SideChannel, Inc. 10-Q

ITEM 2. MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS The following information should be read in conjunction with the unaudited consolidated financial statements and the accompanying notes included in Part I, Item 1 of this Quarterly Report on Form 10-Q. Unless the context requires otherwise, references to the “Company,” “we,” “us,” “our,” “SideChannel,” and “SideChannel, Inc.” refer specifically to SideChannel, Inc. and its consolidated subsidiaries. In addition, unless the context otherwise requires and for the purposes of this Quarterly Report on Form 10-Q only: ● “Business Combination” has the same meaning ascribed to it in Note 1 to the Company’s unaudited consolidated financial statements included elsewhere in this Quarterly Report on Form 10-Q; ● “Exchange Act” refers to the Securities Exchange Act of 1934, as amended; ● “SEC” or the “Commission” refers to the United States Securities and Exchange Commission; and ● “Securities Act” refers to the Securities Act of 1933, as amended. All references to years relate to the fiscal year ended September 30 of the particular year. Forward-Looking Statements This Quarterly Report on Form 10-Q, including estimates, projections, statements relating to our business plans, objectives and expected operating results, and the assumptions upon which those statements are based, contains “forward-looking statements.” These forward-looking statements generally are identified by the words “believe,” “project,” “expect,” “anticipate,” “estimate,” “intend,” “strategy,” “plan,” “may,” “should,” “will,” “would,” “will be,” “will continue,” “will likely result,” and similar expressions. Forward-looking statements are based on current expectations and assumptions that are subject to risks and uncertainties which may cause actual results to differ materially from the forward-looking statements. A detailed discussion of risks and uncertainties that could cause actual results and events to differ materially from such forward-looking statements is included in the section entitled “Risk Factors” in our Annual Report on the 2023 Form 10-K and elsewhere in this Quarterly Report on Form 10-Q. We undertake no obligation to update or revise publicly any forward-looking statements, whether as a result of new information, future events, or otherwise. These forward-looking statements are based on management’s current expectations. These statements are neither promises nor guarantees, but involve known and unknown risks, uncertainties, and other important factors that may cause our actual results, performance, or achievements to be materially different from any future results, performance, or achievements expressed or implied by the forward-looking statements. Although we believe that the assumptions underlying our forward-looking statements are reasonable, any of the assumptions could be inaccurate; therefore, we cannot assure you that the forward-looking statements included in this Quarterly Report on Form 10-Q will prove to be accurate. In light of the significant uncertainties inherent in our forward-looking statements, the inclusion of such information should not be regarded as a representation by us or any other person that our objectives and plans will be achieved. Some of these and other risks and uncertainties that could cause actual results to differ materially from such forward-looking statements are more fully described in our 2023 Form 10-K, elsewhere in this Quarterly Report on Form 10-Q, or those discussed in other documents we filed with the SEC. Except as may be required by applicable law, we undertake no obligation to publicly update or advise of any change in any forward-looking statement, whether as a result of new information, future events, or otherwise. In making these statements, we disclaim any obligation to address or update each factor in future filings with the SEC or communications regarding our business or results, and we do not undertake to address how any of these factors may have caused changes to discussions or information contained in previous filings or communications. In addition, any of the matters discussed above may have affected our past results and may affect future results, so that our actual results may differ materially from those expressed in this Quarterly Report on Form 10-Q and in prior or subsequent communications. This information should be read in conjunction with the interim unaudited financial statements and the notes thereto included in this Quarterly Report on Form 10-Q, and the audited financial statements and notes thereto and “Part II. Other Information - Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations”, contained in our 2023 Form 10-K. We are not aware of any misstatements regarding any third-party information presented in this Quarterly Report on Form 10-Q; however, their estimates, in particular, as they relate to projections, involve numerous assumptions, are subject to risks and uncertainties, and are subject to change based on various factors, including those discussed under, and incorporated by reference in, the section entitled “ Item 1A. Risk Factors ” of this Quarterly Report on Form 10-Q. These and other factors could cause our future performance to differ materially from our assumptions and estimates. Some market and other data included herein, as well as the data of competitors as they relate to SideChannel, is also based on our good faith estimates. Business Overview We are a cybersecurity advisory services and software company. Our mission is to simplify cybersecurity for mid-market and emerging companies, a market we believe is underserved. Our products and services offer comprehensive cybersecurity and privacy risk management solutions. We anticipate ongoing demand for cost-effective security solutions and aim to provide tech-enabled services to meet these needs, including vCISO, zero trust, third-party risk management, due diligence, privacy, threat intelligence, and managed end-point security solutions. Enclave, our proprietary SaaS platform, streamlines critical cybersecurity tasks such as asset inventory and microsegmentation. Enclave integrates access control, microsegmentation, encryption, and secure networking concepts into a unified solution, enabling IT professionals to efficiently segment networks, assign staff, and manage traffic. Our efforts are focused on protecting and enabling the critical business functions of our clients and customers through comprehensive cybersecurity programs. This specifically includes: ● Embedding vCISOs as a fractional resource into the leadership teams of our clients, ● Deploying Enclave to simplify the segmentation of digital networks, ● Assessing, identifying, and mitigating cybersecurity and privacy risks through tech-enabled security engineering processes, and ● Reselling third-party cybersecurity services and software when appropriate. We internally report our revenue using two categories. The first, “vCISO Services,” captures the revenue the Chief Information Security Officer services that we provide to our clients on a “virtual” or outsourced basis, thus the acronym “vCISO.” Services delivered by SideChannel through our team of vCISOs include assessing the cybersecurity risk profile, implementing policies and programs to mitigate risks, and managing the day-to-day tasks to ensure compliance with the adopted cybersecurity framework. Most of our clients use our vCISO services. vCISO engagements typically include a fixed monthly subscription fee and exceed periods of time longer than 12 months. Hourly rates for vCISO time and material projects range from $350 to $425. Each of our vCISOs is generally embedded into the C-suite executive teams of two to four of our clients. According to the 2023 vCISO Service Provider Survey by Hitch Partners, the role of virtual CISOs (vCISOs) is becoming increasingly pivotal in today’s cybersecurity landscape. The survey, which included responses from over 100 professionals, highlights a significant rise in the adoption of vCISO services, particularly among small and cloud-enabled companies. Key services provided by vCISOs include Governance, Risk, and Compliance (GRC), strategic planning, and mentoring security teams. The report notes that the flexibility and expertise offered by vCISOs make them an attractive option for companies facing budget constraints and needing to establish a robust security posture quickly. Many vCISO engagements extend beyond initial expectations, indicating a sustained need for their expertise. Challenges identified include limited budgets and the difficulty of fostering a security-conscious culture within organizations. SideChannel, as a leading vCISO provider, leverages these insights to offer tailored solutions that address the specific needs highlighted in the report. With a comprehensive suite of services, SideChannel provides strategic leadership and practical cybersecurity measures, ensuring their clients can navigate the complexities of modern cybersecurity threats effectively. The company’s approach aligns with the survey’s findings, emphasizing the importance of flexibility, strategic guidance, and cost-effective solutions in the rapidly evolving cybersecurity landscape. The 2024 Verizon Data Breach Investigations Report (“DBIR”) provides critical insights into the current cybersecurity landscape, highlighting trends that emphasize the importance of robust cybersecurity measures. Financial motives are the primary driver behind 93% of cyber breaches, with espionage accounting for 7%. Notably, end-user errors, particularly misdelivery, are responsible for 26% of breaches. The MOVEit breach, characterized by its scalability and ease of exploitation, had a significant impact, surpassing previous incidents like Log4Shell. The report also points to the rapid response to phishing attacks and the limited use of Generative AI by cybercriminals. In response to these evolving threats, SideChannel offers a comprehensive suite of cybersecurity solutions and services designed to protect digital assets effectively. Our second revenue category encompasses an array of cybersecurity software and services that our clients deem necessary to protect their digital assets. These augment our vCISO offering and include a full range of other cybersecurity products and services delivered through a team of security engineers along with a network of third-party service providers VARs. Commercial relationships with third-party service providers and VARs provide SideChannel with additional internal capabilities to mitigate cybersecurity risks. We earn licensing revenue from software contracts and commissions from third-party service provider partnerships which are included in this revenue category. Leveraging insights from the DBIR, SideChannel’s solutions are designed to address financial and espionage-driven breaches effectively, minimize end-user errors, and ensure rapid incident response. Our growth strategy focuses on these three initiatives: 1. Securing new vCISO clients, 2. Adding new cybersecurity software and services offerings, and 3. Increasing adoption of cybersecurity software, including Enclave and services offerings at vCISO clients. Incorporating insights from a recent Gartner survey, it is evident that implementing a zero-trust strategy has become a priority for a majority of organizations worldwide. The survey revealed that 63% of organizations have fully or partially adopted zero-trust frameworks. Interestingly, for 78% of these organizations, the investment in zero-trust constitutes less than 25% of their overall cybersecurity budget. This strategic approach typically covers about half of an organization’s environment, addressing approximately a quarter of overall enterprise risk. Gartner emphasizes the importance of defining the scope early in the zero-trust strategy. Organizations must identify which domains are in scope and understand the extent of risk mitigation achievable through zero-trust controls. Despite the broad adoption, many enterprises struggle with best practices for implementation. Gartner suggests three key practices: establishing a clear scope, communicating success through strategic and operational metrics, and anticipating increases in staffing and costs without delays. 13 In the context of SideChannel’s offerings, our proprietary software, Enclave, is well-positioned to address these challenges. Enclave simplifies crucial cybersecurity tasks such as asset inventory, vulnerability management, and microsegmentation. By integrating access control, microsegmentation, and encryption, Enclave provides a comprehensive solution for managing cybersecurity controls effectively. It allows IT professionals to segment enterprise networks efficiently, allocate the right personnel to those segments, and direct traffic seamlessly. This alignment with zero-trust principles ensures that organizations can enhance their security posture and achieve measurable risk reduction. By leveraging Enclave, SideChannel not only addresses the immediate cybersecurity needs of our clients but also aligns with industry best practices as highlighted by Gartner. This ensures that our clients are not only compliant but also resilient against evolving cyber threats. Revenue by Category Performance for the Nine Months Ended June 30, 2024 and 2023 The revenue metrics discussed in this section are for the nine months ended June 30, 2024, versus the same period in fiscal year 2023. Revenue from vCISO services increased by $68 thousand, or 2.1%, from 2023 to 2024, while revenue from cybersecurity software and services increased by $528 thousand, or 31.8%. Total revenue for the period increased by $596 thousand, or 12.1%. The following pie charts display the revenue by category. The growth in vCISO Services reflects both growth in clients served and an increase in revenue per client. Cybersecurity software and services revenue grew from 2023 to 2024 because of an increase in the use of these services by existing clients and because of an expansion of the services and software offered. New and Retained Revenue We also monitor new and retained revenue. The revenue earned from clients during our first twelve months of working with them is classified as new; while the revenue earned with clients after our first twelve months of working with them is classified as retained. For the nine months ended June 30, 2024 and 2023, vCISO retained revenue increased by 75.2%, or $960 thousand, from $1.3 million to $2.2 million, while vCISO new revenue decreased by 45.2%, or $892 thousand. In the same period, cybersecurity software and services retained revenue increased by 5.6%, or $65 thousand, while new revenue increased by 90.8%, or $463 thousand. Overall, retained revenue increased by 42.2%, or $1.0 million for the period, while new revenue decreased by 17.3%, or $429 thousand. The following chart reflects these changes. We initiated fewer new vCISO services engagements during the nine months ended June 30, 2024, than we did during the nine months ended June 30, 2023. We attribute the decrease to ineffective lead generation campaigns launched during the last half of fiscal year 2023. We had more success at securing cybersecurity software and services work in new engagements during the nine months ended June 30, 2024, than we did during the prior year. Trailing Twelve Months Revenue Retention Further, we consider trailing twelve months revenue retention a key performance indicator. Revenue retention is calculated by dividing retained revenue in the measurement period by the total revenue for the previous twelve-month time frame. The following table shows the revenue retention by category for the twelve months ended June 30, 2024, and September 30, 2023. Trailing Twelve Months Ended June 30, 2024 September 30, 2023 vCISO services 69.5 % 60.8 % Cybersecurity software & services 77.7 % 89.4 % Total 72.3 % 71.0 % 14 RESULTS OF OPERATIONS Three Months Ended June 30, 2024, Compared to the Three Months Ended June 30, 2023 Selected consolidated financial data for the three months ended June 30, 2024 and 2023 are as follows: Three Months Ended June 30, 2024 2023 Revenues $ 1,846 $ 1,750 Cost of revenues 944 876 Gross profit 902 874 Operating expenses General and administrative 778 $ 834 Selling and marketing 137 340 Research and development 141 180 Business combination related costs - 214 Total operating expenses 1,056 1,568 Operating loss (154 ) (694 ) Revenue. Our revenue was $1.85 million for the quarter ended June 30, 2024, compared to $1.75 million for the three-month comparable prior period, representing an increase of $96 thousand, or 5.5%. The factors driving this revenue increase included improved revenue retention and a growth in both consulting engagements and sales of third-party services. Gross Margins. Our gross margin was 48.9% for the quarter ended June 30, 2024, compared to 49.9% for the quarter ended June 30, 2023. The decline in our gross margin was the result of less effective utilization of our service delivery employees and an increase in sales of third-party software and services, which have a lower margin. Operating Expenses. We initiated expense reductions beginning in May 2023 that were fully implemented by March 2024. These reductions impacted all areas of our company. These reductions resulted in a $512 thousand, or 32.7%, decrease in total operating expenses for the three months ended June 30, 2024, compared to the three months ended to June 30, 2023. The changes for each operating expense area are discussed below. The expense reductions were intended to increase the likelihood of achieving positive cash flow from operating activities during fiscal year 2024. ● General and Administrative Expenses. Our general and administrative expense was $778 thousand for the three months ended June 30, 2024, compared to $834 thousand for the prior comparable period, representing a decrease of $56 thousand, or 6.7%. The decrease was achieved by reducing executive positions. ● Selling and Marketing Expenses. Our sales and marketing expense was $137 thousand for the three months ended June 30, 2024, compared to $340 thousand for the prior comparable period, representing a decrease of $203 thousand, or 59.7%. The decrease was driven by a reduction in staff and third-party service provider costs. ● Research and Development Expenses. Our research and development expense was $141 thousand for the three months ended June 30, 2024, compared to $180 thousand for the prior comparable period, representing a decrease of $39 thousand, or 21.7%. The decrease was the result of a staff reduction, as well as some expenses being reallocated to cost of goods sold following the launch of Enclave. ● Business Combination Related Costs. We recorded Business Combination related costs of $0 and $214 thousand for the three months ended June 30, 2024 and 2023, respectively. These costs were associated with the shares issued during the three months ended June 30, 2023, in connection with the working capital adjustment related to the Business Combination. Nine Months Ended June 30, 2024, Compared to the Nine Months Ended June 30, 2023 Selected consolidated financial data for the nine months ended June 30, 2024 and 2023 are as follows: Nine Months Ended June 30, 2024 2023 Revenues $ 5,509 $ 4,913 Cost of revenues 2,894 2,437 Gross profit 2,615 2,476 Operating expenses General and administrative 2,336 $ 2,854 Selling and marketing 562 1,084 Research and development 390 483 Business combination related costs - 214 Total operating expenses 3,288 4,635 Operating loss (673 ) (2,159 ) Revenue. Our revenue was $5.5 million for the nine months ended June 30, 2024, compared to $4.9 million for the nine-month comparable prior period, representing an increase of $596 thousand, or 12.1%. The factors driving this revenue increase include improved revenue retention and growth in vCISO engagements. Gross Margins. Our gross margin was 47.5% for the nine months ended June 30, 2024, compared to 50.4% for the nine months ended June 30, 2023. The decline in our gross margin was the result of less effective utilization of our service delivery employees and an increase in sales of third-party software and services, which have a lower margin. 15 Operating Expenses. We initiated expense reductions in May 2023 that were fully implemented by March 2024. These reductions impacted all areas of our company. These reductions resulted in a $1,347 thousand, or 29.1%, decrease in total operating expenses for the nine months ended June 30, 2024, compared to the nine months ended June 30, 2023. The changes for each operating expense area are discussed below. The expense reductions were intended to increase the likelihood of achieving positive cash flow from operating activities during fiscal year 2024. ● General and Administrative Expenses. Our general and administrative expense was $2.34 million for the nine months ended June 30, 2024, compared to $2.85 million for the prior comparable period, representing a decrease of $518 thousand, or 18.2%. The decrease was achieved by reducing executive positions and eliminating investor relations costs. ● Selling and Marketing Expenses. Our sales and marketing expense was $562 thousand for the nine months ended June 30, 2024, compared to $1,084 thousand for the prior comparable period, representing a decrease of $522 thousand, or 48.2%. The decrease was driven by a reduction in staff and third-party service provider costs. ● Research and Development Expenses. Our research and development expense was $390 thousand for the nine months ended June 30, 2024, compared to $483 thousand for the prior comparable period, representing a decrease of $93 thousand, or 19.3%. The decrease was the result of a staff reduction, as well as some expenses being reallocated to cost of goods sold as Enclave has been launched. ● Business Combination Related Costs. We recorded Business Combination related costs of $0 and $214 thousand for the nine months ended June 30, 2024 and 2023, respectively. These costs were associated with the shares issued during the nine months ended June 30, 2023 in connection with the working capital adjustment related to the Business Combination. LIQUIDITY AND CAPITAL RESOURCES We had an accumulated deficit of $19.6 million as of June 30, 2024. Our accumulated deficit was primarily driven by three non-recurring expenses totaling $16.8 million: (i) $6.2 million for acquisition costs, including $6.1 million related to the contingent consideration from the Business Combination; (ii) $5.7 million impairment of goodwill recorded as a result of the Business Combination, and (iii) $4.9 million impairment of intangible assets. On June 30, 2024, we had cash of $1.1 million. We maintain our cash in accounts held by reputable financial institutions which, at times, may exceed federally insured limits guaranteed by the Federal Deposit Insurance Corporation (“FDIC”). The FDIC insures these deposits up to $250 thousand. As of June 30, 2024, approximately $855 thousand of the Company’s cash balance was uninsured. The Company has not experienced any losses of cash in any of these financial institutions. We had working capital of $1.4 million as of June 30, 2024, compared to working capital of $1.5 million as of September 30, 2023. The decline in working capital was primarily attributed to a reduction in prepaid expenses and an increase in deferred revenue offset by a reduction in accrued liabilities during the nine months ended June 30, 2024. We expect to incur continued operating losses until we generate revenues sufficient to cover our expected ongoing obligations and expenses. W e intend to manage our business such that our current cash reserves will allow us to reach sustainable, positive cash flow from our operations, but we cannot assure if and when that will be achieved. We do not currently have any credit facilities available to us. We believe that our existing cash balance is sufficient to fund our operations through at least September 30, 2025. Cash Flows The following table summarizes selected items in our unaudited consolidated statements of cash flows for the nine months ended June 30, 2024 and 2023: (In thousands) 2024 2023 Net cash provided by (used in): Operating activities $ 117 $ (1,560 ) Investing activities (15 ) (24 ) Financing activities (50 ) 0 Operating Activities We receive cash each month from revenue generated from our clients. We use this cash and a portion of our cash reserves to pay for our monthly expenses. Material cash requirements include personnel costs and the expenses associated with being a public reporting company. We generated $117 thousand of cash from operating activities during the nine months ended June 30, 2024 and recorded a net loss of $645 thousand. During the same period, our non-cash charges were $583 thousand, comprised of (i) $443 thousand in stock-based compensation expense, net of cash used to purchase RSUs from employees to cover income taxes due on vested RSUs, and (ii) $144 thousand in amortization and depreciation. The change in our net operating assets and liabilities was primarily due to a $ 274 thousand decrease in accounts payable and accrued liabilities, primarily because of payments made on our directors and officers insurance note payable and a $367 thousand increase in our deferred revenue balance. 16 Investing Activities We had fixed asset purchases of $15 thousand during the nine months ended June 30, 2024, related to an upgrade of our website. Financing Activities We paid a $50 thousand note payable to Akash Desai in December 2023. The note payable was related to a December 2021 agreement for the redemption of Mr. Desai’s interest in SideChannel LLC. The December 2023 payment completed our obligations to Mr. Desai. We did not have any off-balance sheet arrangements, as defined under applicable SEC rules, during the periods presented, nor do we currently have any such arrangements. Liquidity There have been no material updates to our expectations for our short-term and long-term liquidity and operating capital requirements since our 2023 Form 10-K. ITEM 3. QUANTITATIVE AND QUALITATIVE DISCLOSURES ABOUT MARKET RISK Pursuant to Item 305(e) of Regulation S-K (§ 229.305(e)), the Company is not required to provide the information required by this Item as it is a “smaller reporting company,” as defined by Rule 229.10(f)(1) of the SEC.