Item 1. Business
ITEM
1. BUSINESS
Business
Overview & Strategy
SideChannel
is a cybersecurity advisory services and software company. Our mission is to simplify cybersecurity for mid-market and emerging companies,
a market we believe is underserved. Our products and services offer comprehensive cybersecurity and privacy risk management solutions.
We anticipate ongoing demand for cost-effective cybersecurity solutions, driven by continued remote and hybrid work environments, increased
data breaches, and a heightened focus of Chief Information Officers (CIOs) on information security. To meet these needs, we aim to provide
tech-enabled services, including virtual Chief Information Security Officer (vCISO) services, zero trust solutions, third-party risk
management, due diligence, privacy, threat intelligence, and managed end-point security solutions.
Market
Opportunity
According to the Cantor’s Cybersecurity Q3’24 Market Updater released by
Cantor Technology Investment Banking on October 29, 2024 (“Cantor 2024 Q3 Update”), security spending is forecasted to reach
$190 billion in calendar year (“CY”) 2024, reflecting significant growth in the cybersecurity market. Information security
spending is expected to have grown 12.4% for CY 2023 on a constant currency basis from $141.4 billion in CY 2022 to $158.9 billion in
CY 2023. This growth is driven by continued remote and hybrid work, increased incidences of data breaches, and a continued focus of CIOs
on information security.
The Cantor 2024 Q3 Update also noted:
● The number of reported data compromises increased by 78% in 2023, affecting over 350 million
victims.
● Cybercrime
adversaries are utilizing social engineering to circumvent multi-factor authentication (“MFA”),
and phishing, stolen or compromised credentials, and cloud misconfiguration were the most
frequent attack vectors.
● Intrusions
through cloud environments have increased by 75% year-over-year from 2022 to 2023. As a result,
51% of organizations are planning to increase security investments following a breach.
The Cantor 2024 Q3 Update projects that by the end of 2026, the democratization of technology, digitization, and automation of work are expected to increase the total addressable
market of fully remote and hybrid workers to 64% of all employees, up from 52% in 2021. This shift increases demand for remote worker
technologies such as Identity and Access Management (“IAM”), Endpoint Protection Platforms (“EPP”), and Secure
Web Gateways (“SWG”). Organizations are also investing in application and data security to support the rise in volume and
velocity of data, with the prevalence of Internet of Things (“IoT”) expanding the attack surface.
Transformational
technologies in data security, application security, network security, security operations, and risk management are gaining traction.
These include data security posture management (“DSPM”), homomorphic encryption, cyber-physical system (“CPS”)
security, generative AI (“GenAI”), and application security posture management (“ASPM”). AI is the top emerging
technology to be deployed, with 71% of organizations planning deployment within two to three years, and 34% within the next 12 months, according to the Cantor 2024 Q3 Update.
4
Our
Solutions
Enclave,
our proprietary SaaS platform, streamlines critical cybersecurity tasks such as asset inventory and microsegmentation. Enclave
integrates access control, microsegmentation, encryption, machine identity management, and secure networking concepts into a unified
solution, enabling IT professionals to efficiently segment networks, assign staff, and manage traffic. This aligns with the
industry’s shift towards zero trust frameworks, which have been adopted fully or partially by 63% of organizations worldwide,
according to the Gartner State of Zero Trust Strategy Adoption Survey dated April
22, 2024 (“Gartner 2024 Zero Trust Report”).
Our
efforts are focused on protecting and enabling the critical business functions of our clients and customers through comprehensive cybersecurity
programs. This specifically includes:
● Embedding
vCISOs as a fractional resource into the leadership teams of our clients. The role of vCISOs
is becoming increasingly pivotal, especially among small and cloud-enabled companies. The
flexibility and expertise offered by vCISOs make them an attractive option for companies
facing budget constraints and needing to establish a robust security posture quickly.
● Deploying
Enclave to simplify the segmentation and security of digital networks, addressing the increased
demand for remote worker technologies and zero trust strategies.
● Assessing,
identifying, and mitigating cybersecurity and privacy risks through tech-enabled security
engineering processes. We leverage AI-based security operations for post-detection actions,
including alert prioritization, augmented threat detection/hunting, playbook creation, and
automation of incident response processes.
● Reselling
third-party cybersecurity services and software when appropriate, expanding our offerings
to include a full range of cybersecurity products and services delivered through our team
of security engineers and a network of third-party service providers and value-added resellers
(VARs).
Revenue
Categories
We
internally report our revenue using two categories:
vCISO Services: This category captures the revenue from the Chief Information Security Officer
services that we provide to our clients on a “virtual” or outsourced basis. Services delivered by SideChannel through our
team of vCISOs include assessing the cybersecurity risk profile, implementing policies and programs to mitigate risks, and managing the
day-to-day tasks to ensure compliance with the adopted cybersecurity framework. Most of our clients use our vCISO services.
vCISO
engagements typically include a fixed monthly subscription fee and contract duration typically exceeds 12 months.
Hourly rates for vCISO time and material projects range from $350 to $450. Each of our vCISOs is generally embedded into the C-suite
executive teams of two to four of our clients.
According
to the 2023 vCISO Service Provider Survey by Hitch Partners, the adoption of vCISO services is on the rise, particularly among small
and cloud-enabled companies. Key services provided by vCISOs include Governance, Risk, and Compliance (GRC), strategic planning, and
mentoring security teams. Many vCISO engagements extend beyond initial expectations, indicating a sustained need for their expertise.
5
Cybersecurity Software and Services: This category encompasses an array of cybersecurity software and services
that our clients deem necessary to protect their digital assets. These augment our vCISO offering and include a full range of other cybersecurity
products and services delivered through a team of security engineers along with a network of third-party service providers and VARs. Commercial
relationships with third-party service providers and VARs provide SideChannel with additional internal capabilities to mitigate cybersecurity
risks. We earn licensing revenue from software contracts and commissions from third-party service provider partnerships which are included
in this revenue category.
In
response to evolving threats highlighted in the 2024 Data Breach Investigations Report released by Verizon, SideChannel
offers solutions designed to address financial and espionage-driven breaches effectively, minimize end-user errors, and ensure rapid incident
response. With the increase in data transmission and connected intelligent devices through the prevalence of IoT, the scale of security
risks and the attack surface are much larger. Our offerings in data security, application security, network security, security operations,
and risk management position us to meet these challenges.
Growth
Strategy
Our
growth strategy focuses on these three initiatives:
● Securing
new vCISO clients: As organizations plan to increase security investments due to breaches
and the rising complexity of cyber threats, we aim to expand our client base by offering
flexible, expert vCISO services that address budget constraints and the need for rapid security
posture establishment.
● Adding
new cybersecurity software and services offerings: We plan to enhance our portfolio by
incorporating transformational technologies such as AI-based security operations, data security
posture management (DSPM), polymorphic encryption, cyber-physical system (CPS) security,
and application security posture management (ASPM). This aligns with industry trends and
the anticipated incremental spend on application and data security due to generative AI.
● Increasing
adoption of cybersecurity software, including Enclave, and services offerings at vCISO clients:
By promoting Enclave and our other cybersecurity solutions to our existing vCISO clients,
we aim to deepen our relationships and provide comprehensive, integrated security solutions.
This supports the increased demand for zero trust strategies and remote worker technologies.
Enclave:
A SideChannel Proprietary Software Product
Incorporating insights from the Gartner 2024 Zero Trust Report, implementing a zero-trust strategy has become a priority for a majority of organizations
worldwide. The survey revealed that 63% of organizations have fully or partially adopted zero-trust frameworks. For 78% of these
organizations, the investment in zero trust constitutes less than 25% of their overall cybersecurity budget. This strategic approach
typically covers about half of an organization’s environment, addressing approximately a quarter of overall enterprise
risk.
In the Gartner 2024 Zero Trust Report, Gartner emphasized the importance of defining the scope early in the zero-trust strategy. Organizations must identify which domains are in scope
and understand the extent of risk mitigation achievable through zero-trust controls. Despite broad adoption, many enterprises struggle
with best practices for implementation. Gartner suggests three key practices: establishing a clear scope, communicating success through
strategic and operational metrics, and anticipating increases in staffing and costs without delays.
In
the context of SideChannel’s offerings, our proprietary software, Enclave, is well-positioned to address these challenges. Enclave
simplifies crucial cybersecurity tasks such as asset inventory, vulnerability management, and microsegmentation. By integrating access
control, microsegmentation, encryption, machine identity management, and secure networking concepts into a unified solution, Enclave
provides a comprehensive solution for managing cybersecurity controls effectively. It allows IT professionals to segment enterprise networks
efficiently, allocate the right personnel to those segments, and direct traffic seamlessly. This alignment with zero-trust principles
ensures that organizations can enhance their security posture and achieve measurable risk reduction.
6
By
leveraging Enclave, SideChannel not only addresses the immediate cybersecurity needs of our clients but also aligns with industry
best practices as highlighted by the Gartner 2024 Zero Trust Report and market trends identified
in the Cantor 2024 Q3 Update. With the rise in remote and hybrid work models, and the increased demand for remote worker technologies
such as Identity and Access Management, Endpoint Protection Platform, and Secure Web Gateway, Enclave offers a solution that simplifies
the segmentation and security of digital networks.
Industry
Standards and Compliance
Industry-standard
cybersecurity and risk management frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework (NIST
CSF) and Center for Internet Security Controls (CIS), prioritize inventory of assets and access control as top requirements for a sustainable
and compliant cybersecurity program. CIS version 8 controls call for organizations to:
● Critical
Control 1: “Establish and maintain an accurate, detailed, and up-to-date inventory
of all enterprise assets with the potential to store or process data.”
● Critical
Control 2: “Actively manage (inventory, track, and correct) all software (operating
systems and applications) on the network so that only authorized software is installed and
can execute, and that unauthorized and unmanaged software is found and prevented from installation
or execution.”
● Critical
Control 3: “Configure data access control lists based on a user’s need to know.
Apply data access control lists, also known as access permissions, to local and remote file
systems, databases, and applications.”
We
built Enclave to address these extremely critical cybersecurity controls along with many others. Enclave seamlessly combines access control,
microsegmentation, encryption, and other secure networking concepts to create a comprehensive solution. Through software, it allows IT
professionals to easily segment the enterprise network, place the right staff in those segments, and direct traffic. Unlike open, traditional
models, Enclave allows for near-limitless micro-segmented networks to operate insulated from one another.
Further
information about Enclave is available on our website.
Summary
By aligning our services and solutions with the key trends and growth projections
highlighted in the Cantor 2024 Q3 Update, SideChannel is well-positioned
to capitalize on the expanding cybersecurity market. Our focus on providing cost-effective, tech-enabled services addresses the needs
of mid-market and emerging companies facing increasing cyber threats. Through our vCISO services, proprietary Enclave platform, and a
comprehensive suite of cybersecurity offerings, we aim to drive growth and deliver value to our clients in line with industry expectations.
Company
History
The
Company was originally incorporated in the State of Texas on June 22, 1953,
as American Mortgage Company. During 1996, the Company acquired the operations of Eden Systems, Inc. (“Eden”), which became
a wholly owned subsidiary of the Company. Eden was engaged in water treatment and the retailing of cleaning products. Eden’s operations
were sold on October 1, 1997. On May 16, 1996, the Company changed its name to National Scientific Corporation. From September 30, 1997,
through the year ended September 30, 2001, the company aimed its efforts in the research and development of semiconductor proprietary
technology and processes and in raising capital to fund its operations and research. Effective August 27, 2014, the Company changed its
name to Cipherloc Corporation (“Cipherloc”) after it began engaging in cybersecurity software development. The Company redomiciled
and became a Delaware corporation on September 30, 2021. A reverse merger, completed on July 1, 2022, between SCS, Inc . , f.k.a.
SideChannel, Inc., a provider of cybersecurity services and technology to middle market companies, was acquired by Cipherloc Corporation.
The combined entity changed its name to SideChannel, Inc., on July 5, 2022, and the acquiree is now named SCS, Inc. (“SCS”)
and for accounting purposes, is a subsidiary of the Company.
7
Research
and Development
Since
Enclave is a proprietary software product, we classify all of our software development activities to be research and development. The
success of our software product, Enclave, depends on our ability to provide our customers with reliable, innovative features and benefits
that are delivered before, or at least no later than, our competitors. When the demands of product development exceed the capacity or
knowledge of our in-house staff, we retain temporary third-party consultants to assist us.
Our
research and development expenditures for the fiscal years ended September 30, 2024, and September 30, 2023, were $546 thousand and $669
thousand, respectively. These costs were incurred to develop Enclave.
Selling
and Marketing
We
use four primary sources to identify prospective clients for our services and products including Enclave.
●
Digital Marketing
●
Industry Events and Conferences
●
Direct Outreach
●
Referral Partners
We
continue enhancing our digital marketing tactics and expanding our online presence. A growing list of referral partners recommend SideChannel
to their clients as the primary option to identify, assess, and mitigate cybersecurity risks. Certain referral partners receive a commission
upon a referral becoming a SideChannel client.
During
fiscal year 2024, we began emphasizing our assessment product when it was premature for the prospective client to engage in a traditional
vCISO subscription. Certain clients acquired during 2024 entered into a recurring service or product agreement following the completion
of the assessment. We intend to enhance our assessment product to expand the adoption of this offering to prospective clients.
As
of September 30, 2024, we had three (3) employees dedicated to selling and marketing activities. Our selling and marketing expenditures for the fiscal years ended September
30, 2024, and September 30, 2023, were $771 thousand and $1.4 million, respectively.
Competition
The
cybersecurity software and services market is highly competitive, subject to rapid change, and significantly affected by new product
introductions and other activities of market participants.
Some
of our competitors have greater financial, technical, sales, marketing, and other resources than we do. Because of these and other factors,
competitive conditions in the markets we operate in are likely to continue to intensify in the future, as participants compete for market
share. Increased competition could result in price reductions for our products and services, possibly reducing our net revenue and profit
margins and resulting in a loss of our market share, any of which would likely harm our business.
We
believe that our future results depend largely upon our ability to serve our clients and customers with the products and services described
earlier better than our competitors, and by offering new services and product enhancements, whether such product and service offerings
are developed internally or through acquisition. We also believe that we must provide product and service offerings that compete favorably
against those of our competitors with respect to ease of use, reliability, performance, range of useful features, reputation and price.
We
anticipate that we will face increasing pricing pressures from our competitors in the future. Since there are low barriers to entry into
the cybersecurity services and software markets, we believe competition in these markets will persist and intensify in the future.
Our
chief services competitors include companies such as Optiv, NCC, Coalfire, PwC, EY, Deloitte, and GuidePoint. Our primary software competitors
are companies such as Perimeter 81, Zscaler, Palo Alto, and Illumio.
Intellectual
Property
Protective
Measures
We
believe that our intellectual property is an important and vital asset, which enables us to develop, market, and sell our products and
services and enhance our competitive position. Our intellectual property includes our proprietary business and technical know-how, inventions,
works of authorship, and confidential information. To protect our intellectual property, we rely primarily upon legal rights in trade
secrets, patents, copyrights, and trademarks, in addition to our policies and procedures, security practices, contracts, and relevant
operational measures.
We
protect the confidentiality of our proprietary information by entering into non-disclosure agreements with our employees, contractors,
and other entities with which we do business. In addition, our license agreements related to our software and proprietary information
include confidentiality terms. These agreements are generally non-transferable. We also employ access controls and associated security
measures to protect our facilities, equipment, and networks.
8
Patents,
Copyrights, Trademarks, and Licenses
Our
products, particularly our software and related documentation, are protected under domestic and international copyright laws and other
laws related to the protection of intellectual property and proprietary rights. Currently, we have six active patents registered with the U.S. Patent
and Trademark Office. We employ procedures to label copyrightable works with the appropriate proprietary rights notices, and we actively
enforce our rights in the United States and abroad. However, these measures may not provide us with adequate protection from infringement,
and our intellectual property rights may be challenged.
Our
SideChannel Logo is registered with the U.S. Patent and Trademark Office (“USPTO”). We recently applied for registration of the Enclave Logo in the USPTO and also have common law rights in the Enclave
Logo based on our prior use of the Logo in commerce. In the United States, we can
maintain our trademark rights and renew trademark registrations for as long as the trademarks are in use.
Government
Regulation
Export
Control Regulations . We expect that all of our products will be subject to U.S. export control laws and applicable foreign government
import, export and/or use requirements. The level of such control generally depends on the nature of the products in question. Often,
the level of export control is impacted by the nature of the software and cybersecurity incorporated into our products. In those countries
where such controls apply, the export of our products may require an export license or authorization. However, even if a transaction
qualifies for a license exception or the equivalent, it may still be subject to corresponding reporting requirements. For the export
of some of our products, we may be subject to various post-shipment reporting requirements. Minimal U.S. export restrictions apply to
all our products, whether or not they perform cybersecurity functions. If we become a Department of Defense contractor in the future,
certain registration requirements may be triggered by our sales. In addition, certain of our products and related services may be subject
to the International Traffic in Arms Regulations (ITAR) if our software or services are specifically designed or modified for defense
purposes. If we become engaged in manufacturing or exporting ITAR-controlled goods and services (even if we do not export such items),
we will be required to register with the U.S. State Department.
To
date, Export Control Regulations have had no material impact on our business.
Enhancements
to our existing products may be subject to review under the Export Administration Act to determine what export classification they will
receive. In addition, any new products that we release in the future will also be subject to such review before we can export them. The
U.S. Congress continues to discuss the correct level of export control in possible anti-terrorism legislation. Such export regulations
may be modified at any time. Modifications to these export regulations could reduce or eliminate our ability to export some or all of
our products from the United States in the future, which could put us at a disadvantage in competing with companies located outside of
the U.S. Modifications to U.S. export regulations could restrict us from exporting our existing and future products. Any such modifications
to export regulations may put us at a competitive disadvantage with respect to selling our products internationally.
Privacy
Laws . We may be subject to various international, federal and state regulations regarding the treatment and protection of personally
identifying and other regulated information. Applicable laws may include U.S. federal laws and implementing regulations, such as the
GLBA and HIPAA, as well as state and international laws and regulations, including the California Consumer Privacy Act (CCPA) and the
European Union General Data Protection Regulation (GDPR). Some of these laws have requirements on the transmittal of data from one jurisdiction
to another. In the event our systems are compromised, many of these privacy laws require that we provide notices to our customers whose
personally identifiable data may have been compromised. Additionally, if we transfer data in violation of these laws, we could be subjected
to substantial fines. To mitigate the risk of having such data compromised, we use cybersecurity, software and other security procedures
to protect our databases.
9
Personnel
As
of September 30, 2024, we had 20 full-time employees. We also had approximately 11 independent contractors that provide services to us.
We anticipate that we will need to increase our staffing in the foreseeable future.