What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2025-12-18 compared with 2024-12-13 · 153 added, 218 removed, 95 unchanged (80% of the section changed)

1 unchanged sentence

is a cybersecurity advisory services and software company.

Our mission is to simplify cybersecurity for mid-market and emerging companies,

a market we believe is underserved.

Our products and services offer comprehensive cybersecurity and privacy risk management solutions.

We anticipate ongoing demand for cost-effective cybersecurity solutions, driven by continued remote and hybrid work environments, increased

data breaches, and a heightened focus of Chief Information Officers (CIOs) on information security.

To meet these needs, we aim to provide

tech-enabled services, including virtual Chief Information Security Officer (vCISO) services, zero trust solutions, third-party risk

management, due diligence, privacy, threat intelligence, and managed end-point security solutions.

According to the Cantor’s Cybersecurity Q3’24 Market Updater released by

Cantor Technology Investment Banking on October 29, 2024 (“Cantor 2024 Q3 Update”), security spending is forecasted to reach

$190 billion in calendar year (“CY”) 2024, reflecting significant growth in the cybersecurity market.

Information security

spending is expected to have grown 12.4% for CY 2023 on a constant currency basis from $141.4 billion in CY 2022 to $158.9 billion in

This growth is driven by continued remote and hybrid work, increased incidences of data breaches, and a continued focus of CIOs

on information security.

The Cantor 2024 Q3 Update also noted:

● The number of reported data compromises increased by 78% in 2023, affecting over 350 million

adversaries are utilizing social engineering to circumvent multi-factor authentication (“MFA”),

and phishing, stolen or compromised credentials, and cloud misconfiguration were the most

frequent attack vectors.

through cloud environments have increased by 75% year-over-year from 2022 to 2023.

51% of organizations are planning to increase security investments following a breach.

The Cantor 2024 Q3 Update projects that by the end of 2026, the democratization of technology, digitization, and automation of work are expected to increase the total addressable

market of fully remote and hybrid workers to 64% of all employees, up from 52% in 2021.

This shift increases demand for remote worker

technologies such as Identity and Access Management (“IAM”), Endpoint Protection Platforms (“EPP”), and Secure

Web Gateways (“SWG”).

Organizations are also investing in application and data security to support the rise in volume and

velocity of data, with the prevalence of Internet of Things (“IoT”) expanding the attack surface.

Transformational

technologies in data security, application security, network security, security operations, and risk management are gaining traction.

These include data security posture management (“DSPM”), homomorphic encryption, cyber-physical system (“CPS”)

security, generative AI (“GenAI”), and application security posture management (“ASPM”).

AI is the top emerging

technology to be deployed, with 71% of organizations planning deployment within two to three years, and 34% within the next 12 months, according to the Cantor 2024 Q3 Update.

our proprietary SaaS platform, streamlines critical cybersecurity tasks such as asset inventory and microsegmentation.

integrates access control, microsegmentation, encryption, machine identity management, and secure networking concepts into a unified

solution, enabling IT professionals to efficiently segment networks, assign staff, and manage traffic.

This aligns with the

industry’s shift towards zero trust frameworks, which have been adopted fully or partially by 63% of organizations worldwide,

according to the Gartner State of Zero Trust Strategy Adoption Survey dated April

22, 2024 (“Gartner 2024 Zero Trust Report”).

Our mission is to make cybersecurity simple and accessible for mid-market

and emerging companies, a market that we believe is currently underserved.

Our solutions provide effective cybersecurity risk management

for our clients.

We anticipate that our target customers will continue to need cost-effective security solutions.

We continue to expand

our catalogue of services and solutions to address the cybersecurity needs of our customers, including virtual Chief Information Security

Officer (“vCISO”), cyber program strategy, zero trust, third-party risk management, compliance readiness, cloud security

and architecture services, privacy, threat intelligence, managed end-point security solutions, and awareness and training.

efforts are focused on protecting and enabling the critical business functions of our clients and customers through comprehensive cybersecurity

This specifically includes:

Enclave, a proprietary software product simplifying the important cybersecurity tasks of segmenting and securing digital networks,

addressing the increased demand for remote worker technologies, and advancing zero trust strategies to better protect against threats such as ransomware and intrusions.

vCISOs as a fractional resource into the leadership teams of our clients.

The role of vCISOs

is becoming increasingly pivotal, especially among small and cloud-enabled companies.

flexibility and expertise offered by vCISOs make them an attractive option for companies

facing budget constraints and needing to establish a robust security posture quickly.

Enclave to simplify the segmentation and security of digital networks, addressing the increased

demand for remote worker technologies and zero trust strategies.

identifying, and mitigating cybersecurity and privacy risks through tech-enabled security

engineering processes.

We leverage AI-based security operations for post-detection actions,

including alert prioritization, augmented threat detection/hunting, playbook creation, and

automation of incident response processes.

third-party cybersecurity services and software when appropriate, expanding our offerings

to include a full range of cybersecurity products and services delivered through our team

of security engineers and a network of third-party service providers and value-added resellers

internally report our revenue using two categories:

vCISO Services:

This category captures the revenue from the Chief Information Security Officer

services that we provide to our clients on a “virtual” or outsourced basis.

Services delivered by SideChannel through our

team of vCISOs include assessing the cybersecurity risk profile, implementing policies and programs to mitigate risks, and managing the

day-to-day tasks to ensure compliance with the adopted cybersecurity framework.

Most of our clients use our vCISO services.

engagements typically include a fixed monthly subscription fee and contract duration typically exceeds 12 months.

Hourly rates for vCISO time and material projects range from $350 to $450.

Each of our vCISOs is generally embedded into the C-suite

executive teams of two to four of our clients.

to the 2023 vCISO Service Provider Survey by Hitch Partners, the adoption of vCISO services is on the rise, particularly among small

and cloud-enabled companies.

Key services provided by vCISOs include Governance, Risk, and Compliance (GRC), strategic planning, and

mentoring security teams.

Many vCISO engagements extend beyond initial expectations, indicating a sustained need for their expertise.

Cybersecurity Software and Services:

This category encompasses an array of cybersecurity software and services

that our clients deem necessary to protect their digital assets.

These augment our vCISO offering and include a full range of other cybersecurity

products and services delivered through a team of security engineers along with a network of third-party service providers and VARs.

relationships with third-party service providers and VARs provide SideChannel with additional internal capabilities to mitigate cybersecurity

We earn licensing revenue from software contracts and commissions from third-party service provider partnerships which are included

in this revenue category.

response to evolving threats highlighted in the 2024 Data Breach Investigations Report released by Verizon, SideChannel

offers solutions designed to address financial and espionage-driven breaches effectively, minimize end-user errors, and ensure rapid incident

With the increase in data transmission and connected intelligent devices through the prevalence of IoT, the scale of security

risks and the attack surface are much larger.

Our offerings in data security, application security, network security, security operations,

and risk management position us to meet these challenges.

growth strategy focuses on these three initiatives:

new vCISO clients:

As organizations plan to increase security investments due to breaches

and the rising complexity of cyber threats, we aim to expand our client base by offering

flexible, expert vCISO services that address budget constraints and the need for rapid security

posture establishment.

new cybersecurity software and services offerings:

We plan to enhance our portfolio by

incorporating transformational technologies such as AI-based security operations, data security

posture management (DSPM), polymorphic encryption, cyber-physical system (CPS) security,

and application security posture management (ASPM).

This aligns with industry trends and

the anticipated incremental spend on application and data security due to generative AI.

adoption of cybersecurity software, including Enclave, and services offerings at vCISO clients:

By promoting Enclave and our other cybersecurity solutions to our existing vCISO clients,

we aim to deepen our relationships and provide comprehensive, integrated security solutions.

This supports the increased demand for zero trust strategies and remote worker technologies.

A SideChannel Proprietary Software Product

Incorporating insights from the Gartner 2024 Zero Trust Report, implementing a zero-trust strategy has become a priority for a majority of organizations

The survey revealed that 63% of organizations have fully or partially adopted zero-trust frameworks.

For 78% of these

organizations, the investment in zero trust constitutes less than 25% of their overall cybersecurity budget.

This strategic approach

typically covers about half of an organization’s environment, addressing approximately a quarter of overall enterprise

In the Gartner 2024 Zero Trust Report, Gartner emphasized the importance of defining the scope early in the zero-trust strategy.

Organizations must identify which domains are in scope

and understand the extent of risk mitigation achievable through zero-trust controls.

Despite broad adoption, many enterprises struggle

with best practices for implementation.

Gartner suggests three key practices:

establishing a clear scope, communicating success through

strategic and operational metrics, and anticipating increases in staffing and costs without delays.

the context of SideChannel’s offerings, our proprietary software, Enclave, is well-positioned to address these challenges.

The role of vCISOs is becoming increasingly pivotal, especially

among small and cloud-enabled companies.

The flexibility and expertise offered by vCISOs make them an attractive option for companies

facing budget constraints, needing to establish a robust security posture quickly, and overseeing increasingly complex regulatory environments.

identifying, and mitigating cybersecurity and privacy risks through tech-enabled security engineering processes.

We leverage AI-based

security operations for post-detection actions, including alert prioritization, augmented threat detection/hunting, playbook creation,

and automation of incident response processes.

third-party cybersecurity services and software when appropriate, expanding our offerings to include a full range of cybersecurity

products and services delivered through our team of security engineers and a network of third-party service providers and value-added

resellers (VARs).

the context of SideChannel’s offerings, Enclave is well-positioned to address these challenges faced by enterprises in achieving

a zero trust environment:

a clear scope,

Communicating

success through strategic and operational metrics, and

increase in staffing and costs without delays.

simplifies crucial cybersecurity tasks such as asset inventory, vulnerability management, and microsegmentation.

6 unchanged sentences

ensures that organizations can enhance their security posture and achieve measurable risk reduction.

leveraging Enclave, SideChannel not only addresses the immediate cybersecurity needs of our clients but also aligns with industry

best practices as highlighted by the Gartner 2024 Zero Trust Report and market trends identified

in the Cantor 2024 Q3 Update.

With the rise in remote and hybrid work models, and the increased demand for remote worker technologies

such as Identity and Access Management, Endpoint Protection Platform, and Secure Web Gateway, Enclave offers a solution that simplifies

the segmentation and security of digital networks.

combining zero trust network access with certificate management and machine identity, Enclave seamlessly creates a unified security architecture

that eliminates traditional network vulnerabilities.

This integration enables IT teams to enforce precise access policies based on verified

machine identities.

Certificate-based identities allow a simplified management for any certificate-based communication, while the zero

trust framework continuously validates every connection attempt.

This powerful combination delivers robust security without the typical

management overhead, allowing organizations to implement sophisticated microsegmentation strategies with remarkable simplicity and minimal

resource requirements.

offer cybersecurity service solutions designed to address financial and espionage-driven breaches effectively, minimize end-user errors,

and ensure rapid incident response.

With the increase in data transmission and connected intelligent devices through the prevalence of

Internet of Things, the scale of security risks and the attack surface are much larger.

Our offerings in data security, application security,

network security, security operations, and risk management position us to meet these challenges.

information about Enclave and our service offerings are available on our website (www.sidechannel.com).

internally report our revenue using two categories:

This category captures the revenue from the Chief Information Security Officer services that we provide to our clients

on a “virtual” or outsourced basis.

Embedded into the C-suite executive teams of our clients, our vCISOs deliver services

including assessing the cybersecurity risk profile, implementing policies and programs to mitigate risks, and managing the day-to-day

tasks to ensure compliance with the adopted cybersecurity framework.

Most of our clients use our vCISO services.

Engagements typically

include a fixed monthly subscription fee and exceed 12 months because of renewal options of 1, 3, 6, or 12 months.

Cybersecurity

Software and Services:

This category encompasses an array of cybersecurity software and services that our clients deem necessary

to protect their digital assets, including Enclave.

These augment our vCISO offering and include a full range of other cybersecurity

products and services delivered through a team of security engineers along with a network of third-party service providers and VARs.

Commercial relationships with third-party service providers and VARs provide SideChannel with additional internal capabilities to

mitigate cybersecurity risks.

We earn licensing revenue from software contracts and commissions from third-party service provider

partnerships which are included in this revenue category.

growth strategy focuses on these three initiatives:

adoption of Enclave:

By promoting Enclave and our other cybersecurity solutions to our existing vCISO clients, we aim to deepen

our relationships and provide comprehensive, integrated security solutions.

This supports the increased demand for zero trust strategies

and remote worker technologies.

new vCISO Services Clients:

As organizations plan to increase security investments due to breaches and the rising complexity

of cyber threats, we aim to expand our client base by offering flexible, expert vCISO services that address budget constraints and

the need for rapid security posture establishment.

new Cybersecurity Software and Services offerings:

We plan to enhance our portfolio by incorporating transformational technologies

such as AI-based security operations, data security posture management (“DSPM”), polymorphic encryption, cyber-physical system (“CPS”)

security, and application security posture management (“ASPM”).

This aligns with industry trends and the anticipated incremental spend

on application and data security due to generative AI.

Standards and Compliance

Industry-standard

cybersecurity and risk management frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework (NIST

CSF) and Center for Internet Security Controls (CIS), prioritize inventory of assets and access control as top requirements for a sustainable

cybersecurity and risk management frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework and Center for Internet Security Controls (“CIS”), prioritize inventory of assets and access control as top requirements for a sustainable

and compliant cybersecurity program.

CIS version 8 controls call for organizations to:

“Establish and maintain an accurate, detailed, and up-to-date inventory

of all enterprise assets with the potential to store or process data.”

“Actively manage (inventory, track, and correct) all software (operating

systems and applications) on the network so that only authorized software is installed and

can execute, and that unauthorized and unmanaged software is found and prevented from installation

or execution.”

The first three controls in CIS version 8 call for organizations to:

“Establish and maintain an accurate, detailed, and up-to-date inventory of all enterprise assets with the potential

to store or process data.”

“Actively manage (inventory, track, and correct) all software (operating systems and applications) on the network

so that only authorized software is installed and can execute, and that unauthorized and unmanaged software is found and prevented

from installation or execution.”

“Configure data access control lists based on a user’s need to know.

Apply data access control lists, also known as access permissions, to local and remote file

systems, databases, and applications.”

built Enclave to address these extremely critical cybersecurity controls along with many others.

Enclave seamlessly combines access control,

microsegmentation, encryption, and other secure networking concepts to create a comprehensive solution.

Through software, it allows IT

professionals to easily segment the enterprise network, place the right staff in those segments, and direct traffic.

Unlike open, traditional

models, Enclave allows for near-limitless micro-segmented networks to operate insulated from one another.

information about Enclave is available on our website.

By aligning our services and solutions with the key trends and growth projections

highlighted in the Cantor 2024 Q3 Update, SideChannel is well-positioned

to capitalize on the expanding cybersecurity market.

Our focus on providing cost-effective, tech-enabled services addresses the needs

of mid-market and emerging companies facing increasing cyber threats.

Through our vCISO services, proprietary Enclave platform, and a

comprehensive suite of cybersecurity offerings, we aim to drive growth and deliver value to our clients in line with industry expectations.

Company was originally incorporated in the State of Texas on June 22, 1953,

as American Mortgage Company.

During 1996, the Company acquired the operations of Eden Systems, Inc.

(“Eden”), which became

a wholly owned subsidiary of the Company.

Eden was engaged in water treatment and the retailing of cleaning products.

Eden’s operations

were sold on October 1, 1997.

On May 16, 1996, the Company changed its name to National Scientific Corporation.

From September 30, 1997,

through the year ended September 30, 2001, the company aimed its efforts in the research and development of semiconductor proprietary

technology and processes and in raising capital to fund its operations and research.

Effective August 27, 2014, the Company changed its

name to Cipherloc Corporation (“Cipherloc”) after it began engaging in cybersecurity software development.

The Company redomiciled

and became a Delaware corporation on September 30, 2021.

A reverse merger, completed on July 1, 2022, between SCS, Inc .

SideChannel, Inc., a provider of cybersecurity services and technology to middle market companies, was acquired by Cipherloc Corporation.

The combined entity changed its name to SideChannel, Inc., on July 5, 2022, and the acquiree is now named SCS, Inc.

Apply data access control lists, also

known as access permissions, to local and remote file systems, databases, and applications.”

built Enclave to primarily address these three extremely critical cybersecurity controls along with other controls in CIS version 8.

Enclave seamlessly

combines access control, microsegmentation, encryption, and other secure networking concepts to create a comprehensive solution.

Through software, it allows IT professionals to easily segment the enterprise network, place the right staff in those segments, and

direct traffic.

Unlike open, traditional models, Enclave allows for near-limitless micro-segmented networks to operate insulated

from one another.

Company was originally incorporated in the State of Texas on June 22, 1953, as American Mortgage Company.

During 1996, the Company

acquired the operations of Eden Systems, Inc.

(“Eden”), which became a wholly owned subsidiary of the Company.

engaged in water treatment and the retailing of cleaning products.

Eden’s operations were sold on October 1, 1997.

1996, the Company changed its name to National Scientific Corporation.

From September 30, 1997, through the year ended September 30,

2001, the company aimed its efforts in the research and development of semiconductor proprietary technology and processes and in

raising capital to fund its operations and research.

Effective August 27, 2014, the Company changed its name to Cipherloc

Corporation (“Cipherloc”) after it began engaging in cybersecurity software development.

The Company redomiciled and

became a Delaware corporation on September 30, 2021.

A reverse merger was completed on July 1, 2022, between SCS, Inc .

SideChannel, Inc.

and Cipherloc.

combined entity changed its name to SideChannel, Inc., on July 5, 2022, and the acquiree is now named SCS, Inc.

and for accounting purposes, is a subsidiary of the Company.

and Development

Enclave is a proprietary software product, we classify all of our software development activities to be research and development.

success of our software product, Enclave, depends on our ability to provide our customers with reliable, innovative features and benefits

that are delivered before, or at least no later than, our competitors.

When the demands of product development exceed the capacity or

knowledge of our in-house staff, we retain temporary third-party consultants to assist us.

Enclave is a proprietary software product, we classify all our software development activities to be research and development.

of our software product, Enclave, depends on our ability to provide our customers with reliable, innovative features and benefits that

are delivered before, or at least no later than, our competitors.

When the demands of product development exceed the capacity or knowledge

of our in-house staff, we retain temporary third-party consultants to assist us.

research and development expenditures for the fiscal years ended September 30, 2025, and September 30, 2024, were $562 thousand and $546

thousand, respectively.

These costs were incurred to develop Enclave.

These costs were incurred primarily to develop Enclave.

and Marketing

use four primary sources to identify prospective clients for our services and products including Enclave:

Digital Marketing

Industry Events and Conferences

Direct Outreach

Referral Partners

Events and Conferences

continue enhancing our digital marketing tactics and expanding our online presence.

3 unchanged sentences

upon a referral becoming a SideChannel client.

fiscal year 2024, we began emphasizing our assessment product when it was premature for the prospective client to engage in a traditional

vCISO subscription.

Certain clients acquired during 2024 entered into a recurring service or product agreement following the completion

of the assessment.

We intend to enhance our assessment product to expand the adoption of this offering to prospective clients.

of September 30, 2025, we had three (3) employees dedicated to selling and marketing activities.

Our selling and marketing expenditures for the fiscal years ended September

30, 2024, and September 30, 2023, were $771 thousand and $1.4 million, respectively.

Our selling and marketing expenditures

for the fiscal years ended September 30, 2025, and September 30, 2024, were $966 thousand and $771 thousand, respectively.

cybersecurity software and services market is highly competitive, subject to rapid change, and significantly affected by new product

15 unchanged sentences

Our primary software competitors

are companies such as Perimeter 81, Zscaler, Palo Alto, and Illumio.

are companies such as Check Point, Cisco, CrowdStrike, F5 Networks, HPE, Huawei, Illumio, Juniper,

Microsoft, Netskope, Palo Alto Networks, SonicWALL, Sophos, and zScaler.

believe that our intellectual property is an important and vital asset, which enables us to develop, market, and sell our products and

15 unchanged sentences

laws related to the protection of intellectual property and proprietary rights.

Currently, we have six active patents registered with the U.S.

and Trademark Office.

We employ procedures to label copyrightable works with the appropriate proprietary rights notices, and we actively

enforce our rights in the United States and abroad.

However, these measures may not provide us with adequate protection from infringement,

and our intellectual property rights may be challenged.

SideChannel Logo is registered with the U.S.

Currently, we have six active patents registered with

Patent and Trademark Office.

We employ procedures to label copyrightable works with the appropriate proprietary rights notices,

and we actively enforce our rights in the United States and abroad.

However, these measures may not provide us with adequate protection

from infringement, and our intellectual property rights may be challenged.

SideChannel and Enclave logos are registered with the U.S.

Patent and Trademark Office (“USPTO”).

We recently applied for registration of the Enclave Logo in the USPTO and also have common law rights in the Enclave

Logo based on our prior use of the Logo in commerce.

In the United States, we can

maintain our trademark rights and renew trademark registrations for as long as the trademarks are in use.

In the United States, we

can maintain our trademark rights and renew trademark registrations for as long as the trademarks are in use.

Control Regulations

We expect that all of our products will be subject to U.S.

export control laws and applicable foreign government

import, export and/or use requirements.

expect that all our products will be subject to U.S.

export control laws and applicable foreign government import, export and/or use

requirements.

The level of such control generally depends on the nature of the products in question.

the level of export control is impacted by the nature of the software and cybersecurity incorporated into our products.

In those countries

where such controls apply, the export of our products may require an export license or authorization.

However, even if a transaction

qualifies for a license exception or the equivalent, it may still be subject to corresponding reporting requirements.

For the export

of some of our products, we may be subject to various post-shipment reporting requirements.

export restrictions apply to

all our products, whether or not they perform cybersecurity functions.

If we become a Department of Defense contractor in the future,

certain registration requirements may be triggered by our sales.

In addition, certain of our products and related services may be subject

to the International Traffic in Arms Regulations (ITAR) if our software or services are specifically designed or modified for defense

If we become engaged in manufacturing or exporting ITAR-controlled goods and services (even if we do not export such items),

we will be required to register with the U.S.

Often, the level of export

control is impacted by the nature of the software and cybersecurity incorporated into our products.

In those countries where such

controls apply, the export of our products may require an export license or authorization.

However, even if a transaction qualifies

for a license exception or the equivalent, it may still be subject to corresponding reporting requirements.

For the export of some

of our products, we may be subject to various post-shipment reporting requirements.

export restrictions apply to all

our products, whether or not they perform cybersecurity functions.

If we become a Department of Defense prime contractor in the

future, certain registration requirements may be triggered by our sales.

In addition, certain of our products and related services

may be subject to the International Traffic in Arms Regulations (ITAR) if our software or services are specifically designed or

modified for defense purposes.

If we become engaged in manufacturing or exporting ITAR-controlled goods and services (even if we do

not export such items), we will be required to register with the U.S.

State Department.

28 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business