ cybersecurity framework. We track revenue and other key performance indicators using the vCISO Services category and Cybersecurity Software and Services category. Detail on the performance of these categories is discussed in our Management’s Discussion and Analysis of Financial Condition and Results of Operations in Part II, Item 7 later in this filing. We currently provide Cybersecurity Software and Services and intend to increase our delivery of more tech-enabled services to address the needs of our customers, including: ● Additional Virtual Chief Information Security Officers ● Zero trust ● Third-party risk management ● Due diligence ● Privacy ● Threat intelligence, and ● Managed end-point security solutions We now have over 20 C-suite level information security officers, who possess combined experience of over 400 years in the industry. Since inception, SideChannel has created over 50 multi-layered cybersecurity programs for its clients. We believe that our customers, and prospective customers, in the mid-market will favor our approach, as it provides them with an efficient way to work with a single vendor to manage and oversee their cybersecurity programs. We also believe that our approach will reduce our customers’ overall security costs and streamline their ability to increase their sales, reduce regulatory risks and monitor their risk posture. We believe that we provide a full range of cybersecurity solutions through our employees, and through our network of subcontractors, and our array of partnerships with third party service providers and software companies. We work with our clients to help them select the right cybersecurity tools, products, and solutions. We believe that our use of a combination of employees and subcontractors allows us to cost effectively grow our client base and broaden the subject matter expertise on our bench while maintaining the agility needed to move directly into implementation of projects, which we believe reduces the risk to our customers. Our subcontractors also provide us with sales leads and referrals, and may resell our services to their own client base. 5 Enclave, A SideChannel Proprietary Software Product We are developing products and services around our unique insight into mid-market and emerging companies. During September 2022, SideChannel announced a proprietary product, Enclave, which simplifies a particularly important cybersecurity task called “microsegmentation”. Industry standard cybersecurity and risk management frameworks, such as National Institute of Standards and Technology Cybersecurity Framework (“NIST CSF”) and Center for Internet Security Controls (“CIS”), prioritize inventory of assets and access control as top requirements for a sustainable and compliant cybersecurity program. CIS version 8 controls call for organizations to: ● Control 1 - “Establish and maintain an accurate, detailed, and up-to-date inventory of all enterprise assets with the potential to store or process data”, ● Control 2 - “Actively manage (inventory, track, and correct) all software (operating systems and applications) on the network so that only authorized software is installed and can execute, and that unauthorized and unmanaged software is found and prevented from installation or execution.” ● Control 3 - “Configure data access control lists based on a user’s need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications.” We built Enclave to address these extremely critical cybersecurity controls along with many others. Enclave seamlessly combines access control, microsegmentation, encryption and other secure networking concepts to create a comprehensive solution. It allows Information Technology (IT) to easily segment the enterprise network, place the right staff in those segments and direct traffic. Unlike open, traditional models, Enclave allows for near-limitless micro-segmented networks to operate insulated from one another. According to statistics published by Varonis , a global data protection company, organizations with a zero-trust approach to cybersecurity saw an average breach cost $1.8 million less than organizations without. Enclave reduces the attack surface; which means there is less surface area to search. Checkpoint’s Cloud Security Report stated, forty-three percent (43%) of breaches start with an insider; either intentional or unintentional. Enclave reduces the time to containment by reducing the surface area visible to an intruder. This also limits the scope of a post-event search to uncover situational facts. IBM reported that when remote work is a factor in causing a data breach, the average cost per breach is $1.1 million higher. Add that to productivity lost waiting for network slowdowns caused by VPN (“Virtual Private Network”) tunnels, and the costs go up even more. Enclave provides: Simplified Security Operations ● Simple, fast, no training required. Deploy in minutes and configure in seconds. Enhanced Resilience ● Gain confidence that only authorized systems, people and data are interacting at any time. Capacity to Scale and Deploy ● Deploy and scale across virtual machines, Kubernetes containers, on premises, or in the cloud Real-time Visibility of Network Flows ● Visualize application dependencies without the need for any knowledge of the underlying architecture. Monitoring & Reporting ● Enclave stores flow records with workload context, enabling network and security teams to use this data for compliance reports. Stronger Security ● Easily deployable end-to-end encryption protects data in transit. Scalable Solution ● As your environment scales, Enclave will adapt automatically – on premises or in the public cloud. Further information about Enclave is available at https://sidechannel.com/product/enclave/. Company History The Company was incorporated in the State of Texas on June 22, 1953 as American Mortgage Company. During 1996, the Company acquired the operations of Eden Systems, Inc. (“Eden”) as a wholly owned subsidiary. Eden was engaged in water treatment and the retailing of cleaning products. Eden’s operations were sold on October 1, 1997. On May 16, 1996, the Company changed its name to National Scientific Corporation. From September 30, 1997 through the year ended September 30, 2001, the company aimed its efforts in the research and development of semiconductor proprietary technology and processes and in raising capital to fund its operations and research. Effective August 27, 2014, the Company changed its name to “Cipherloc Corporation.” The Company became a Delaware corporation on September 30, 2021. 6 Business Combination Between Cipherloc Corporation and SideChannel, Inc. (now known as SCS, Inc.) Pursuant to the Purchase Agreement, on the Closing Date, the former shareholders of the Subsidiary (the “Sellers”) exchanged all of their equity securities in the Subsidiary for a total of 59,900,000 shares of the Company’s common stock (the “First Tranche Shares”), and 100 shares of the Company’s newly designated Series A Preferred Stock, $0.001 par value (the “Series A Preferred Stock”). The Sellers are entitled to receive up to an additional 59,900,000 shares of the Company’s common stock (the “Second Tranche Shares”) at such time that the operations of the Subsidiary, as a subsidiary of the Company, achieves at least $5.5 million in revenue (the “Milestone”) for any twelve-month period occurring after the Closing Date and before June 30, 2026, the 48-month anniversary of the execution of the Purchase Agreement. On the Closing Date, the Sellers acquired approximately 40.4% of the Company’s outstanding common stock. If the Subsidiary achieves the Milestone, and the Sellers are issued the Second Tranche Shares, and assuming that there is no other change in the number of shares outstanding prior to the issuance of the Second Tranche Shares, the Sellers will hold a total of approximately 57.5% of the Company’s outstanding common stock. The number of the Second Tranche Shares may be reduced or increased, based upon whether the Subsidiary’s working capital as of the Closing Date was less than or more than $0. The number of the Second Tranche Shares may also be subject to adjustment based upon any successful indemnification claims made by the Company pursuant to the Purchase Agreement. The Shares are subject to a Lock-Up/Leak-Out Agreement, pursuant to which, subject to certain exceptions, the Sellers may not directly or indirectly offer to sell, or otherwise transfer, any of the Shares for twenty-four months after the Closing Date without the prior written consent of the Company. Notwithstanding the foregoing, pursuant to the Lock-Up/Leak-Out Agreement, each of the Sellers may sell up to 20% of their Shares beginning twelve (12) months after the Closing Date, and the remaining 80% of their shares of Common Stock beginning twenty-four (24) months after the Closing Date. On July 1, 2022, Sammy Davis and David Chasteen resigned from the Company’s Board of Directors (the “Board”). On that date, (i) the Board appointed Deborah MacConnel and Kevin Powers to fill the vacancies resulting from those resignations. and (ii) the Board expanded the number of members of the Board by two members and approved the appointments of Brian Haugli and Hugh Regan to fill the new seats. Mr. Haugli’s and Mr. Regan’s appointment were effective on July 19, 2022. Ms. MacConnel, Mr. Powers, and Mr. Regan are considered independent directors. As of July 19, 2022, the total number of members of the Board was six (6), including four (4) independent directors. On July 1, 2022, the Board appointed Brian Haugli to the position of Chief Executive Officer of the Company, following the resignation of David Chasteen from that position. Mr. Chasteen was appointed of Executive Vice President of the Company on the same date. FASB issues authoritative literature in the Accounting Standards Codification. ASC 805 Business Combinations (“ASC 805”) provides guidance for accounting for mergers and acquisitions. The standard defines a business combination, including criteria for both the transaction to qualify as a business combination and determining whether an entity is a business, and then provides details how to account for the transaction. Applying ASC 805 to the Acquisition, the Company determined that SCS will be the accounting acquirer for financial reporting purposes. In order to account for the acquisition, management closed the books of Cipherloc on the Closing Date, closed all equity accounts to additional paid in capital and merged the balance sheets as of the Closing Date. SCS maintained its historical financial statements, only consolidating Cipherloc’s assets, liabilities, and equity as of the Closing Date. Research and Development Our research and development expenditures for the fiscal years ended September 30, 2022 and September 30, 2021 were $178,000 and $0, respectively. These costs were incurred to develop Enclave which is a product acquired in the Business Combination. 7 Competition The cybersecurity software and services market sectors are highly competitive, subject to rapid change, and significantly affected by new product introductions and other activities of market participants. Some of our competitors have greater financial, technical, sales, marketing and other resources than we do. Because of these and other factors, competitive conditions in the markets we compete in are likely to continue to intensify in the future, as participants compete for market share. Increased competition could result in price reductions for our products and services, possibly reducing our net revenue and profit margins and resulting in a loss of our market share, any of which would likely harm our business. We believe that our future results depend largely upon our ability to serve our clients and customers with the products and services described above better than our competitors, and by offering new services and product enhancements, whether such product and service offerings are developed internally or through acquisition. We also believe that we must provide product and service offerings that compete favorably against those of our competitors with respect to ease of use, reliability, performance, range of useful features, reputation and price. We anticipate that we will face increasing pricing pressures from our competitors in the future. Since there are low barriers to entry into the cybersecurity services and software markets, which are both subject to rapid technological change, we believe competition in our market will persist and intensify in the future. Intellectual Property Protective Measures We believe that our intellectual property is an important and vital asset, which enables us to develop, market, and sell our products and services, and enhance our competitive position. Our intellectual property includes our proprietary business and technical know-how, inventions, works of authorship, and confidential information. To protect our intellectual property, we rely primarily upon legal rights in trade secrets, patents, copyrights, and trademarks, in addition to our policies and procedures, security practices, contracts, and relevant operational measures. We protect the confidentiality of our proprietary information by entering into non-disclosure agreements with our employees, contractors, and other entities with which we do business. In addition, our license agreements related to our software and proprietary information include confidentiality terms. These agreements are generally non-transferable. We also employ access controls and associated security measures to protect our facilities, equipment, and networks. Patents, Copyrights, Trademarks, and Licenses Our products, particularly our software and related documentation, are protected under domestic and international copyright laws and other laws related to the protection of intellectual property and proprietary rights. Currently, we have six patents filed with the U.S. Patent and Trademark Office. We employ procedures to label copyrightable works with the appropriate proprietary rights notices, and we actively enforce our rights in the United States and abroad. However, these measures may not provide us with adequate protection from infringement, and our intellectual property rights may be challenged. Our SideChannel and Enclave logos are registered trademarks with the U.S. Patent and Trademark Office. In the United States, we can maintain our trademark rights and renew trademark registrations for as long as the trademarks are in use. 8 Government Regulation Export Control Regulations . We expect that all of our products will be subject to U.S. export control laws and applicable foreign government import, export and/or use requirements. The level of such control generally depends on the nature of the products in question. Often, the level of export control is impacted by the nature of the software and cybersecurity incorporated into our products. In those countries where such controls apply, the export of our products may require an export license or authorization. However, even if a transaction qualifies for a license exception or the equivalent, it may still be subject to corresponding reporting requirements. For the export of some of our products, we may be subject to various post-shipment reporting requirements. Minimal U.S. export restrictions apply to all our products, whether or not they perform cybersecurity functions. If we become a Department of Defense contractor in the future, certain registration requirements may be triggered by our sales. In addition, certain of our products and related services may be subject to the International Traffic in Arms Regulations (ITAR) if our software or services are specifically designed or modified for defense purposes. If we become engaged in manufacturing or exporting ITAR-controlled goods and services (even if we do not export such items), we will be required to register with the U.S. State Department. To date, Export Control Regulations have had no material impact on our business. Enhancements to our existing products may be subject to review under the Export Administration Act to determine what export classification they will receive. In addition, any new products that we release in the future will also be subject to such review before we can export them. The U.S. Congress continues to discuss the correct level of export control in possible anti-terrorism legislation. Such export regulations may be modified at any time. Modifications to these export regulations could reduce or eliminate our ability to export some or all of our products from the United States in the future, which could put us at a disadvantage in competing with companies located outside of the U.S. Modifications to U.S. export regulations could restrict us from exporting our existing and future products. Any such modifications to export regulations may put us at a competitive disadvantage with respect to selling our products internationally. Privacy Laws . We may be subject to various international, federal and state regulations regarding the treatment and protection of personally identifying and other regulated information. Applicable laws may include U.S. federal laws and implementing regulations, such as the GLBA and HIPAA, as well as state and international laws and regulations, including the California Consumer Privacy Act (CCPA) and the European Union General Data Protection Regulation (GDPR). Some of these laws have requirements on the transmittal of data from one jurisdiction to another. In the event our systems are compromised, many of these privacy laws require that we provide notices to our customers whose personally identifiable data may have been compromised. Additionally, if we transfer data in violation of these laws, we could be subjected to substantial fines. To mitigate the risk of having such data compromised, we use cybersecurity, software and other security procedures to protect our databases. Personnel As of November 30, 2022, we had nineteen (19) full-time employees. We also have thirteen (13) independent contractors that provide services to us. We anticipate that we will need to increase our staffing in the foreseeable future.