CynergisTek, Inc.

Good afternoon, everyone. A little breaking news to start the call today; early today, for the second year in a row, Black Book Market Research has awarded CynergisTek as the top Cybersecurity Consultants for assessment audit, strategy and implementation in the healthcare industry.

This is an award well, we're really proud of. As an independent survey from 705 healthcare providers, we don't pay for placement, and frankly did not even know it was coming until we saw the press release this morning.

And 2020 has been a bit of a crazy year for everyone. But to get this type of recognition from the industry and from our clients, further demonstrates that our strategy is working.

We've worked aggressively to add new capabilities to deal with a changing threat landscape, including compromise assessment, security validation, and we've been on the front lines helping clients address these recent ransomware attacks. With all of that it's a real honor to continue to get recognized by our clients in the industry in a really tough year like this.

Beating out to major players including Clearwater, Booz Allen, KPMG UI, IBM fortifies a host of others. So I wanted to make sure I mentioned this before we get into the details of the quarter.

Now, towards the end of Q3 and into the beginning of the fourth quarter, we started to see signs of market recovery. This has shown itself in a number of ways.

First, we're seeing clients, particularly those that have a more mature security posture, realizing that the pandemic, the move to work from home, the rapid deployment of telemedicine and new expectations for interoperability have created new vulnerabilities in their security posture. Concluding these trends are not temporary, has created an increased willingness to enter into long term contracts with a focus on shoring up your defenses in this new world.

This was highlighted in our two recent releases with Valley Health and Fairview Health, both new logos to the CynergisTek family. These customers were interested in the combination of our core managed services, along with our strategy to go beyond just security assessments and into the validation of security controls.

We also saw some recent renewals with long standing customers that included the addition of some of these new services, increasing their commitment to security. Second, we saw progress in our efforts to diversify beyond our base, which is primarily made up of healthcare providers and into the broader industry of healthcare.

A good example of this is the recent managed services signing with a large state Department of Public Health in the West Coast. Now as you can imagine, health departments across the US are front and center in the effort to track infections and manage contact traces.

As such, they're generating volumes of information and must be properly assessed, protected and secured. All in healthcare all organization and our consultants are ideally suited for this mission.

I also want to mention our recent traction with [Red Skin], a CynergisTek own brand that focuses on offensive security testing outside of our traditional healthcare market. One of our strategic imperatives last year was to rebuilding upscaler penetration testing team, is now our offensive security team has new people and when we do offerings, which has allowed us to win consulting contracts in one of the nation's largest media companies, and a well known consumer electronics company, Logitech.

These are early contract wins for our team, and they demonstrate the expertise and capabilities we brought to respite. Now we're optimistic about our ability to expand these services over the coming months, as we continue to prove our capabilities opportunistically in the broader market.

Now, not all of our clients are out of the woods when it comes to COVID-19 and the associated financial repercussions. This has had a significant impact on healthcare providers.

When they run into financial instability, it can impact us. And this included a recent situation where a client exercises a termination for convenience clause, stepping away from a long-term contract in an effort to reduce costs.

This impacted our pre sold revenue during the quarter, as Paul will discuss. Now moving into next year, we anticipate budget uncertainty in healthcare providers will continue.

It's important to note that while we see a pullback, we believe that generally does not represent losses to competition, but rather an increase in the technical debt our clients are experiencing, and temporary deferment of investments in security and privacy. Unfortunately, this growing technical debt has also been noted by adversaries that are becoming more brazen, in an effort to take down America's hospitals right in the middle of a pandemic, increasing attacks, increasing consequences, and an increasing regulatory footprint and drive demand for our services.

Remember, when a hospital is locked up with ransomware, they're essentially down, diverting patients, canceling elective procedures and struggling through crisis operations with limited capabilities. Hospital learned the impact of limited operations can be financially devastating with the start of COVID.

In just the past few weeks, about a dozen systems experienced the same impact. But it wasn't due to COVID.

Intuitive orchestrated brazen ransomware attack. Now put this into perspective.

In just the last month, we've seen the first death attributed to ransomware, or patient had to be diverted to another hospital died in transit. And another incident the governor of Vermont deployed the Vermont National Guard to assist in the significant recovery of a hospital system that was infected with ransomware.

That incident is still ongoing today. Healthcare is rapidly realizing that investments in cybersecurity are very similar investments in masks, gowns and telemedicine.

It's simply something that's going to be required to remain operational in this new world. And now that has the attention of CEOs and boards, it's not how I want to see demand evolve, but it is happening.

And we're well positioned to do everything we can to help keep American hospitals open and seeing patients. Now a year ago, if I completed my first 100 days as the CEO, I outlined a set of strategic imperatives that would guide our strategy to transform the business and return it to growth.

Now we had this call before COVID-19 hit. We found those imperatives held true as we navigated the pandemic.

It even helped us to galvanize our decisions as we work through some of the challenges we face in our own COVID response. So year later which was you would take stand.

The first thing that was very clear a year ago was we need to rebalance our costs in both overhead and infrastructure. Over the last year, we've pulled $4 million out of our annual cost structure and reduced headcount by more than 25.

Other than public company costs, which is limited opportunity to influence, we're running lean with 90% of our employees directly in front of customers servicing or selling. A year ago, we also discussed the need to rebuild our go-to-market.

Fast forward today and we've rebuilt our sales team activity to be completely remote and significantly improved our pipeline. We still [roll] our marketing standards we entered COVID as that was an expansion we could pull back on.

And we're just now starting to rebuild our web presence and reinvest in promoting our brand digitally. This is an important initiative, as all of our go-to- market efforts has gone virtual, with face to face interaction shutdown in COVID.

Over the last month, we promoted the internal candidate to be a VP of Marketing. We conducted our Annual Customer Conference, albeit virtually, and a web presence will be a source of investment moving forward.

Now turning to our team, in many ways, we're a different company than we were a year ago. Our executive team has many new faces coming to us with a great depth of expertise for both healths are and security.

Our Board is also very different than it was a year ago. And we will continue to retool and up skill our team.

On the delivery front, we talked a year ago about the deliberate backlog, long backlog with the dis-satisfied clients. And I was concerned not only the time it took to deliver on contracts, but also the size of a project management organization with acquired management.

This has been a major area of focus. And we're far more efficient than a year ago.

We found new ways to deliver by cross training individuals, allowing us to dramatically reduce the number of consultants on an engagement by nearly half. We reduce our project management overhead by becoming more optimized using new tools.

And ensuring that all of our managers are also capable of providing hourly work to handle surge capacity. As we go into Q4, our utilization is nearing capacity as work that has been deferred during COVID shutdowns now returns.

Lastly and most importantly, we set out a target to return to growth. That is our last remaining imperative.

And with a significantly reduced cost structure, a more efficient team and several new offerings, this provides us with that pathway. With that, let me turn it over to Paul to remove review our financial performance.

Thanks, Caleb. As Caleb mentioned, we're still seeing an impact from COVID during the quarter, and as a result of its impact on healthcare providers.

Again, this impact was primarily felt in a reduction in our pre sold revenue, which dropped from $19 million to $16 million, primarily due to one larger managed services customer that had significant budget issues. This contract will turn at the end of this year give us some time to respond.

We made significant strides towards this response with a better than expected Q3 bookings. Although, still below historical levels; it's an improvement from Q2, and we see positive signs going forward in the macro environment, which we will continue to take steps to keep you updated as things progress.

Additionally, we continue to react to the impact from Covid by reducing expenses, and focusing on opportunities to reduce further. This was a key driver to our improved margins gross and operating margins in Q3 when compared to the first half of this year.

As we highlighted in Q2, we took steps to significantly reduce operating expenses with both permanent and temporary measures that have reduced our cash burn to around $300 per month at these revenue levels. Couple other reminders, we received the $2.8 million under the Paycheck Protection Program and expect the majority of the loan will be forgiven.

And we're also expecting tax relief as a result of the CARES Act, which will we carry back available losses from this year to the extent possible, which we think at this point will exceed $1 million. In addition, the Board just approved an aftermarket equity program that will allow the company from time to time to issue up to a total of $5 million of shares of the company's common stock to the public at the company's discretion.

The funds raised will be used for ongoing operations and growth initiatives. Outlined in our standard financial disclosures, revenue decreased by $0.3 million to $4.5 million due to lower revenue for managed services, which reduced $0.4 million to $2.7 million due to the impact of some customers canceling or delaying renewals, and reduction in net new customers due to COVID.

Professional and consulting services increased $0.1 million to $1.8 million due to lower revenue from the synergistic business as a result of the COVID offset though by $0.8 million in new and consulting professional services revenues from the acquisition of Backbone in Q4 last year. We're starting to see Backbone's business recovered from the COVID impact and expect them to be back to historical levels and growing by Q1 next year.

Gross margin was 35% for Q3 2020, compared to 34% in 2019 and 27% in Q2 this year. As I mentioned in my highlights this improvement in gross margin is due to staff and expense reductions we made over the last couple quarters, along with reduced travel in reaction to the lower revenue and COVID related travel restrictions.

Sales and marketing expenses increased $1.3 million for Q2 2020 compared to $1.1 million for the same period in 2019. This increase was due the addition of Backbone.

G&A expense decreased by $0.2 million to $1.5 million for Q3 2020 compared to the same period in 2019. The decrease is due $0.4 million and expense reduction efforts taken to improve operating margins, offset by $0.2 million in additional cost for Backbone.

Non-GAAP adjusted EBITDA loss was $0.8 million for Q3 2020 compared $0.4 million for Q3, 2019 and $1.3 million in Q2 of this year. The full financials and reconciliation of GAAP to non-GAAP information can be found in the earnings release that came out today.

This concludes the financials and prepared remarks for Q3 2020. Operator, you can open the floor to questions.

Good afternoon, gentlemen. You just mentioned that the sales trends were striking in end of Q3.

To what extent do you think this is reflecting the more publicized incident? So you described cyber incidents.

Well, there are two components to this, Jeff, right. I mean, one is that we significantly retooled our sales team go- to-market and now have a much more robust and reliable pipeline than we had a year ago.

So I'll call that the basic blocking and tackling. The second piece of this is that while in the midst of COVID, especially kind of in February, March, April-ish when we were all really locked down, and everyone's trying to figure out what jam was up.

We use that opportunity to retool; we switch to an agile management methodology. Our team met every single day and we continue to today.

And we use that time to bring forward several new offerings such as compromise assessments and partnership with Awake Security, security validation assessments, review and run books. Interestingly enough, we knew and were public for some time that ransomware was likely the biggest threat that we're going to impact healthcare.

And unfortunately, we were right. So as we started to see these brazen attacks in the last couple of weeks, we were very well positioned.

And I mean, really, only in the last few days, has this not been back to back to back to back calls for myself and my team, helping our clients work through this crisis and figuring out what they need to do. So I guess the long winded answer to your question is it's all of it.

But a lot of this is trying to figure out where the puck is going to be, and being well positioned for that.

Okay. There's been a lot of press in the last a couple weeks or so about rapidly increasing outbreaks of COVID in the United States.

And I'm wondering if that's concerning you about another phase to shutdown small lab, which adversely affects your business? Or do you think hospitals and other health systems are better set up now to weathering it not affect you as much as you might otherwise have thought?

Well, I think there's two dynamics here, right. So, first of all, at least at the moment online back in kind of February, March, hospitals are still seeing elected patients, right.

So elective surgeries are continuing; they're not completely shut down just to handle COVID surge. And I think we've in a lot of ways hospitals have found ways to get through this.

Now, that is not true in all areas of the country, there are some places that are being severely impacted. And that does seem to go in waves.

What has also happened in this is procurement departments, I think have started to figure out that the answer isn't that you can shut everything off; they're going to need certain capabilities. And we've started to see that to return, I wouldn't say completely normal, because we're not face to face with clients.

But we are processing deals, things are a little slower than anyone would like because you can't go meet with a client. But if we look at this, I don't think we're going to see the same impact.

Now, the second factor in this is that these recent ransomware incidents, this is a little bit different than anything we've ever seen on US soil before. Up to this point, generally speaking, attacks on US soil, involve people stealing data maybe shutting something down with a denial of service attack for a few hours that they take out a website, and stealing a whole lot of data and intellectual property.

But in those in all of those attacks, we've seen of late people were not directly impacted in a way that could potentially harm them from a life safety perspective. This is different.

This is a change in adversarial intent, where bad guys are knowingly targeting large hospital systems with the express intent to find their electronic healthcare records, lock them up and prevent the hospital from seeing patients. That is what we call a kinetic impact.

And it's devastating, right? But it also represents a significant escalation in that adversarial intent, but what it means to the hospital system, and I tamper my comment here by saying I don't want to sound alarmist, but the simple reality is all these hospitals in the last few weeks have realized that if they don't move to shore up their defenses, it's going to be hard to remain open.

And that's the difference in this. It's very analogous, frankly, to wearing a mask is that kind of the analogy of the day, you might not get ransomware if you don't invest in your security defenses, but if you do, the impact can be pretty devastating.

Yes, it runs a lot of urgency to the issue.

That's right.

Okay, I have a couple of questions for Paul. I think it was two quarters ago, you had mentioned the possibility of reaching mid to high 40s on gross margin by the end of the year.

It's obviously been delayed or deferred, but I'm wondering if you still see the business as eventually being able to achieve that goal.

We've definitely been impacted in the short term, Jeff, on that. So we do not anticipate that we'll get there this year.

But at least from our perspective, we can get there. It's going to take getting back to growth, and getting back to that $5 million to $5.5 million run rate, which is kind of that critical revenue level for us.

So as we get back to there, that's why I think we'll have the ability to get back in those 40 plus margin ranges.

Okay, and with respect to those $5 million worth of shares once it was referred to what's the size of the earlier arrangement you had, I think, with a large institutional owner, where you've already issued some warrants, and they were --

We'll put that on hold for now. Yes, we'll put that on hold as we work through the ATM.

So that, then we'll revisit the need for that if necessary based on the results of the ATM.

Okay, and lastly, you have a couple million dollars back on the balance sheet for the Backbone earnout. Where do you think your stand at this with respect to that?

At least in the initial year did not hit the year one earnout. And so we're still working and evaluating their ability and opportunity to hit years two and three.

And so that's kind of the status of there right now. We just closed books for October, which is the month in which it ended the first year.

So we're still working through and evaluating our next steps there.

Hey, Paul, I can -- I had a quick question. I already looked at the Q.

And the performance obligations were $15.6 million, 88% you recognize over 24 months. So that infers that sequentially over last quarter and the prior quarter, we have a little more visibility at least sequentially.

I wondered if you could just disclose given the strength that you've seen where those performance obligations would be today. Thank you.

Avi, I'm not sure if I completely understand your question. I may have you, maybe.

Yes, sure. So you disclose the performance obligations, which are forward long-term contracts, correct?

Yes.

And at the end of the quarter, 9/30, you had $15.6 million. And I wondered if you could disclose, maybe you can maybe don't have the number available.

But if you could disclose, given the strength you've seen, you started out to strengthen your sales pipeline, sales where that would be today.

Oh, yes, I can't give; I can't provide that number right now. That's a number we don't traditionally provide at this point.

So we don't get into the booking numbers at this point, Avi.

Okay. Could you at least disclose if it's up from where it was at the end of the quarter?

It is up since the end of the quarter. I can tell you that.

Hi, gentlemen, good evening. So adding on to Avi's last question how's your visibility look at right now?

I mean, we had unprecedented events that occurred this quarter. Seems as though you guys have announced two major wins, I would assume the sales cycle now given what has occurred and what has just been articulated is quicker than ever in this field.

So how quickly and your team close a contract with a new entity?

Well, that is all over the map right now. And it's all over the map because in a lot of ways procurement departments have a new set of muscles that we haven't historically seen, Bill.

In some systems, you have just a very draconian, all costs are under control. Everything's got to go through multiple levels of approval.

I mean, I'll give you an example that recent release on the Public Health Department of the West Coast, that's a deal that, took, that deal took quarter after quarter after quarter, we saw that deal defer because of COVID, and various hoops, and then finally got it done all in a week type of thing. There are other situations, especially with what's happened over the last couple weeks, where we'll close a deal in two days.

It's a really good question. And I guess my long winded answer to that is it hasn't stabilized right now.

And it's all over the map, just depending on what's going on and the temperature. What I will say is interesting to see is that we do see in many cases, the incidents over the last couple of weeks are causing some clients to go forward and ask for emergency budget requests, and also go forward asking to reinvestigate wherever they were in there, kind of prospecting on 2021 budgets.

Now I would say the one thing I can kind of say overall is larger deals still take longer, as you can imagine, anything that's public still takes longer because often times you have to take it out to bid. But we're definitely seeing cases where some of the new services were able to get in the door with a new logo in a matter of a week or two.

And that's really encouraging because those are new growth opportunities for us.

No, I agree with that completely. And as I look at your run rate, right now, let's just take this last quarter, $4.5 million; Paul just articulated that $5 million, $5.5 million depending upon the mix, of course, it's very interesting.

I don't see it that far away from that threshold. And I was just wondering given my first question on visibility.

And what you and your sales team headed up by Shane is -- are seen maybe quick, quicker turn business, is it processed? Do you have an idea of when we possibly can get there?

How close are we to that? It seems as though we're quite close, am I mistaken?

Go ahead, Paul.

I'll just say it's a little early to tell -- a point you unfortunately that large customer that we lost for the managed services was kind of that one hit us as we mentioned. And so we've got to make up that ground.

So I think you're right, from the perspective that we're seeing the growth, we're seeing new opportunities, we did have -- we do have some ground to make up though, as in bundle that all in with kind of the overall COVID impact. We've got to recover from some of the things that we took the hits on in Q2 and Q3 here.

But as it relates to net new logos, and renewals and growth in the business, we're seeing it, it's just where you got to dig out of that hole we have because of again, primarily this one large customer that had budget issues.

I think that's exactly what I was going to kind of comment on. I mean, the frustrating thing sitting in our seat right now is you can see the opportunity we're grabbing at it.

It's just we have to make up for that loss ground that we experienced earlier this year. And all it took was one or two customers with convenience clauses and it's really an interesting situation where these are not cases where we lost the competition.

These are cases where a client literally just decided that they could no longer afford to pay for security provisions. And that's a really tough thing to digest.

That being said, I'm hopeful that also when budgets start to turn around here, we may see some of those clients return.

Okay, gentlemen, I just think that the end market has changed here. And your sales cycle is probably quicker than ever and agreed on the budget side, but the sales cycle and given the material events that have occurred for top tier and when the top entities in the country changes the landscape.

And I wish you all the best. I think we will get that.

Thanks.