Item 1. Business
ITEM
1. BUSINESS
Reverse
Merger
On
July 1, 2022 (the “Closing Date”), the Company, then known as Cipherloc Corporation, a Delaware corporation, completed its
acquisition (“Business Combination”) of all the outstanding equity securities of SideChannel, Inc., a Massachusetts corporation,
pursuant to an Equity Securities Purchase Agreement dated May 16, 2022 (the “Purchase Agreement”). On September 9, 2022,
SideChannel, Inc., the acquired Massachusetts corporation and a subsidiary of the registrant, changed its name to SCS, Inc. (the “Subsidiary”
or “SCS”) and Cipherloc Corporation, the Delaware parent company of SCS, changed its name to SideChannel, Inc.
The
transaction was accounted for as a reverse acquisition merger, in accordance with accounting principles generally accepted in the United
States of America (“GAAP”). Under this method of accounting, SCS was deemed to be the accounting acquirer for financial reporting
purposes. This determination was primarily based on the facts that, immediately following the Business Combination: (1) the majority
of the Board of Directors of the combined company will be composed of directors designated by the Sellers under the terms of the Purchase
Agreement; and (2) existing members of SCS management constituted the management of the combined company. Because SCS has been determined
to be the accounting acquirer in the Business Combination, but not the legal acquirer, the transaction is deemed a reverse acquisition
under the guidance of the Financial Accounting Standards Board (“FASB”) Accounting Standards Codification (“ASC”)
Topic 805, Business Combinations. As a result, the historical financial statements of SideChannel are the historical financial statements
of the combined company.
Following
the closing of the Business Combination, SCS became a wholly owned subsidiary of the Company. As used herein, the words “the Company”
refers to SideChannel, Inc., together with its subsidiaries.
Business
Overview & Strategy
The
Company is a provider of cybersecurity services and technology to companies; national, state and local municipalities; and
non-profits. The Company’s website is www.sidechannel.com .
Our
mission is to make cybersecurity easy and accessible for mid-market and emerging companies, a market that we believe is currently underserved.
We believe that our cybersecurity offerings will reduce risks for our customers through identifying and developing cybersecurity, privacy,
and risk management solutions. We anticipate that our target customers will continue to need cost-effective security solutions beginning
with but not limited to what we refer to as virtual Chief Information Security Officer services (“vCISO” or “vCISO
Services”).
We have developed a new software product, Enclave, that we believe offers companies of all sizes the means to simplify
several crucial cybersecurity infrastructure procedures, including encryption, microsegmentation and access control.
Enclave is a modern network segmentation platform that combines access control, asset inventory, encryption and zero trust network
access to create a microsegmentation solution that prioritizes both IT and cybersecurity’s highest-level needs.
Enclave is purpose-built to:
●
Simultaneously secure and
segment networks
●
Limit
the damage a bad actor can do by decreasing the digital square footage they can explore
●
Easily
implement access controls for employees, support staff, and third-party vendors while never disrupting current operations
Our
strategy focuses on growth from the following three areas:
1.
Securing
new vCISO clients
2.
Adding
new Cybersecurity Software and Services offerings such as Enclave
3.
Increasing
adoption of Cybersecurity Software and Services offerings at vCISO clients, including Enclave
4
vCISO
engagements typically include a fixed monthly subscription fee with durations longer than twelve (12) months. Rates for vCISO time
and material projects range from $350 to $425 per hour. Each of our vCISOs is generally embedded into the C-suite executive teams of
two (2) to four (4) of our clients. We augment our vCISO offering with a full range of other cybersecurity services through a team
of security engineers combined with a network of third-party service providers and value-added resellers (“VARs”).
Commercial relationships with VARs provide SideChannel with additional internal capabilities to mitigate cybersecurity risks. We
earn a commission on software engagements we generate through VARs.
We
have implemented an account management organization responsible for delivering services and software to our clients. Our vCISOs
and the security and privacy engineers that support them are part of our account management organization. As this team delivers vCISO
Services for our clients, we often identify projects to implement and maintain programs that reduce cybersecurity risks that expand
our scope of work and increase our revenue generating potential. Similarly, as this team delivers a new cybersecurity service or installs
cybersecurity software at a client, we often learn about opportunities to improve the protection of our clients’ digital assets
through additional service and software engagements.
Our
vCISO engagements provide our clients with the C-suite cybersecurity leadership needed to effectively mitigate cybersecurity risks
and support ongoing operation of critical business functions. This strategic cybersecurity leadership will often result in
additional statements of work for SideChannel to deliver the Cybersecurity Software and Services needed to address gaps in our
clients’ cybersecurity framework. We track revenue and other key performance indicators using the vCISO Services category and
Cybersecurity Software and Services category. Detail on the revenue performance of these categories is discussed in
“Management’s Discussion and Analysis of Financial Condition and Results of Operations” in Part II, Item 7 of this
Annual Report on Form 10-K.
We
currently provide Cybersecurity Software and Services and intend to increase our delivery of more tech-enabled services to address the
needs of our customers, including:
●
Additional
Virtual Chief Information Security Officers
●
Zero
trust
●
Third-party
risk management
●
Due
diligence
●
Privacy
●
Threat
intelligence, and
●
Managed
end-point security solutions
We
believe that our current and prospective customers in the mid-market will favor our approach, as it
provides them with an efficient way to work with a single vendor to manage and oversee their cybersecurity programs. We also believe
that our approach will reduce our customers’ overall security costs and streamline their ability to increase their sales,
reduce regulatory risks, and monitor their risk posture.
We
believe that we provide a full range of cybersecurity solutions through our employees, our network of subcontractors, and
our array of partnerships with third-party service providers and software companies. We work with our clients to help them select the
right cybersecurity tools, products, and solutions. We believe that our use of a combination of employees and subcontractors allows us
to cost effectively grow our client base and broaden the subject matter expertise of our service delivery teams while maintaining the agility needed to
move directly into implementation of projects, which we believe reduces the risk to our customers. Our subcontractors also provide us
with sales leads and referrals and may resell our services to their own client base.
5
Enclave,
A SideChannel Proprietary Software Product
We
are developing products and services around our unique insight into mid-market and emerging companies. During September 2022, SideChannel
announced a proprietary product, Enclave, which simplifies a particularly important cybersecurity task called “microsegmentation.”
Industry standard cybersecurity and risk management frameworks, such as National Institute of Standards and Technology Cybersecurity
Framework (“NIST CSF”) and Center for Internet Security Controls (“CIS”), prioritize inventory of assets and
access control as top requirements for a sustainable and compliant cybersecurity program. CIS version 8 controls call for organizations
to:
●
Control
1 - “Establish and maintain an accurate, detailed, and up-to-date inventory of all enterprise assets with the potential to
store or process data.”
●
Control
2 - “Actively manage (inventory, track, and correct) all software (operating systems and applications) on the network so that
only authorized software is installed and can execute, and that unauthorized and unmanaged software is found and prevented from installation
or execution.”
●
Control
3 - “Configure data access control lists based on a user’s need to know. Apply data access control lists, also known
as access permissions, to local and remote file systems, databases, and applications.”
We
built Enclave to address these extremely critical cybersecurity controls along with many others. Enclave seamlessly combines access
control, microsegmentation, encryption and other secure networking concepts to create a comprehensive solution. Through software it
allows Information Technology (IT) to easily segment the enterprise network, place the right staff in those segments and direct
traffic. Unlike open, traditional models, Enclave allows for near-limitless micro-segmented networks to operate insulated from one
another.
Further
information about Enclave is available at https://sidechannel.com/enclave/.
Company
History
The
Company was incorporated in the State of Texas on June 22, 1953, as American Mortgage Company. During 1996, the Company acquired the
operations of Eden Systems, Inc. (“Eden”), making it a wholly owned subsidiary. Eden was engaged in water treatment and the
retailing of cleaning products. Eden’s operations were sold on October 1, 1997. On May 16, 1996, the Company changed its name to
National Scientific Corporation. From September 30, 1997, through the year ended September 30, 2001, the company aimed its efforts in
the research and development of semiconductor proprietary technology and processes and in raising capital to fund its operations and
research. Effective August 27, 2014, the Company changed its name to “Cipherloc Corporation.” The Company became a Delaware
corporation on September 30, 2021.
Business
Combination Between Cipherloc Corporation and SideChannel, Inc. (now known as SCS, Inc.)
As
part of the Business Combination, the former stockholders of SCS (the “Sellers”) exchanged all of their equity
securities in SCS for a total of 59,900,000 shares of the Company’s common stock (the “First Tranche Shares”), and
100 shares of the Company’s newly designated Series A Preferred Stock, $0.001 par value (the “Series A Preferred
Stock”). The In addition the Sellers were entitled to receive up to an additional 59,900,000 shares of the Company’s
common stock (the “Second Tranche Shares” and together with the First Tranche Shares and the Series A Preferred Stock,
the “Shares”) at such time that the operations of SCS, as a subsidiary of the Company, achieved at least $5.5 million in
revenue (the “Milestone”) for any twelve-month period occurring after the Closing Date and before the 48-month
anniversary of the execution of the Purchase Agreement. The number of the Second Tranche Shares could have been reduced or
increased, based upon whether SCS working capital as of the Closing Date is less than or more than zero (“Closing Working
Capital Adjustment”). The number of the Second Tranche Shares was also subject to adjustment based upon any successful
indemnification claims made by the parties pursuant to the Purchase Agreement. The Closing Working Capital Adjustment increased the Second Tranche Shares by 2,116,618 shares of common stock. The
100 shares of Series A Preferred Stock were converted to common stock on May 4, 2023.
The
Shares are subject to a Lock-Up/Leak-Out Agreement, pursuant to which, subject to certain exceptions, the Sellers may not directly or
indirectly offer to sell, or otherwise transfer, any of the Shares for twenty-four months after the Closing Date without the prior written
consent of the Company. Notwithstanding the foregoing, pursuant to the Lock-Up/Leak-Out Agreement, each of the Sellers may sell up to
20% of their Shares beginning twelve (12) months after the Closing Date, and the remaining 80% of their shares of Common Stock beginning
twenty-four (24) months after the Closing Date.
6
Research
and Development
Since Enclave is a proprietary software product, we classify all of our software development activities to be research
and development. The success of our software product, Enclave,
depends on our ability to provide our customers with reliable, innovative features and benefits that are delivered before, or at least
no later than, our competitors. At September 30, 2023, we employed a total of three (3) software engineers engaged in product development.
In addition, when the demands of product development exceed the capacity or knowledge of our in-house staff, we retain temporary third-party
consultants to assist us.
Our
research and development expenditures for the fiscal years ended September 30, 2023 and September 30, 2022 were $669,000 and $178,000,
respectively. These costs were incurred to develop Enclave which is a product acquired in the Business Combination.
Competition
The
cybersecurity software and services market is highly competitive, subject to rapid change, and significantly affected by new
product introductions and other activities of market participants.
Some
of our competitors have greater financial, technical, sales, marketing, and other resources than we do. Because of these and other factors,
competitive conditions in the markets we operate in are likely to continue to intensify in the future, as participants compete for market
share. Increased competition could result in price reductions for our products and services, possibly reducing our net revenue and profit
margins and resulting in a loss of our market share, any of which would likely harm our business.
We
believe that our future results depend largely upon our ability to serve our clients and customers with the products and services described
earlier better than our competitors, and by offering new services and product enhancements, whether such product and service offerings
are developed internally or through acquisition. We also believe that we must provide product and service offerings that compete favorably
against those of our competitors with respect to ease of use, reliability, performance, range of useful features, reputation and price.
We
anticipate that we will face increasing pricing pressures from our competitors in the future. Since there are low barriers to entry into
the cybersecurity services and software markets, we believe competition in these
markets will persist and intensify in the future.
Our chief services competitors include companies such as Optiv, NCC, Coalfire, PwC, EY, Deloitte, and GuidePoint.
Our primary software competitors are companies such as Perimeter 81, Zscaler, Palo Alto, and Illumio.
Intellectual
Property
Protective
Measures
We
believe that our intellectual property is an important and vital asset, which enables us to develop, market, and sell our products and
services and enhance our competitive position. Our intellectual property includes our proprietary business and technical know-how, inventions,
works of authorship, and confidential information. To protect our intellectual property, we rely primarily upon legal rights in trade
secrets, patents, copyrights, and trademarks, in addition to our policies and procedures, security practices, contracts, and relevant
operational measures.
We
protect the confidentiality of our proprietary information by entering into non-disclosure agreements with our employees, contractors,
and other entities with which we do business. In addition, our license agreements related to our software and proprietary information
include confidentiality terms. These agreements are generally non-transferable. We also employ access controls and associated security
measures to protect our facilities, equipment, and networks.
7
Patents,
Copyrights, Trademarks, and Licenses
Our
products, particularly our software and related documentation, are protected under domestic and international copyright laws and other
laws related to the protection of intellectual property and proprietary rights. Currently, we have six patents filed with the U.S. Patent
and Trademark Office. We employ procedures to label copyrightable works with the appropriate proprietary rights notices, and we actively
enforce our rights in the United States and abroad. However, these measures may not provide us with adequate protection from infringement,
and our intellectual property rights may be challenged.
Our
SideChannel and Enclave logos are registered trademarks with the U.S. Patent and Trademark Office. In the United States, we can maintain
our trademark rights and renew trademark registrations for as long as the trademarks are in use.
Government
Regulation
Export
Control Regulations . We expect that all of our products will be subject to U.S. export control laws and applicable foreign government
import, export and/or use requirements. The level of such control generally depends on the nature of the products in question. Often,
the level of export control is impacted by the nature of the software and cybersecurity incorporated into our products. In those countries
where such controls apply, the export of our products may require an export license or authorization. However, even if a transaction
qualifies for a license exception or the equivalent, it may still be subject to corresponding reporting requirements. For the export
of some of our products, we may be subject to various post-shipment reporting requirements. Minimal U.S. export restrictions apply to
all our products, whether or not they perform cybersecurity functions. If we become a Department of Defense contractor in the future,
certain registration requirements may be triggered by our sales. In addition, certain of our products and related services may be subject
to the International Traffic in Arms Regulations (ITAR) if our software or services are specifically designed or modified for defense
purposes. If we become engaged in manufacturing or exporting ITAR-controlled goods and services (even if we do not export such items),
we will be required to register with the U.S. State Department.
To
date, Export Control Regulations have had no material impact on our business.
Enhancements
to our existing products may be subject to review under the Export Administration Act to determine what export classification they will
receive. In addition, any new products that we release in the future will also be subject to such review before we can export them. The
U.S. Congress continues to discuss the correct level of export control in possible anti-terrorism legislation. Such export regulations
may be modified at any time. Modifications to these export regulations could reduce or eliminate our ability to export some or all of
our products from the United States in the future, which could put us at a disadvantage in competing with companies located outside of
the U.S. Modifications to U.S. export regulations could restrict us from exporting our existing and future products. Any such modifications
to export regulations may put us at a competitive disadvantage with respect to selling our products internationally.
Privacy
Laws . We may be subject to various international, federal and state regulations regarding the treatment and protection of personally
identifying and other regulated information. Applicable laws may include U.S. federal laws and implementing regulations, such as the
GLBA and HIPAA, as well as state and international laws and regulations, including the California Consumer Privacy Act (CCPA) and the
European Union General Data Protection Regulation (GDPR). Some of these laws have requirements on the transmittal of data from one jurisdiction
to another. In the event our systems are compromised, many of these privacy laws require that we provide notices to our customers whose
personally identifiable data may have been compromised. Additionally, if we transfer data in violation of these laws, we could be subjected
to substantial fines. To mitigate the risk of having such data compromised, we use cybersecurity, software and other security procedures
to protect our databases.
8
Personnel
As
of September 30, 2023, we had 23 full-time employees. We also have approximately 11 independent contractors that provide services to
us. We anticipate that we will need to increase our staffing in the foreseeable future.