TELOS CORP 10-Q

Item 2. Management’s Discussion and Analysis of Financial Condition and Results of Operations Forward-Looking Statements This Quarterly Report on Form 10-Q contains forward-looking statements. For this purpose, any statements contained herein that are not statements of historical fact may be deemed to be forward-looking statements. Without limiting the foregoing, the words “believes,” “anticipates,” “plans,” “expects” and similar expressions are intended to identify forward-looking statements. There are a number of important factors that could cause the Company’s actual results to differ materially from those indicated by such forward-looking statements. These factors include, without limitation, those set forth in the risk factors section included in the Company’s Form 10-K for the year ended December 31, 2021, as filed with the SEC. General and Business Overview We offer technologically advanced, software-based security solutions that empower and protect the world’s most security-conscious organizations against rapidly evolving, sophisticated and pervasive threats. Our portfolio of security products, services, and expertise empower our customers with capabilities to reach new markets, serve their stakeholders more effectively, and successfully defend the nation or their enterprise. We protect our customers’ people, information, and digital assets so they can pursue their corporate goals and conduct their global missions with confidence in their security and privacy. Our mission is to protect our customers’ people, systems, and vital information assets with offerings for cybersecurity, cloud security, and enterprise security. In the current global environment, our mission is more critical than ever. The emergence of each new information and communications technology introduces new vulnerabilities, as security is still too often overlooked in solution development. Networks and applications meant to enhance productivity and profitability often jeopardize an organization due to poor planning, misconfiguration, or an unknown gap in security. Ransomware, insider threats, cybercrime, and advanced persistent threats continue to menace public and private enterprises across all industries. Cybersecurity, cloud security, and enterprise security of the modern organization share much in common, yet also call for a diverse range of skills, capabilities, and experience in order to meet the requirements of security-conscious customers. Decades of experience in developing, orchestrating, and delivering solutions across these three domains give us the vision and the confidence to provide solutions that empower and protect the enterprise at an integrated, holistic level. Our experience in addressing challenges in one area of an enterprise helps us meet requirements in others. We understand that a range of complementary capabilities may be needed to solve a single challenge, and we also recognize when a single solution might address multiple challenges. Our security solutions span across these three domains. As a result of the change in our organization and leadership structure in the fourth quarter of 2021, we established and operate in two reportable segments – Security Solutions and Secure Networks. Security Solutions Security Solutions, which focuses on cybersecurity, cloud and identity solutions, includes Information Assurance, Secure Communications, and Telos ID. Cybersecurity solutions help our customers ensure the ongoing security, integrity, and compliance of their on-premises and related cloud-based systems by reducing threats and vulnerabilities to foil cyber adversaries before they can attack. Our security engineers and subject matter experts assess our customers’ cybersecurity environments and design, engineer, and operate systems needed to strengthen their cybersecurity posture. Our cloud solutions leverage the specialized skills and experience needed to help our customers plan, engineer, execute and accelerate secure cloud migrations while assuring ongoing management and security of enterprise cloud technology environments. Our identity solutions deliver digital identity, biometric, and nationwide enrollment services and address Know Your Customer and identity management challenges for enterprises working within regulated and critical infrastructure environments. • Information Assurance ◦ Xacta : a premier platform for enterprise cyber risk management and security compliance automation, delivering security awareness for systems in the cloud, on-premises, and in hybrid and multi-cloud environments. Xacta delivers automated cyber risk and compliance management solutions to large commercial and government enterprises. Across the U.S. federal government, Xacta is the de facto commercial cyber risk and compliance management solution. 20 Table of Contents • Secure Communications: ◦ Telos Ghost: a virtual obfuscation network-as-a-service with encryption and managed attribution capabilities to ensure the safety and privacy of people, information, and resources on the network. Telos Ghost seeks to eliminate cyberattack surfaces by obfuscating and encrypting data, masking user identity and location, and hiding network resources. It provides the additional layers of security and privacy needed for intelligence gathering, cyber threat protection, securing critical infrastructure, and protecting communications and applications when operations, property, and even lives can be jeopardized by a single error in security. ◦ Telos Advanced Cyber Analytics ("ACA") : a solution-as-a-service that delivers timely, accurate, actionable intelligence at speed and scale to illuminate threats to enterprise assets. It enables organizations to detect malicious activity earlier and to uncover and identify previously unknown attacks and new malicious behavior. Further, it assists in the attribution of events and provides sophisticated and comprehensive analytics without expensive overhead. ◦ Telos Automated Message Handling System (“AMHS”): web-based organizational message distribution and management for mission-critical communications; the recognized gold standard for organizational messaging in the U.S. government. Telos AMHS is used by military field operatives for critical communications on the battlefield and is the only web-based solution for assured messaging and directory services using the Defense Information System Agency's Organizational Messaging Service and its specialized communications protocols. • Telos ID: offering identity trust and digital services through IDTrust360 ® – an enterprise-class digital identity risk platform for extending flexible hybrid cloud identity services. This platform is enabled for mobile, enterprise environments and custom digital identity services that mitigate threats through the integration of advanced technologies that fuse biometrics, credentials, and other identity-centric data used to continuously monitor trust. In April 2021, we announced the acquisition of the assets of DFT, whose ONYX ® touchless mobile fingerprint software is being integrated with the IDTrust360 platform. We maintain government certifications and designations that distinguish Telos ID, including TSA PreCheck ® enrollment provider, Designated Aviation Channeling provider, FBI-approved Channeler, and Financial Industry Regulatory Authority Electronic Fingerprint Submission provider. Secure Networks Secure Networks focuses on enterprise security. Secure Networks provides secure networking architectures and solutions to the DoD, the federal Intelligence Community and other federal government agencies. Our net-centric solutions enable collaboration and connectivity in order to increase efficiency, reduce costs, and improve mission outcomes. We provide an extensive range of wired and wireless, fixed and deployable, classified and unclassified voice, data, and video secure network solutions and services to support defense and civilian missions. Capabilities include network design, operations and sustainment; system integration and engineering; network security and compliance; deployable comms; robotic process automation and other digital transformation capabilities; service desk; defensive cyber operations; and program management. • Secure Mobility: solutions for business and government that enable remote work and minimize operational and security concerns across and beyond the enterprise. Our secure mobility team brings credentials to every engagement, supplying deep expertise and experience as well as highly desirable clearances and industry-recognized certifications for network engineering, mobility, and security. • Network Management and Defense: services for operating, administrating, and defending complex enterprise networks and for defensive cyber operations. Our diverse portfolio of network management and defense capabilities addresses common and uncommon requirements in many industries and disciplines, ranging from the military and government agencies to Fortune 500 companies. Business Environment Our business performance continues to be heavily affected by the overall level of U.S. government spending and the alignment of our solutions with the priorities of the U.S. government. U.S. government spending and contracts continue to be affected by the federal budget and appropriations process and related legislation. 21 Table of Contents Congress could not agree on fiscal year ("FY") 2023 appropriations legislation before the start of the fiscal year on October 1, 2022. As a result, the entire federal government is currently operating under the terms of a continuing resolution ("CR"), which only permits agencies to spend at FY 2022 appropriations levels without any adjustments for the dramatic increase in inflation we have seen over the past year. Moreover, federal departments and agencies are generally precluded from moving forward on new contract starts or accelerating current projects while they are funded by a CR. The current CR runs through December 16, 2022, and it is not clear at this time whether Congress will be able to come to an agreement on appropriations legislation for FY 2023 by then or will have to pass another CR, possibly lasting into January or February 2023. Such continued delays in finalizing FY 2023 appropriations could, in turn, impact future planning by Telos and our government customers. The President’s FY 2023 budget request called for approximately 4% more defense spending than was provided for FY 2022. However, this proposed FY 2023 budget was developed before Russia invaded Ukraine and did not include expenditures related to that ongoing event. The proposed FY 2023 budget also assumed an inflation rate for DoD of 2.2%, which Pentagon officials subsequently acknowledged would need to be adjusted higher. There is significant congressional support for boosting defense spending further to account for these factors and other needs, as demonstrated by the House and Senate versions of the FY 2023 National Defense Authorization Act, which call for authorizing appropriations of $37 billion (House) and $45 billion (Senate) more than proposed by the President’s budget. Actual final appropriations levels for national defense will not be determined until December, at the earliest. The proposed FY 2023 budget also called for an increase in federal civilian agency (non-defense) cybersecurity funding of nearly 11%. The Biden Administration says it is seeking to increase investments across the various civilian federal agencies to help align them to the cybersecurity practices and priorities outlined in the President’s Executive Order 14028, “Improving the Nation’s Cybersecurity.” As with overall defense spending, final appropriations levels for non-defense cybersecurity efforts will not be determined until December, at the earliest. An exception to this is the new four-year, $1 billion State and Local Cybersecurity Grant program, which has already been appropriated and the first year’s funding is now available. Looking ahead to next year, the Office of Management and Budget ("OMB") has already given federal departments and agencies guidance for cybersecurity priorities to include in their FY 2024 proposed budgets. OMB has directed that agencies prioritize accelerated adoption of the cloud, IT modernization, further private sector collaboration for sector risk management responsibilities and ensuring adequate cyber threat information sharing, and supply chain risk management. These priorities align with the solutions Telos has been developing and bringing to market for the past several years. For example, Xacta, our flagship offering, continues to set the standard for innovative capabilities in managing cyber risk and automating continuous compliance in on-premises, cloud, and hybrid environments. Our cloud practice area includes cloud migration, CloudSecOps, and cloud security compliance to accelerate IT modernization for business and government. Our Telos ACA platform combines decades of information security experience with an extensive background in cyber intelligence to defend enterprises against advanced cyber threats. Cybersecurity Landscape In recent years, continuing and increasingly damaging ransomware and other cyberattacks against federal, state and local governments, K-12 and higher education, and private sector enterprises have resulted in intensified efforts to better defend against such attacks. The growing demand for these solutions continues to provide Telos with the privilege of offering our expertise to protect these vitally important organizations. Ransomware remains arguably the most severe cyber threat to enterprises in the commercial, state, and local government and education sectors. Our Xacta offering empowers these organizations and institutions to maintain a strong cyber risk posture to minimize the risk of ransomware gaining a foothold in their IT environment. Our Telos ACA offering provides real- and near-real-time intelligence into known and unknown threats to give organizations advance warning of ransomware and other threats. Should ransomware get loose in the enterprise network, Telos Ghost, our virtual obfuscation network offering, can hide vital resources from view to prevent the payload from reaching them. Critical infrastructure and industrial internet of things ("IoT") are among the categories at greatest risk of cyberattacks. Energy, utilities, financial services, and healthcare were among the critical infrastructure sectors that experienced high-profile breaches or ransomware attacks over the past year. Telos Ghost can hide critical IoT and industrial control systems from the public internet to keep them from being compromised. Telos Ghost can also cordon off financial data, medical records, intellectual property, and other crown-jewel assets from visibility or accessibility by adversaries. These capabilities are increasingly important, as threat actors continue to breach enterprise networks in spite of access management systems such as virtual private networks and multi-factor authentication. Telos Ghost creates an additional layer of defense against intruders by hiding critical records, information, and applications as well as their users in an anonymous undiscoverable network. Adversaries cannot see them, so they cannot hack them. This also makes Telos Ghost a robust component in a Secure Access Service Edge or Zero Trust Network Access security architecture. 22 Table of Contents Government mandates and initiatives to assure stronger security in highly regulated industries, as noted above, also lead to opportunities for Telos solutions and services. An update to the research study Telos conducted last year reveals that audit fatigue continues to burden these organizations, with automation solutions being recognized as the most effective remedy for the many repetitive and redundant tasks that security compliance requires. Xacta streamlines, harmonizes, and automates the security controls and processes that comprise the leading cybersecurity standards and frameworks, in on-premises, cloud, hybrid, and multi-cloud environments. For example, Xacta supports Federal Risk and Authorization Management Program ("FedRAMP") authorization, allowing all process participants to collaborate within the same Xacta application to attain a FedRAMP Authority to Operate. Xacta is also a trailblazer in deploying the Open Security Controls Assessment Language, a multi-format framework adopted by FedRAMP to allow security professionals to automate security assessment, auditing, and continuous monitoring processes. The DoD’s emerging Cybersecurity Maturity Model Certification ("CMMC") program is intended to ensure that members of the defense supply chain are applying sound cybersecurity practices in order to protect sensitive unclassified information. Because CMMC 2.0 is still an evolving standard, the flexible Xacta for CMMC offering enables Defense Industrial Base customers to conduct preliminary CMMC compliance audits that assess the maturity level required today as well as build a roadmap to future maturity level requirements. Telos is also a Cyber AB Registered Provider Organization ™ , authorized by The Cyber AB to provide consulting services to government contractors and other companies in preparation for their CMMC assessments. Finally, CISOs with today’s cost-conscious enterprises are under increasing pressure to provide evidence that their security strategies yield a return on investment. Xacta’s latest cyber risk quantification capabilities meet this need, allowing our customers to calculate inherent risk likelihood, impact, and criticality, shown in a graphic display that illustrates real-time risk posture and visualizes progress over time. In addition, customers can also define their own financial loss formula for customer-specific risk analysis in dollar amounts. COVID-19 Pandemic With much of the business of government still being conducted by federal employees working remotely through the use of information technology systems, we believe there will continue to be a need on the part of the government for the types of solutions and services provided by Telos. Backlog Backlog is a useful measure in developing our annual budgeted revenue by estimating for the upcoming year, our continuing business from existing customers and active contracts. We consider backlog, both funded and unfunded (as explained below), other expected annual renewals, and expansion planned by our current customers. Total backlog consists of the aggregate contract revenues remaining to be earned by us at a given time over the life of our contracts, whether funded or unfunded. Funded backlog consists of the aggregate contract revenues remaining to be earned at a given time, which, in the case of U.S. government contracts, means that they have been funded by the procuring agency. Unfunded backlog is the difference between total backlog and funded backlog and includes potential revenues that may be earned if customers exercise delivery orders and/or renewal options to continue these contracts. Based on historical experience, we generally assume option year renewals to be exercised. Most of our customers fund contracts on the basis of one year or less, and, as a result, funded backlog is generally expected to be earned within one year from any point in time, whereas unfunded backlog is expected to be earned over a longer period. Financial Overview TSA PreCheck ® Update On October 18, 2022, TSA issued an authority to operate to Telos ID for Telos’ PreCheck ® System. With TSA approval, Telos is providing its TSA PreCheck ® enrollment services for a trial period to a limited population of applicants in order to validate systems and processes in advance of its full implementation as an authorized TSA PreCheck ® enrollment provider. Once Telos successfully completes its trial period to the satisfaction of TSA, Telos will launch its services to the public more widely. Telos continues to anticipate this launch will occur in calendar year 2022. 23 Table of Contents Results of Operations Table MD&A 1: Results of Operations For the Three Months Ended For the Nine Months Ended September 30, 2022 September 30, 2021 September 30, 2022 September 30, 2021 (in thousands) Revenue $ 63,593 68,981 169,544 178,383 Cost of sales 42,648 44,104 108,799 116,502 Gross profit 20,945 24,877 60,745 61,881 Gross margin 32.9 % 36.1 % 35.8 % 34.7 % Selling, general and administrative expenses 28,614 29,965 95,314 97,935 Selling, general and administrative expenses as percentage of revenue 45.0 % 43.4 % 56.2 % 54.9 % Operating loss (7,669) (5,088) (34,569) (36,054) Other income/(expense) 518 20 648 (1,001) Interest expense (181) (195) (558) (583) Loss before income taxes (7,332) (5,263) (34,479) (37,638) (Provision for)/benefit from income taxes (8) 41 (133) (6) Net loss $ (7,340) $ (5,222) $ (34,612) $ (37,644) Company Results We generate revenue from the delivery of products and services to our customers. The discussion of material changes in our net revenue should be read in conjunction with the subsequent discussion of changes in our consolidated cost of sales and our business segment results of operations. Cost of sales, for both services and products, consists of material, labor, subcontracting costs and an allocation of indirect costs. Three Months Ended September 30, 2022, Compared with Three Months Ended September 30, 2021 For the three months ended September 30, 2022, revenue decreased by $5.4 million, or 7.8%, compared to the same period in 2021. The decrease in revenue was primarily due to a large program that ended in 2021 within Security Solutions and the expected wind-down of large programs within Secure Networks. Cost of sales decreased by $1.5 million, or 3.3%, for the third quarter of 2022 compared to the same period in 2021, primarily as a result of decreased revenue, reduced costs across the Secure Networks portfolio, and revenue mix, offset by increased investment in a single large program in Security Solutions. Gross profit decreased by $3.9 million, or 15.8%, in the third quarter of 2022 compared to the same period in 2021. Gross margin decreased from 36.1% to 32.9% for the third quarter of 2022 compared to the same period in 2021. This is primarily due to higher investment in a single large program in Security Solutions, offset by higher gross margins in Secure Networks due to broad-based margin performance across the portfolio, and a slight shift in revenue mix towards Security Solutions. Selling, general, and administrative (“SG&A”) expenses decreased by $1.4 million, or 4.5%, in the third quarter of 2022 compared to the same period in 2021, primarily attributable to the cost actions, offset by an increase in stock-based compensation. Operating loss was $7.7 million for the third quarter of 2022, compared to $5.1 million for the same period in 2021, primarily due to the decrease in gross profit in the third quarter of 2022, as mentioned above, offset by the decrease in SG&A expenses. There were no significant changes in interest expense, and other income and expenses between the comparable periods. The change in the income tax provision for the third quarter of 2022 compared to the same period in 2021 is based on the estimated annual effective tax rate applied to the pretax loss incurred for the quarter plus discrete tax items, based on our expectation of pretax loss for the fiscal year. Net loss was $7.3 million for the third quarter of 2022, compared to $5.2 million for the same period in 2021, primarily due to the decrease in gross profit, offset by the decrease in SG&A expenses. 24 Table of Contents Nine Months Ended September 30, 2022, Compared with Nine Months Ended September 30, 2021 Revenue decreased by $8.8 million, or 5.0%, during the nine months ended September 30, 2022 compared to the same period in 2021. The decrease is the result of the end of a large program in 2021 in Security Solutions and the expected wind-down of large programs in Secure Networks, offset by other increases across the portfolio. Cost of sales decreased by $7.7 million, or 6.6%, for the nine months ended September 30, 2022, compared to the same period in 2021, primarily as a result of decreased revenue, reduced costs across the portfolio, and revenue mix. Gross profit decreased by $1.1 million, or 1.8%, for the nine months ended September 30, 2022, compared to the same period in 2021. Gross margin increased from 34.7% to 35.8% for the comparable periods due to broad-based margin performance across the portfolio and a shift in revenue mix toward Security Solutions. SG&A expense decreased by 2.7% to $95.3 million for the nine months ended September 30, 2022, from $97.9 million for the same period in 2021, primarily due to reduced stock-based compensation. Operating loss was $34.6 million for the nine months ended September 30, 2022, compared to $36.1 million for the same period in 2021, primarily due to the decreases in SG&A expense, offset by the decrease in gross profit described above. Other expense of $1.0 million for the nine months ended September 30, 2021, was attributable to an accrual for a litigation settlement agreement, with no similar cost in 2022. There was no significant change in interest expense between comparable periods. The increase in the income tax provision for the nine months ended September 30, 2022, compared to the same period in 2021, is based on the estimated annual effective tax rate applied to the pretax loss incurred for the nine months plus discrete tax items, based on our expectation of pretax loss for the fiscal year. Net loss was $34.6 million for the nine months ended September 30, 2022, compared to $37.6 million for the same period in 2021, primarily attributable to the decrease in SG&A expenses coupled by the change in other expenses mentioned above, offset by the decrease in gross profit. Segment Results The accounting policies of each business segment are the same as those followed by the Company as a whole. Management evaluates business segment performance based on gross profit. Table MD&A 2: Security Solutions Segment - Financial Results For the Three Months Ended For the Nine Months Ended September 30, 2022 September 30, 2021 September 30, 2022 September 30, 2021 (in thousands) Revenue $ 32,440 $ 34,558 $ 90,178 $ 89,624 Gross profit $ 15,577 $ 19,517 $ 47,062 $ 46,032 Gross margin 48.0 % 56.5 % 52.2 % 51.4 % For the three months ended September 30, 2022, Security Solutions' revenue decreased by $2.1 million, or 6.1%, compared to the same period in 2021. The reduction was primarily attributable to a large program that ended in 2021 and a decrease in another large program within the portfolio. Security Solutions' gross profit for the third quarter of 2022 decreased by $3.9 million, or 20.2%, compared to the same period in 2021. Gross margin for the quarter decreased from 56.5% in 2021 to 48.0% in 2022 due to higher investment in a single large program and revenue mix shift within the portfolio. Revenue for the nine months ended September 30, 2022, slightly increased by $0.6 million, or 0.6%, compared to the same period in 2021. This is due to broad based increases across the segment portfolio, offset by a decrease in revenue from a program that ended in 2021. Security Solutions' gross profit for the nine months ended September 30, 2022, increased by $1.0 million, or 2.2%, compared to the same period in 2021. Segment gross margin also increased from 51.4% in 2021 to 52.2% in 2022. The segment's profitability improvement was primarily due to a revenue mix shift within the business, along with some minor margin improvements in certain portions of the portfolio. 25 Table of Contents Table MD&A 3: Secure Networks Segment - Financial Results For the Three Months Ended For the Nine Months Ended September 30, 2022 September 30, 2021 September 30, 2022 September 30, 2021 (in thousands) Revenue $ 31,153 $ 34,423 $ 79,366 $ 88,759 Gross profit $ 5,368 $ 5,360 $ 13,683 $ 15,849 Gross margin 17.2 % 15.6 % 17.2 % 17.9 % Secure Networks' revenue for the third quarter of 2022 decreased by $3.3 million, or 9.5%, compared to the same period in 2021. This was driven by the expected wind-down of large programs within the portfolio. While revenue decreased in the third quarter of 2022, Secure Networks' gross profit remained at approximately $5.4 million during the comparable periods. Segment gross margin increased between comparable periods from 15.6% in 2021 to 17.2% in 2022 due to broad-based margin performance across the portfolio. For the nine months ended September 30, 2022, Secure Networks' revenue decreased by $9.4 million, or 10.6%, compared to the same period in 2021, due to the expected wind-down of large programs. Gross profit for Secure Networks for the nine months ended September 30, 2022, decreased by $2.2 million, or 13.7%, compared to the same period in 2021, primarily as a result of the decline in year-to-date segment revenue. Segment gross margin decreased between comparable periods from 17.9% in 2021 to 17.2% in 2022 due to minor margin reductions across the portfolio. Non-GAAP Financial Measures In addition to our results determined in accordance with GAAP, we believe the non-GAAP financial measures of Enterprise EBITDA, Adjusted EBITDA, Adjusted EBITDA Margin, Adjusted Net Income (Loss), Adjusted Earnings Per Share ("EPS") and Free Cash Flow are useful in evaluating our operating performance. We believe that this non-GAAP financial information, when taken collectively with our GAAP results, may be helpful to readers of our financial statements because it provides consistency and comparability with past financial performance and assists in comparisons with other companies, some of which use similar non-GAAP financial information to supplement their GAAP results. The non-GAAP financial information is presented for supplemental informational purposes only, should not be considered a substitute for financial information presented in accordance with GAAP, and may be different from similarly titled non-GAAP measures used by other companies. A reconciliation is provided below for each of these non-GAAP financial measures to the most directly comparable financial measure stated in accordance with GAAP. We use the following non-GAAP financial measures to understand and evaluate our core operating performance and trends, to prepare and approve our annual budget, to develop short-term and long-term operating plans, and to evaluate the performance of certain management personnel when determining incentive compensation. We believe these non-GAAP financial measures facilitate comparison of our operating performance on a consistent basis between periods by excluding certain items that may, or could, have a disproportionately positive or negative impact on our results of operations in any particular period. When viewed in combination with our results prepared in accordance with GAAP, these non-GAAP financial measures help provide a broader picture of factors and trends affecting our results of operations. Enterprise EBITDA, Adjusted EBITDA and Adjusted EBITDA Margin Enterprise EBITDA, Adjusted EBITDA and Adjusted EBITDA Margin are supplemental measures of operating performance that are not made under GAAP and that do not represent, and should not be considered as an alternative to net (loss) income and net (loss) income margin, as determined by GAAP. We define Enterprise EBITDA as net (loss) income, adjusted for non-operating expense (income), interest expense, provision for (benefit from) income taxes, and depreciation and amortization. We define Adjusted EBITDA as Enterprise EBITDA, adjusted for stock-based compensation expense. We define Adjusted EBITDA margin as adjusted EBITDA as a percentage of total revenue. 26 Table of Contents Table MD&A 4: Reconciliation of Net Loss to Enterprise EBITDA, Adjusted EBITDA and Adjusted EBITDA Margin For the Three Months Ended For the Nine Months Ended September 30, 2022 September 30, 2021 September 30, 2022 September 30, 2021 Amount Margin Amount Margin Amount Margin Amount Margin (in thousands) Net loss $ (7,340) (11.5) % $ (5,222) (7.6) % $ (34,612) (20.4) % $ (37,644) (21.1) % Adjustments: Non-operating (income)/expense (518) (0.8) % (20) — % (648) (0.4) % 1,001 0.6 % Interest expense 181 0.3 % 195 0.3 % 558 0.3 % 583 0.3 % Provision for/(benefit from) income taxes 8 — % (41) — % 133 0.1 % 6 — % Depreciation and amortization 1,517 2.4 % 1,459 2.1 % 4,427 2.6 % 4,223 2.4 % Enterprise EBITDA (6,152) (9.6) % (3,629) (5.2) % (30,142) (17.8) % (31,831) (17.8) % Stock-based compensation expense (1) 14,721 23.1 % 12,372 17.9 % 44,225 26.1 % 47,378 26.5 % Adjusted EBITDA $ 8,569 13.5 % $ 8,743 12.7 % $ 14,083 8.3 % $ 15,547 8.7 % (1) The stock-based compensation adjustment to EBITDA for the three and nine months ended September 30, 2022, is made up of $15.0 million and $42.2 million, respectively, of stock-based compensation expenses for the awarded RSUs and PRSUs, and $(0.3) million and $2.0 million, respectively, of other sources of stock-based compensation (adjustment)/expense. The other source of stock-based compensation consists of accrued compensation, which the Company intends to settle in shares of the Company's common stock. However, it is the Company's discretion whether this compensation will ultimately be paid in stock or cash. The Company has the right to dictate the form of these payments up until the date at which they are paid. Any change to the expected payment form would result in a change of estimate that would add back to Adjusted EBITDA. Adjusted Net Income (Loss) and Adjusted EPS Adjusted Net Income (Loss) and Adjusted EPS are supplemental measures of operating performance that are not made under GAAP and that do not represent, and should not be considered as an alternatives to net income (loss) and earnings (loss) per share, as determined by GAAP. We define Adjusted Net Income (Loss) as net income (loss), adjusted for non-operating expense (income) and stock-based compensation expense. We define Adjusted EPS as Adjusted Net Income (Loss) divided by the weighted-average number of common shares outstanding for the period. Table MD&A 5: Reconciliation of Net Loss to Adjusted Net Income and Adjusted EPS For the Three Months Ended For the Nine Months Ended September 30, 2022 September 30, 2021 September 30, 2022 September 30, 2021 Adjusted Net Income/(Loss) Adjusted Per Share Adjusted Net Income/(Loss) Adjusted Per Share Adjusted Net Income/(Loss) Adjusted Per Share Adjusted Net Income/(Loss) Adjusted Per Share (in thousands, except per share data) Reported GAAP measure $ (7,340) $ (0.11) $ (5,222) $ (0.08) $ (34,612) $ (0.51) $ (37,644) $ (0.57) Adjustments: Non-operating (income)/ expense (518) (0.01) (20) — (648) (0.01) 1,001 0.01 Stock-based compensation expense (2) 14,721 0.22 12,372 0.19 44,225 0.65 47,378 0.72 Adjusted non-GAAP measure $ 6,863 $ 0.10 $ 7,130 $ 0.11 $ 8,965 $ 0.13 $ 10,735 $ 0.16 Weighted-average shares of common stock outstanding 67,493 66,755 67,641 65,999 (2) The stock-based compensation adjustment to net loss for the three and nine months ended September 30, 2022, is made up of $15.0 million and $42.2 million, respectively, of stock-based compensation expenses for the awarded RSUs and PRSUs, and $(0.3) million and $2.0 million, respectively, of other sources of stock-based compensation (adjustment)/expense. The other source of stock-based compensation consists of accrued compensation, which the Company intends to settle in shares of the Company's common stock. However, it is the Company's discretion whether this compensation will ultimately be paid in stock or cash. The Company has the right to dictate the form of these payments up until the date at which they are paid. Any change to the expected payment form would result in a change in estimate that would add back to Adjusted Net Income/(Loss). Free Cash Flow Free cash flow, as reconciled in the table below, is a non-GAAP financial measure defined as net cash provided by or used in operating activities, less purchases of property and equipment and capitalized software development costs. This non-GAAP financial measure may be a useful measure for investors and other users of our financial statements as a supplemental measure of our cash performance and to assess the quality of our earnings as a key performance measure in evaluating management. 27 Table of Contents Table MD&A 6: Free Cash Flow For the Three Months Ended For the Nine Months Ended September 30, 2022 September 30, 2021 September 30, 2022 September 30, 2021 (in thousands) Net cash flows provided by operating activities $ 11,986 $ 12,991 $ 20,118 $ 9,637 Adjustments: Purchase of property and equipment (174) (575) (815) (1,645) Capitalized software development costs (3,446) (3,009) (8,580) (6,672) Free cash flow $ 8,366 $ 9,407 $ 10,723 $ 1,320 Enterprise EBITDA, Adjusted EBITDA, Adjusted EBITDA Margin, Adjusted Net Income (Loss), Adjusted EPS and Free Cash Flow each has limitations as an analytical tool, and you should not consider any of them in isolation, or as a substitute for analysis of our results as reported under GAAP. Among other limitations, Enterprise EBITDA, Adjusted EBITDA, Adjusted EBITDA Margin, Adjusted Net Income (Loss), Adjusted EPS and Free Cash Flow each does not reflect our cash expenditures, or future requirements, for capital expenditures or contractual commitments, does not reflect the impact of certain cash charges resulting from matters we consider not to be indicative of our ongoing operations, and does not reflect income tax expense or benefit. Other companies in our industry may calculate Enterprise EBITDA, Adjusted EBITDA, Adjusted EBITDA Margin, Adjusted Net Income (Loss), Adjusted EPS and Free Cash Flow differently than we do, which limits their usefulness as a comparative measure. Because of these limitations, neither Enterprise EBITDA, Adjusted EBITDA, Adjusted EBITDA Margin, Adjusted Net Income (Loss), Adjusted EPS nor Free Cash Flow should be considered as a replacement for net income (loss), net income (loss) margin, earnings (loss) per share, or net cash flows provided by/ (used in) operating activities, as determined by GAAP, or as a measure of our profitability. We compensate for these limitations by relying primarily on our GAAP results and using non-GAAP measures only for supplemental purposes. Liquidity and Capital Resources Upon the closing of the IPO in November 2020, we issued 17.2 million shares of our common stock at a price of $17.00 per share, generating net proceeds of approximately $272.8 million. We used approximately $108.9 million of the net proceeds in connection with the exchangeable redeemable preferred stock conversion, $30.0 million to fund our acquisition of the outstanding Class B Units of Telos ID (see Note 10 – Purchase of Telos ID Non-controlling Interests ), and $21.0 million to repay our outstanding senior term loan and subordinated debt. On April 6, 2021, we completed our follow-on offering of 9.1 million shares of our common stock at a price of $33.00 per share, including 7.0 million shares of common stock by certain existing stockholders of Telos. The offering generated approximately $64.3 million of net proceeds to Telos. We did not receive any proceeds from the shares of common stock sold by the selling stockholders. On April 19, 2021, we used approximately $1.3 million of the net proceeds to repurchase 39,682 shares of our common stock and $26.9 million to repurchase 900,970 outstanding warrants for our common stock held by EnCap fund holders. Further, on July 30, 2021, we used approximately $5.9 million of the net proceeds to acquire the assets of DFT (see Note 9 – Acquisition ). We intend to use the remaining net proceeds of the IPO and the follow-on offering for general corporate purposes. Our overall financial position and liquidity are strong. Our working capital was $130.6 million and $140.8 million as of September 30, 2022, and December 31, 2021, respectively. Although no assurances can be given, we expect that funds generated from operations are sufficient to maintain the liquidity we require to meet our operating, investing and financing needs for the next 12 months. As of September 30, 2022, we had a cash and cash equivalent balance of $125.3 million, compared to $126.6 million on December 31, 2021. This balance gives us the flexibility for capital deployment while maintaining our focus on preserving a strong balance sheet to position us for future opportunities. We believe we have adequate funds on hand to execute our financial and operating strategy. Cash provided by operating activities was $20.1 million for the nine months ended September 30, 2022, compared to cash used in operating activities of $9.6 million for the same period in 2021. Cash provided by or used in operating activities is primarily driven by the Company’s operating loss, the timing of receipt of customer payments, the timing of our payments to vendors and employees, and the timing of inventory turnover, adjusted for certain non-cash items that do not impact cash flows from operating activities. Cash used in investing activities was approximately $9.4 million and $14.2 million for the nine months ended September 30, 2022, and 2021, respectively, primarily due to software development costs of $8.6 million and $6.7 million for the nine months ended September 30, 2022, and 2021, respectively, and the purchase of property and equipment. In addition, in 2021, $5.9 million was paid in cash for the acquisition completed in July 2021 (see Note 9 – Acquisition ). Cash used in financing activities was $11.8 million for the nine months ended September 30, 2022, compared to cash provided by financing activities of $32.7 million for the same period in 2021. This is primarily attributable to payments under finance leases for both periods, payments of tax withholding related to a net share settlement of equity awards of $3.1 million in 2022, and the repurchase of common stock of $7.6 million in 2022 under the share repurchase program (see Note 13 – Share Rep urchases ). By 28 Table of Contents contrast, in 2021, there was a cash inflow from the follow-on offering that generated $64.3 million of net proceeds, reduced by $2.4 million of final distributions to the Class B Members of Telos ID in the first quarter, $26.9 million used to repurchase the outstanding warrants and $1.3 million to repurchase the common stock held by EnCap fund holders. Critical Accounting Policies and Estimates The preparation of financial statements in conformity with accounting principles generally accepted in the U.S. requires us to make estimates, judgments, and assumptions that affect the amounts reported. Actual results could differ from those estimates. The 2021 Form 10-K, as filed with the SEC on March 28, 2022, includes a summary of critical accounting policies we believe are the most important to aid in understanding our financial results. There have been no changes to those critical accounting policies that have had a material impact on our reported amounts of assets, liabilities, revenues, or expenses during the nine months ended September 30, 2022. Item 3. Quantitative and Qualitative Disclosures about Market Risk None.