What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-05-15 compared with 2025-11-14 · 190 added, 178 removed, 283 unchanged (57% of the section changed)

ITEM 1A — RISK FACTORS

Our operations and financial results are subject to various risks and uncertainties, including those described below, which could adversely affect our business, financial condition, results of

operations, cash flows, and the trading price of our common and capital stock.

You should carefully consider the risks and uncertainties described below in addition to the other information set forth in this Report, including in “Management’s

Discussion and Analysis of Financial Condition and Results of Operations” and our condensed consolidated financial statements and related notes, before making any investment in our common stock.

The risks and uncertainties described below are not

the only ones we face.

Additional risks and uncertainties not presently known to us or that we currently believe to be immaterial may also adversely affect our business.

If any of these risk factors occur, you could lose substantial value or your

entire investment in our shares.

Risks Related to Our Business and Our Financial Reporting

Our financial statements include a going concern disclosure required under U.S.

The Company’s current level of operating expenditures, if continued without additional sources of revenue or financing, would exhaust existing liquid resources in the second quarter of 2027, a period of less than

twelve months from the date of issuance of the financial statements included in this Report on Form 10-Q.

GAAP, this condition requires disclosure of substantial doubt about the Company’s ability to continue as a going concern, as set

forth in the Notes to our condensed consolidated financial statements.

This disclosure reflects the application of prescribed accounting standards and is not intended to imply any change in the Company’s expectations regarding its business,

strategy or outlook .

Our operating results may not be consistent and may be difficult to predict, and we may not be able to achieve or sustain profitability in the future.

We had a net loss of $11.6 million for the nine months ended September 30, 2025 and a net loss of $18.2 million for the year ended December 31, 2024.

As of September 30, 2025, we had an accumulated

deficit of $216.3 million.

We had a net loss of $4.4 million for the quarter ended March 31, 2026, and a net loss of $18.2 million for the year ended December 31, 2025.

As of March 31, 2026, we had an accumulated deficit of

$227.2 million.

Our operating results have fluctuated in the past due to several factors and may fluctuate in the future due to the same or similar factors, which include but are not limited to the following:

Time and resources required to accelerate transition to new product development and sales strategies targeting large enterprises, government customers, service provider partnerships;

Customer acceptance of our DE, MBSE and Cyber Threat Assessment services;

Customer acceptance of our DE, DTE methods, MBSE and cyber threat intelligence and assessment services;

Establishing and maintaining relationships with third parties to integrate our family of cybersecurity products and services into their operations and develop solutions key to the defense market, critical

infrastructure and threat intelligence service;

infrastructure, and cyber threat intelligence service;

Customer adoption of our VirnetX One™ platform and software products and services;

The number of product license sales of VirnetX War Room™, VirnetX Matrix™ and associated services;

Adoption of VirnetX One TM platform by third party application providers of secure communications;

Adoption of VirnetX One™ platform by third party application providers of secure communications;

Intensely competitive market with established companies that have larger customer bases, and greater resources than we do;

6 unchanged sentences

Our business strategy is to enter into partnerships, strategic investments, and other cooperative arrangements with other companies and government agencies.

have invested in and we continue to seek to invest in or acquire businesses, technologies, or other assets that we believe could complement or expand our business.

In addition, we are regularly involved in cooperative efforts with respect to the

incorporation of our products into products of others and vice versa, collaborative research and development efforts with government and university laboratories, distributor and reseller arrangements and service provider partnerships.

relationships are generally non-exclusive, and some of our partners also have cooperative relationships with certain of our competitors or offer some products and services that are competitive with ours.

If we lose third-party relationships, if

these relationships are not commercially successful, or if we are unable to enter into third-party relationships on commercially reasonable terms in the future, our business could be negatively impacted.

We have invested in and we continue to seek

to invest in or acquire businesses, technologies, or other assets that we believe could complement or expand our business.

In addition, we are regularly involved in cooperative efforts with respect to the incorporation of our products into products

of others and vice versa, collaborative research and development efforts with government and university laboratories, distributor and reseller arrangements and service provider partnerships.

These relationships are generally non-exclusive, and some

of our partners also have cooperative relationships with certain of our competitors or offer some products and services that are competitive with ours.

If we lose third-party relationships, if these relationships are not commercially successful, or

if we are unable to enter into third-party relationships on commercially reasonable terms in the future, our business could be negatively impacted.

We expect that we will experience long and unpredictable sales cycles, which may impact our operating results.

The sales cycle between initial customer contact and the execution of a contract or license agreement with a customer or purchaser of our products can vary widely.

We expect that our sales cycles will

be long and unpredictable due to several factors, including but not limited to:

The sales cycle between initial customer contact and the execution of a contract can vary widely.

We expect that our sales cycles will be long and unpredictable due to several factors, including but

not limited to:

The need to educate potential customers about our product and service capabilities;

1 unchanged sentence

Delays caused by time-consuming internal review processes customary with potential customers including large government agencies and institutions in the space and defense industries; and

Long sales cycles may increase the risk that our financial resources are exhausted before we are able to generate significant revenue.

In addition, potential customers of our products include local, state, federal

and foreign government agencies, as well as institutions in the space and defense industries.

Sales processes to government authorities can be extensive and unpredictable.

Government authorities generally have complex budgeting, purchasing,

and regulatory processes that govern their capital spending, and their spending is likely to be adversely impacted by economic conditions.

In addition, in many instances, sales to government authorities may require field trials and may be

delayed by the time it takes for government officials to evaluate multiple competing bids, negotiate terms, and award contracts.

For these reasons, the sales cycle associated with our products is subject to a number of significant risks that are beyond our control.

Consequently, if customer orders are delayed or not realized,

our revenues and results of operations could be materially and adversely affected.

We plan to offer our products to government entities, which are subject to a number of challenges and risks.

Long sales cycles may increase the risk that our financial resources are exhausted before we generate significant revenue.

In addition, potential customers include local, state, federal and foreign government agencies, as well as institutions in the space and defense industries.

Sales processes to government authorities

can be extensive and unpredictable.

Government authorities generally have complex budgeting, purchasing, and regulatory processes that govern their capital spending, and their spending is likely to be adversely impacted by economic conditions.

addition, in many instances, sales to government authorities may require field trials and may be delayed by the time it takes for government officials to evaluate multiple competing bids, negotiate terms, and award contracts.

For these reasons, the

sales cycle associated with our products is subject to a number of significant risks that are beyond our control.

Consequently, if customer orders are delayed or not realized, our revenues and results of operations could be materially and adversely

We offer our products to government entities, which are subject to a number of challenges and risks.

Government entities have announced reductions in, or experienced increased pressure to reduce, government spending.

9 unchanged sentences

products and services, including ours, or impose challenging regulatory requirements on such adoptions, any of which may inhibit the growth of our public sector business.

Selling to government entities can be highly competitive, expensive and

time consuming, often requiring significant upfront time and expense without any assurance that we will successfully sell our products to such governmental entity.

Government entities may require contract terms that differ from our standard

arrangements or require the maintenance of certain facility and employee security clearance, which may be difficult to obtain or maintain.

Our business could be adversely affected if our employees cannot obtain and maintain required personnel security clearances or we cannot establish and maintain a required

facility security clearance.

Selling to government entities can be highly competitive, expensive and time

consuming, often requiring significant upfront time and expense without any assurance that we will successfully sell our products to such governmental entity.

Government entities may require contract terms that differ from our standard arrangements

or require the maintenance of certain facility and employee security clearance, which may be difficult to obtain or maintain.

Our business could be adversely affected if our employees cannot obtain and maintain required personnel security clearances or we cannot establish and maintain a

required facility security clearance.

Certain government contracts may require our employees to maintain various levels of security clearances and may require us to maintain a facility security clearance to comply with U.S.

and international government

agency requirements.

international government agency requirements.

Many governments have strict security clearance requirements for personnel who perform work in support of classified programs.

Obtaining and maintaining security clearances for employees typically involves a lengthy process,

and it can be difficult to identify, recruit, and retain employees who already hold security clearances.

If our employees are unable to obtain security clearances in a timely manner, or at all, or if our employees who hold security clearances are

unable to maintain their clearances or terminate employment with us, then we may be unable to bid on or win new classified contracts.

To the extent we are not able to obtain or maintain a facility security clearance, we may not be able to bid on

or win classified contracts, which would have an adverse impact on our business, financial condition, and results of operations.

We have limited technical resources and are at an early stage in commercialization of our VirnetX One™ platform and software products.

Obtaining and maintaining security clearances for employees typically

involves a lengthy process, and it can be difficult to identify, recruit, and retain employees who already hold security clearances.

If our employees are unable to obtain security clearances in a timely manner, or at all, or if our employees who

hold security clearances are unable to maintain their clearances or terminate employment with us, then we may be unable to bid on or win new classified contracts.

To the extent we are not able to obtain or maintain a facility security clearance, we

may not be able to bid on or win classified contracts, which would have an adverse impact on our business, financial condition, and results of operations.

We have limited technical resources and are at an early stage in commercialization of our VirnetX One™ platform and software products, as well as our DE, DTE

methods, MBSE, and cyber threat assessment services.

Part of our business includes the internal development of commercial products we seek to monetize.

26 unchanged sentences

new technologies and market entrants, we expect competition to intensify in the future.

For example, disruptive technologies such as generative AI has and may continue to fundamentally alter the market for our services in unpredictable ways and

For example, disruptive technologies such as generative AI have and may continue to fundamentally alter the market for our services in unpredictable ways and

reduce customer demand.

20 unchanged sentences

Our products are highly technical and complex and, when deployed, may contain errors or defects.

Despite testing, some errors in our products may only be

discovered after a product has been installed and used by customers.

Any errors or defects discovered in our products after commercial release could result in failure to achieve market acceptance, loss of revenue or delay in revenue recognition,

loss of customers and increased service and warranty cost, any of which could adversely affect our business, operating results, and financial condition.

In addition, we could face claims for product liability, tort, or breach of warranty, including

claims relating to changes to our products made by our channel partners.

The performance of our products could have unforeseen or unknown adverse effects on the networks over which they are delivered as well as on third-party applications and

services that utilize our services, which could result in legal claims against us harming our business.

Furthermore, we expect to provide implementation, consulting, and other technical services in connection with the implementation and ongoing

maintenance of our products, which typically involves working with sophisticated software, computing, and communications systems.

We expect that our contracts with customers will contain provisions relating to warranty disclaimers and liability

limitations, which may not be upheld.

Defending a lawsuit, regardless of its merit, is costly and may divert management’s attention and adversely affect the market’s perception of us and our products.

In addition, if our business liability

insurance coverage proves inadequate or future coverage is unavailable on acceptable terms or at all, our business, operating results, and financial condition could be adversely impacted.

Despite testing, some errors in our products may only be discovered after a product has been installed

and used by customers.

Any errors or defects discovered in our products after commercial release could result in failure to achieve market acceptance, loss of revenue or delay in revenue recognition, loss of customers and increased service and

warranty cost, any of which could adversely affect our business, operating results, and financial condition.

In addition, we could face claims for product liability, tort, or breach of warranty, including claims relating to changes to our products

made by our channel partners.

The performance of our products could have unforeseen or unknown adverse effects on the networks over which they are delivered as well as on third-party applications and services that utilize our services, which could

result in legal claims against us harming our business.

Furthermore, we expect to provide implementation, consulting, and other technical services in connection with the implementation and ongoing maintenance of our products, which typically

involves working with sophisticated software, computing, and communications systems.

We expect that our contracts with customers will contain provisions relating to warranty disclaimers and liability limitations, which may not be upheld.

a lawsuit, regardless of its merit, is costly and may divert management’s attention and adversely affect the market’s perception of us and our products.

In addition, if our business liability insurance coverage proves inadequate or future coverage

is unavailable on acceptable terms or at all, our business, operating results, and financial condition could be adversely impacted.

Malfunctions of third-party communications infrastructure, hardware and software expose us to a variety of risks that we cannot control.

4 unchanged sentences

If one or more of these companies is unable or unwilling to supply or expand their levels of service to us in the future, our operations could be severely interrupted.

Also, to the extent that the number of users of networks

utilizing our current or future products suddenly increases, the technology platform and secure hosting services which will be required to accommodate a higher volume of traffic may result in slower response times or service interruptions.

interruptions or increases in response time could result in a loss of potential or existing users and, if sustained or repeated, could reduce the appeal of the networks to users.

In addition, users depend on real-time communications; outages caused

by increased traffic could result in delays and system failures.

These types of occurrences could cause users to perceive that our solution does not function properly and could therefore adversely affect our ability to attract and retain licensees,

strategic partners, and customers.

System failure or interruption or our failure to meet increasing demands on our systems could harm our business.

12 unchanged sentences

We believe our patents are valid, enforceable, and valuable.

Notwithstanding this belief, third parties may make claims of infringement with respect to our

products or services or invalidity claims with respect to our patents or become aware of our trade secrets by way of leaks from bad actors within or outside of our employee base or otherwise, and such claims could give rise to material cost for

defense or settlement or both, and such claims or leaks could jeopardize or substantially delay a successful outcome of litigation we are or may become involved in, divert resources away from our other activities, limit or cease our related

revenues, or otherwise materially and adversely affect our business.

Even if we are successful in protecting our intellectual property rights, they may not ultimately provide us with any competitive advantages and may be less valuable than we

currently expect.

These risks may be heightened in countries other than the United States where laws regarding patent protection are less developed and may be negatively affected by the fact that legal standards in the United States and elsewhere

for protection of intellectual property rights in Internet-related businesses are uncertain and still evolving.

In addition, there are a significant number of United States and foreign patents and patent applications in our areas of interest, and

we expect that significant litigation in these areas will continue and will add uncertainty to the value of certain patents and other intellectual property rights in our areas of interest.

If we are unable to protect our intellectual property

rights or otherwise realize value from them, our business would be negatively affected.

Notwithstanding this belief, third parties may make claims of infringement with respect to our products or services or invalidity claims

with respect to our patents or become aware of our trade secrets by way of leaks from bad actors within or outside of our employee base or otherwise, and such claims could give rise to material cost for defense or settlement or both, and such

claims or leaks could jeopardize or substantially delay a successful outcome of litigation we are or may become involved in, divert resources away from our other activities, limit or cease our related revenues, or otherwise materially and adversely

affect our business.

Even if we are successful in protecting our intellectual property rights, they may not ultimately provide us with any competitive advantages and may be less valuable than we currently expect.

These risks may be heightened in

countries other than the United States where laws regarding patent protection are less developed and may be negatively affected by the fact that legal standards in the United States and elsewhere for protection of intellectual property rights in

Internet-related businesses are uncertain and still evolving.

In addition, there are a significant number of United States and foreign patents and patent applications in our areas of interest, and we expect that significant litigation in these

areas will continue and will add uncertainty to the value of certain patents and other intellectual property rights in our areas of interest.

If we are unable to protect our intellectual property rights or otherwise realize value from them, our

business would be negatively affected.

If we experience security breaches or incidents, we could be exposed to liability and our reputation and business could suffer.

We expect to retain certain confidential and proprietary customer information in our secure data centers and secure domain name registry, as well as personal data and other confidential and

proprietary information relating to our business.

It will be critical to our business strategy that our facilities and infrastructure, including our secure domain name servers, remain secure and are perceived by the marketplace to be secure.

secure domain name registry operations will also depend on our ability to maintain our computer and telecommunications equipment in effective working order and to reasonably protect our systems against interruption, and potentially depend on

protection by other registrars in the shared registration system.

Additionally, we maintain confidential and proprietary business information, including trade secrets.

We expect to continue to have to expend significant time and money to maintain

or increase the security of our products, facilities, and infrastructure.

Security technologies are constantly being tested by computer professionals, academics and “hackers.” Advances in computer capabilities and the techniques for attacking

security solutions, new discoveries in the field of cryptography or other events or developments could result in compromises or breaches of our security measures and could make some or all our products obsolete or unmarketable.

Likewise, we may

need to dedicate engineering and other resources to mitigate or eliminate security vulnerabilities and may find it necessary or appropriate to repair or replace products already sold or licensed to our customers.

Despite the security measures that

we and our service providers utilize, our infrastructure and that of our service providers may be vulnerable to physical break-ins, ransomware, computer viruses, other malicious code attacks by hackers, phishing attacks, social engineering, or

similar disruptive problems.

There can be no assurances our security measures or those of our service providers will prevent security breaches or incidents.

Any disruption or security breach or incident that we or our service providers suffer or

are perceived to suffer, including any such disruption, breach or incident resulting in a loss of, or damage to, data or systems, or inappropriate disclosure, access, loss, or other processing of confidential, financial, proprietary or personal

information, including data related to our personnel, could result in loss, disclosure or other unauthorized processing of such data, could delay our research and development or commercialization efforts, could compel us to comply with breach

notification laws and regulations, subject us to mandatory corrective action, and otherwise subject us to liability under laws and regulations that protect the privacy and security of personal information.

It is possible that we may have to expend

additional financial and other resources to address such problems.

We face security threats from malicious third parties that could obtain unauthorized access to our systems, network, and data.

We expect to retain certain confidential and proprietary customer

information in our secure data centers and secure domain name registry, as well as personal data and other confidential and proprietary information relating to our business.

It is critical to our business strategy that our facilities and

infrastructure, including our secure domain name servers, remain secure and are perceived by the marketplace to be secure.

Our secure domain name registry operations will also depend on our ability to maintain our computer and telecommunications

equipment in effective working order and to reasonably protect our systems against interruption, and potentially depend on protection by other registrars in the shared registration system.

We expect to expend significant time and money to maintain or increase the security of our products, facilities, and infrastructure.

Security technologies are constantly being tested by computer

professionals, academics and “hackers.” Advances in computer capabilities and the techniques for attacking security solutions, new discoveries in the field of cryptography or other events or developments could result in compromises or breaches of

our security measures and could make some or all our products obsolete or unmarketable.

Remote work by our personnel and those of third parties has resulted in increased vulnerability to cyber-attacks.

Additionally, during times of war and other geopolitical tensions

and conflicts may create increased risks of cyber-attacks.

As a provider of Internet security software and technology, we may be the target of dedicated efforts by hackers and other third parties to overcome or defeat our security measures.

physical or electronic break-in or other security breach or incident or compromise impacting our products, or any information stored at our secure data centers and domain name registration systems, including any compromise due to human error or

employee or contractor malfeasance, may jeopardize the security of information stored on our premises or in the computer systems and networks of our customers.

Additionally, any such data security incident, or the perception that one has occurred

could also result in adverse publicity, harm to our reputation and competitive position, and therefore adversely affect the market’s perception of the security of electronic commerce and communications over IP networks as well as the security or

reliability of our services, which could have a material adverse impact on our business, financial condition, and results of operations.

We may need to dedicate engineering and other

resources to mitigate or eliminate security vulnerabilities and may find it necessary or appropriate to repair or replace products already sold or licensed to our customers.

Despite the security measures that we and our service providers utilize,

our infrastructure and that of our service providers may be vulnerable to physical break-ins, ransomware, computer viruses, other malicious code attacks by hackers, phishing attacks, social engineering, or similar disruptive problems.

no assurances our security measures or those of our service providers will prevent security breaches or incidents.

Any disruption or security breach or incident that we or our service providers suffer or are perceived to suffer, including any such

disruption, breach or incident resulting in a loss of, or damage to, data or systems, or inappropriate disclosure, access, loss, or other processing of confidential, financial, proprietary or personal information, including data related to our

personnel, could result in loss, disclosure or other unauthorized processing of such data.

Such events could delay our research and development or commercialization efforts, could compel us to comply with breach notification laws and regulations,

subject us to mandatory corrective action, and otherwise subject us to liability under laws and regulations that protect the privacy and security of personal information.

It is possible that we may have to expend additional financial and other

resources to address such problems, which could have a material adverse impact on our operations.

Additionally, during times of war and other geopolitical tensions and conflicts may create increased risks of cyber-attacks.

As a provider of Internet security software and technology, we may be the

target of dedicated efforts by hackers and other third parties to overcome or defeat our security measures.

Any physical or electronic break-in or other security breach or incident or compromise impacting our products, or any information stored at

our secure data centers and domain name registration systems, including any compromise due to human error or employee or contractor malfeasance, may jeopardize the security of information stored on our premises or in the computer systems and

networks of our customers.

Additionally, any such data security incident, or the perception that one has occurred could also result in adverse publicity, harm to our reputation and competitive position, and therefore adversely affect the market’s

perception of the security of electronic commerce and communications over IP networks as well as the security or reliability of our services, which could have a material adverse impact on our business, financial condition, and results of

A security breach or other security incident, or the perception any such event has occurred, could require a substantial level of financial resources to address and otherwise respond to, may be

39 unchanged sentences

regulations related to the online collection, use and dissemination of data.

Further, many foreign countries and governmental bodies, including the European Union (EU), where we conduct business, have laws and regulations concerning the

collection and use of personal data obtained from their residents or by businesses operating within their jurisdiction.

Further, many foreign countries and governmental bodies, including the European Union (EU), where we conduct business, have laws and regulations concerning the collection and use of personal data

obtained from their residents or by businesses operating within their jurisdiction.

These laws and regulations often are more restrictive than those in the United States.

Laws and regulations in these

jurisdictions apply broadly to the collection, use, storage, disclosure, and security of data that identifies or may be used to identify or locate an individual.

Laws and regulations in these jurisdictions apply broadly to the collection,

use, storage, disclosure, and security of data that identifies or may be used to identify or locate an individual.

We also expect that there will continue to be new proposed laws, regulations and industry standards concerning privacy, data protection and information security in the United States, the EU, and other

14 unchanged sentences

For example, Connecticut, Virginia, Utah, and Colorado enacted legislation similar to the CCPA and

CPRA that took effect in 2023; Florida, Montana, Oregon, and Texas have enacted similar legislation that has become effective in 2024; Delaware, Nebraska, Maryland, New Hampshire, New Jersey, Minnesota, Tennessee, and Iowa have enacted similar

legislation that has or will become effective in 2025; and Indiana, Kentucky, and Rhode Island have enacted similar legislation that will become effective in 2026.

Department of Justice has also issued regulations regarding certain bulk

sensitive personal data transfers.

We cannot yet fully determine the impact these or future laws, regulations and standards may have on our business, but they may require us to modify our data processing practices and policies and to incur

substantial costs and expenses in efforts to comply.

Privacy, data protection and information security laws and regulations are often subject to differing interpretations, may be inconsistent among jurisdictions, and may be alleged to be

inconsistent with our current or future practices.

Additionally, we may be bound by contractual requirements applicable to our collection, use, processing, and disclosure of various types of data, including personal data, and may be bound by, or

voluntarily comply with, self-regulatory or other industry standards relating to these matters.

These and other requirements could reduce demand for our products, increase our costs, impair our ability to grow our business, or restrict our ability

to store and process data or, in some cases, impact our ability to offer our service in some locations and may subject us to liability.

Any failure or perceived failure to comply with applicable laws, regulations, industry standards, and

contractual obligations may adversely affect our business.

Further, in view of new or modified federal, state, or foreign laws and regulations, industry standards, contractual obligations and other legal obligations, or any changes in their

interpretation, we may find it necessary or desirable to fundamentally change our business activities and practices or to expend significant resources to modify our product and otherwise adapt to these changes.

We may be unable to make such changes

and modifications in a commercially reasonable manner or at all, and our ability to develop new products and features could be limited.

CPRA that took effect in 2023; Florida, Montana, Oregon, and Texas enacted similar legislation that took effect in 2024; Delaware, Nebraska, Maryland, New Hampshire, New Jersey, Minnesota, Tennessee, and Iowa enacted similar legislation that took

effect in 2025;

and Indiana, Kentucky, and Rhode Island enacted similar legislation that took effect in 2026;

and Alabama and Oklahoma enacted similar legislation that takes effect in 2027.

Department of Justice has also issued regulations regarding certain bulk sensitive personal data transfers.

We cannot yet fully determine the impact these or future laws, regulations and

standards may have on our business, but they may require us to modify our data processing practices and policies and to incur substantial costs and expenses in efforts to comply.

Privacy, data protection and information security laws and

regulations are often subject to differing interpretations, may be inconsistent among jurisdictions, and may be alleged to be inconsistent with our current or future practices.

Additionally, we may be bound by contractual requirements applicable to

our collection, use, processing, and disclosure of various types of data, including personal data, and may be bound by, or voluntarily comply with, self-regulatory or other industry standards relating to these matters.

These and other requirements

could reduce demand for our products, increase our costs, impair our ability to grow our business, or restrict our ability to store and process data or, in some cases, impact our ability to offer our service in some locations and may subject us to

Any failure or perceived failure to comply with applicable laws, regulations, industry standards, and contractual obligations may adversely affect our business.

Further, in view of new or modified federal, state, or foreign laws and

regulations, industry standards, contractual obligations and other legal obligations, or any changes in their interpretation, we may find it necessary or desirable to fundamentally change our business activities and practices or to expend

significant resources to modify our product and otherwise adapt to these changes.

We may be unable to make such changes and modifications in a commercially reasonable manner or at all, and our ability to develop new products and features could be

The costs of compliance with and other burdens imposed by laws, regulations and standards may limit the use and adoption of our service and reduce overall demand for it, or lead to significant fines,

10 unchanged sentences

and an increase in the number of shares eligible for future resale in the public market which may negatively impact the market price of our stock.

The exercise of our outstanding vested stock options and the vesting of RSUs and restricted stock dilutes the ownership interests of our existing stockholders.

As of September 30, 2025, we had 242,300

outstanding options and RSUs to purchase shares of common stock representing approximately 6% of our total shares outstanding of which 228,615 were vested.

To the extent restricted stock is awarded, outstanding stock options or warrants are

exercised, and RSUs vest, existing stockholders’ percentage voting interests will decline.

Also, the number of shares eligible for resale in the public market will increase and such increase may have a negative effect on the value or market trading

price of our common stock.

The exercise of our outstanding vested stock options and the vesting of RSUs dilutes the ownership interests of our existing stockholders.

As of March 31, 2026, we had 697,758 outstanding RSUs and

options to purchase shares of common stock representing approximately 18% of our total shares outstanding of which 227,490 were vested.

To the extent restricted stock is awarded, outstanding stock options are exercised, and RSUs vest, existing

stockholders’ percentage voting interests will decline.

Also, the number of shares eligible for resale in the public market will increase and such increase may have a negative effect on the value or market trading price of our common stock.

Investors may have limited influence because ownership of our common stock is limited.

As of September 30, 2025, our executive officers and directors beneficially owned approximately 17% of our outstanding common stock.

As of March 31, 2026, our executive officers and directors beneficially owned approximately 16% of our outstanding common stock.

Because of their beneficial ownership interest, our officers and

7 unchanged sentences

A staggered Board of Directors:

Only one or two of five directors will be up for election at any given annual meeting, delaying the ability of stockholders to affect a change in control of us because it would take

two annual meetings to effectively replace a majority of the Board of Directors.

Only one or two of five directors will be up for election at any given annual meeting, delaying the ability of stockholders to affect a change in control of us because it would

take two annual meetings to effectively replace a majority of the Board of Directors.

Blank check preferred stock:

Our Board of Directors has the authority to establish the rights, preferences, and privileges of our 10,000,000 authorized, but unissued, shares of preferred stock.

Therefore, this

stock may be issued at the discretion of our Board of Directors with preferences over your shares of our common stock in a manner that is materially dilutive to you.

In addition, blank check preferred stock can be used to create a “poison

pill” which is designed to deter a hostile bidder from buying a controlling interest in our stock without the approval of our Board of Directors.

We have not adopted such a “poison pill;” but our Board of Directors can do so in the future,

very rapidly and without stockholder approval.

this stock may be issued at the discretion of our Board of Directors with preferences over your shares of our common stock in a manner that is materially dilutive to you.

In addition, blank check preferred stock can be used to create a

“poison pill” which is designed to deter a hostile bidder from buying a controlling interest in our stock without the approval of our Board of Directors.

We have not adopted such a “poison pill;” but our Board of Directors can do so in the

future, very rapidly and without stockholder approval.

Advance notice requirements for director nominations and for business to be brought before stockholder meetings:

Stockholders wishing to submit director nominations or raise matters to a vote of the stockholders

must provide notice to us within very specific date windows and in very specific form to have the matter voted on at a stockholder meeting.

This gives our Board of Directors and management more time to react to stockholder proposals

generally and could also permit us to disregard a stockholder proposal to the extent such proposal is not submitted in accordance with the Restated Bylaws.

Stockholders wishing to submit director nominations or raise matters to a vote of the

stockholders must provide notice to us within very specific date windows and in very specific form to have the matter voted on at a stockholder meeting.

This gives our Board of Directors and management more time to react to stockholder

proposals generally and could also permit us to disregard a stockholder proposal to the extent such proposal is not submitted in accordance with the Restated Bylaws.

No stockholder actions by written consent:

3 unchanged sentences

Super majority requirement for stockholder amendments to the Restated Bylaws:

Stockholder proposals to alter or amend our Restated Bylaws or to adopt new bylaws can only be approved by the affirmative vote of at

least 66 2/3% of the outstanding shares of our common stock.

Stockholder proposals to alter or amend our Restated Bylaws or to adopt new bylaws can only be approved by the affirmative vote of

at least 66 2/3% of the outstanding shares of our common stock.

No ability of stockholders to call a special meeting of the stockholders:

A special meeting of the stockholders, other than as required by statute, may be called at any time by the Board of Directors, the chairman

of the Board of Directors, or the president, and any power of stockholders to call a special meeting of stockholders is specifically denied.

Accordingly, stockholders, even those who represent a significant percentage of our shares of

common stock, may need to wait for the annual meeting before nominating directors or raising other business proposals to be voted on by the stockholders.

A special meeting of the stockholders, other than as required by statute, may be called at any time by the Board of Directors, the

chairman of the Board of Directors, or the president, and any power of stockholders to call a special meeting of stockholders is specifically denied.

Accordingly, stockholders, even those who represent a significant percentage of our shares

of common stock, may need to wait for the annual meeting before nominating directors or raising other business proposals to be voted on by the stockholders.

In addition, the provisions of Section 203 of the Delaware General Corporation Law govern us.

1 unchanged sentence

voting stock, from merging or combining with us for a certain period of time.

These and other provisions in our Restated Charter, our Restated Bylaws and under Delaware law could discourage potential takeover attempts, reduce the price

that investors might be willing to pay for shares of our common stock in the future and result in the market price being lower than it would be without these provisions.

These and other provisions in our Restated Charter, our Restated Bylaws and under Delaware law could discourage potential takeover attempts, reduce the price that

investors might be willing to pay for shares of our common stock in the future and result in the market price being lower than it would be without these provisions.

Our Restated Bylaws designate a state or federal court located within the State of Delaware as the exclusive forum for substantially all disputes between us and

11 unchanged sentences

General Risk Factors

We may need to raise additional capital to support our business growth, and this capital may be dilutive, may cause our stock price to drop or may not be

We may need to raise additional capital to support our business in the near term;

such capital may be dilutive, may cause our stock price to drop or may not be

available on acceptable terms, if at all.

We may need to raise additional capital, which may not be available to us when needed or may not be available on terms acceptable to us, to support our business growth or to respond to business

opportunities, challenges, or unforeseen circumstances, including sales under our past and any future shelf registration statements.

Our ability to obtain additional capital, if and when required, will depend on our business plans, investor demand,

our operating performance, the condition of the capital markets, the terms of our current contractual obligations and other factors.

To the extent we are unable to secure additional revenue over the next several months, we will need to raise additional capital in the near term.

Based on our current level of operating expenditures, we project that

our existing cash, cash equivalents and short-term investments will be insufficient to fund the current level of operations, and we have therefore concluded that the conditions for a going concern disclosure under U.S.

GAAP are present, as

described notes to our consolidated financial statements.

Our ability to obtain additional capital, if and when required, will depend on our business plans, investor demand, our operating performance, the

condition of the capital markets, the terms of our current contractual obligations and other factors.

If we raise additional funds through the issuance of equity, equity-linked or debt securities, including those under our past and any future shelf registration statements, those securities may have

11 unchanged sentences

Our success depends on the skills, experience, and performance of our key personnel.

Due to the specialized nature of our business and limited staff, we are

particularly dependent on Kendall Larsen, our Chief Executive Officer and President.

Due to the specialized nature of our business and limited staff, we are particularly dependent on Kendall Larsen,

our Chief Executive Officer and President.

We have no employment agreements with any of our key executives that prevent them from leaving us at any time.

In addition, we do not maintain key person life

insurance for any of our officers or key employees.

In addition, we do not maintain key person life insurance for any of our officers or key

The loss of Mr.

Larsen, or our failure to retain other key personnel or plan for the succession of key personnel, would jeopardize our ability to execute our strategic plan and materially harm our

Larsen, or our failure to retain other key personnel or plan for the succession of key personnel, would jeopardize our ability to execute our strategic plan and materially harm our business.

We will need to recruit and retain additional qualified personnel to successfully grow our business .

10 unchanged sentences

Our business may also be adversely affected by further downturn in macroeconomic conditions, including

inflation and rising interest rates, tariffs, trade wars, global political and economic uncertainty and tensions, such as the ongoing Russia-Ukraine and Israel-Hamas conflicts, as well as any related political or economic response, counter

responses or otherwise, financial services sector instability, a reduction in business confidence and activity, financial market volatility, unexpected changes in tax law or policy, and other factors.

Such events can adversely affect our operations

or the economy as a whole and may cause our customers to delay their decisions on spending for the services we provide and perpetuate significant changes in regional and global economic conditions and cycles.

inflation and rising interest rates, tariffs, trade wars, global political and economic uncertainty and tensions, such as the ongoing Russia-Ukraine and Middle East conflicts, as well as any related political or economic response, counter responses

or otherwise, financial services sector instability, a reduction in business confidence and activity, financial market volatility, unexpected changes in tax law or policy, and other factors.

Such events can adversely affect our operations or the

economy as a whole and may cause our customers to delay their decisions on spending for the services we provide and perpetuate significant changes in regional and global economic conditions and cycles.

These events may also pose risks to our

10 unchanged sentences

We are currently evaluating the full impact of the OBBB Act on us.

March 31, 2026, the OBBB Act has had no material income tax impact on our financial statements.

In addition, the Organization for Economic Cooperation and Development has proposed imposing a 15% global minimum tax under the Pillar Two Model Rules (Pillar Two), and this proposal has been adopted

5 unchanged sentences

laws or tax rulings could adversely affect our effective tax rate and our operating results.

As of March 31, 2026, we are not yet subject to Pillar Two due to the level of gross receipts.

Trading in our common stock is limited, and the price of our common shares may be subject to volatility.

Our common stock is currently listed on Nasdaq and was previously listed on NYSE and NYSE American LLC (formerly the NYSE MKT LLC).

Over the past year, the market price of our common stock has

experienced significant fluctuations.

Between October 1, 2024, and September 30, 2025, the adjusted closing price for our common stock ranged between $3.86 and $20.91.

The price of our common stock may continue to be volatile as a result of several

factors, some of which are beyond our control.

Our common stock is currently listed on the Nasdaq Stock Market LLC (Nasdaq) and was previously listed on NYSE and NYSE American LLC (formerly the NYSE MKT LLC).

Over the past year, the market price

of our common stock has experienced significant fluctuations.

Between April 1, 2025, and March 31, 2026, the adjusted closing price for our common stock ranged between $7.50 and $24.84.

The price of our common stock may continue to be volatile as a

result of several factors, some of which are beyond our control.

These factors include, but are not limited to, the following:

annual variations, actual or anticipated, in our operating results;

variations, actual or anticipated, in our operating results;

significant changes in our management;

23 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors