Item 1. Business
Item 1. Business
General Overview
Telos Corporation is a Maryland corporation headquartered in Ashburn, Virginia. Telos Corporation, together with its subsidiaries (the "Company" or "Telos" or "We"), offers technologically advanced, software-based security solutions that empower and protect the world's most security-conscious organizations against rapidly evolving, sophisticated and pervasive threats. Our portfolio of security products, services and expertise empowers our customers with capabilities to reach new markets, serve their stakeholders more effectively, and successfully defend the nation or their enterprise with confidence in their security and privacy.
Our mission is to protect our customers' people, information, and digital assets with offerings for cybersecurity, cloud security, and enterprise security. In the current global environment, our mission is more critical than ever. The emergence of each new information and communications technology ("ICT") introduces new vulnerabilities, as security is still too often overlooked in solution development. Networks and applications meant to enhance productivity and profitability often jeopardize an organization due to poor planning, misconfiguration, or an unknown gap in security. Ransomware, insider threats, cybercrime, and advanced persistent threats continue to menace public and private enterprises across all industries.
Cybersecurity, cloud security, and enterprise security of the modern organization share much in common, yet also call for a diverse range of skills, capabilities, and experience in order to meet the requirements of security-conscious customers. Decades of experience in developing, orchestrating, and delivering solutions across these three domains give us the vision and the confidence to provide solutions that empower and protect the enterprise at an integrated, holistic level. Our experience in addressing challenges in one area of an enterprise helps us meet requirements in others. We understand that a range of complementary capabilities may be needed to solve a single challenge, and we also recognize when a single solution might address multiple challenges. Our security solutions span these three domains: cybersecurity, cloud security and enterprise security.
Fiscal year 2023 was a transition year for Telos, with a focus on streamlining our operations while rebuilding and growing our revenue base by generating new business wins. Our 2023 business development priorities were to:
• Reorganize internally to consolidate and centralize business development resources;
• Add new talent to drive execution of solution development and new business generation;
• Maximize existing strategic partnerships for market expansion; and
• Increase our opportunity portfolio and quality of contract vehicles.
To improve our path forward, we planned to:
• Optimize our solution portfolio through accelerated plays on various programs and enhance program management;
• Expand our pipeline and strengthen proposals for new businesses; and
• Engage all employees through synergy, setting performance goals, and improving benefits.
Business Segments
We conduct our business through two reportable and operating segments: Security Solutions and Secure Networks. These segments enable the alignment of our strategies and objectives and provide a framework for the timely and rational allocation of resources within the line of business.
Additional information regarding our segments is presented in Note 1 8 – Segment Information to the consolidated financial statements at Item 8 of this Form 10-K.
5
Table of Contents
Security Solutions Segment:
The Security Solutions segment focuses on cybersecurity, cloud, identity solutions, and secure messaging. Cybersecurity solutions help our customers ensure the ongoing security, integrity and compliance of their on-premises and related cloud-based systems by reducing threats and vulnerabilities to foil cyber adversaries before they can attack. Our security engineers and subject matter experts assess our customers' cybersecurity environments and design, engineer, and operate systems needed to strengthen their cybersecurity postures. Our cloud solutions leverage the specialized skills and experience needed to help our customers plan, engineer, execute, and accelerate secure cloud migrations while assuring ongoing management and security of enterprise cloud technology environments. Our identity solutions deliver digital identity, biometric, and nationwide enrollment services and address Know Your Customer and identity management challenges for enterprises working within regulated and critical infrastructure environments. Our secure messaging services are used to securely transmit messages that provide direction and establish a formal position, commitment, or responses requiring the authority of an organization. Security Solutions represented 53.3% and 55.5% of total revenues for fiscal years 2023 and 2022, respectively.
The Security Solutions segment offers the following solutions and services:
• Information Assurance:
◦ Xacta ® : a premier platform for enterprise cyber risk management and security compliance automation, delivering security awareness for systems in the cloud, on-premises, and in hybrid and multi-cloud environments. Xacta delivers automated cyber risk and compliance management solutions to large commercial and government enterprises. Across the United States ("U.S.") federal government, Xacta is a leading commercial cyber risk and compliance management solution. With use cases including cyber risk management, risk remediation management, security authorization, compliance management, audit management, inventory management, vulnerability management, continuous compliance monitoring, and vendor and supply chain risk management, Xacta administers the key elements of more than 100 leading regulations and policies for IT security compliance, including the National Institute of Standards and Technology ("NIST") Risk Management Framework ("RMF"), RMF for Department of Defense ("DoD") IT, Committee on National Security Systems Instruction No. 1253, NIST Cybersecurity Framework, the Federal Risk and Authorization Management Program and the DoD's Cybersecurity Maturity Model Certification ("CMMC") program.
◦ Cybersecurity services : proven solutions and services for the full cybersecurity lifecycle, including consulting services, assessment and compliance, engineering and evaluation, operations, and penetration testing. With a pedigree in information and cybersecurity that spans three decades, our certified cybersecurity personnel provide services and solutions that deliver continuous security assurance for business, government, and critical infrastructure.
• Secure Communications:
◦ Telos Automated Message Handling System ("Telos AMHS"): web-based organizational message distribution and management for mission-critical communications; the recognized gold standard for organizational messaging in the U.S. government. Telos AMHS™ is used by military field operatives for critical communications on the battlefield using the Defense Information System Agency's Organizational Messaging Service and its specialized communications protocols. Telos AMHS is also used by the Intelligence Community ("IC") for timely situational awareness and assessment reporting utilizing the Director of National Intelligence's Information Transport Service, Organizational Messaging data standards and computing infrastructure. Because Telos AMHS supports timely and reliable delivery for authoritative communications, its uses include terrorist warnings, "eyes-only" messages, military execution orders, intelligence information, overflight clearances, and Emergency Action Messages for nuclear command and control. Information exchanged at this level and for these purposes requires operational requirements for time-sensitive, guaranteed delivery, precedence, high availability, and reliability.
◦ Telos Advanced Cyber Analytics ("Telos ACA") : a solution that is a dynamic, proprietary threat feed source of global Internet Protocol ("IP") addresses known to engage in potentially malicious activity, including mass scanning and generic opportunistic attacks. Telos ACA™ allows security operation centers the advantage of being able to reduce "noisy" IP security threat alerts and thereby increase operational efficiency, the ability to potentially identify forthcoming mass exploitation events, and the ability to improve the focus of ongoing threat hunts.
6
Table of Contents
Telos ACA leverages a sophisticated global sensor network of nodes that run 24/7/365 and analyzes and aggregates anomalous Internet activity in near real time. Telos ACA intelligence is seamlessly and conveniently delivered as an industry-standard Structured Threat Information eXpression/Trusted Automated eXchange of Intelligence Information ("STIX/TAXII") based threat feed. STIX states the "what" of threat intelligence, while TAXII defines "how" that information is relayed. STIX and TAXII are machine-readable and, therefore, easily automated. This allows for easy consumption into third-party security tools, where the threat feed can be used to enrich and provide relevant information related to potential malicious network activity within environments. Telos ACA provides the IP, metadata, and raw data elements to improve threat hunting and eliminate threat noise.
◦ Telos Ghost ® : a virtual obfuscation network-as-a-service with encryption and managed attribution capabilities to ensure the safety and privacy of people, information, and resources on the network. Telos Ghost seeks to eliminate cyberattack surfaces by obfuscating and encrypting data, masking user identity and location, and hiding network resources. It provides the additional layers of security and privacy needed for intelligence gathering, cyber threat protection, securing critical infrastructure, and protecting communications and applications when a single error in security can jeopardize operations, property, and even lives. Telos Ghost is used for a variety of highly sensitive applications, including cyber threat research, open-source intelligence, supply chain security vulnerability assessment, worldwide investigative and recovery services, and hiding critical assets.
• Digital Identity Solutions:
◦ IDTrust360 ® : an enterprise digital trusted identity risk platform for extending flexible hybrid cloud identity services. This platform is enabled for mobile, enterprise environments and custom digital identity services that mitigate threats by integrating advanced technologies that fuse biometrics, credentials, and other identity-centric data used to continuously monitor trust. IDTrust360 is a commercially owned and operated platform with direct interfaces to the Federal Bureau of Investigation's ("FBI") criminal records, Department of Homeland Security's ("DHS") terrorist watch list service, U.S. Department of Treasury's pay.gov, other government identity risk management systems, and numerous commercial identity, intelligence, and risk-based data sources. We actively engage with federal customers to integrate vital event records, government identification document records, and other fingerprint-based biometric records hosted across multiple agencies. This enables Telos to offer NIST-compliant digital identity services aligned with federal security mandates.
◦ ONYX ® : the world's first and most accurate touchless fingerprint biometric solution for mobile devices. Powered by state-of-the-art machine learning, ONYX eases deployment in a variety of industries, including financial services and healthcare, and applications like consumer authentication and physical access and security. Acquired by Telos in 2021, the patented and award-winning ONYX solution delivers touchless fingerprint biometrics that people can submit simply by using their mobile phones. In June 2022, ONYX won first place in the overall competition of the Mobile Fingerprint Information Technology Challenge hosted by the NIST.
We maintain government certifications and designations that distinguish Telos ID, including TSA PreCheck ® enrollment provider, Aviation Channeling Services ("ACS") provider, FBI-approved Channeler, and Financial Industry Regulatory Authority Electronic Fingerprint Submission provider.
Secure Networks Segment:
With a focus on enterprise security, the Secure Networks segment provides secure networking architectures and solutions to our customers through secure mobility solutions and network management and defense services. Our net-centric solutions enable collaboration and connectivity to increase efficiency, reduce costs, and improve mission outcomes. Telos provides an extensive range of wired and wireless, fixed and deployable, classified and unclassified voice, data, and video secure network solutions and services to support defense and civilian missions. Capabilities include network design, operations, and sustainment, system integration and engineering, network security and compliance, deployable comms, service desk, defensive cyber operations, and program management. Secure Networks represented 46.7% and 44.5% of total revenues for the years ended December 31, 2023 and 2022, respectively.
These are our solutions and services in our Secure Networks segment:
• Secure Mobility: solutions for business and government that enable remote work and minimize operational and security concerns across and beyond the enterprise. Our secure mobility team brings credentials to every engagement, supplying deep expertise and experience, highly desirable clearances and industry-recognized certifications for network engineering, mobility, and security. We also offer secure mobility professional services, such as consulting and deployment services, to deliver integrated communications solutions that meet even the most complex needs of civilian, defense, and commercial customers.
7
Table of Contents
• Network Management and Defense: services for operating, administrating, and defending complex enterprise networks and services for defensive cyber operations. Our diverse network management and defense capabilities address common and uncommon requirements in many industries and disciplines, from military to government agencies. Telos network engineers, security specialists, and program managers are experienced with advanced DoD and federal networks and are certified in the leading tools, technologies, and best practices for network management and administration. We ensure the consistency and continuity of network management services required in today's mission-critical network environments.
Our Growth Strategies
We are pursuing multiple strategies in order to grow the Company in both our commercial and government business end markets. Our key growth strategies include:
• Broaden reach within the U.S. federal government . We have historically focused on the U.S. federal government and believe we are an established leader in providing security solutions to federal agencies, including DoD and the IC. Nonetheless, we believe the U.S. federal government continues to represent a significant growth opportunity, and we expect to continue to invest in products and solutions to serve additional customers within the U.S. federal government.
For example, Xacta is included on DHS's Continuous Diagnostics and Mitigation Approved Products List to provide federal agencies with innovative security tools, which we believe presents us with an excellent opportunity to pursue contracts with additional federal agencies. In addition, our platform is available for use in the AWS GovCloud (U.S.), Oracle and Azure Government. The Telos ACA offering is positioned to supply unique data sets to government agencies, allowing them to be better informed as they defend and protect their networks and assets. Telos ACA is also positioned to provide government customers with specific, actionable and high-fidelity intelligence about malicious cyber activity targeted at their networks.
• Leverage our diverse security solutions to expand our presence in commercial markets . Our offerings are designed to have broad applications and include security risk and compliance, secure messaging, identity vetting, and managed attribution and obfuscation. We believe that we are well-positioned to sell our capabilities into a dynamic and growing commercial opportunity set and will continue innovating to address emerging and unique requirements.
For example, we have leveraged core Xacta functionality to meet the needs of large financial services and customer relationship management firms. We have also leveraged our U.S. federal government identity management qualifications to improve the speed and accuracy of vetting results for more than 100 airports, air carriers, and general aviation across the country. We intend to continue innovating and developing additional offerings for cloud, mobile, and Internet of Things ("IoT") devices.
• Target and replace inefficient legacy products . Recognizing the limitations of their legacy systems, organizations are replacing existing systems and processes with Telos solutions.
For example, Telos AMHS is a web-centric system that replaced legacy capabilities like communications centers for the purpose of executing operational orders (through organizational messaging) across the U.S. federal government and around the world. Xacta has disrupted the cyber risk and compliance management business across the U.S. federal government, replacing tedious manual activity with automation and delivering that automation to meet our customer's needs on-premises, in hybrid environments, in the cloud, and across multi-cloud infrastructures.
• Pursue strategic acquisition opportunities . We believe that our markets remain fragmented, with many niche players providing limited product solutions targeting narrow customer segments. Given the breadth of our solution set and our customer end markets, we believe that we are well-positioned to opportunistically acquire smaller companies and incorporate their technology or deploy their solutions across a larger customer set. We believe that a targeted and opportunistic acquisition strategy will be a force multiplier for our organic growth opportunity.
Customers
Our primary customers include the U.S. federal government, large commercial businesses, state and local governments, and international customers. Our consolidated revenues are largely attributable to prime contracts or to subcontracts with our contractors engaged in work for the U.S. government, with the remaining attributable to state and local governments, and commercial markets.
Our security solutions are the product of the extensive labor investment in developing our intellectual property and highly sophisticated software technology. These investments helped us expand with commercial customers, and win additional contracts within the military, the IC and civilian government agencies. Once our security solutions are embedded in our customers' technology infrastructure, these customer relationships often expand and lead to opportunities to provide additional security solutions.
8
Table of Contents
Our U.S. federal government customers include the DoD, the Central Intelligence Agency, and multiple other agencies within the IC, and multiple civilian agencies, including but not limited to, the DHS, the U.S. Department of State, the FBI, and the Department of Health and Human Services. These customers have a number of subsidiary agencies with separate budgets and procurement functions. Our contracts may be with the highest level of these agencies or with the subsidiary agencies of these customers.
Our commercial customers include leading enterprises such as Amazon.com, Inc., Google, Zscaler, Ernst & Young, Deloitte, Accenture, SAP, Verizon and Oracle.
Sales and Marketing
As part of our sales and marketing investments, we also make corporate investments in functional areas such as contracts, solution architects, lead generation tools, and operations to ensure our back-office systems and processes scale for business growth.
Sales
We expanded our sales capability for markets in which we are well known, such as the U.S. government, certain critical infrastructure sectors, and certain commercial verticals such as healthcare and financial services. We added commission incentivized sales personnel aligned to market segments focused on the U.S. federal government, the IC and the DoD market areas.
Customer acquisition often involves extensive interaction at all levels of an organization, from executives, to decision makers, to end users. We seek to forge relationships throughout an organization in an effort to obtain broad consensus as part of the sales process. We leverage the full power of Telos (executives, sales and industry partners) to gain access and build our brand awareness.
Our sales strategy is to establish a customer foothold with one of our solutions and work to achieve rapid success. We then leverage this customer relationship to generate interest in other solutions from the Telos portfolio. We have a variety of upsell opportunities that allow us to expand our presence within a customer account. For example, various complementary Xacta features build on each other and are sold separately.
Much of our business is awarded through the submission of formal competitive bids; however, a portion of our revenue is awarded through limited competition or sole-source contracts.
Partner Organizations
Our sales team works with partner organizations like AWS, Microsoft Azure, and Oracle to pursue mutual customers and leverage their marketplace platforms and marketing programs. In the past years, Telos announced a collaboration with IBM Security as part of IBM's Active Governance Services, which allows enterprises to operationalize and automate activities and solve challenges in cybersecurity compliance and regulatory risks. The solution combines IBM's world-class expertise in cyber compliance and governance programs with Telos' Xacta IT risk management platform to automate the time-consuming aspects of compliance and audit activities such as control selection, validation, reporting, and monitoring.
Marketing
We build market awareness of Telos and our solutions through a variety of marketing programs, including regular briefings with industry analysts, public relations activities, government relations initiatives, web seminars, trade show exhibitions, speaking engagements, and digital marketing. We will continue investing in these activities and targeting additional vertical-specific content creation, targeted advertising and brand awareness campaigns, social media campaigns, and search engine marketing.
Our sales team works hand in hand with our marketing team and various subject matter experts to develop targeted awareness campaigns for our various solutions that generate valuable leads and contacts.
Research and Development
We developed proprietary software-based solutions in various platforms related to security and cyber risk management. We invest substantial resources in research and development to innovate new solutions, enhance our offerings and grow opportunities by developing new features and modules for our existing platforms. In 2023, we invested in preexisting programs and next generation solutions in secure communications and cybersecurity. Leveraging our agile innovation and development practices, we rapidly establish prototypes that we can fully test for suitability and to pre-establish enterprise risk level across a variety of government networks and clouds. We are committed to and view our continued investment in research and development as a key factor to our long-term business success.
9
Table of Contents
Human Capital Resources
As of December 31, 2023, we had 619 employees, of whom approximately 88.7% are located in the United States. Approximately 377 of our U.S.-based employees held U.S. security clearances, and 26% self-identify as veterans of U.S. military service. Our employees are not represented by a labor union or covered by a collective bargaining agreement. We have not experienced any work stoppages, and we consider relations with our employees to be good.
Telos places a strong emphasis on supporting our people. Our management team is committed to maintaining a corporate culture that fosters mutual respect and job satisfaction for our people while delivering innovation and value to customers and shareholders. This commitment is reflected in our core values:
Always with integrity, at Telos we:
Build trusted relationships,
Work hard together,
Design and deliver superior solutions, and
Have fun doing it.
These values are woven throughout the fabric of Telos. They are reflected in our hiring practices, reinforced regularly, and reviewed during appraisals. Employees are encouraged to challenge themselves and each other to exhibit the core values in all activities.
Our employees are given avenues of communication and interaction should they observe activities inconsistent with our core values. While employees are encouraged first to speak openly about any issues, a 24/7 hotline provides an opportunity to express concerns anonymously.
We consider the foundational value of integrity to be a non-negotiable requirement of employment, and an expectation of suppliers, partners, and our customers. We guard our reputation and will take necessary action to protect it. An essential part of our brand promise is always to engage employees, customers, partners, suppliers, and investors with integrity.
As part of our effort to improve our disclosures around human capital issues, in 2023, we provided a public report pursuant to the Sustainability Accounting Standards Board ("SASB") Software & IT Service Standard, which report addresses, in part, metrics relating to recruiting and managing a global, diverse and skilled workforce.
Talent Acquisition and Retention
We operate in a very competitive environment for talent. To ensure we can attract the most well-qualified employees, we employ strategic sourcing methods, innovative recruitment campaigns, and inclusive outreach initiatives to attract a diverse pool of candidates. This involves leveraging various channels, such as job boards, social media platforms, and diversity-focused partnerships, to engage with candidates from different backgrounds and experiences.
During 2023, we made several improvements to our employee value proposition, including enhancements on benefits available to employees, increasing paid time off and parental leave, accelerating the vesting period for stock matched by the Company in employees' 401(k) plans, instituting a new performance management program, and various supplemental programs to support our employees' physical, mental and financial well-being.
In addition, at Telos, we help our employees succeed by providing flexibility in where and how they work. The employees' ability to work remotely or in a hybrid arrangement is a strategy that helps us attract, hire and retain the best people, regardless of their specific location. This strategy increases employee empowerment and satisfaction, drives efficiency, and enables us to hire from a broad and diverse talent pool.
Diversity and Inclusion
We value diversity and inclusion and are committed to providing a work environment free of discrimination and harassment, where our employees can do their best work, bring their whole selves to work, feel supported, and in turn, support others. We strive to create a working environment where everyone feels included and respected and has an equal opportunity to contribute. We believe that diverse teams maximize their potential and bring with them varied views, experiences, and perspectives . While we believe that our employee population is gender and ethnically diverse for our industry and operating markets, with approximately 25% of our global population self-identifying as female and approximately 38% self-identifying as underrepresented minorities, our objective is to continue to improve our hiring, development, training, advancement, and retention of diverse talent and to foster an inclusive environment at Telos.
10
Table of Contents
Seasonality
We generally experience seasonality due to our key customers' fiscal year ends and procurement cycles. We derive a substantial portion of our revenue from the U.S. government, whose fiscal year ends on September 30 of each year, which may favorably impact our third fiscal quarter. In addition, our quarterly results may be impacted by the number of working days in a given quarter. See "Risk Factors — We are subject to the seasonality of U.S. government spending."
Government Contracts and Regulation
Our business is heavily regulated and we must comply with and are affected by laws and regulations relating to the formation, administration and performance of U.S. government and other contracts. U.S. government contracts generally are subject to the Federal Acquisition Regulation ("FAR"), which sets forth policies, procedures and requirements for acquiring goods and services by the U.S. government, and agency-specific regulations that implement or supplement the FAR. These regulations impose a broad range of requirements, many of which are unique to government contracting, including various procurement, security, contract pricing and cost, contract termination, and adjustments and audit requirements. These laws and regulations, among other things:
• Impose specific and unique cost accounting practices that may differ from Generally Accepted Accounting Principles in the United States of America ("U.S. GAAP" or "GAAP") and therefore require reconciliation;
• Define allowable and unallowable costs and otherwise govern our right to reimbursement under various cost-type U.S. government contracts;
• Require compliance with U.S. government Cost Accounting Standards;
• Require reviews by the Defense Contract Audit Agency, Defense Contract Management Agency and other U.S. government agencies for compliance with government requirements for a contractor's business system; and
• Restrict the use and dissemination of, and require the protection of, unclassified contract-related information and information classified for national security purposes and the export of certain products and technical data.
U.S. government customers employ several contracting methods to purchase services and products. Budgetary pressures and reforms in the procurement process have caused many U.S. government customers to increasingly purchase services and products using contracting methods that allow them to select multiple contract winners or pre-qualify certain contractors to provide services or products on established general terms and conditions rather than through single-award contracts. The predominant contracting methods through which U.S. government agencies procure services and products include definitive award contracts, indefinite delivery / indefinite quantity ("IDIQ") contracts, U.S. General Service Administration ("GSA") schedule contracts and other transactional agreements ("OTA").
Government contracts are subject to congressional funding. Consequently, at the outset of a program, a contract is usually partially funded, and Congress annually determines if additional funds are to be appropriated to the contract. All of our government customers have the right to terminate their contract with us at their convenience or in the event that we default. Most of our contracts have cancellation terms that permit us to recover all or a portion of our incurred costs and fees for work performed where the U.S. government issues a termination for convenience.
A portion of our business is classified by the U.S. government and cannot be specifically described. The operating results of these classified programs are included in our consolidated financial statements.
These regulations and risks are described in more detail below under "Risk Factors" in this Annual Report on Form 10-K.
Environmental, Social, and Governance Matters
We strive to operate our business in an environmentally responsible manner and in support of sustainable long-term financial performance. Our Environmental, Social and Governance ("ESG") task force is charged with addressing climate and environmentally-related risks and opportunities, including our publicly-disclosed climate transition plan. The Company publicly reports certain climate change-related information via CDP and provides public sustainability disclosures using the SASB Software & IT Service Standard. By making these disclosures, however, we have not concluded that the information disclosed is material to our business. The Board of Directors authorized the Nominating and Corporate Governance Committee to oversee the Company's ESG efforts, which include climate-related risks and opportunities.
See Item 1A, "Risk Factors," for discussion of risks related to global climate and ESG matters.
11
Table of Contents
Company Website and Available Information
Our corporate headquarters is located at 19886 Ashburn Road, Ashburn, Virginia 20147, and our telephone number is (703) 724-3800. Our website can be accessed at www.telos.com, which contains information about our Company and operations. Through a link on the Investor Relations section of our website, copies of each of our filings with the U.S. Securities and Exchange Commission ("SEC") can be viewed and downloaded free of charge as soon as reasonably practicable after the reports and amendments are electronically filed with or furnished to the SEC. The information on our website is not incorporated by reference into and is not part of this Annual Report on Form 10-K.
The SEC also maintains a website (www.sec.gov) that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC, including Telos.
12
Table of Contents