TELOS CORP 10-Q

Item 1A. Risk Factors The following risk factors are in addition to those risk factors disclosed in our Annual Report on Form 10-K, filed with the SEC on April 13, 2020, which are incorporated by reference herein. We are subject to the seasonality of the U.S. government spending. We derive a substantial portion of our revenues from U.S. government contracting, and as a result, we are subject to the annual seasonality of the U.S. government purchasing. Because the U.S. government fiscal year ends on September 30, it is not uncommon for U.S. government agencies to award extra tasks in the weeks immediately prior to the end of its fiscal year in order to avoid the loss of unexpended fiscal year funds. As a result of this seasonality, we have historically experienced higher revenues in the third and fourth fiscal quarters, ending September 30 and December 31, respectively, with the pace of orders typically substantially reduced during the first and second fiscal quarters ending March 31 and June 30, respectively. Our pricing structures for our solutions and services may change from time to time. We expect that we may change our pricing model from time to time, including as a result of competition, global economic conditions, and general reductions in our customers’ spending levels, pricing studies, or changes in how our solutions are broadly consumed. Similarly, as we introduce new products and services, or as a result of the evolution of our existing solutions and services, we may have difficulty determining the appropriate price structure for our products and services. In addition, as new and existing competitors introduce new products or services that compete with ours, or revise their pricing structures, we may be unable to attract new customers at the same price or based on the same pricing model as we have used historically. Moreover, as we continue to target selling our solutions and services to larger organizations, these larger organizations may demand substantial price concessions. In addition, we may need to change pricing policies to accommodate government pricing guidelines for our contracts with federal, state, local, and foreign governments and government agencies. If we are unable to modify or develop pricing models and strategies that are attractive to existing and prospective customers, while enabling us to significantly grow our sales and revenue relative to our associated costs and expenses in a reasonable period of time, our business, financial condition, and results of operations may be adversely impacted. We depend on computing infrastructure operated by Amazon Web Services (“AWS”), Microsoft, and other third parties to support some of our solutions and customers, and any errors, disruption, performance problems, or failure in their or our operational infrastructure could adversely affect our business, financial condition, and results of operations. We rely on the technology, infrastructure, and software applications, of certain third parties, such as AWS and Microsoft Azure, in order to host or operate some of certain key platform features or functions of our business. Additionally, we rely on computer hardware and cloud capabilities purchased in order to deliver our solutions and services. We do not have control over the operations of the facilities of the third parties that we use. If any of these third-party services experience errors, disruptions, security issues, or other performance deficiencies, if they are updated such that our solutions become incompatible, if these services, software, or hardware fail or become unavailable due to extended outages, interruptions, defects, or otherwise, or if they are no longer available on commercially reasonable terms or prices (or at all), these issues could result in errors or defects in our solutions, cause our solutions to fail, our revenue and margins could decline, or our reputation and brand to be damaged, we could be exposed to legal or contractual liability, our expenses could increase, our ability to manage our operations could be interrupted, and our processes for managing our sales and servicing our customers could be impaired until equivalent services or technology, if available, are identified, procured, and implemented, all of which may take significant time and resources, increase our costs, and could adversely affect our business. Many of these third-party providers attempt to impose limitations on their liability for such errors, disruptions, defects, performance deficiencies, or failures, and if enforceable, we may have additional liability to our customers or third-party providers. 44 Table of Contents We have experienced, and may in the future experience, disruptions, failures, data loss, outages, and other performance problems with our infrastructure and cloud-based offerings due to a variety of factors, including infrastructure changes, introductions of new functionality, human or software errors, employee misconduct, capacity constraints, denial of service attacks, phishing attacks, computer viruses, malicious or destructive code, or other security-related incidents, and our disaster recovery planning may not be sufficient for all situations. If we experience disruptions, failures, data loss, outages, or other performance problems, our business, financial condition, and results of operations could be adversely affected. Our systems and the third-party systems upon which we and our customers rely are also vulnerable to damage or interruption from catastrophic occurrences such as earthquakes, floods, fires, power loss, telecommunication failures, cybersecurity threats, terrorist attacks, natural disasters, public health crises such as the COVID-19 pandemic, geopolitical and similar events, or acts of misconduct. Despite any precautions we may take, the occurrence of a catastrophic disaster or other unanticipated problems at our or our third-party vendors’ hosting facilities, or within our systems or the systems of third parties upon which we rely, could result in interruptions, performance problems, or failure of our infrastructure, technology, or solutions, which may adversely impact our business. In addition, our ability to conduct normal business operations could be severely affected. In the event of significant physical damage to one of these facilities, it may take a significant period of time to achieve full resumption of our services, and our disaster recovery planning may not account for all eventualities. In addition, any negative publicity arising from these disruptions could harm our reputation and brand and adversely affect our business. Furthermore, our solutions are in many cases important or essential to our customers’ operations, including in some cases, their cybersecurity or oversight and compliance programs, and subject to service level agreements (“SLAs”). Any interruption in our service, whether as a result of an internal or third-party issue, could damage our brand and reputation, cause our customers to terminate or not renew their contracts with us or decrease use of our solutions and services, require us to indemnify our customers against certain losses, result in our issuing credit or paying penalties or fines, subject us to other losses or liabilities, cause our solutions to be perceived as unreliable or unsecure, and prevent us from gaining new or additional business from current or future customers, any of which could harm our business, financial condition, and results of operations. Moreover, to the extent that we do not effectively address capacity constraints, upgrade our systems as needed, and continually develop our technology and network architecture to accommodate actual and anticipated changes in technology, our business, financial condition, and results of operations could be adversely affected. The provisioning of additional cloud hosting capacity requires lead time. AWS, Microsoft Azure, and other third parties have no obligation to renew their agreements with us on commercially reasonable terms, or at all. If AWS, Microsoft Azure, or other third parties increase pricing terms, terminate or seek to terminate our contractual relationship, establish more favorable relationships with our competitors, or change or interpret their terms of service or policies in a manner that is unfavorable with respect to us, we may be required to transfer to other cloud providers or invest in a private cloud. If we are required to transfer to other cloud providers or invest in a private cloud, we could incur significant costs and experience possible service interruption in connection with doing so, or risk loss of customer contracts if they are unwilling to accept such a change. A failure to maintain our relationships with our third-party providers (or obtain adequate replacements), and to receive services from such providers that do not contain any material errors or defects, could adversely affect our ability to deliver effective products and solutions to our customers and adversely affect our business and results of operations. We will face risks associated with the growth of our business in new commercial markets and with new customer verticals, and we may neither be able to continue our organic growth nor have the necessary resources to dedicate to the overall growth of our business. We plan to expand our operations in new commercial markets, including those where we may have limited operating experience, and may be subject to increased business, technology and economic risks that could affect our financial results. In recent periods, we have increased our focus on commercial customers. In the future, we may increasingly focus on such customers, including in the banking, financial services, healthcare, pharmaceutical, manufacturing, telecommunication, airlines and aerospace, insurance, retail, transportation, shipping and logistics, and energy industries, as well as other critical infrastructure industries. Entering new verticals and expanding in the verticals in which we are already operating will continue to require significant resources and there is no guarantee that such efforts will be successful or beneficial to us. Historically, sales to a new customer have often led to additional sales to the same customer or similarly situated customers. As we expand into and within new and emerging markets and heavily regulated industry verticals, we will likely face additional regulatory scrutiny, risks, and burdens from the governments and agencies which regulate those markets and industries. While this approach to expansion within new commercial markets and verticals has proven successful in the past, it is uncertain we will achieve the same penetration and organic growth in the future and our reputation, business, financial condition, and results of operations could be negatively impacted. 45 Table of Contents In the future, we may seek to enter into other credit facilities to help fund our working capital needs. These credit facilities may expose us to additional risks associated with leverage and may inhibit our operating flexibility. We may seek to enter into other credit facilities with third-party lenders to help fund our business. Such credit facilities will likely require us to pay a commitment fee on the undrawn amount and will likely contain a number of affirmative and restrictive covenants. If we violate any such covenants, our lenders could accelerate the maturity of any debt outstanding and we may be prohibited from making any distributions to our stockholders. Such debt may be secured by our assets, including the stock we may own in subsidiaries and the rights we have under intercompany loan agreements that we may enter into in the future with our businesses. Our ability to meet our debt service obligations may be affected by events beyond our control and will depend primarily upon cash produced by our business. Any failure to comply with the terms of our indebtedness may have a material adverse effect on our financial condition. In addition, we expect that such credit facilities will bear interest at floating rates which will generally change as interest rates change. We will bear the risk that the rates that we are charged by our lenders will increase faster than we can grow the cash flow from our businesses, which could reduce profitability, materially adversely affect our ability to service our debt and cause us to breach covenants contained in our third-party credit facilities. Our business is subject to complex and evolving U.S. and non-U.S. laws and regulations regarding privacy, data protection and security, technology protection, and other matters. Many of these laws and regulations are subject to change and uncertain interpretation, and could result in claims, changes to our business practices, monetary penalties, increased cost of operations, or otherwise harm our business. We are subject to a variety of local, state, national, and international laws and directives and regulations in the United States and abroad that involve matters central to our business, including privacy and data protection, data security, data storage, retention, transfer and deletion, technology protection, and personal information. Foreign data protection, data security, privacy, and other laws and regulations can impose different obligations or be more restrictive than those in the United States. These U.S. federal and state and foreign laws and regulations, which, depending on the regime, may be enforced by private parties or government entities, are constantly evolving and can be subject to significant change, and they are likely to remain uncertain for the foreseeable future. In addition, the application, interpretation, and enforcement of these laws and regulations are often uncertain, and may be interpreted and applied inconsistently from country to country and inconsistently with our current policies and practices. A number of proposals are pending before U.S. federal, state, and foreign legislative and regulatory bodies that could significantly affect our business. The overarching complexity of privacy and data protection laws and regulations around the world pose a compliance challenge that could manifest in costs, damages, or liability in other forms as a result of failure to implement proper programmatic controls, failure to adhere to those controls, or the malicious or inadvertent breach of applicable privacy and data protection requirements by us, our employees, our business partners, or our customers. In addition to government regulation, self-regulatory standards and other industry standards may legally or contractually apply to us, be argued to apply to us, or we may elect to comply with such standards or to facilitate our customers’ compliance with such standards. Because privacy, data protection, and information security are critical competitive factors in our industry, we may make statements on our website, in marketing materials, or in other settings about our data security measures and our compliance with, or our ability to facilitate our customers’ compliance with, these standards. We also expect that there will continue to be new proposed laws and regulations concerning privacy, data protection, and information security, and we cannot yet determine the impact such future laws, regulations and standards, or amendments to or re-interpretations of existing laws and regulations, industry standards, or other obligations may have on our business. New laws, amendments to or re-interpretations of existing laws and regulations, industry standards, and contractual and other obligations may require us to incur additional costs and restrict our business operations. As these legal regimes relating to privacy, data protection, and information security continue to evolve, they may result in ever-increasing public scrutiny and escalating levels of enforcement and sanctions. Furthermore, because the interpretation and application of laws, standards, contractual obligations and other obligations relating to privacy, data protection, and information security are uncertain, these laws, standards, and contractual and other obligations may be interpreted and applied in a manner that is, or is alleged to be, inconsistent with our data management practices, our policies or procedures, or the features of our solutions. If so, in addition to the possibility of fines, lawsuits, and other claims, we could be required to fundamentally change our business activities and practices or modify our solutions, which could have an adverse effect on our business. We may be unable to make such changes and modifications in a commercially reasonable manner or at all, and our ability to fulfill existing obligations, make enhancements, or develop new solutions and features could be limited. Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations, and policies that are applicable to the businesses of our customers may limit the use and adoption of, and reduce the overall demand for, our solutions. 46 Table of Contents These existing and proposed laws and regulations can be costly to comply with and can make our solutions and services less effective or valuable, delay or impede the development of new products, result in negative publicity, increase our operating costs, require us to modify our data handling practices, limit our operations, impose substantial fines and penalties, require significant management time and attention, or put our data or technology at risk. Any failure or perceived failure by us or our solutions to comply with U.S., or applicable foreign laws, regulations, directives, policies, industry standards, or legal obligations relating to privacy, data protection, or information security, or any security incident that results in loss of or the unauthorized access to, or acquisition, use, release, or transfer of, personal information, personal data, or other customer or sensitive data sensitive data or information may result in governmental investigations, inquiries, enforcement actions and prosecutions, private claims and litigation, indemnification or other contractual obligations, other remedies, including fines or demands that we modify or cease existing business practices, or adverse publicity, and related costs and liabilities, which could significantly and adversely affect our business and results of operations. Changes in accounting principles or their application to us could result in unfavorable accounting charges or effects, which could adversely affect our results of operations and growth prospects. We prepare consolidated financial statements in accordance with U.S. generally accepted accounting principles (“GAAP”). In particular, we make certain estimates and assumptions related to the adoption and interpretation of these principles including the recognition of our revenue and the accounting of our stock-based compensation expense with respect to our consolidated financial statements. If these assumptions turn out to be incorrect, our revenue or our stock-based compensation expense could materially differ from our expectations, which could have a material adverse effect on our financial results. A change in any of these principles or guidance, or in their interpretations or application to us, may have a significant effect on our reported results, as well as our processes and related controls, and may retroactively affect previously reported results or our forecasts, which may negatively impact our financial statements. For example, recent new standards issued by the Financial Accounting Standards Board could materially impact our consolidated financial statements . The adoption of these new standards may potentially require enhancements or changes in our processes or systems and may require significant time and cost on behalf of our financial management. This may in turn adversely affect our results of operations and growth prospects. If our judgments or estimates relating to our critical accounting policies are based on assumptions that change or prove to be incorrect, our results of operations could fall below expectations of securities analysts and investors, resulting in a decline in our stock price. The preparation of our consolidated financial statements in conformity with GAAP requires management to make judgments, estimates, and assumptions that affect the amounts reported in the consolidated financial statements and accompanying notes. We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, the results of which form the basis for making judgments about the carrying values of assets, liabilities, and equity, and the amount of revenue and expenses that are not readily apparent from other sources. Our results of operations may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our results of operations to fall below the expectations of securities analysts and investors, resulting in a decline in the trading price of our common stock. Significant judgments, estimates, and assumptions used in preparing our consolidated financial statements include, or may in the future include, those related to revenue recognition, stock-based compensation, common stock valuations, and income taxes. 47 Table of Contents A novel strain of coronavirus, COVID-19, may adversely affect our future business operations, financial condition and our ability to execute on business or contract opportunities. In December 2019, an outbreak of COVID-19 was reported in Wuhan, China. On March 11, 2020, the World Health Organization declared COVID-19 a global pandemic and on March 13, 2020, President Donald J. Trump declared the virus a national emergency. This highly contagious disease has spread to most of the countries in the world and throughout the United States, creating a serious impact on customers, workforces, and suppliers, disrupting economies and financial markets, and potentially leading to a world-wide economic downturn. It has caused a disruption of the normal operations of many businesses, including the temporary closure or scale-back of business operations and/or the imposition of either quarantine or remote work or meeting requirements for employees, either by government order or on a voluntary basis. The pandemic may adversely affect our customers’ ability to perform their missions and is in many cases disrupting their operations. It may also impact the ability of our subcontractors, partners, and suppliers to operate and fulfill their contractual obligations, and result in an increase in their costs and cause delays in performance. These supply chain effects, and the direct effect of the virus and the disruption on our operations, may negatively impact both our ability to meet customer demand and our revenue and profit margins. Our employees, in some cases, are working remotely due either to safety concerns or to customer imposed limitations and using various technologies to perform their functions. We could see delays or changes in customer demand, particularly if government funding priorities change. Additionally, the disruption and volatility in the global and domestic capital markets may increase the cost of capital and limit our ability to access capital. Both the health and economic aspects of COVID-19 are highly fluid and the future course of each is uncertain. For these reasons and other reasons that may come to light if the coronavirus pandemic and associated protective or preventative measures expand, we may experience a material adverse effect on our business operations, revenues and financial condition, and our ability to execute on business or contract opportunities, including the TSA PreCheck TM enrollment program; however, its ultimate impact is highly uncertain and subject to change.